Initialization method and device of high-performance server, equipment and storage medium

Abstract

The invention discloses an initialization method, device and equipment of a high-performance server and a storage medium, and is applied to the technical field of information, and the initialization method comprises the steps that when the high-performance server is started, an initialization plug-in and a password module engine are loaded; the initialization plug-in carries out initialization and determines whether commercial password initialization is completed or not; when it is determined that commercial password initialization is not completed, the initialization plug-in initializes the high-performance server by using a guide type initialization service based on the position of the signature key pair; the guide type initialization service is a service for intercepting a uniform resource locator of a high-performance server, automatically generating a certificate request file and writing an encryption key pair at a specified position in a password module. According to the method and the device, the signature key pair determined by the password module is automatically called by using the initialization plug-in, the high-performance server is initialized based on the guide type initialization service, and the whole process does not need manual participation, so that the high-performance server initialization which is simple, convenient and easy to use and has commercial password compliance can be realized.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method, device, equipment and storage medium for initializing a high-performance server. Background Art

[0002] Nginx is a lightweight, high-performance web server. Supporting the Transport Layer Cryptography Protocol (TLCP), Nginx is widely used in cryptographic evaluations across various businesses, implementing key functions such as TCCP communication. In actual cryptographic evaluations, Nginx is not only required to use a commercially certified cryptographic module to store keys and perform cryptographic operations, but also to have its digital certificates and encryption key pairs issued and generated by a certified CA (this CA typically also includes a key management system for generating and managing encryption key pairs) to complete Nginx initialization. Therefore, the commercially certified Nginx initialization process includes: generating a signing key pair and certificate request using the cryptographic module; submitting the certificate request to the CA; importing the dual certificates (signing certificate / encryption certificate) issued by the CA; importing the encryption key pair generated by the CA; modifying the Nginx configuration; and starting Nginx. Nginx uses configuration files to configure digital certificates, cryptographic module engines, and indexes or container names for public and private key pairs (according to GM / T 0018 and GM / T 0016 standards, a key pair index / container name includes two key pairs: a signature key pair and an encryption key pair). To complete the aforementioned Nginx initialization by having an external CA issue a certificate, multiple steps are required, including manually operating the cryptographic module to generate a certificate request, submitting the certificate request to the CA for certificate issuance and generation of an encryption key pair, importing the signature and encryption certificate files, operating the cryptographic module to import the encryption key pair, modifying the Nginx configuration, and starting Nginx. This process is cumbersome and prone to errors.

[0003] It can be seen that how to improve the efficiency and accuracy of initialization of a high-performance server such as Nginx is a technical problem that those skilled in the art urgently need to solve. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment and storage medium for initializing a high-performance server, which solves the technical problem of low efficiency and accuracy in initializing a high-performance server in the prior art.

[0005] To solve the above technical problems, the present invention provides a method for initializing a high-performance server, comprising:

[0006] When the high-performance server starts, the initialization plug-in and the cryptographic module engine are loaded; wherein the initialization plug-in is a plug-in that complies with the high-performance server specification and runs in the high-performance server;

[0007] The cryptographic module engine is initialized to load the cryptographic module and determine the location of the signature key pair;

[0008] The initialization plug-in performs initialization to determine whether the commercial key initialization is completed;

[0009] When it is determined that the commercial key initialization is not completed, the initialization plug-in initializes the high-performance server using a wizard-style initialization service based on the location of the signature key pair; wherein, the wizard-style initialization service is a service that intercepts the uniform resource locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location inside the cryptographic module.

[0010] Optionally, when the high-performance server starts, before loading the initialization plugin and the cryptographic module engine, it also includes:

[0011] The high-performance server loads configuration information;

[0012] The configuration information includes the name of the cryptographic module engine, the index or container name of the public-private key pair, the activation information of the Hypertext Transfer Protocol service, and the shutdown information of the Hypertext Transfer Protocol Security service; wherein the name is used to determine the cryptographic module corresponding to the cryptographic module engine, and the index of the public-private key pair and the container name are used to determine the location of the public-private key pair.

[0013] Optionally, the above high-performance server initialization method further includes:

[0014] When it is determined that the commercial key initialization is completed, the initialization plug-in displays the current digital certificate information.

[0015] Optionally, when it is determined that the commercial key initialization is not completed, the initialization plug-in initializes the high-performance server using a wizard-style initialization service based on the location of the signature key pair, including:

[0016] When it is determined that the commercial key initialization is not completed and the certificate request has not been generated, the initialization plug-in calls the cryptographic module to generate and store the signature key pair through the open source secure socket layer cryptographic library and the cryptographic module engine.

