Intelligent password key management method and device based on SKF standard

Abstract

The application relates to an intelligent password key management method and device based on an SKF standard, and belongs to the technical field of computers.The method comprises the following steps: receiving a first interface calling request for a first management interface, including information of a target operation based on a first intelligent password key; if the operation is a device layer operation, calling an SKF standard interface corresponding to the target operation to execute the target operation; if the operation is an application layer operation, calling an SKF standard interface to generate an application handle, storing the application handle into a memory, and calling an SKF standard interface corresponding to the target operation to execute the target operation; and if the operation is a container layer operation, calling an SKF standard interface to generate an application handle and a container handle, storing the application handle and the container handle into a memory, and calling an SKF standard interface corresponding to the target operation to execute the target operation.The application executes the target operation through an encapsulated interface, reduces the development difficulty, improves the development convenience and the development efficiency, and improves the stability of a program and the safety of a memory.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a smart password key management method and device based on the SKF standard. Background Technology

[0002] The full Chinese name of the SKF standard is "GM / T 0016 Smart Cryptographic Key Cryptographic Application Interface Specification", abbreviated as SKF (Secure Key Function). This standard defines the application interface for smart cryptographic keys (hereinafter referred to as USBkeys) based on the PKI cryptosystem, covering functions, data types, parameter definitions, and device security requirements. It is a C language development interface. In this standard, USBkey devices are vertically divided into three layers: device layer, application layer, and container layer; the core interface functions are divided into four categories: device management, application management, container operation, and cryptographic operations. Figure 1 This is a schematic diagram of the device hierarchy and core interface functions of a USB key.

[0003] Existing USB key development solutions based on the SKF standard in the industry mainly utilize the SKF interface library provided by the manufacturer. These solutions are developed based on the SKF standard definitions and actual business processes to create a deeply customized solution. However, the SKF standard interface definitions are overly complex, with the interface definitions intersecting with the device layer, resulting in a lack of clear overall hierarchy. This causes developers to spend excessive time figuring out how to use the interfaces. The three-layer vertical design of the device requires developers to maintain numerous handles. For example, a single container-related operation requires maintaining at least three handles: the device handle, the application handle, and the container handle. The more handles required to maintain, the more likely it is to lead to program instability and memory insecurity. Summary of the Invention

[0004] Based on the above analysis, the present invention aims to provide a smart password key management method and device based on the SKF standard, in order to solve the problems of existing developers spending too much time studying how to use the interface, low development efficiency, and developers maintaining too many handles, which can easily lead to program instability and memory insecurity.

[0005] On one hand, embodiments of the present invention provide a smart key management method based on the SKF standard. The method includes: receiving a first interface call request for a first management interface when the device is successfully connected to and authenticated with a first smart key; wherein the first interface call request includes information about a target operation based on the first smart key; wherein a device handle is generated after the first smart key is successfully connected; and for the first interface call request, performing the following operations through the first management interface: if the target operation is a device-level operation, calling the SKF standard for executing the target operation. The interface executes the target operation; if the target operation is an application layer operation, an application handle is generated by calling the SKF standard interface for generating application handles, the application handle is stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation; if the target operation is a container layer operation, an application handle is generated by calling the SKF standard interface for generating application handles, a container handle is generated by calling the SKF standard interface for generating container handles, the application handle and the container handle are stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation.

[0006] The beneficial effects of the above technical solution are as follows: it enables the execution of target operations through the encapsulated first management interface, reduces the complexity of the interface, and provides unified management of the handles used therein, providing a solution that benefits developers, reducing development difficulty, improving development convenience and efficiency, and improving program stability and memory security.

[0007] Based on a further improvement of the above method, the method further includes: in response to detecting the disconnection of the first smart key, sending a second interface call request to a second management interface; wherein the second interface call request includes information about the disconnection of the first smart key; for the second interface call request, performing the following operations through the second management interface: obtaining the current handle generation status; in response to the current generation of the device handle, the application handle, and the container handle, releasing the device handle from memory by calling the SKF standard interface for releasing the device handle, releasing the application handle from memory by calling the SKF standard interface for releasing the application handle, and releasing the container handle from memory by calling the SKF standard interface for releasing the container handle; in response to the current generation of the device handle and the application handle, releasing the device handle from memory by calling the SKF standard interface for releasing the device handle, and releasing the application handle from memory by calling the SKF standard interface for releasing the application handle; in response to the current generation of the device handle, releasing the device handle from memory by calling the SKF standard interface for releasing the device handle.

[0008] The beneficial effects of the above-mentioned further improvement scheme are: it enables operations after the smart password key is disconnected through the second management interface, realizes unified management of the handle lifecycle, and further improves the stability of the program and the security of memory.

[0009] Based on a further improvement of the above method, before receiving the first interface call request for the first management interface, the method further includes: in response to detecting the insertion operation of the first smart key, obtaining the device descriptor information of the first smart key; wherein the device descriptor information includes a vendor ID and a product ID; receiving the third interface call request for the third management interface; wherein the third interface call request is used to request initialization configuration information; For the third interface call request, the following operations are performed through the third management interface: obtain the first authentication process configuration file corresponding to the vendor ID and the product ID, read the first authentication process configuration file and load the SKF standard library, and initialize the memory context; wherein, the SKF standard library includes information about the SKF standard interface; receive the fourth interface call request for the fourth management interface; wherein, the fourth interface call request is used to request connection and authentication of the first smart key according to the first authentication process configuration file; for the fourth interface call request, the following operations are performed through the fourth management interface: in response to the device descriptor configuration information in the first authentication process configuration file being consistent with the device descriptor information, connect the first smart key by calling the SKF standard interface for device connection, generate the device handle by calling the SKF standard interface for generating the device handle after the first smart key is successfully connected, and store the device handle in memory; perform device authentication on the first smart key by calling the SKF standard interface for device authentication according to the first authentication process configuration file.

