A high-performance server initialization method, device, equipment and storage medium

Abstract

The application discloses a kind of initialization method, device and equipment of high-performance server and storage medium, applied in information technology field, comprising: when high-performance server starts, load initialization plug-in and password module engine;Initialization plug-in is initialized, to determine whether to complete commercial secret initialization;When determining that commercial secret initialization is not completed, initialization plug-in is based on the position of signature key pair and uses the initialization service of guide type to high-performance server initialization;Guide type initialization service is the uniform resource locator for intercepting high-performance server, automatically generate certificate request file, and the service of writing encryption key pair in the specified position in password module.This application determines the signature key pair by using initialization plug-in to automatically call password module, and initializes high-performance server based on guide type initialization service, since the whole process does not need manual intervention, so it can realize simple and easy to use and commercial secret compliance high-performance server initialization.

Description

Technical Field

[0001] This invention relates to the field of information technology, and in particular to an initialization method, apparatus, device, and storage medium for a high-performance server. Background Technology

[0002] Nginx is a lightweight, high-performance web server that supports TLCP (Transport Layer Cryptography protocol). Nginx can be widely used for security assessment in various businesses to implement critical functions such as TCLP communication. In actual security assessment, Nginx is required not only to use a commercially certified cryptographic module to store keys and perform cryptographic operations, but also to have its digital certificates and encryption key pairs issued and generated by a licensed Certificate Authority (CA) (which typically includes a key management system for generating and managing encryption key pairs) to complete Nginx initialization. Therefore, the commercially compliant Nginx initialization process includes: generating a signing key pair and certificate request using a cryptographic module; submitting the certificate request to the CA; importing the CA-issued dual certificates (signing certificate / encryption certificate); importing the CA-generated encryption key pair; modifying the Nginx configuration; and starting Nginx. Nginx uses configuration files to configure digital certificates, the cryptographic module engine, and the index or container name of public and private key pairs (according to GM / T 0018 and GM / T 0016 standards, a key pair index / container name contains two pairs of keys: a signing key pair and an encryption key pair). To complete the Nginx initialization process by having an external CA issue a certificate, multiple steps are involved, including manually generating a certificate request in the cryptographic module, submitting the certificate request to the CA for certificate issuance and encryption key pair generation, importing the signing and encryption certificate files, importing the encryption key pair in the cryptographic module, modifying the Nginx configuration, and starting Nginx. This process is cumbersome and prone to errors.

[0003] It is evident that improving the efficiency and accuracy of initialization on high-performance servers like Nginx is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide an initialization method, apparatus, device and storage medium for a high-performance server, which solves the technical problem of low efficiency and accuracy in the initialization of high-performance servers in the prior art.

[0005] To address the aforementioned technical problems, this invention provides an initialization method for a high-performance server, comprising:

[0006] When the high-performance server starts, it loads the initialization plugin and the cryptographic module engine; wherein the initialization plugin is a plugin that conforms to the high-performance server specification and runs on the high-performance server.

[0007] The cryptographic module engine is initialized by loading the cryptographic module and determining the position of the signature key pair;

[0008] The initialization plugin is initialized to determine whether commercial secret initialization is complete.

[0009] When it is determined that the commercial cryptography initialization has not been completed, the initialization plugin initializes the high-performance server using a wizard-style initialization service based on the location of the signature key pair; wherein, the wizard-style initialization service is a service that intercepts the Uniform Resource Locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location within the cryptographic module.

[0010] Optionally, before loading the initialization plugins and cryptographic module engine when the high-performance server starts, the following may also be included:

[0011] The high-performance server loads configuration information;

[0012] The configuration information includes the name of the cryptographic module engine, the index or container name of the public-private key pair, the enabling information of the Hypertext Transfer Protocol service, and the disabling information of the Hypertext Transfer Security Protocol service; wherein, the name is used to identify the cryptographic module corresponding to the cryptographic module engine, and the index and container name of the public-private key pair are used to identify the location of the public-private key pair.

[0013] Optionally, the above-mentioned high-performance server initialization method also includes:

[0014] When the commercial cryptography initialization is confirmed to be complete, the initialization plugin displays the current digital certificate information.

[0015] Optionally, when it is determined that commercial cryptography initialization has not been completed, the initialization plugin initializes the high-performance server using a wizard-style initialization service based on the location of the signature key pair, including:

[0016] When it is determined that commercial cryptography initialization has not been completed and no certificate request has been generated, the initialization plugin calls the cryptographic module to generate and store the signature key pair through the open-source Secure Sockets Layer cryptographic library and the cryptographic module engine.