[0017] Optionally, when it is determined that commercial key initialization is not completed and a certificate request has not yet been generated, the initialization plug-in, through the open source secure socket layer cryptographic library and the cryptographic module engine, calls the cryptographic module to generate and store the signing key pair, further comprising:

[0018] The initialization plug-in modifies the initialization progress to a certificate request has been generated, and jumps to a page for importing a dual certificate and encryption key pair issued by a certificate authentication system.

[0019] Optionally, the above high-performance server initialization method further includes:

[0020] When it is determined that the commercial key initialization is not completed and a certificate request has been generated, the initialization plug-in returns to the browser and imports a dual certificate and encryption key pair page issued by the certificate authentication system.

[0021] Optionally, when it is determined that the commercial key initialization is not completed and a certificate request has been generated, after the initialization plug-in returns to the browser and imports the dual certificate and encryption key pair page issued by the certificate authentication system, the process further includes:

[0022] After the signing certificate, encryption certificate and protected encryption key pair file issued by the certificate authentication system are selected and submitted on the browser side, the initialization plug-in calls the cryptographic module through the open source secure socket layer cryptographic library and the cryptographic module engine to verify whether the signing certificate matches; if it does not match, an error is reported and the system returns;

[0023] When a match is found, the initialization plug-in calls the cryptographic module through the open source secure socket layer cryptographic library and the cryptographic module engine, decrypts and verifies the protected encryption key pair inside the cryptographic module, and reports an error and returns if the decryption and verification fails; otherwise, the encryption key pair is written to a specified location inside the cryptographic module;

[0024] The initialization plug-in stores the signature certificate and encryption certificate in a local directory;

[0025] The initialization plug-in changes the initialization progress to that the commercial key initialization has been completed, and returns a page showing the digital certificate information to the browser.

[0026] An embodiment of the present invention further provides an initialization device for a high-performance server, comprising:

[0027] A loading module, used to load the initialization plug-in and the cryptographic module engine when the high-performance server is started; wherein the initialization plug-in is a plug-in that complies with the high-performance server specification and runs in the high-performance server;

[0028] A signature key pair location determination module, configured to initialize the cryptographic module engine, load the cryptographic module, and determine the location of the signature key pair;

[0029] A judgment module, used for initializing the initialization plug-in and determining whether the commercial key initialization is completed;

[0030] An initialization module is used to initialize the high-performance server using a wizard-style initialization service based on the location of the signature key pair when it is determined that the commercial key initialization is not completed; wherein, the wizard-style initialization service is a service that intercepts the uniform resource locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location inside the cryptographic module.

[0031] An embodiment of the present invention further provides an initialization device for a high-performance server, comprising:

[0032] memory for storing computer programs;

[0033] A processor is used to execute the computer program to implement the steps of the initialization method of the high-performance server as described above.

[0034] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program implements the steps of the above-mentioned method for initializing a high-performance server.

[0035] An embodiment of the present invention further provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned high-performance server initialization method when executed by a processor.

[0036] It can be seen that the present invention loads the initialization plug-in and the cryptographic module engine when the high-performance server is started; wherein, the initialization plug-in is a plug-in that complies with the high-performance server specifications and runs in the high-performance server; the cryptographic module engine initializes and loads the cryptographic module to determine the location of the signature key pair; the initialization plug-in is initialized to determine whether the commercial secret initialization is completed; when it is determined that the commercial secret initialization is not completed, the initialization plug-in initializes the high-performance server based on the location of the signature key pair using a wizard-style initialization service; wherein, the wizard-style initialization service is a service that intercepts the uniform resource locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location inside the cryptographic module.

[0037] The beneficial effects of the embodiments of the present invention are as follows: Compared with the current manual operation with multiple steps, which results in cumbersome steps and is prone to errors, the present application loads the initialization plug-in and the cryptographic module engine, so that the cryptographic module can be determined based on the cryptographic module engine, and the initialization plug-in is used to automatically call the signature key pair determined by the cryptographic module, and the high-performance server is initialized based on the wizard-style initialization service. Since the entire process does not require human participation, it is possible to achieve simple, easy-to-use and commercially cryptographic compliant high-performance server initialization.