[0010] The beneficial effects of the above-mentioned further improvement scheme are: it realizes the initialization of configuration information through the encapsulated second management interface, and the connection and authentication of smart password keys through the third management interface, reducing the complexity of the interface, and unifying the management of the handles used, further improving the convenience and efficiency of development, as well as improving the stability of the program and the security of memory.

[0011] Based on a further improvement of the above method, before obtaining the first authentication process configuration file corresponding to the manufacturer ID and the product ID, the method further includes: generating the first authentication process configuration file according to the second authentication process configuration file of at least one second smart key that has been successfully authenticated.

[0012] The beneficial effects of the above-mentioned further improvement scheme are: by generating the first authentication process configuration file based on the second authentication process configuration file of at least one second smart key that has been successfully authenticated, the automatic generation of the first authentication process configuration file is realized, reducing the difficulty of adapting to new devices.

[0013] A further improvement to the above method, wherein generating the first authentication process configuration file based on the second authentication process configuration file of at least one successfully authenticated second smart key, includes: obtaining the configuration enumeration value in the second authentication process configuration file of the at least one second smart key; repeatedly performing the action of arranging and combining the configuration enumeration value in the second authentication process configuration file of the at least one second smart key to obtain a third authentication process configuration file, until the first smart key is successfully authenticated based on the third authentication process configuration file; and using the third authentication process configuration file that has successfully passed the authentication test as the first authentication process configuration file.

[0014] The beneficial effects of the above-mentioned further improvement scheme are as follows: by obtaining the configuration enumeration value in the second authentication process configuration file of at least one second smart key, repeatedly executing the action of arranging and combining the configuration enumeration value in the second authentication process configuration file of at least one second smart key to obtain the third authentication process configuration file, until the first smart key is successfully authenticated according to the third authentication process configuration file, and using the third authentication process configuration file that has successfully passed the authentication test as the first authentication process configuration file, the generation efficiency of the first authentication process configuration file is improved and the adaptability of the first authentication process configuration file is guaranteed.

[0015] Based on a further improvement to the above method, after performing authentication testing on the first smart password key according to the third authentication process configuration file, the method further includes: modifying the third authentication process configuration file in response to the number of authentication test failures exceeding a preset number.

[0016] The beneficial effect of the above-mentioned further improvement scheme is that by modifying the third authentication process configuration file in response to the number of authentication test failures exceeding the preset number, the generation efficiency of the first authentication process configuration file is further improved.

[0017] Based on a further improvement of the above method, before generating the first authentication process configuration file according to the second authentication process configuration file of at least one successfully authenticated second smart password key, the method further includes: determining the at least one second smart password key according to a preset device priority; wherein, the device priority from high to low includes: the same manufacturer ID but different product ID; different manufacturer ID and different product ID.

[0018] The beneficial effect of the above-mentioned further improvement scheme is that by determining at least one second smart password key according to the preset device priority, the generation efficiency of the first authentication process configuration file is further improved.

[0019] On the other hand, embodiments of the present invention provide a smart password key management device based on the SKF standard. The device includes: a receiving module, configured to: receive a first interface call request for a first management interface when successfully connected to and authenticated with a first smart password key; wherein the first interface call request includes information about a target operation based on the first smart password key; wherein a device handle is generated after the first smart password key is successfully connected; and a processing module, configured to: perform the following operations through the first management interface in response to the first interface call request: if the target operation is a device-level operation, execute the target operation by calling a function to perform the target operation. The target operation is executed using the SKF standard interface. If the target operation is an application-level operation, an application handle is generated by calling the SKF standard interface for generating application handles, the application handle is stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation. If the target operation is a container-level operation, an application handle is generated by calling the SKF standard interface for generating application handles, a container handle is generated by calling the SKF standard interface for generating container handles, the application handle and the container handle are stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation.

[0020] The intelligent password key management device based on the SKF standard provided by this invention enables the execution of target operations through the encapsulated first management interface, reducing the complexity of the interface and providing unified management of the handles used. This provides a solution that benefits developers, reduces development difficulty, improves development convenience and efficiency, and enhances program stability and memory security.

[0021] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the smart password key management method based on the SKF standard as described above.

[0022] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the smart cryptographic key management method based on the SKF standard as described above.

[0023] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the smart password key management method based on the SKF standard as described above.

[0024] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0025] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0026] Figure 1 This is a schematic diagram of the device hierarchy and core interface functions of a USB key;

[0027] Figure 2 This is one of the flowcharts of the smart password key management method based on the SKF standard provided by the present invention;

[0028] Figure 3 This is a schematic diagram illustrating the generation process of the authentication process configuration file in the smart cryptographic key management method based on the SKF standard provided by this invention.