[0017] Optionally, when it is determined that commercial cryptography initialization has not been completed and no certificate request has been generated, after the initialization plugin calls the cryptographic module to generate and store the signature key pair through the open-source Secure Sockets Layer cryptographic library and the cryptographic module engine, it further includes:

[0018] The initialization plugin modifies the initialization progress to indicate that a certificate request has been generated and redirects to the page for importing the dual certificates and encryption key pairs issued by the certificate authentication system.

[0019] Optionally, the above-mentioned high-performance server initialization method also includes:

[0020] When it is determined that the commercial cryptography initialization has not been completed and a certificate request has been generated, the initialization plugin returns and imports a page containing the dual certificates and encryption key pair issued by the certificate authentication system to the browser.

[0021] Optionally, when it is determined that commercial cryptography initialization has not been completed and a certificate request has been generated, after the initialization plugin returns a page to the browser containing the dual certificates and encryption key pair issued by the certificate authentication system, it also includes:

[0022] When the browser selects and submits the signature certificate, encryption certificate, and protected encryption key pair file issued by the certificate authentication system, the initialization plugin calls the cryptographic module to verify whether the signature certificate matches through the open-source Secure Sockets Layer cryptographic library and the cryptographic module engine; if they do not match, an error is reported and the process returns.

[0023] When a match is found, the initialization plugin calls the cryptographic module through the open-source Secure Sockets Layer cryptographic library and the cryptographic module engine. Inside the cryptographic module, it decrypts and verifies the protected encryption key pair. If the decryption and verification fail, an error is reported and the process returns. Otherwise, the encryption key pair is written to a specified location inside the cryptographic module.

[0024] The initialization plugin stores the signing certificate and encryption certificate in a local directory;

[0025] The initialization plugin changes the initialization progress to "commercial cryptography initialization completed" and returns a page displaying digital certificate information to the browser.

[0026] This invention also provides an initialization apparatus for a high-performance server, comprising:

[0027] A loading module is used to load the initialization plugin and the cryptographic module engine when the high-performance server starts up; wherein, the initialization plugin is a plugin that conforms to the high-performance server specification and runs in the high-performance server.

[0028] The signature key pair location determination module is used to initialize the cryptographic module engine, load the cryptographic module, and determine the location of the signature key pair.

[0029] The judgment module is used to determine whether the commercial secret initialization has been completed during the initialization of the initialization plugin.

[0030] An initialization module is used to initialize the high-performance server based on the location of the signature key pair when it is determined that the commercial cryptography initialization has not been completed. The initialization plugin uses a wizard-style initialization service to initialize the high-performance server. The wizard-style initialization service intercepts the Uniform Resource Locator (URL) of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location within the cryptography module.

[0031] This invention also provides an initialization device for a high-performance server, comprising:

[0032] Memory, used to store computer programs;

[0033] A processor for executing the computer program to implement the steps of the initialization method for a high-performance server as described above.

[0034] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the initialization method for the high-performance server described above.

[0035] This invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the above-described high-performance server initialization method.

[0036] As can be seen, when the high-performance server starts, the present invention loads an initialization plugin and a cryptographic module engine. The initialization plugin is a plugin that conforms to the high-performance server specification and runs on the high-performance server. The cryptographic module engine initializes by loading the cryptographic module and determining the location of the signature key pair. The initialization plugin initializes itself and determines whether commercial cryptographic initialization is complete. If it is determined that commercial cryptographic initialization is not complete, the initialization plugin initializes the high-performance server based on the location of the signature key pair using a wizard-style initialization service. The wizard-style initialization service intercepts the Uniform Resource Locator (URL) of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location within the cryptographic module.

[0037] The beneficial effects of this invention are as follows: Compared with the current manual operation of multiple steps, which is cumbersome and prone to errors, this application loads an initialization plugin and a cryptographic module engine, which enables the cryptographic module to be determined based on the cryptographic module engine. The initialization plugin automatically calls the signature key pair determined by the cryptographic module, and the high-performance server is initialized based on the wizard-style initialization service. Since the whole process does not require manual intervention, it can realize a simple, easy-to-use and commercially compliant high-performance server initialization.