[0038] In addition, the present invention also provides a method, device, equipment and storage medium for initializing a high-performance server, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0040] Figure 1 A flowchart of a method for initializing a high-performance server provided by an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of the structural framework of an initialization process of a high-performance server provided by an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of the structure of an initialization device for a high-performance server provided by an embodiment of the present invention;

[0043] Figure 4 A schematic structural diagram of an initialization device for a high-performance server provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0045] Some of the terms that appear in the description of the embodiments of this application are subject to the following interpretations:

[0046] SM2 / SM3 / SM4 cryptographic algorithms: SM2 (elliptic curve public key cryptography algorithm) is an elliptic curve public key cryptography algorithm released by my country, and its standard is the GB / T32918 series; SM3 is a cryptographic hash algorithm released by my country, and its standard is GB / T32905; SM4 is a block cipher algorithm released by my country, and its standard is GB / T32907.

[0047] SSL / TLS: SSL (Secure Socket Layer) and its successor TLS (Transport Layer Security) are security protocols that provide security and data integrity for network communications.

[0048] TLCP: TLCP (Transport layer cryptography protocol) is a transport layer cryptography protocol published by my country in GB / T38636-2020 "Information Security Technology Transport Layer Cryptography Protocol (TLCP)", also known as National Secret SSL, which includes multiple SSL cipher suites using SM2 / SM3 / SM4 algorithms.

[0049] OpenSSL: OpenSSL (Secure Sockets Layer) is a Secure Sockets Layer (SSL) cryptographic library that includes key cryptographic algorithms, common key and certificate management capabilities, and implementation of the SSL protocol. Modified versions of OpenSSL can also implement the TLCP protocol. The OpenSSL package can be roughly divided into three main functional components: the cryptographic algorithm library, the protocol library, and the application command tool.

[0050] OpenSSL Engine: The OpenSSL Engine provides a mechanism for adding hardware devices to OpenSSL and replacing the software algorithms provided by OpenSSL. At the same time, this mechanism can also use the keys inside the hardware devices and perform cryptographic operations.

[0051] Cryptographic modules: A cryptographic module is a hardware device that uses cryptographic technology to provide secure key management and cryptographic operations for business systems. Business systems use the cryptographic services provided by the cryptographic module to ensure data confidentiality, integrity, validity, and non-repudiation.

[0052] Nginx: Nginx is a lightweight, high-performance web server that uses a non-blocking, fully asynchronous mechanism. It has the characteristics of low memory usage and strong concurrency. Its concurrency capability is in a leading position among similar web servers.

[0053] CA: CA is the abbreviation of Certificate Authentication system. CA mainly implements the full life cycle management of digital certificates, including the issuance, release, renewal, and revocation of digital certificates.

[0054] Please refer to Figure 1 , Figure 1 A flowchart of a method for initializing a high-performance server provided in an embodiment of the present invention. The method may include:

[0055] S101, when the high-performance server is started, an initialization plug-in and a cryptographic module engine are loaded; wherein the initialization plug-in is a plug-in that complies with the high-performance server specification and runs in the high-performance server.

[0056] The high-performance server in this embodiment is Nginx. Nginx is used to provide web services based on the Transport Layer Cryptographic Protocol (TLCP). TLCP communication is performed using OpenSSL. The open-source Nginx needs to be modified to adapt to OpenSSL's support for the TLCP protocol. OpenSSL is a modified version of OpenSSL that supports the TLCP protocol. It provides software cryptographic algorithms and implementations of the TLCP protocol, as well as an engine mechanism for accessing hardware devices such as cryptographic modules. This allows the hardware to manage keys and perform cryptographic operations using SM2 (asymmetric encryption algorithm), SM3 (hash algorithm), and SM4 (symmetric encryption algorithm). The initialization plug-in in this embodiment complies with the Nginx specification and runs within Nginx, providing a wizard-based initialization service (e.g., a web wizard method) for commercial cryptographic initialization of Nginx. This wizard-based initialization service is used to generate keys for commercial cryptographic devices, as well as generate and import external CA certificates. The cryptographic module engine in this embodiment complies with the OpenSSL engine interface requirements and calls the cryptographic module to implement encryption algorithms, which can include SM2, SM3, SM4, and others. When Nginx in this embodiment starts, it will load the initialization plug-in and load the cryptographic module engine according to the configuration file.

[0057] It should be further explained that, based on any of the above embodiments, in order to ensure the accuracy of initialization, when the high-performance server is started, before loading the initialization plug-in and the cryptographic module engine, the following steps may also be included:

[0058] The high-performance server loads configuration information, including the name of the cryptographic module engine, the index or container name of the public-private key pair, information about enabling the Hypertext Transfer Protocol service, and information about disabling the Hypertext Transfer Protocol Security service. The name identifies the cryptographic module corresponding to the cryptographic module engine, and the index and container name of the public-private key pair identify the location of the public-private key pair. In this embodiment, the cryptographic module engine and the index or container name of the public-private key pair are pre-set in the Nginx configuration file. The configuration also enables HTTP (Hypertext Transfer Protocol) services and disables HTTPS (Hypertext Transfer Protocol Secure) services (based on TLS / TLS). HTTPS services are only available after initialization.