[0029] Figure 4 This is the second flowchart of the smart password key management method based on the SKF standard provided by the present invention;

[0030] Figure 5 This is the third flowchart of the smart password key management method based on the SKF standard provided by the present invention;

[0031] Figure 6 This is a comparison diagram between the smart password key management method based on the SKF standard provided by this invention and the standard SKF process;

[0032] Figure 7 This is a schematic diagram of the structure of the intelligent password key management device based on the SKF standard provided by the present invention;

[0033] Figure 8 A schematic diagram of the physical structure of an electronic device is provided. Detailed Implementation

[0034] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0035] Figure 2 This is one of the flowcharts illustrating the smart password key management method based on the SKF standard provided by this invention. For example... Figure 2As shown, the method includes:

[0036] Step S1: In the state of successfully connecting to and authenticating the first smart key, receive a first interface call request for the first management interface; wherein, the first interface call request includes information on the target operation based on the first smart key; wherein, after the first smart key is successfully connected, a device handle is generated.

[0037] The SKF-based smart key management method provided by this invention can be applied to various devices capable of connecting to smart keys (USB keys) and having data processing capabilities, such as servers, personal computers, and mobile terminals. For ease of description, the device running the SKF-based smart key management method will be referred to as an SKF-based smart key management device, and will be hereinafter simply referred to as a smart key management device.

[0038] This invention, based on the SKF standard interface, encapsulates a new management interface according to actual usage scenarios, reducing interface complexity and providing unified management of the handles used, thus offering a solution beneficial to developers. Furthermore, this method minimizes the need for calls from different manufacturers' USB keys (USB key devices support the SKF standard interface by default). Device management can be completed using only the SKF interface library provided by the manufacturer and the corresponding USB key device, without requiring additional development support from the manufacturer, thus providing a solution beneficial to manufacturers.

[0039] After the smart key management device successfully connects to and authenticates the first smart key, it can support the execution of one or more target operations, depending on the program settings. It can automatically send a first management interface request to the first management interface according to the program settings, or trigger a first interface call request to the first management interface through a preset trigger operation, such as clicking a menu, thereby executing the target operation. When the smart key management device is successfully connected to and authenticated with the first smart key, it receives a first interface call request for the first management interface. The first interface call request includes information about the target operation to be executed. Since a device handle is generated after the smart key management device successfully connects to and authenticates with the first smart key, a device handle is already generated when the smart key management device is successfully connected to and authenticated with the first smart key.

[0040] Step S2: For the first interface call request, perform the following operations through the first management interface:

[0041] If the target operation is a device-level operation, the target operation is executed by calling the SKF standard interface used to execute the target operation;

[0042] If the target operation is an application layer operation, an application handle is generated by calling the SKF standard interface for generating application handles, the application handle is stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation.

[0043] If the target operation is a container layer operation, an application handle is generated by calling the SKF standard interface for generating application handles, a container handle is generated by calling the SKF standard interface for generating container handles, the application handle and the container handle are stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation.

[0044] like Figure 1 As shown, the operation level of the target operation can be determined based on the information of the target operation based on the first smart password key. The operation level of the target operation may be a device-level operation, an application-level operation, or a container-level operation.

[0045] If the target operation is at the device layer, it is executed by calling the corresponding SKF standard interface. If the target operation is at the application layer, an application handle is generated by calling the SKF standard interface for generating application handles, the application handle is stored in memory, and the target operation is executed by calling the corresponding SKF standard interface. If the target operation is at the container layer, an application handle is generated by calling the SKF standard interface for generating application handles, a container handle is generated by calling the SKF standard interface for generating container handles, both the application handle and the container handle are stored in memory, and the target operation is executed by calling the corresponding SKF standard interface.

[0046] The smart key management method based on the SKF standard provided by this invention, in a state where a connection to and authentication of a first smart key is successful, receives a first interface call request for a first management interface. The first interface call request includes information about a target operation based on the first smart key. For the first interface call request, the following operations are performed through the first management interface: if the target operation is at the device layer, the target operation is executed by calling the SKF standard interface used to execute the target operation; if the target operation is at the application layer, an application handle is generated by calling the SKF standard interface used to generate an application handle, the application handle is stored in memory, and then the interface is called... The target operation is executed through the SKF standard interface for executing the target operation. If the target operation is a container layer operation, the application handle is generated by calling the SKF standard interface for generating the application handle, and the container handle is generated by calling the SKF standard interface for generating the container handle. The application handle and container handle are stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation. This achieves the execution of the target operation through the encapsulated first management interface, reducing the complexity of the interface and providing unified management of the handles used. It provides a better solution for developers, reduces development difficulty, improves development convenience and efficiency, and enhances program stability and memory security.

[0047] According to the present invention, a smart password key management method based on the SKF standard is provided. The method further includes: in response to detecting that the connection of the first smart password key is disconnected, sending a second interface call request to a second management interface; wherein the second interface call request includes information about the first smart password key being disconnected; for the second interface call request, performing the following operations through the second management interface: obtaining the current handle generation status; in response to the current generation of the device handle, the application handle, and the container handle, releasing the device handle from memory by calling the SKF standard interface for releasing the device handle, releasing the application handle from memory by calling the SKF standard interface for releasing the application handle, and releasing the container handle from memory by calling the SKF standard interface for releasing the container handle; in response to the current generation of the device handle and the application handle, releasing the device handle from memory by calling the SKF standard interface for releasing the device handle, and releasing the application handle from memory by calling the SKF standard interface for releasing the application handle; in response to the current generation of the device handle, releasing the device handle from memory by calling the SKF standard interface for releasing the device handle.

