Password strategy updating method, device and system, electronic equipment and storage medium

Abstract

The invention discloses a password policy updating method, device and system, electronic equipment and a storage medium, and relates to the technical field of network security, the method comprises the following steps: in response to a received target password policy message, updating a first local password suite library based on a target password policy to obtain an updated first local password suite library; wherein the target password strategy message comprises newly added, modified or forbidden password suite information; starting a new service process based on the updated first local cipher suite library; and sending the update message containing the target password policy to the client, thereby realizing flexible adjustment and instant effectiveness of the target password policy, avoiding terminating an old service process, restarting a system or disconnecting original connection communication, avoiding service data interruption, quickly responding to a security demand, and improving the dynamic instant update capability of the target password policy.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of network security, and particularly relates to a password policy updating method and device, system, electronic equipment and storage medium. BACKGROUND

[0002] With the rapid development of Internet technology, password technology, as an important foundation of the network security system, is widely used in communication, finance, cloud computing and other industries. In particular, in the 5G communication network, the communication security between network functions (NF) mainly relies on the Transport Layer Security (TLS) protocol to achieve encryption protection. The TLS protocol builds a key agreement mechanism, establishes a secure data transmission channel, and forms an end-to-end data encryption and integrity protection system.

[0003] Since updating the password policy will depend on the termination of the service process or system restart, it is necessary to actively disconnect the secure connection or establish a new connection. This method may cause business interruption, prolonged exposure of security vulnerabilities, and other problems. Therefore, how to improve the dynamic and instant updating capability of the password policy is a problem that needs to be solved at present. SUMMARY

[0004] The present disclosure provides a password policy updating method and device, system, electronic equipment and storage medium to solve the problems in the related art, which realizes flexible adjustment and instant effect of the target password policy, without terminating the old service process, restarting the system or disconnecting the original connection communication, avoids business data interruption, quickly responds to security needs, and improves the dynamic and instant updating capability of the target password policy.

[0005] According to a first aspect of the present disclosure, a password policy updating method is provided, wherein the method is applied to a server and includes:

[0006] In response to the received target password policy message, updating a first local password suite library based on the target password policy to obtain an updated first local password suite library; wherein the target password policy message includes added, modified or disabled password suite information;

[0007] Starting a new service process based on the updated first local password suite library;

[0008] Sending an update message containing the target password policy to a client.

[0009] In some embodiments of the present disclosure, the updating of the first local password suite library based on the target password policy to obtain the updated first local password suite library includes:

[0010] In response to the first local cipher suite library not supporting a target cipher suite, sending request information for obtaining the target cipher suite; wherein the target cipher suite is a cipher suite corresponding to the target cipher policy;

[0011] updating the first local cipher suite library based on the received target cipher suite and the corresponding target cipher policy, to obtain an updated first local cipher suite library.

[0012] In some embodiments of the present disclosure, the updating of the first local cipher suite library based on the received target cipher suite and the corresponding target cipher policy, to obtain an updated first local cipher suite library, comprises:

[0013] receiving a cipher suite library file corresponding to the target cipher suite;

[0014] updating the first local cipher suite library based on the cipher suite library file and the target cipher policy, to obtain an updated first local cipher suite library.

[0015] In some embodiments of the present disclosure, the starting of the new service process based on the updated first local cipher suite library comprises:

[0016] starting the new service process based on the updated first local cipher suite library in a preset hot loading manner.

[0017] In some embodiments of the present disclosure, the updating of the first local cipher suite library based on the target cipher policy, to obtain an updated first local cipher suite library, comprises:

[0018] determining whether the target cipher policy is consistent with a cipher policy in the first local cipher suite library;

[0019] In response to the target cipher policy being inconsistent with the cipher policy in the first local cipher suite library, updating the original cipher policy in the first local cipher suite library using the target cipher policy.

[0020] In some embodiments of the present disclosure, the starting of the new service process based on the updated first local cipher suite library comprises:

[0021] starting the new service process based on the target cipher policy in a preset hot loading manner.

[0022] According to a second aspect of the present disclosure, a cipher policy updating method is provided, wherein the method is applied to a client and comprises:

[0023] In response to receiving the update message containing the target cipher policy, updating the second local cipher suite library based on the target cipher policy to obtain an updated second local target cipher suite library;

[0024] Based on the updated second local target cipher suite library, starting a new service process.

[0025] In some embodiments of the present disclosure, in response to receiving the update information of the cipher policy sent by the server, based on the update information, determining whether to support a target cipher suite in the target cipher policy, further comprising:

[0026] In response to supporting the target cipher suite, based on the target cipher policy and the second local target cipher suite library, starting the new service process.

[0027] In some embodiments of the present disclosure, the updating of the second local cipher suite library based on the target cipher policy to obtain the updated second local target cipher suite library comprises:

[0028] In response to the second local cipher suite library not supporting the target cipher suite, sending request information for obtaining the target cipher suite;

[0029] Based on the received target cipher suite and the corresponding target cipher policy, updating the second local cipher suite library to obtain the updated second local cipher suite library.