[0059] S102: The cryptographic module engine is initialized to load the cryptographic module and determine the location of the signature key pair.

[0060] In this embodiment, the cryptographic module is used to provide a secure key management function, and on this basis, provides a secure encryption algorithm cryptographic operation function, such as SM2, SM3, and SM4 algorithms. In this embodiment, the cryptographic module engine is initialized to ensure that the cryptographic module is loaded.

[0061] S103: Initialize the plug-in to determine whether the commercial key initialization is completed.

[0062] In this embodiment, the initialization plug-in performs initialization to determine the initialization progress (determine whether the commercial key initialization is completed). This embodiment does not limit the specific result of whether the commercial key initialization is completed.

[0063] S104, when it is determined that the commercial key initialization is not completed, the initialization plug-in initializes the high-performance server using the wizard-style initialization service based on the location of the signature key pair; wherein the wizard-style initialization service is a service that intercepts the uniform resource locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location inside the cryptographic module.

[0064] This embodiment does not limit the specific state of incomplete commercial key initialization. For example, in this embodiment, the state of incomplete commercial key initialization is that a certificate request has not yet been generated; or in this embodiment, the state of incomplete commercial key initialization is that a certificate request has already been generated. It is understood that any URL (Uniform Resource Locator) accessed by a browser to Nginx is intercepted by the initialization plug-in. If Nginx has completed commercial key initialization, the request is processed according to the Nginx default process. Otherwise, the initialization plug-in redirects the request to the corresponding commercial key initialization page based on the initialization progress, and initialization is performed based on the wizard-based initialization service.

[0065] It should be further explained that the above method may further include: when it is determined that the commercial key initialization is completed, initializing the plug-in to display the current digital certificate information.

[0066] It should be further explained that, to improve initialization accuracy, when commercial key initialization is determined to be incomplete, the initialization plug-in utilizes a wizard-style initialization service to initialize the high-performance server based on the location of the signing key pair. This may include: when commercial key initialization is determined to be incomplete and a certificate request has not yet been generated, the initialization plug-in invokes the cryptographic module through the open-source Secure Sockets Layer cryptographic library and cryptographic module engine to generate and store the signing key pair. In this embodiment, if the initialization progress (the state of incomplete commercial key initialization) is determined to be that a certificate request has not yet been generated, the initialization plug-in returns a certificate request generation interface to the browser and, based on the input, performs the following steps: After the certificate request information is entered and submitted on the browser side, the initialization plug-in invokes the cryptographic module through OpenSSL and the cryptographic module engine to generate and store the signing key pair at the configured location. The newly generated signing key pair is then used to sign the certificate request information, ultimately generating a certificate request file and returning it to the browser. This embodiment provides intelligent initialization steps when a certificate request has not yet been generated, improving initialization accuracy.

[0067] It should be further explained that, based on any of the above embodiments, when it is determined that the commercial key initialization has not been completed and a certificate request has not yet been generated, the initialization plug-in, through the open source Secure Sockets Layer cryptographic library and cryptographic module engine, calls the cryptographic module to generate and store the signature key pair, and can also include: the initialization plug-in modifies the initialization progress to indicate that a certificate request has been generated, and jumps to the page for importing the dual certificate and encryption key pair issued by the certificate authentication system. In this embodiment, the initialization plug-in modifies the initialization progress to indicate that a certificate request has been generated, and then jumps to the page for importing the dual certificate and encryption key pair issued by the CA. This embodiment provides a specific method for adjusting the initialization precision, thereby improving the accuracy of initialization.

[0068] It should be further explained that, based on any of the above embodiments, the above-mentioned high-performance server initialization method may further include: when it is determined that the commercial key initialization is not completed and a certificate request has been generated, the initialization plug-in returns to the browser and imports the dual certificate and encryption key pair page issued by the certificate authentication system. This embodiment provides the initialization steps when the initialization progress is that the commercial key initialization is not completed and a certificate request has been generated. After the signing certificate, encryption certificate, and protected encryption key pair file issued by the CA are selected and submitted on the browser side, the initialization plug-in calls the cryptographic module through OpenSSL and the cryptographic module engine to verify whether the signing certificate matches. If there is no match, an error is reported and the return is returned; if there is a match, the subsequent steps are performed.