[0048] If the connection between the first smart key and the terminal device is detected to be disconnected, all handles are automatically released from memory by sending a second interface call request to the second management interface. Since handles generated under different target operations are different, the current handle generation status is obtained. If a device handle, application handle, and container handle are currently generated, it indicates that a container-level target operation has been executed. In this case, the device handle is released from memory by calling the SKF standard interface for releasing device handles, the application handle is released from memory by calling the SKF standard interface for releasing application handles, and the container handle is released from memory by calling the SKF standard interface for releasing container handles. If a device handle and application handle are currently generated, it indicates that an application-level target operation has been executed. In this case, the device handle is released from memory by calling the SKF standard interface for releasing device handles, and the application handle is released from memory by calling the SKF standard interface for releasing application handles. If a device handle is currently generated, it indicates that a device-level target operation has been executed. In this case, the device handle is released from memory by calling the SKF standard interface for releasing device handles.

[0049] The smart key management method based on the SKF standard provided by this invention, in response to the detection of a disconnection of the first smart key, sends a second interface call request to a second management interface. The second interface call request includes information about the disconnection of the first smart key. For the second interface call request, the second management interface performs the following operations: obtains the current handle generation status; in response to the existence of a device handle, application handle, and container handle, it releases the device handle from memory by calling the SKF standard interface for releasing the device handle, and releases the application handle from memory by calling the SKF standard interface for releasing the application handle. By calling the SKF standard interface for releasing container handles from memory, and in response to the existence of device handles and application handles, the SKF standard interface for releasing device handles and application handles is called to release device handles from memory. Similarly, in response to the existence of device handles, the SKF standard interface for releasing device handles is called to release device handles from memory. This enables operations after the smart password key is disconnected via the second management interface, achieving unified management of handle lifecycles and further improving program stability and memory security.

[0050] According to a smart key management method based on the SKF standard provided by the present invention, before receiving a first interface call request for a first management interface, the method further includes: in response to detecting an insertion operation of the first smart key, obtaining device descriptor information of the first smart key; wherein, the device descriptor information includes a vendor ID and a product ID; receiving a third interface call request for a third management interface; wherein, the third interface call request is used to request initialization configuration information; for the third interface call request, performing the following operations through the third management interface: obtaining a first authentication process configuration file corresponding to the vendor ID and the product ID, reading the first authentication process configuration file and loading the SKF standard library, and initializing the memory context; wherein, the SKF standard library includes the SKF standard library. Information from the F standard interface; receiving a fourth interface call request for the fourth management interface; wherein, the fourth interface call request is used to request connection and authentication of the first smart key according to the first authentication process configuration file; for the fourth interface call request, the following operations are performed through the fourth management interface: in response to the device descriptor configuration information in the first authentication process configuration file being consistent with the device descriptor information, connecting the first smart key by calling the SKF standard interface for device connection; after the first smart key is successfully connected, generating the device handle by calling the SKF standard interface for generating the device handle, and storing the device handle in memory; according to the first authentication process configuration file, authenticating the first smart key by calling the SKF standard interface for device authentication.

[0051] Before receiving the first interface call request for the first management interface, it is necessary to establish a connection with the first smart key and successfully authenticate the first smart key.

[0052] To establish a connection with and successfully authenticate the first smart key, it must first be inserted into the smart key management device. If the smart key management device detects the insertion, it retrieves the device descriptor information. This device descriptor information includes details of its various fields, including the vendor ID and product ID. The combination of the vendor ID and product ID theoretically uniquely identifies a specific USB device model.

[0053] Receives third-interface call requests for the third management interface. The order of these calls can be configured within the smart key management program or triggered by user actions. For each third-interface call request, the third management interface performs the following operations: retrieves the first authentication process configuration file corresponding to the vendor ID and product ID, reads the first authentication process configuration file and loads the SKF standard library, and initializes the memory context. The SKF standard library includes information on SKF standard interfaces.

[0054] The system receives a fourth interface call request for the fourth management interface. This request requests connection to and authentication of the first smart key according to the first authentication process configuration file. For this request, the fourth management interface performs the following operations: If the device descriptor configuration information in the first authentication process configuration file matches the device descriptor information, then the connection and authentication operation for the first smart key is performed. This includes connecting the first smart key via the SKF standard interface for device connection, generating a device handle via the SKF standard interface for generating a device handle after successful connection, storing the device handle in memory, and authenticating the first smart key via the SKF standard interface for device authentication according to the first authentication process configuration file. If the device descriptor configuration information in the first authentication process configuration file does not match the device descriptor information, then the connection and authentication operation for the smart key is not performed, i.e., the fourth interface call request is rejected.

[0055] The smart key management method based on the SKF standard provided by this invention, in response to the detection of a first smart key insertion operation, obtains the device descriptor information of the first smart key, which includes a vendor ID and a product ID. It then receives a third interface call request for a third management interface, which requests initialization configuration information. For the third interface call request, the third management interface performs the following operations: obtains a first authentication process configuration file corresponding to the vendor ID and product ID; reads the first authentication process configuration file and loads the SKF standard library; initializes the memory context; the SKF standard library includes information about SKF standard interfaces; and receives a fourth interface call request for a fourth management interface, which requests connection and authentication of the first smart key according to the first authentication process configuration file. The system requests that the following operations be performed through the fourth management interface: In response to the consistency between the device descriptor configuration information and the device descriptor information in the first authentication process configuration file, the system connects to the first smart key by calling the SKF standard interface for device connection. After the first smart key is successfully connected, the system generates a device handle by calling the SKF standard interface for generating device handles, stores the device handle in memory, and performs device authentication on the first smart key by calling the SKF standard interface for device authentication according to the first authentication process configuration file. This achieves the initialization of configuration information through the encapsulated second management interface and the connection and authentication of the smart key through the third management interface, reducing the complexity of the interfaces and providing unified management of the handles used, further improving development convenience and efficiency, as well as enhancing program stability and memory security.