[0030] In some embodiments of the present disclosure, the updating of the second local cipher suite library based on the received target cipher suite and the corresponding target cipher policy to obtain the updated second local cipher suite library comprises:

[0031] Receiving a cipher suite library file corresponding to the target cipher suite;

[0032] Based on the cipher suite library file and the target cipher policy, updating the second local cipher suite library to obtain the updated second local cipher suite library.

[0033] In some embodiments of the present disclosure, after starting the new service process based on the updated second local target cipher suite library, further comprising:

[0034] Based on the second local target cipher suite library that has not been updated, maintaining original connection communication with the server;

[0035] Based on the target cipher policy in the updated second local target cipher suite library, establishing new connection communication with the server;

[0036] migrating the service data from the original connection communication to the new connection communication;

[0037] after the service data migration is completed, closing the original connection communication with the server.

[0038] According to a third aspect of the present disclosure, a method for updating a password policy is provided, wherein the method is applied to a password policy management platform, and the method comprises:

[0039] sending a target password policy message to a server, so that the server updates a first local password suite library based on the target password policy, obtains an updated first local password suite library, and starts a new service process based on the updated first local password suite library;

[0040] The target password policy message comprises information of a newly added, modified or disabled password suite.

[0041] In some embodiments of the present disclosure, the method further comprises:

[0042] In response to the received request information for obtaining the target password suite corresponding to the target password policy sent by the server, sending a password suite library file corresponding to the target password suite to the server.

[0043] In some embodiments of the present disclosure, the method further comprises:

[0044] In response to the received request information for obtaining the target password suite corresponding to the target password policy sent by the client, sending a password suite library file corresponding to the target password suite to the client.

[0045] According to a fourth aspect of the present disclosure, an updating device for a password policy is provided, wherein the device is applied to a server, and the device comprises:

[0046] a first updating unit, configured to update a first local password suite library based on a target password policy in response to a received target password policy message, and obtain an updated first local password suite library; the target password policy message comprises information of a newly added, modified or disabled password suite;

[0047] a first starting unit, configured to start a new service process based on the updated first local password suite library;

[0048] a first sending unit, configured to send an updating message containing the target password policy to a client.

[0049] In some embodiments of the present disclosure, the first updating unit comprises:

[0050] The first sending module is configured to send request information for obtaining a target cryptographic suite in response to the first local cryptographic suite library not supporting the target cryptographic suite, wherein the target cryptographic suite is a cryptographic suite corresponding to the target cryptographic policy.

[0051] The first updating module is configured to update the first local cryptographic suite library based on the received target cryptographic suite and corresponding target cryptographic policy, to obtain the updated first local cryptographic suite library.

[0052] In some embodiments of the present disclosure, the first updating module comprises:

[0053] The first receiving submodule is configured to receive a cryptographic suite library file corresponding to the target cryptographic suite.

[0054] The first updating submodule is configured to update the first local cryptographic suite library based on the cryptographic suite library file and the target cryptographic policy, to obtain the updated first local cryptographic suite library.

[0055] In some embodiments of the present disclosure, the first starting unit comprises:

[0056] The first starting module is configured to start the new service process in a preset hot loading mode based on the updated first local cryptographic suite library.

[0057] In some embodiments of the present disclosure, the first updating unit further comprises:

[0058] The judging module is configured to judge whether the target cryptographic policy is consistent with a cryptographic policy in the first local cryptographic suite library.

[0059] The second updating module is configured to update an original cryptographic policy in the first local cryptographic suite library using the target cryptographic policy in response to the target cryptographic policy being inconsistent with the cryptographic policy in the first local cryptographic suite library.

[0060] In some embodiments of the present disclosure, the first starting unit further comprises:

[0061] The second starting module is configured to start the new service process in a preset hot loading mode based on the target cryptographic policy.

[0062] According to a fifth aspect of the present disclosure, an updating device of a cryptographic policy is provided, which is applied to a client and comprises:

[0063] The second updating unit is configured to update a second local cryptographic suite library based on a target cryptographic policy in response to receiving an updating message containing the target cryptographic policy, to obtain an updated second local target cryptographic suite library.

[0064] The second starting unit is configured to start a new service process based on the updated second local target cipher suite library.

[0065] In some embodiments of the present disclosure, the apparatus further comprises a judging unit;

[0066] The judging unit is configured to start the new service process based on the target cipher policy and the second local target cipher suite library in response to supporting the target cipher suite.

[0067] In some embodiments of the present disclosure, the second updating unit comprises:

[0068] The second sending module is configured to send request information for obtaining the target cipher suite in response to the second local cipher suite library not supporting the target cipher suite.

[0069] The third updating module is configured to update the second local cipher suite library based on the received target cipher suite and corresponding target cipher policy, to obtain the updated second local cipher suite library.

[0070] In some embodiments of the present disclosure, the third updating module comprises:

[0071] The second receiving submodule is configured to receive a cipher suite library file corresponding to the target cipher suite.

[0072] The second updating submodule is configured to update the second local cipher suite library based on the cipher suite library file and the target cipher policy, to obtain the updated second local cipher suite library.