[0069] It should be further explained that, based on any of the above embodiments, when it is determined that the commercial key initialization is not completed and a certificate request has been generated, after the initialization plug-in returns to the browser and imports the dual certificate and encryption key pair page issued by the certificate authentication system, the following may also be included:

[0070] Step 1: After selecting and submitting the signature certificate, encryption certificate, and protected encryption key pair file issued by the certificate authentication system on the browser side, the initialization plug-in calls the cryptographic module through the open source secure socket layer cryptographic library and the cryptographic module engine to verify whether the signature certificate matches; if it does not match, an error is reported and the system returns;

[0071] Step 2: When a match is found, the initialization plug-in calls the cryptographic module through the open source secure socket layer cryptographic library and the cryptographic module engine, decrypts and verifies the protected encryption key pair inside the cryptographic module, and reports an error and returns if the decryption and verification fails; otherwise, the encryption key pair is written to a specified location inside the cryptographic module;

[0072] Step 3: Initialize the plug-in to store the signature certificate and encryption certificate in the local directory;

[0073] In step 4, the initialization plug-in changes the initialization progress to completed commercial key initialization and returns a page showing the digital certificate information to the browser.

[0074] The complete steps in this embodiment are as follows: i. After selecting and submitting the signature certificate, encryption certificate and protected encryption key pair file issued by the CA on the browser side, the initialization plug-in calls the cryptographic module through OpenSSL and the cryptographic module engine to verify whether the signature certificate matches. If not, an error is reported and the return is made; if they match, the subsequent steps are performed; ii. The initialization plug-in calls the cryptographic module through OpenSSL and the cryptographic module engine, decrypts and verifies the protected encryption key pair inside the cryptographic module (a series of decryption steps are performed using the signature private key inside the cryptographic module). If the decryption verification fails, an error is reported and the return is made; otherwise, the cryptographic module is instructed to iii. Initialize the plug-in to store the signature certificate and encryption certificate in a local directory; iv. Initialize the plug-in to change the initialization progress to completed commercial key initialization and return the page showing the digital certificate information to the browser; v. Initialize the plug-in to modify the Nginx configuration file, including writing the signature certificate, encryption certificate path, turning on the HTTPS (based on TLCP) service switch, etc., and let Nginx reload the configuration file; Nginx reloads the configuration file and uses a cryptographic module with commercial key qualifications and a digital certificate issued by a CA with operational qualifications to provide HTTPS (based on TLCP) services.

[0075] An embodiment of the present invention provides a method for initializing a high-performance server, which may include: S101, when the high-performance server is started, loading an initialization plug-in and a cryptographic module engine; wherein the initialization plug-in is a plug-in that complies with the high-performance server specification and runs in the high-performance server; S102, the cryptographic module engine initializes the cryptographic module and loads it, determining the location of the signature key pair; S103, the initialization plug-in initializes and determines whether the commercial key initialization is completed; S104, when it is determined that the commercial key initialization is not completed, the initialization plug-in initializes the high-performance server based on the location of the signature key pair using a wizard-style initialization service; wherein the wizard-style initialization service is a service that intercepts the uniform resource locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location within the cryptographic module. Compared with the current manual operation of multiple steps, which is cumbersome and prone to errors, the present application loads the initialization plug-in and the cryptographic module engine, so that based on the cryptographic module determined by the cryptographic module engine, the initialization plug-in automatically calls the signature key pair determined by the cryptographic module, and initializes the high-performance server based on the wizard-style initialization service. Since the entire process does not require human intervention, it can achieve simple, easy-to-use and commercial key compliant high-performance server initialization. Compared with the current manual operation of multiple steps, which is cumbersome and prone to errors, the present invention loads the initialization plug-in and the cryptographic module engine, so that based on the cryptographic module determined by the cryptographic module engine, the initialization plug-in can be used to automatically call the signature key pair determined by the cryptographic module, and initialize the high-performance server based on the wizard-style initialization service. Since the entire process does not require human participation, it can achieve simple, easy-to-use and commercially compliant high-performance server initialization.

[0076] In order to make the present invention easier to understand, please refer to Figure 2 , Figure 2 A schematic diagram of a structural framework of an initialization process of a high-performance server provided in an embodiment of the present invention may specifically include:

[0077] 1. In the Nginx configuration file, pre-set the cryptographic module engine, the index or container name of the public and private key pairs, and configure to enable the HTTP service and disable the HTTPS (based on TLCP) service.

[0078] The components involved in the implementation of the present invention include: Nginx, an initialization plug-in, a cryptographic module, OpenSSL, and a cryptographic module engine. The initialization plug-in complies with the Nginx specification, runs in Nginx, and provides a web-based wizard process for initializing Nginx commercial cryptography. If Nginx has not completed commercial cryptography compliance initialization, the plug-in takes over all HTTP requests passing through Nginx and redirects the requests to the web page for the commercial cryptography initialization process.