[0056] According to a smart password key management method based on the SKF standard provided by the present invention, before obtaining the first authentication process configuration file corresponding to the manufacturer ID and the product ID, the method further includes: generating the first authentication process configuration file according to the second authentication process configuration file of at least one second smart password key that has been successfully authenticated.

[0057] The authentication algorithms and data used by different manufacturers vary significantly in their device authentication processes. This means that code adapted for one manufacturer's devices cannot be directly applied to devices from other manufacturers. Therefore, in current development practices, modifying the code related to the device authentication process is unavoidable, wasting considerable manpower and time. Device authentication is performed based on an authentication process configuration file, which includes key information such as the device authentication key, device authentication data, and device authentication algorithm.

[0058] Understandably, if a first authentication process configuration file corresponding to the vendor ID and product ID of the first smart key already exists, then the first authentication process configuration file can be directly obtained and used to authenticate the first smart key. If a first authentication process configuration file corresponding to the vendor ID and product ID of the first smart key does not exist, then the first process configuration file needs to be generated in advance.

[0059] This invention generates a first authentication process configuration file based on a second authentication process configuration file of at least one successfully authenticated second smart key, reducing the difficulty of adapting to new devices. The second smart key is used to distinguish it from the first smart key; the second smart key is an already adapted smart key, while the first smart key is a smart key to be adapted. At least one second smart key can include multiple different smart keys.

[0060] The smart password key management method based on the SKF standard provided by this invention generates a first authentication process configuration file by generating a second authentication process configuration file based on a second authentication process configuration file of at least one successfully authenticated second smart password key, thereby achieving automated generation of the first authentication process configuration file and reducing the difficulty of adapting to new devices.

[0061] According to the present invention, a smart key management method based on the SKF standard is provided. The step of generating a first authentication process configuration file based on a second authentication process configuration file of at least one successfully authenticated second smart key includes: obtaining configuration enumeration values ​​from the second authentication process configuration files of the at least one second smart key; repeatedly performing the action of arranging and combining the configuration enumeration values ​​from the second authentication process configuration files of the at least one second smart key to obtain a third authentication process configuration file, until the first smart key is successfully authenticated based on the third authentication process configuration file; and using the successfully authenticated third authentication process configuration file as the first authentication process configuration file.

[0062] When generating the first authentication process configuration file based on the second authentication process configuration file of at least one successfully authenticated second smart key, the configuration enumeration values ​​in the second authentication process configuration files of at least one second smart key are obtained. These configuration enumeration values ​​are then arranged and combined to obtain a third authentication process configuration file. The first smart key is then authenticated using this third authentication process configuration file. If the authentication test is successful, the successfully authenticated third authentication process configuration file is used as the first authentication process configuration file. If the test fails, the process of arranging and combining the configuration enumeration values ​​in the second authentication process configuration files of at least one second smart key to obtain the third authentication process configuration file is repeated until the first smart key successfully completes the authentication test using the third authentication process configuration file. Note that the second authentication process configuration file is only used to distinguish it from the first authentication process configuration file; each second smart key corresponds to a different second authentication process configuration file.

[0063] For example, obtain the authentication process configuration file ConfigA that has been adapted for USBkeyA, USBkeyB, and USBkeyC. ConfigA includes the contents of the authentication process configuration files corresponding to USBkeyA, USBkeyB, and USBkeyC, and is a file obtained by integrating the authentication process configuration files corresponding to USBkeyA, USBkeyB, and USBkeyC.

[0064] The three smart key pairs to be adapted include: USBkeyD, USBkeyE, and USBkeyF (assuming that the three manufacturers have provided corresponding SKF interface libraries and can successfully call their devices through these libraries).

[0065] Generate the authentication process configuration file for the new device according to the following procedure:

[0066] The system retrieves the configuration enumeration values ​​from the authentication process configuration files of USBkeyA, USBkeyB, and USBkeyC. These values ​​are then combined and arranged to obtain the third authentication process configuration file. It's understood that the same configuration enumeration value can be selected from the authentication process configuration files of USBkeyA, USBkeyB, and USBkeyC, but only one of the same configuration enumeration value will be selected.

[0067] The authentication test is performed on USBkeyD using the third authentication process configuration file. If the authentication test is successful, the third authentication process configuration file is used as the authentication process configuration file for USBkeyD. If the authentication test fails, the process of retrieving the configuration enumeration values ​​from the authentication process configuration files of USBkeyA, USBkeyB, and USBkeyC, and then permuting and combining these values ​​to obtain the third authentication process configuration file is repeated until the authentication test on USBkeyD using the third authentication process configuration file is successful.

[0068] The process for obtaining the authentication configuration files for USBkeyE and USBkeyF is the same as for USBkeyD, and will not be repeated here. The contents of the authentication configuration files for USBkeyD, USBkeyE, and USBkeyF can be uniformly written into ConfigB. Of course, the authentication configuration files for different smart keys can also be created as independent files, differing only in their storage format.

[0069] Successful authentication process configuration files can be persistently saved for use in generating authentication process configuration files for new devices.

[0070] Figure 3 This is a schematic diagram illustrating the generation process of the authentication process configuration file in the smart cryptographic key management method based on the SKF standard provided by this invention. The method includes:

[0071] Using the adapted (successfully authenticated) configuration file as a template, generate an authentication process configuration file for the device to be adapted.