[0038] In addition, the present invention also provides an initialization method, apparatus, device and storage medium for a high-performance server, which also have the above-mentioned beneficial effects. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0040] Figure 1 A flowchart illustrating an initialization method for a high-performance server provided in an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of the structural framework of the initialization process of a high-performance server provided in an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of the structure of an initialization device for a high-performance server provided in an embodiment of the present invention;

[0043] Figure 4 This is a schematic diagram of the structure of an initialization device for a high-performance server provided in an embodiment of the present invention. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] Some terms that appear in the description of the embodiments of this application are subject to the following interpretation:

[0046] SM2 / SM3 / SM4 cryptographic algorithms: SM2 (Elliptic Curve Public Key Cryptography) is an elliptic curve public key cryptographic algorithm released by my country, and its standard is GB / T32918 series; SM3 is a cryptographic hash algorithm released by my country, and its standard is GB / T32905; SM4 is a block cipher algorithm released by my country, and its standard is GB / T32907.

[0047] SSL / TLS: SSL (Secure Socket Layer) and its successor TLS (Transport Layer Security) are security protocols that provide security and data integrity for network communications.

[0048] TLCP: TLCP (Transport Layer Cryptography Protocol) is a transport layer cryptography protocol published in my country in GB / T38636-2020 "Information Security Technology Transport Layer Cryptography Protocol (TLCP)". It can also be called the national cryptographic SSL, which includes multiple SSL cipher suites using SM2 / SM3 / SM4 algorithms.

[0049] OpenSSL: OpenSSL (Secure Sockets Layer Cryptography Library) is a Secure Sockets Layer cryptography library that encompasses major cryptographic algorithms, commonly used keys, certificate encapsulation and management functions, and an implementation of the SSL protocol. Modified versions of OpenSSL can also implement the TLCP protocol. The entire OpenSSL software package can be roughly divided into three main functional parts: cryptographic algorithm library, protocol library, and application command-line tools.

[0050] OpenSSL Engine: The OpenSSL Engine provides a mechanism to add hardware devices to OpenSSL, replacing the software algorithms provided by OpenSSL. This mechanism can also use the keys inside the hardware device and perform cryptographic operations.

[0051] Cryptographic Module: A cryptographic module is a hardware device that uses cryptographic technology as its core to provide secure key management and cryptographic operations for business systems. Business systems achieve data confidentiality, integrity, validity, and non-repudiation by calling the cryptographic services provided by the cryptographic module.

[0052] Nginx: Nginx is a lightweight, high-performance web server that uses a non-blocking, fully asynchronous mechanism. It features low memory consumption and strong concurrency capabilities, placing it among the leading web servers of its type in terms of concurrency.

[0053] CA: CA is short for Certificate Authentication system. CA mainly implements the full lifecycle management of digital certificates, including the issuance, publication, renewal, and revocation of digital certificates.

[0054] Please refer to Figure 1 , Figure 1 A flowchart illustrating a high-performance server initialization method provided in an embodiment of the present invention. The method may include:

[0055] S101, when the high-performance server starts, loads the initialization plugin and the password module engine; the initialization plugin is a plugin that conforms to the high-performance server specification and runs on the high-performance server.

[0056] In this embodiment, the high-performance server is Nginx. Nginx is used to provide web services based on the TLCP (Transport Layer Cryptographic Protocol) protocol, where TLCP communication is completed by calling OpenSSL. The open-source Nginx needs to be modified to adapt to support the TLCP protocol of OpenSSL. The modified OpenSSL supports the TLCP protocol, providing software cryptographic algorithms and the implementation of the TLCP protocol, and providing an engine mechanism to access hardware devices such as cryptographic modules. This allows for key management and cryptographic operations using SM2 (asymmetric encryption algorithm), SM3 (hash algorithm), and SM4 (symmetric encryption algorithm) algorithms. The initialization plugin in this embodiment conforms to the Nginx specification, runs within Nginx, and provides a wizard-style initialization service (e.g., a web wizard method) for Nginx commercial cryptographic initialization. This wizard-style initialization service is used to complete the key generation process for commercial cryptographic standard cryptographic devices, as well as the generation and import process of external CA certificates. The cryptographic module engine in this embodiment conforms to the OpenSSL engine interface requirements, calling the cryptographic module to implement encryption algorithms, which can be SM2, SM3, SM4, etc. In this embodiment, when Nginx starts, it loads the initialization plugin and, according to the configuration file, loads the cryptographic module engine.

[0057] It should be further noted that, based on any of the above embodiments, in order to ensure the accuracy of initialization, before loading the initialization plugin and cryptographic module engine when the high-performance server starts, the following may also be included:

[0058] The high-performance server loads configuration information; this configuration information includes the name of the cryptographic module engine, the index or container name of the public / private key pair, the enabling information for the Hypertext Transfer Protocol (HTTP) service, and the disabling information for the Hypertext Transfer Security Protocol (HTTPS) service. The name identifies the cryptographic module corresponding to the cryptographic module engine, and the index and container name of the public / private key pair determine their location. In this embodiment, the cryptographic module engine, the index or container name of the public / private key pair are pre-set in the Nginx configuration file, and the HTTP service is enabled while the HTTPS service (based on TLCP) service is disabled, because HTTPS service can only be provided after initialization.