[0079] 2. When Nginx starts, it loads the initialization plug-in and loads the password module engine according to the configuration file.

[0080] 3. The initialization plug-in and the password module engine are initialized. The initialization plug-in records the current initialization progress, and the password module engine loads the password module.

[0081] 4. Nginx provides a secret initialization function through the initialization plug-in. If the secret initialization is not completed, the plug-in provides a wizard-style WEB initialization function; if the secret initialization is completed, the current digital certificate information is displayed.

[0082] 5. Any URL accessed through the browser to access Nginx will be intercepted by the initialization plug-in. If the Nginx has not completed the commercial key initialization, the initialization plug-in will jump to the corresponding page of commercial key initialization according to the initialization progress, and initialize the high-performance server based on the wizard-style initialization service.

[0083] 6. If the commercial key initialization has been completed, the current digital certificate information will be displayed.

[0084] The Nginx plug-in implemented based on the method of the present invention can easily and conveniently implement commercial secret compliance Nginx initialization, so that Nginx can use a cryptographic module with commercial secret qualifications for key storage and cryptographic operations to implement TLCP, and can also use a CA with operational qualifications to issue dual certificates and generate encryption key pairs for it, thereby meeting the requirements of secret review.

[0085] The following introduces an initialization device for a high-performance server provided by an embodiment of the present invention. The initialization device for a high-performance server described below and the initialization method for a high-performance server described above can refer to each other.

[0086] Please refer to Figure 3 , Figure 3 A schematic structural diagram of an initialization device for a high-performance server provided in an embodiment of the present invention may include:

[0087] The loading module 100 is used to load the initialization plug-in and the cryptographic module engine when the high-performance server is started; wherein the initialization plug-in is a plug-in that complies with the high-performance server specification and runs in the high-performance server;

[0088] The signature key pair location determination module 200 is used to initialize the cryptographic module engine, load the cryptographic module, and determine the location of the signature key pair;

[0089] The judgment module 300 is used for the initialization plug-in to perform initialization and determine whether the commercial key initialization is completed;

[0090] Initialization module 400 is used to initialize the high-performance server using a wizard-style initialization service based on the location of the signature key pair when it is determined that the commercial key initialization is not completed; wherein, the wizard-style initialization service is a service that intercepts the uniform resource locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location inside the cryptographic module.

[0091] Furthermore, based on the above embodiment, the initialization device of the high-performance server may further include:

[0092] A configuration information loading module, used for loading configuration information on the high-performance server;

[0093] The configuration information includes the name of the cryptographic module engine, the index or container name of the public-private key pair, the activation information of the Hypertext Transfer Protocol service, and the shutdown information of the Hypertext Transfer Protocol Security service; wherein the name is used to determine the cryptographic module corresponding to the cryptographic module engine, and the index of the public-private key pair and the container name are used to determine the location of the public-private key pair.

[0094] Furthermore, based on any of the above embodiments, the initialization device of the high-performance server may further include:

[0095] The digital certificate information display module is used to display the current digital certificate information when the commercial key initialization is determined to be completed.

[0096] Further, based on any of the above embodiments, the initialization module 400 may include:

[0097] The signature key pair determination module is used to, when it is determined that the commercial key initialization is not completed and the certificate request has not been generated, call the cryptographic module through the open source secure socket layer cryptographic library and the cryptographic module engine to generate and store the signature key pair.

[0098] Furthermore, based on any of the above embodiments, the initialization device of the high-performance server may further include:

[0099] The dual certificate and encryption key pair page jump module is used for the initialization plug-in to modify the initialization progress to the point where a certificate request has been generated, and jump to the page for importing the dual certificate and encryption key pair issued by the certificate authentication system.

[0100] Furthermore, based on any of the above embodiments, the initialization device of the high-performance server may further include:

[0101] The import module is used to return the dual certificate and encryption key pair page issued by the certificate authentication system to the browser and import the initialization plug-in when it is determined that the commercial key initialization is not completed and a certificate request has been generated.