[0072] Insert the manufacturer's USB key and test the authentication process configuration file;

[0073] If the test result is unsuccessful, the authentication process configuration file will be regenerated. The number of times this process is repeated can be controlled. Once the threshold is exceeded, the configuration file can be manually modified.

[0074] Output the correct authentication process configuration file.

[0075] Figure 4 This is the second flowchart illustrating the smart password key management method based on the SKF standard provided by this invention. Figure 4 As shown, the method includes:

[0076] Place the generated configuration file ConfigB correctly in the specified location on server ServerA;

[0077] Now suppose we have written a binary program that "creates a container for ECC key pairs" and calls the interface provided by this method.

[0078] Insert the USB keys from the three manufacturers and run the program to create ECC key pairs for USB key devices with specified manufacturers and serial numbers;

[0079] After completing the USB key management of any manufacturer, the device can be directly unplugged. After the interface detects that the device has been unplugged, it will clean up all handles related to the device generated in memory.

[0080] The smart password key management method based on the SKF standard provided by this invention obtains the configuration enumeration value in the second authentication process configuration file of at least one second smart password key, repeatedly executes the action of arranging and combining the configuration enumeration value in the second authentication process configuration file of at least one second smart password key to obtain a third authentication process configuration file, until the first smart password key is successfully authenticated according to the third authentication process configuration file, and uses the third authentication process configuration file that has successfully passed the authentication test as the first authentication process configuration file, thereby improving the generation efficiency of the first authentication process configuration file and ensuring the adaptability of the first authentication process configuration file.

[0081] According to the present invention, a smart password key management method based on the SKF standard, after performing authentication testing on the first smart password key according to the third authentication process configuration file, the method further includes: modifying the third authentication process configuration file in response to the number of authentication test failures exceeding a preset number.

[0082] Obtain the configuration enumeration values ​​from the second authentication process configuration file of at least one second smart key. Arrange and combine these values ​​to obtain a third authentication process configuration file. Perform authentication testing on the first smart key based on the third authentication process configuration file. If the number of authentication test failures exceeds a preset number, the third authentication process configuration file can be manually modified before re-testing the first smart key to expedite the success rate.

[0083] The smart password key management method based on the SKF standard provided by this invention further improves the generation efficiency of the first authentication process configuration file by modifying the third authentication process configuration file in response to the number of authentication test failures exceeding a preset number.

[0084] According to a smart password key management method based on the SKF standard provided by the present invention, before generating the first authentication process configuration file based on the second authentication process configuration file of at least one successfully authenticated second smart password key, the method further includes: determining the at least one second smart password key according to a preset device priority; wherein, the device priority from high to low includes: the same manufacturer ID but different product ID; different manufacturer ID and different product ID.

[0085] Before generating the first authentication process configuration file based on the second authentication process configuration file of at least one second smart key that has been successfully authenticated, at least one second smart key is determined according to a preset device priority.

[0086] It should be noted that at least one second smart key does not necessarily include all the smart keys that have been successfully authenticated. At least one second smart key can be determined based on some of the smart keys that have been successfully authenticated.

[0087] When determining at least one second smart key, the priority of devices, from highest to lowest, includes: those with the same vendor ID but different product IDs; and those with different vendor IDs and different product IDs. For example, at least one second smart key can be constructed by first selecting all or some smart keys that have the same vendor ID as the first smart key but different product IDs.

[0088] If the first authentication process configuration file of the first smart key cannot be obtained based on a smart key with the same manufacturer ID but a different product ID as the first smart key, then at least one second smart key can be constructed by gradually adding smart keys with different manufacturer IDs and product IDs than the first smart key. When arranging and combining the configuration enumeration values ​​in the second authentication process configuration file of at least one second smart key, you can first try to configure the enumeration values ​​to include more information about the second smart key with higher device priority.

[0089] The smart password key management method based on the SKF standard provided by this invention further improves the generation efficiency of the first authentication process configuration file by determining at least one second smart password key according to the preset device priority.

[0090] Figure 5 This is the third flowchart illustrating the smart password key management method based on the SKF standard provided by this invention. Figure 5 As shown, the method includes:

[0091] After the smart password key management program starts running, it reads the authentication process configuration file, loads the SKF standard library, and initializes the memory context;

[0092] Connect the USBKey and authenticate the device, then store the device handle in memory;

[0093] Perform the operation to generate an ECC key pair, and store the resulting application handle and container handle into memory;

[0094] After detecting that the smart password key has been withdrawn, release the memory space of the device handle, application handle, and container handle in memory.

[0095] This management program code does not need to explicitly manage the three types of handles in the SKF standard, because they are managed uniformly in memory. When they need to be released, they will be released and destroyed in a unified manner, avoiding potential memory leak problems.

[0096] Figure 6 This is a comparison diagram between the smart password key management method based on the SKF standard provided by this invention and the standard SKF process. (See diagram for example.) Figure 6 As shown, the right side is a flowchart of the smart password key management method based on the SKF standard provided by this invention. Each flowchart can be implemented as an encapsulated management interface, and the left side is a standard SKF flowchart. This invention is based on the SKF standard interface and encapsulates the management interface according to actual business needs. Specifically, the interface is encapsulated for device connection authentication, execution of target operations, and post-device removal processing, reducing the complexity of the interface and providing unified management of the handles used, thus offering a beneficial solution for developers.

[0097] The following describes the smart password key management device based on the SKF standard provided by the present invention. The smart password key management device based on the SKF standard described below can be referred to in correspondence with the smart password key management method based on the SKF standard described above.