[0059] S102, the cryptographic module engine initializes by loading the cryptographic module and determining the location of the signature key pair.

[0060] In this embodiment, the cryptographic module provides secure key management functions, and on this basis, provides secure encryption algorithm cryptographic operations, such as SM2, SM3, and SM4 algorithms. In this embodiment, the cryptographic module engine is initialized to determine when to load the cryptographic module.

[0061] S103, initialize the plugin and determine whether the commercial secret initialization is complete.

[0062] In this embodiment, the initialization plugin is initialized to determine the initialization progress (whether commercial secret initialization is complete). This embodiment does not limit the specific result of whether commercial secret initialization is completed.

[0063] S104, when it is determined that the commercial cryptography initialization has not been completed, the initialization plugin initializes the high-performance server based on the location of the signature key pair using the wizard-style initialization service; wherein, the wizard-style initialization service is a service that intercepts the Uniform Resource Locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location inside the cryptographic module.

[0064] This embodiment does not limit the specific state of incomplete commercial encryption initialization. For example, in this embodiment, incomplete commercial encryption initialization means that no certificate request has been generated; or in this embodiment, incomplete commercial encryption initialization means that a certificate request has been generated. It is understood that any URL (Uniform Resource Locator) accessed through a browser to Nginx will be intercepted by the initialization plugin. If the Nginx instance has completed commercial encryption initialization, the request will be processed according to Nginx's default process; otherwise, the initialization plugin will redirect the request to the corresponding commercial encryption initialization page based on the initialization progress and perform initialization based on the wizard-style initialization service.

[0065] It should be further noted that the above method may also include: when the commercial cryptography initialization is confirmed to be complete, the initialization plugin displays the current digital certificate information.

[0066] It should be further explained that, to improve the accuracy of initialization, when it is determined that commercial cryptographic initialization is incomplete, the initialization plugin initializes the high-performance server based on the location of the signature key pair using a wizard-style initialization service. This can include: when it is determined that commercial cryptographic initialization is incomplete and no certificate request has been generated, the initialization plugin uses the open-source Secure Sockets Layer cryptographic library and cryptographic module engine to call the cryptographic module to generate and store the signature key pair. In this embodiment, if the initialization progress (the state of incomplete commercial cryptographic initialization) is determined to be that no certificate request has been generated, the initialization plugin returns a certificate request generation interface to the browser and performs the following steps based on the input: after the certificate request information is filled in and submitted on the browser side, the initialization plugin uses OpenSSL and the cryptographic module engine to call the cryptographic module to generate and store the signature key pair at the configured location, then uses the newly generated signature key pair to sign the certificate request information, and finally generates a certificate request file, which is returned to the browser. This embodiment provides the steps for intelligent initialization when no certificate request has been generated, improving the accuracy of initialization.

[0067] It should be further explained that, based on any of the above embodiments, when it is determined that commercial cryptographic initialization has not been completed and a certificate request has not yet been generated, after the initialization plugin generates and stores the signature key pair by calling the cryptographic module through the open-source Secure Sockets Layer cryptographic library and cryptographic module engine, it may further include: the initialization plugin changing the initialization progress to "certificate request generated" and redirecting to the page for importing the dual certificates and encryption key pairs issued by the certificate authentication system. In this embodiment, the initialization plugin changes the initialization progress to "certificate request generated" and then redirects to the page for importing the dual certificates and encryption key pairs issued by the CA. This embodiment provides a specific method for adjusting the initialization precision, improving the accuracy of initialization.

[0068] It should be further noted that, based on any of the above embodiments, the high-performance server initialization method may further include: when it is determined that commercial cryptographic initialization has not been completed and a certificate request has been generated, the initialization plugin returns to the browser a page containing the dual certificates and encryption key pairs issued by the certificate authentication system. This embodiment provides the initialization steps when the initialization progress indicates that commercial cryptographic initialization is incomplete and a certificate request has been generated as follows: after selecting and submitting the CA-issued signing certificate, encryption certificate, and protected encryption key pair file on the browser side, the initialization plugin, through OpenSSL and the cryptographic module engine, calls the cryptographic module to verify whether the signing certificate matches. If it does not match, an error is reported and returned; if it matches, subsequent steps are performed.