[0102] Furthermore, based on any of the above embodiments, the initialization device of the high-performance server may further include:

[0103] The signature certificate match judgment module is used to, after the signature certificate, encryption certificate and protected encryption key pair file issued by the certificate authentication system are selected and submitted on the browser side, call the cryptographic module through the open source secure socket layer cryptographic library and the cryptographic module engine to verify whether the signature certificate matches; if there is no match, an error is reported and the function is returned;

[0104] a decryption module, configured to, when a match occurs, cause the initialization plug-in to call the cryptographic module through the open source secure socket layer cryptographic library and the cryptographic module engine, decrypt and verify the protected encryption key pair within the cryptographic module, and report an error and return if the decryption and verification fails; otherwise, write the encryption key pair to a specified location within the cryptographic module;

[0105] Signature certificate and encryption certificate storage module, used for the initialization plug-in to store the signature certificate and encryption certificate in a local directory;

[0106] The commercial key initialization module has been completed, and is used for the initialization plug-in to change the initialization progress to commercial key initialization has been completed, and return a page showing digital certificate information to the browser.

[0107] It should be noted that the order of the modules and units in the initialization device for the high-performance server can be changed without affecting the logic.

[0108] An embodiment of the present invention provides an initialization device for a high-performance server, which may include: a loading module 100, configured to load an initialization plug-in and a cryptographic module engine when the high-performance server is started; wherein the initialization plug-in is a plug-in that complies with high-performance server specifications and runs in the high-performance server;

[0109] The signature key pair location determination module 200 is used to initialize the cryptographic module engine, load the cryptographic module, and determine the location of the signature key pair. The judgment module 300 is used to initialize the initialization plug-in and determine whether the commercial key initialization is complete. The initialization module 400 is used to, when it is determined that the commercial key initialization is not complete, initialize the high-performance server using a wizard-style initialization service based on the location of the signature key pair. The wizard-style initialization service intercepts the uniform resource locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location within the cryptographic module. Compared to the current manual operation of multiple steps, which is cumbersome and prone to errors, the present application loads the initialization plug-in and the cryptographic module engine. Based on the cryptographic module determined by the cryptographic module engine, the initialization plug-in automatically calls the signature key pair determined by the cryptographic module, and initializes the high-performance server based on the wizard-style initialization service. Since the entire process does not require human intervention, it can achieve simple, easy-to-use, and commercial key compliant high-performance server initialization.

[0110] An initialization device for a high-performance server provided by an embodiment of the present invention is introduced below. The initialization device for a high-performance server described below and the initialization method for a high-performance server described above can refer to each other.

[0111] Please refer to Figure 4 , Figure 4 A schematic structural diagram of an initialization device for a high-performance server provided in an embodiment of the present invention may include:

[0112] Memory 10, for storing computer programs;

[0113] The processor 20 is configured to execute a computer program to implement the above-mentioned method for initializing the high-performance server.

[0114] The memory 10 , the processor 20 , and the communication interface 30 all communicate with each other via a communication bus 40 .

[0115] In the embodiment of the present invention, the memory 10 is used to store one or more programs. The program may include program code, and the program code includes computer operation instructions. In the embodiment of the present invention, the memory 10 may store programs for implementing the following functions:

[0116] When the high-performance server starts, the initialization plug-in and the cryptographic module engine are loaded; wherein the initialization plug-in is a plug-in that complies with the high-performance server specification and runs in the high-performance server;

[0117] The cryptographic module engine is initialized to load the cryptographic module and determine the location of the signature key pair;

[0118] Initialize the plug-in to determine whether the commercial key initialization is completed;

[0119] When it is determined that the commercial key initialization is not completed, the initialization plug-in initializes the high-performance server using the wizard-style initialization service based on the location of the signature key pair; among which, the wizard-style initialization service is a service that intercepts the uniform resource locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location inside the cryptographic module.

[0120] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function, etc.; the data storage area may store data created during use.

[0121] In addition, the memory 10 may include a read-only memory and a random access memory, and provides instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores an operating system and operating instructions, executable modules or data structures, or a subset or an extended set thereof. The operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and processing hardware-based tasks.

[0122] The processor 20 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field programmable gate array, or other programmable logic device. The processor 20 may be a microprocessor or any conventional processor. The processor 20 may call a program stored in the memory 10 .

[0123] The communication interface 30 may be an interface of a communication module, and is used to connect to other devices or systems.

[0124] Of course, it needs to be explained that Figure 4 The structure shown does not constitute a limitation on the initialization device of the high-performance server in the embodiment of the present invention. In actual applications, the initialization device of the high-performance server may include Figure 4 More or fewer components than shown, or combinations of certain components.

[0125] The following describes a computer-readable storage medium provided by an embodiment of the present invention. The computer-readable storage medium described below and the method for initializing a high-performance server described above may refer to each other.

[0126] The present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the above-mentioned method for initializing a high-performance server are implemented.

[0127] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., which can store program codes.