[0098] Figure 7 This is a schematic diagram of the intelligent password key management device based on the SKF standard provided by the present invention. Figure 7 As shown, the device includes a receiving module 10 and a processing module 20, wherein:

[0099] The receiver 10 is configured to: receive a first interface call request for a first management interface when the connection to the first smart key is successful and the authentication of the first smart key is successful; wherein the first interface call request includes information on a target operation based on the first smart key; wherein a device handle is generated after the first smart key is successfully connected;

[0100] The processing module 20 is configured to: for the first interface call request, perform the following operations through the first management interface: if the operation level of the target operation is a device layer operation, execute the target operation by calling the SKF standard interface for executing the target operation; if the operation level of the target operation is an application layer operation, generate an application handle by calling the SKF standard interface for generating an application handle, store the application handle in memory, and execute the target operation by calling the SKF standard interface for executing the target operation; if the operation level of the target operation is a container layer operation, generate an application handle by calling the SKF standard interface for generating an application handle, generate a container handle by calling the SKF standard interface for generating a container handle, store the application handle and the container handle in memory, and execute the target operation by calling the SKF standard interface for executing the target operation.

[0101] The smart key management device based on the SKF standard provided by this invention, upon successful connection and authentication with a first smart key, receives a first interface call request for a first management interface. The first interface call request includes information about a target operation based on the first smart key. After successful connection, a device handle is generated by the first smart key. For the first interface call request, the following operations are performed through the first management interface: if the target operation is at the device layer, the target operation is executed by calling the SKF standard interface used to execute the target operation; if the target operation is at the application layer, an application handle is generated by calling the SKF standard interface used to generate an application handle, and the application handle is stored... The data is stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation. If the target operation is a container layer operation, an application handle is generated by calling the SKF standard interface for generating application handles, and a container handle is generated by calling the SKF standard interface for generating container handles. The application handle and container handle are stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation. This achieves the execution of the target operation through the encapsulated first management interface, reducing the complexity of the interface and providing unified management of the handles used. It provides a better solution for developers, reduces development difficulty, improves development convenience and efficiency, and enhances program stability and memory security.

[0102] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8As shown, the electronic device may include: a processor 810, a communications interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communications interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a smart key management method based on the SKF standard. This method includes: receiving a first interface call request for a first management interface when successfully connected to and authenticated with a first smart key; wherein the first interface call request includes information about a target operation based on the first smart key; wherein a device handle is generated after the first smart key is successfully connected; and for the first interface call request, performing the following operations through the first management interface: if the operation level of the target operation is a device-level operation, by calling a function to execute the target operation... The SKF standard interface executes the target operation. If the target operation is an application-level operation, an application handle is generated by calling the SKF standard interface for generating application handles, the application handle is stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation. If the target operation is a container-level operation, an application handle is generated by calling the SKF standard interface for generating application handles, a container handle is generated by calling the SKF standard interface for generating container handles, the application handle and the container handle are stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation.

[0103] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0104] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program, the computer program being able to be stored on a non-transitory computer-readable storage medium, the computer program being executed by a processor, the computer being able to execute the smart password key management method based on the SKF standard provided by the above methods, the method including: receiving a first interface call request for a first management interface in a state where a connection with a first smart password key is successful and authentication of the first smart password key is successful; wherein the first interface call request includes information on a target operation based on the first smart password key; wherein a device handle is generated after the first smart password key is successfully connected; and for the first interface call request, performing the following operation through the first management interface: if If the target operation is at the device layer, it is executed by calling the SKF standard interface for executing the target operation. If the target operation is at the application layer, it is executed by calling the SKF standard interface for generating application handles, storing the application handles in memory, and then executing the target operation by calling the SKF standard interface for executing the target operation. If the target operation is at the container layer, it is executed by calling the SKF standard interface for generating application handles and the SKF standard interface for generating container handles, storing both the application handles and the container handles in memory, and then executing the target operation by calling the SKF standard interface for executing the target operation.

[0105] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the smart key management method based on the SKF standard provided by the methods described above. The method includes: receiving a first interface call request for a first management interface in a state where a connection to and authentication of a first smart key is successful; wherein the first interface call request includes information about a target operation based on the first smart key; wherein a device handle is generated after the first smart key is successfully connected; and performing the following operation through the first management interface for the first interface call request: if the operation level of the target operation is a device... The target operation is executed by calling the SKF standard interface for executing the target operation. If the operation level of the target operation is an application layer operation, an application handle is generated by calling the SKF standard interface for generating application handles, the application handle is stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation. If the operation level of the target operation is a container layer operation, an application handle is generated by calling the SKF standard interface for generating application handles, a container handle is generated by calling the SKF standard interface for generating container handles, the application handle and the container handle are stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation.