[0069] It should be further noted that, based on any of the above embodiments, when it is determined that the commercial cryptography initialization has not been completed and a certificate request has been generated, after the initialization plugin returns a page to the browser containing the dual certificates and encryption key pair issued by the certificate authentication system, it may further include:

[0070] Step 1: After selecting and submitting the signature certificate, encryption certificate, and protected encryption key pair file issued by the certificate authentication system in the browser, the initialization plugin uses the open-source Secure Sockets Layer cryptographic library and the cryptographic module engine to call the cryptographic module to verify whether the signature certificate matches; if they do not match, an error is reported and the process returns.

[0071] Step 2: When a match is found, the initialization plugin calls the cryptographic module through the open-source Secure Sockets Layer cryptographic library and cryptographic module engine. Inside the cryptographic module, the protected encryption key pair is decrypted and verified. If the decryption and verification fail, an error is reported and the process returns; otherwise, the encryption key pair is written to a specified location inside the cryptographic module.

[0072] Step 3: Initialize the plugin by storing the signing certificate and encryption certificate in the local directory;

[0073] Step 4: The initialization plugin changes the initialization progress to "commercial certificate initialization completed" and returns a page displaying digital certificate information to the browser.

[0074] The complete steps in this embodiment are as follows: i. After selecting and submitting the CA-issued signing certificate, encryption certificate, and protected encryption key pair file on the browser side, the initialization plugin calls the cryptographic module through OpenSSL and the cryptographic module engine to verify whether the signing certificate matches. If they do not match, an error is reported and the process returns; if they match, subsequent steps are performed. ii. The initialization plugin calls the cryptographic module through OpenSSL and the cryptographic module engine. Within the cryptographic module, the protected encryption key pair is decrypted and verified (a series of decryption steps are performed using the signing private key within the cryptographic module). If decryption and verification fail, an error is reported and the process returns; otherwise, the process continues within the cryptographic module. iii. The initialization plugin stores the signing certificate and encryption certificate in the local directory; iv. The initialization plugin changes the initialization progress to "commercial cryptographic initialization completed" and returns a page displaying digital certificate information to the browser; v. The initialization plugin modifies the Nginx configuration file, including writing the paths to the signing certificate and encryption certificate, enabling the HTTPS (TLCP-based) service switch, and causes Nginx to reload the configuration file; Nginx reloads the configuration file and provides HTTPS (TLCP-based) service using a cryptographic module with commercial cryptographic qualifications and a digital certificate issued by a CA with operational qualifications.

[0075] This invention provides an initialization method for a high-performance server, which may include: S101, when the high-performance server starts, loading an initialization plugin and a cryptographic module engine; wherein, the initialization plugin is a plugin that conforms to the high-performance server specification and runs on the high-performance server; S102, the cryptographic module engine performs initialization by loading the cryptographic module and determining the location of the signature key pair; S103, the initialization plugin performs initialization and determines whether commercial cryptographic initialization is complete; S104, when it is determined that commercial cryptographic initialization is not complete, the initialization plugin initializes the high-performance server based on the location of the signature key pair using a wizard-style initialization service; wherein, the wizard-style initialization service intercepts the Uniform Resource Locator (URL) of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location within the cryptographic module. Compared with the current method of manual operation involving multiple steps, which is cumbersome and prone to errors, this application, by loading an initialization plugin and a cryptographic module engine, enables the initialization plugin to automatically call the signature key pair determined by the cryptographic module based on the cryptographic module determined by the cryptographic module engine, and initializes the high-performance server based on the wizard-style initialization service. Since the entire process does not require manual intervention, it can achieve simple, easy-to-use, and commercially compliant high-performance server initialization. Compared to the current manual operation involving multiple steps, which is cumbersome and prone to errors, this invention loads an initialization plugin and a cryptographic module engine. This allows the initialization plugin to automatically call the signature key pair determined by the cryptographic module engine based on the cryptographic module, and initialize the high-performance server based on the wizard-style initialization service. Since the entire process does not require manual intervention, it can achieve simple, easy-to-use, and commercially compliant high-performance server initialization.

[0076] For a clearer understanding of this invention, please refer to the following details. Figure 2 , Figure 2 A schematic diagram of the structural framework of the initialization process of a high-performance server provided in this embodiment of the invention may specifically include:

[0077] 1. In the Nginx configuration file, pre-set the cryptographic module engine, the index or container name of the public and private key pairs, and configure to enable HTTP service and disable HTTPS (based on TLCP) service.

[0078] The components involved in this invention include: Nginx, an initialization plugin, a cryptographic module, OpenSSL, and a cryptographic module engine. The initialization plugin conforms to the Nginx specification, runs within Nginx, and provides a web wizard process for Nginx's commercial cryptographic initialization. When Nginx has not completed commercial cryptographic compliance initialization, this plugin takes over all HTTP requests passing through Nginx and redirects the requests to the web page for the commercial cryptographic initialization process.