[0128] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0129] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0130] Finally, it should be noted that, in this document, relationships such as first and second, etc., are used solely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0131] The above is a detailed introduction to the initialization method, device, equipment and storage medium of a high-performance server provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for general technical personnel in this field, according to the ideas of the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for initializing a high-performance server, characterized in that: include: When the high-performance server starts, the initialization plug-in and the cryptographic module engine are loaded; wherein the initialization plug-in is a plug-in that complies with the high-performance server specification and runs in the high-performance server; The cryptographic module engine is initialized to load the cryptographic module and determine the location of the signature key pair; The initialization plug-in performs initialization to determine whether the commercial key initialization is completed; When it is determined that the commercial key initialization is not completed, the initialization plug-in initializes the high-performance server using a wizard-style initialization service based on the location of the signature key pair; wherein, the wizard-style initialization service is a service that intercepts the uniform resource locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location inside the cryptographic module.

2. The method for initializing a high-performance server according to claim 1, wherein: When the high-performance server starts, before loading the initialization plug-in and the cryptographic module engine, it also includes: The high-performance server loads configuration information; The configuration information includes the name of the cryptographic module engine, the index or container name of the public-private key pair, the activation information of the Hypertext Transfer Protocol service, and the shutdown information of the Hypertext Transfer Protocol Security service; wherein the name is used to determine the cryptographic module corresponding to the cryptographic module engine, and the index of the public-private key pair and the container name are used to determine the location of the public-private key pair.

3. The method for initializing a high-performance server according to claim 1, wherein: Also includes: When it is determined that the commercial key initialization is completed, the initialization plug-in displays the current digital certificate information.

4. The method for initializing a high-performance server according to any one of claims 1 to 3, characterized in that: When it is determined that the commercial key initialization is not completed, the initialization plug-in initializes the high-performance server using a wizard-style initialization service based on the location of the signature key pair, including: When it is determined that the commercial key initialization is not completed and the certificate request has not been generated, the initialization plug-in calls the cryptographic module to generate and store the signature key pair through the open source secure socket layer cryptographic library and the cryptographic module engine.

5. The method for initializing a high-performance server according to claim 4, wherein: When it is determined that the commercial key initialization is not completed and the certificate request has not been generated, the initialization plug-in calls the cryptographic module through the open source secure socket layer cryptographic library and the cryptographic module engine to generate and store the signature key pair, and further includes: The initialization plug-in modifies the initialization progress to a certificate request has been generated, and jumps to a page for importing a dual certificate and encryption key pair issued by a certificate authentication system.

6. The method for initializing a high-performance server according to claim 4, wherein: Also includes: When it is determined that the commercial key initialization is not completed and a certificate request has been generated, the initialization plug-in returns to the browser and imports a dual certificate and encryption key pair page issued by the certificate authentication system.

7. The method for initializing a high-performance server according to claim 6, wherein: When it is determined that the commercial key initialization is not completed and a certificate request has been generated, the initialization plug-in returns to the browser and imports the dual certificate and encryption key pair page issued by the certificate authentication system, and further includes: After the signing certificate, encryption certificate and protected encryption key pair file issued by the certificate authentication system are selected and submitted on the browser side, the initialization plug-in calls the cryptographic module through the open source secure socket layer cryptographic library and the cryptographic module engine to verify whether the signing certificate matches; if it does not match, an error is reported and the system returns; When a match is found, the initialization plug-in calls the cryptographic module through the open source secure socket layer cryptographic library and the cryptographic module engine, decrypts and verifies the protected encryption key pair inside the cryptographic module, and reports an error and returns if the decryption and verification fails; otherwise, the encryption key pair is written to a specified location inside the cryptographic module; The initialization plug-in stores the signature certificate and encryption certificate in a local directory; The initialization plug-in changes the initialization progress to that the commercial key initialization has been completed, and returns a page showing the digital certificate information to the browser.

8. A high-performance server initialization device, characterized in that: include: A loading module, used to load the initialization plug-in and the cryptographic module engine when the high-performance server is started; wherein the initialization plug-in is a plug-in that complies with the high-performance server specification and runs in the high-performance server; A signature key pair location determination module, configured to initialize the cryptographic module engine, load the cryptographic module, and determine the location of the signature key pair; A judgment module, used for initializing the initialization plug-in and determining whether the commercial key initialization is completed; An initialization module is used to initialize the high-performance server using a wizard-style initialization service based on the location of the signature key pair when it is determined that the commercial key initialization is not completed; wherein, the wizard-style initialization service is a service that intercepts the uniform resource locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location inside the cryptographic module.

9. A high-performance server initialization device, characterized in that: include: memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the high-performance server initialization method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for initializing a high-performance server according to any one of claims 1 to 7.

Images