[0106] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0107] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0108] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0109] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0110] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A smart password key management method based on the SKF standard, characterized in that, include: When the connection to the first smart key is successful and the authentication of the first smart key is successful, a first interface call request for the first management interface is received; wherein, the first interface call request includes information on the target operation based on the first smart key; wherein, after the first smart key is successfully connected, a device handle is generated; For the first interface call request, the following operations are performed through the first management interface: If the target operation is a device-level operation, the target operation is executed by calling the SKF standard interface used to execute the target operation; If the target operation is an application layer operation, an application handle is generated by calling the SKF standard interface for generating application handles, the application handle is stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation. If the target operation is a container layer operation, an application handle is generated by calling the SKF standard interface for generating an application handle, a container handle is generated by calling the SKF standard interface for generating a container handle, the application handle and the container handle are stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation. The method further includes: In response to detecting that the connection of the first smart key has been disconnected, a second interface call request is sent to the second management interface; wherein the second interface call request includes information about the disconnection of the first smart key; For the second interface call request, the following operations are performed through the second management interface: Get the current handle creation status; In response to the existence of the device handle, the application handle, and the container handle, the device handle is released from memory by calling the SKF standard interface for releasing the device handle, the application handle is released from memory by calling the SKF standard interface for releasing the application handle, and the container handle is released from memory by calling the SKF standard interface for releasing the container handle. In response to the existence of the device handle and the application handle, the device handle is released from memory by calling the SKF standard interface for releasing the device handle, and the application handle is released from memory by calling the SKF standard interface for releasing the application handle. In response to the existence of the device handle, the device handle is released from memory by calling the SKF standard interface for releasing device handles.

2. The smart password key management method based on the SKF standard according to claim 1, characterized in that, Before receiving the first interface call request for the first management interface, the method further includes: In response to detecting the insertion operation of the first smart key, the device descriptor information of the first smart key is obtained; wherein, the device descriptor information includes a manufacturer ID and a product ID; Receive a third interface call request for the third management interface; wherein the third interface call request is used to request initialization configuration information; For the third interface call request, the following operations are performed through the third management interface: obtain the first authentication process configuration file corresponding to the vendor ID and the product ID, read the first authentication process configuration file and load the SKF standard library, and initialize the memory context; wherein, the SKF standard library includes information about the SKF standard interface; Receive a fourth interface call request for the fourth management interface; wherein, the fourth interface call request is used to request connection and authentication of the first smart password key according to the first authentication process configuration file; For the fourth interface call request, the following operations are performed through the fourth management interface: In response to the device descriptor configuration information in the first authentication process configuration file being consistent with the device descriptor information, the first smart key is connected by calling the SKF standard interface for device connection; after the first smart key is successfully connected, the device handle is generated by calling the SKF standard interface for generating device handles, and the device handle is stored in memory; according to the first authentication process configuration file, the first smart key is authenticated by calling the SKF standard interface for device authentication.

3. The smart password key management method based on the SKF standard according to claim 2, characterized in that, Before obtaining the first authentication process configuration file corresponding to the vendor ID and the product ID, the method further includes: The first authentication process configuration file is generated based on the second authentication process configuration file of at least one second smart key that has been successfully authenticated.

4. The smart password key management method based on the SKF standard according to claim 3, characterized in that, The step of generating the first authentication process configuration file based on the second authentication process configuration file of at least one successfully authenticated second smart key includes: Obtain the configuration enumeration value in the second authentication process configuration file of the at least one second smart password key; Repeatedly execute the action of arranging and combining the configuration enumeration values ​​in the second authentication process configuration file of the at least one second smart key to obtain a third authentication process configuration file, until the first smart key is successfully authenticated according to the third authentication process configuration file. The third authentication process configuration file that has successfully passed the authentication test is used as the first authentication process configuration file.

5. The smart password key management method based on the SKF standard according to claim 4, characterized in that, After performing the authentication test on the first smart password key according to the third authentication process configuration file, the method further includes: If the number of authentication test failures exceeds a preset number, the configuration file for the third authentication process will be modified.

6. The smart password key management method based on the SKF standard according to claim 3, characterized in that, Before generating the first authentication process configuration file based on the second authentication process configuration file of at least one successfully authenticated second smart key, the method further includes: The at least one second smart password key is determined according to a preset device priority; wherein, the device priority from high to low includes: the same manufacturer ID but different product ID; different manufacturer ID and different product ID.

7. A smart password key management device based on the SKF standard, characterized in that, include: The receiving module is configured to: receive a first interface call request for a first management interface when the connection with the first smart key is successful and the authentication of the first smart key is successful; wherein the first interface call request includes information on a target operation based on the first smart key; wherein a device handle is generated after the first smart key is successfully connected; The processing module is configured to: for the first interface call request, perform the following operations through the first management interface: If the target operation is a device-level operation, the target operation is executed by calling the SKF standard interface used to execute the target operation; If the target operation is an application layer operation, an application handle is generated by calling the SKF standard interface for generating application handles, the application handle is stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation. If the target operation is a container layer operation, an application handle is generated by calling the SKF standard interface for generating an application handle, a container handle is generated by calling the SKF standard interface for generating a container handle, the application handle and the container handle are stored in memory, and the target operation is executed by calling the SKF standard interface for executing the target operation. The processing module is further configured to: in response to detecting the disconnection of the first smart key, send a second interface call request to the second management interface; wherein the second interface call request includes information about the disconnection of the first smart key; For the second interface call request, the following operations are performed through the second management interface: Get the current handle creation status; In response to the existence of the device handle, the application handle, and the container handle, the device handle is released from memory by calling the SKF standard interface for releasing the device handle, the application handle is released from memory by calling the SKF standard interface for releasing the application handle, and the container handle is released from memory by calling the SKF standard interface for releasing the container handle. In response to the existence of the device handle and the application handle, the device handle is released from memory by calling the SKF standard interface for releasing the device handle, and the application handle is released from memory by calling the SKF standard interface for releasing the application handle. In response to the existence of the device handle, the device handle is released from memory by calling the SKF standard interface for releasing device handles.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the smart password key management method based on the SKF standard as described in any one of claims 1 to 6.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the smart password key management method based on the SKF standard as described in any one of claims 1 to 6.

Images