[0079] 2. When Nginx starts, it loads the initialization plugin and, according to the configuration file, loads the password module engine.

[0080] 3. Initialize the plugin and password module engine. The plugin initialization records the current initialization progress, and the password module engine loads the password module.

[0081] 4. Nginx provides a digital certificate initialization function through an initialization plugin. If the digital certificate initialization is not completed, the plugin provides a wizard-style web initialization function; if the digital certificate initialization is completed, the current digital certificate information is displayed.

[0082] 5. Any URL accessed through a browser to Nginx will be intercepted by the initialization plugin. If the Nginx instance has not completed commercial encryption initialization, the initialization plugin will redirect the user to the corresponding commercial encryption initialization page based on the initialization progress, and initialize the high-performance server based on the wizard-style initialization service.

[0083] 6. If commercial cryptography initialization has been completed, the current digital certificate information will be displayed.

[0084] The Nginx plugin implemented based on the method of this invention can easily and conveniently achieve commercial cryptographic compliance Nginx initialization. This allows Nginx to use cryptographic modules with commercial cryptographic qualifications for key storage and cryptographic operations to implement TLCP, and to use CAs with operational qualifications to issue dual certificates and generate encryption key pairs, thus meeting the requirements of cryptographic evaluation.

[0085] The initialization apparatus for a high-performance server provided in the embodiments of the present invention will be described below. The initialization apparatus for a high-performance server described below can be referred to in correspondence with the initialization method for a high-performance server described above.

[0086] Please refer to the details. Figure 3 , Figure 3 A schematic diagram of an initialization device for a high-performance server provided in an embodiment of the present invention may include:

[0087] The loading module 100 is used to load the initialization plugin and the password module engine when the high-performance server starts up; wherein, the initialization plugin is a plugin that conforms to the high-performance server specification and runs in the high-performance server.

[0088] The signature key pair location determination module 200 is used to initialize the cryptographic module engine, load the cryptographic module, and determine the location of the signature key pair.

[0089] The judgment module 300 is used to determine whether the commercial secret initialization has been completed during the initialization of the initialization plugin.

[0090] The initialization module 400 is used to initialize the high-performance server based on the location of the signature key pair when it is determined that the commercial cryptography initialization has not been completed. The initialization plugin uses a wizard-style initialization service to initialize the high-performance server. The wizard-style initialization service is a service that intercepts the Uniform Resource Locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location inside the cryptography module.

[0091] Furthermore, based on the above embodiments, the initialization device for the high-performance server may further include:

[0092] Configuration information loading module, used to load configuration information for the high-performance server;

[0093] The configuration information includes the name of the cryptographic module engine, the index or container name of the public-private key pair, the enabling information of the Hypertext Transfer Protocol service, and the disabling information of the Hypertext Transfer Security Protocol service; wherein, the name is used to identify the cryptographic module corresponding to the cryptographic module engine, and the index and container name of the public-private key pair are used to identify the location of the public-private key pair.

[0094] Furthermore, based on any of the above embodiments, the initialization device for the high-performance server may further include:

[0095] The digital certificate information display module is used to display the current digital certificate information when the commercial cryptography initialization is completed.

[0096] Furthermore, based on any of the above embodiments, the initialization module 400 may include:

[0097] The signature key pair determination module is used when it is determined that commercial cryptography initialization has not been completed and no certificate request has been generated. In this case, the initialization plugin calls the cryptographic module to generate and store the signature key pair through the open-source Secure Sockets Layer cryptographic library and the cryptographic module engine.

[0098] Furthermore, based on any of the above embodiments, the initialization device for the high-performance server may further include:

[0099] The dual certificate and encryption key pair page redirection module is used by the initialization plugin to modify the initialization progress to indicate that a certificate request has been generated, and redirect to the page for importing the dual certificates and encryption key pairs issued by the certificate authentication system.

[0100] Furthermore, based on any of the above embodiments, the initialization device for the high-performance server may further include:

[0101] The import module is used to return and import the dual certificate and encryption key pair issued by the certificate authentication system to the browser when it is determined that the commercial cryptography initialization has not been completed and a certificate request has been generated.

[0102] Furthermore, based on any of the above embodiments, the initialization device for the high-performance server may further include:

[0103] The signature certificate matching judgment module is used when the browser selects and submits the signature certificate, encryption certificate and protected encryption key pair file issued by the certificate authentication system. The initialization plugin calls the cryptographic module to verify whether the signature certificate matches through the open source Secure Sockets Layer cryptographic library and the cryptographic module engine; if they do not match, an error is reported and returned.

[0104] The decryption module is used when a match is found. The initialization plugin calls the cryptographic module through the open-source Secure Sockets Layer cryptographic library and the cryptographic module engine. The cryptographic module decrypts and verifies the protected encryption key pair. If the decryption and verification fail, an error is reported and the process returns. Otherwise, the encryption key pair is written to a specified location within the cryptographic module.

[0105] A signing certificate and encryption certificate storage module is used by the initialization plugin to store the signing certificate and encryption certificate in a local directory;

[0106] The commercial cryptography initialization module has been completed. This module is used by the initialization plugin to change the initialization progress to "commercial cryptography initialization completed" and return a page displaying digital certificate information to the browser.

[0107] It should be noted that the order of the modules and units in the initialization device of the high-performance server can be changed without affecting the logic.

[0108] An initialization device for a high-performance server provided in this embodiment of the invention may include: a loading module 100, used to load an initialization plugin and a cryptographic module engine when the high-performance server starts up; wherein, the initialization plugin is a plugin that conforms to the high-performance server specification and runs in the high-performance server.

[0109] The signature key pair location determination module 200 is used to load the cryptographic module during the initialization of the cryptographic module engine and determine the location of the signature key pair. The judgment module 300 is used to determine whether commercial cryptographic initialization is complete during the initialization of the initialization plugin. The initialization module 400 is used to initialize the high-performance server based on the location of the signature key pair using a wizard-style initialization service when it is determined that commercial cryptographic initialization is incomplete. The wizard-style initialization service intercepts the Uniform Resource Locator (URL) of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location within the cryptographic module. Compared to the current method of manual operation involving multiple steps, which is cumbersome and prone to errors, this application, by loading the initialization plugin and the cryptographic module engine, enables the initialization plugin to automatically call the signature key pair determined by the cryptographic module engine and initialize the high-performance server based on the wizard-style initialization service. Since the entire process requires no manual intervention, it achieves a simple, easy-to-use, and commercially compliant high-performance server initialization.

[0110] The initialization device for a high-performance server provided in the embodiments of the present invention will be described below. The initialization device for a high-performance server described below can be referred to in correspondence with the initialization method for a high-performance server described above.

[0111] Please refer to Figure 4 , Figure 4 A schematic diagram of the structure of an initialization device for a high-performance server provided in an embodiment of the present invention may include:

[0112] Memory 10 is used to store computer programs;

[0113] Processor 20 is used to execute computer programs to implement the above-described high-performance server initialization method.

[0114] The memory 10, processor 20, and communication interface 30 all communicate with each other through the communication bus 40.

[0115] In this embodiment of the invention, the memory 10 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment of the invention, the memory 10 may store programs for implementing the following functions:

[0116] When the high-performance server starts, it loads the initialization plugin and the cryptographic module engine; the initialization plugin is a plugin that conforms to the high-performance server specification and runs on the high-performance server.

[0117] The cryptographic module engine initializes by loading the cryptographic module and determining the location of the signature key pair;

[0118] Initialize the plugin and determine if commercial secret initialization is complete.

[0119] When it is determined that the commercial cryptography initialization has not been completed, the initialization plugin initializes the high-performance server based on the location of the signature key pair using a wizard-style initialization service. The wizard-style initialization service intercepts the Uniform Resource Locator (URL) of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location within the cryptographic module.

[0120] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0121] Furthermore, memory 10 may include read-only memory and random access memory, providing instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores operating systems and operating instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and handling hardware-based tasks.

[0122] Processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic device. Processor 20 can be a microprocessor or any conventional processor. Processor 20 can call programs stored in memory 10.

[0123] The communication interface 30 can be an interface for the communication module, used to connect with other devices or systems.

[0124] Of course, it should be noted that, Figure 4 The structure shown does not constitute a limitation on the initialization device of the high-performance server in the embodiments of the present invention. In practical applications, the initialization device of the high-performance server may include devices such as... Figure 4 More or fewer components as shown, or combinations of certain components.

[0125] The computer-readable storage medium provided in the embodiments of the present invention will be described below. The computer-readable storage medium described below can be referred to in correspondence with the initialization method of the high-performance server described above.

[0126] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described high-performance server initialization method.

[0127] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0128] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0129] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0130] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0131] The foregoing has provided a detailed description of the initialization method, apparatus, device, and storage medium for a high-performance server provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for initializing a high-performance server, characterized in that, include: When the high-performance server starts, it loads the initialization plugin and the cryptographic module engine; wherein the initialization plugin is a plugin that conforms to the high-performance server specification and runs on the high-performance server. The cryptographic module engine initializes and loads the cryptographic module, determining the position of the signature key pair; The initialization plugin is initialized to determine whether commercial secret initialization is complete. When it is determined that the commercial cryptography initialization has not been completed, the initialization plugin initializes the high-performance server using a wizard-style initialization service based on the location of the signature key pair; wherein, the wizard-style initialization service is a service that intercepts the Uniform Resource Locator of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location within the cryptographic module.

2. The initialization method for a high-performance server according to claim 1, characterized in that, Before loading the initialization plugins and cryptographic module engine when the high-performance server starts, it also includes: The high-performance server loads configuration information; The configuration information includes the name of the cryptographic module engine, the index or container name of the public-private key pair, the enabling information of the Hypertext Transfer Protocol service, and the disabling information of the Hypertext Transfer Security Protocol service; wherein, the name is used to identify the cryptographic module corresponding to the cryptographic module engine, and the index and container name of the public-private key pair are used to identify the location of the public-private key pair.

3. The initialization method for a high-performance server according to claim 1, characterized in that, Also includes: When the commercial cryptography initialization is confirmed to be complete, the initialization plugin displays the current digital certificate information.

4. The initialization method for a high-performance server according to any one of claims 1 to 3, characterized in that, When it is determined that commercial key initialization has not been completed, the initialization plugin initializes the high-performance server using a wizard-style initialization service based on the location of the signature key pair, including: When it is determined that commercial cryptography initialization has not been completed and no certificate request has been generated, the initialization plugin calls the cryptographic module to generate and store the signature key pair through the open-source Secure Sockets Layer cryptographic library and the cryptographic module engine.

5. The initialization method for a high-performance server according to claim 4, characterized in that, When it is determined that commercial cryptography initialization has not been completed and no certificate request has been generated, after the initialization plugin calls the cryptographic module to generate and store the signature key pair through the open-source Secure Sockets Layer cryptographic library and the cryptographic module engine, it further includes: The initialization plugin modifies the initialization progress to indicate that a certificate request has been generated and redirects to the page for importing the dual certificates and encryption key pairs issued by the certificate authentication system.

6. The initialization method for a high-performance server according to claim 4, characterized in that, Also includes: When it is determined that the commercial cryptography initialization has not been completed and a certificate request has been generated, the initialization plugin returns and imports a page containing the dual certificates and encryption key pairs issued by the certificate authentication system to the browser.

7. The initialization method for a high-performance server according to claim 6, characterized in that, When it is determined that commercial cryptography initialization has not been completed and a certificate request has been generated, the initialization plugin returns a page to the browser containing the dual certificates and encryption key pair issued by the certificate authentication system. This page then includes: When the browser selects and submits the signature certificate, encryption certificate, and protected encryption key pair file issued by the certificate authentication system, the initialization plugin calls the cryptographic module to verify whether the signature certificate matches through the open-source Secure Sockets Layer cryptographic library and the cryptographic module engine; if they do not match, an error is reported and the process returns. When a match is found, the initialization plugin calls the cryptographic module through the open-source Secure Sockets Layer cryptographic library and the cryptographic module engine. Inside the cryptographic module, it decrypts and verifies the protected encryption key pair. If the decryption and verification fail, an error is reported and the process returns. Otherwise, the encryption key pair is written to a specified location inside the cryptographic module. The initialization plugin stores the signing certificate and encryption certificate in a local directory; The initialization plugin changes the initialization progress to "commercial cryptography initialization completed" and returns a page displaying digital certificate information to the browser.

8. An initialization device for a high-performance server, characterized in that, include: A loading module is used to load the initialization plugin and the cryptographic module engine when the high-performance server starts up; wherein, the initialization plugin is a plugin that conforms to the high-performance server specification and runs in the high-performance server. The signature key pair location determination module is used to initialize the cryptographic module engine, load the cryptographic module, and determine the location of the signature key pair. The judgment module is used to determine whether the commercial secret initialization has been completed during the initialization of the initialization plugin. An initialization module is used to initialize the high-performance server based on the location of the signature key pair when it is determined that the commercial cryptography initialization has not been completed. The initialization plugin uses a wizard-style initialization service to initialize the high-performance server. The wizard-style initialization service intercepts the Uniform Resource Locator (URL) of the high-performance server, automatically generates a certificate request file, and writes the encryption key pair to a specified location within the cryptography module.

9. An initialization device for a high-performance server, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the initialization method for a high-performance server as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the initialization method for the high-performance server as described in any one of claims 1 to 7.

Images