[0073] In some embodiments of the present disclosure, the apparatus further comprises:

[0074] The communication unit is configured to maintain original connection communication with a server based on an un-updated second local target cipher suite library after the second starting unit starts a new service process based on the updated second local target cipher suite library.

[0075] The establishing unit is configured to establish new connection communication with the server based on the target cipher policy in the updated second local target cipher suite library.

[0076] The migration unit is configured to migrate service data from the original connection communication to the new connection communication.

[0077] The closing unit is configured to close the original connection communication with the server after the service data migration is completed.

[0078] According to a sixth aspect of the present disclosure, an updating device of a password policy is provided, the device is applied to a password policy management platform, and comprises:

[0079] a third updating unit configured to send a target password policy message to a server, so that the server updates a first local password suite library based on the target password policy, and obtains an updated first local password suite library;

[0080] a third starting unit configured to start a new service process based on the updated first local password suite library;

[0081] The target password policy message comprises added, modified or disabled password suite information.

[0082] In some embodiments of the present disclosure, the device further comprises:

[0083] a second sending unit configured to, in response to the received request information for obtaining the target password suite corresponding to the target password policy sent by the server, send a password suite library file corresponding to the target password suite to the server.

[0084] In some embodiments of the present disclosure, the device further comprises:

[0085] a third sending unit configured to, in response to the received request information for obtaining the target password suite corresponding to the target password policy sent by the client, send a password suite library file corresponding to the target password suite to the client.

[0086] According to a seventh aspect of the present disclosure, an updating system of a password policy is provided, the system comprises a password policy management platform, a server and a client, and comprises:

[0087] The password policy management platform comprises the updating device of the password policy as described in the sixth aspect of the present disclosure;

[0088] The server comprises the updating device of the password policy as described in the fourth aspect of the present disclosure;

[0089] The client comprises the updating device of the password policy as described in the fifth aspect of the present disclosure.

[0090] According to an eighth aspect of the present disclosure, an electronic device is provided, comprising:

[0091] at least one processor; and

[0092] a memory connected with the at least one processor in communication; wherein

[0093] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of the first aspect embodiment or the method of the second aspect embodiment or the method of the third aspect embodiment.

[0094] According to a ninth aspect embodiment of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to perform the method of the first aspect embodiment or the method of the second aspect embodiment or the method of the third aspect embodiment.

[0095] According to a tenth aspect embodiment of the present disclosure, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the method of the first aspect embodiment or the method of the second aspect embodiment or the method of the third aspect embodiment.

[0096] In summary, according to the updating method and device, system, electronic device and storage medium of the cryptographic policy provided by the present disclosure, the method comprises: in response to a received target cryptographic policy message, updating a first local cryptographic suite library based on a target cryptographic policy to obtain an updated first local cryptographic suite library; wherein the target cryptographic policy message includes added, modified or disabled cryptographic suite information; starting a new service process based on the updated first local cryptographic suite library; and sending an update message containing the target cryptographic policy to a client, which realizes flexible adjustment and instant effect of the target cryptographic policy, without terminating an old service process, restarting a system or disconnecting an original connection communication, avoids business data interruption, quickly responds to security requirements, and improves the dynamic and instant updating capability of the target cryptographic policy.

[0097] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present application, nor to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0098] The accompanying drawings are used to better understand the present scheme and do not limit the present disclosure. Among them:

[0099] Figure 1 A flowchart of an updating method of a cryptographic policy provided by an embodiment of the present disclosure;

[0100] Figure 2 A flowchart of another updating method of a cryptographic policy provided by an embodiment of the present disclosure;

[0101] Figure 3Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0102] Figure 4 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0103] Figure 5 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0104] Figure 6 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0105] Figure 7 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0106] Figure 8 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0107] Figure 9 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0108] Figure 10 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0109] Figure 11 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0110] Figure 12 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0111] Figure 13 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0112] Figure 14 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0113] Figure 15 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0114] Figure 16 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0115] Figure 17 Another flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown in FIG. 6;

[0116] Figure 18 Schematic block diagram of an example electronic device provided for embodiments of the present disclosure. DETAILED DESCRIPTION

[0117] Exemplary embodiments of the present disclosure are described below with reference to the accompanying drawings, which include various details of the embodiments of the present disclosure to assist in understanding them. These should be considered as merely exemplary, however, and therefore, it will be appreciated that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Also, for the sake of brevity and clarity, descriptions of well-known functions and constructions are omitted from the following description.

[0118] With the rapid development of Internet technology, cryptography technology, as an important foundation of the network security system, is widely used in communication, finance, cloud computing and other industries. In particular, in the 5G communication network, the communication security between network functions (NF) mainly relies on the Transport Layer Security (TLS) protocol to achieve encryption protection. The TLS protocol builds a key agreement mechanism, establishes a secure data transmission channel, and forms an end-to-end data encryption and integrity protection system.

[0119] Since updating the password policy will depend on the termination of the service process or system restart, it is necessary to actively disconnect the secure connection or establish a new connection. This method may cause business interruption, prolonged exposure of security vulnerabilities, and other problems. Therefore, how to improve the dynamic and instant updating capability of the password policy is a problem that needs to be solved at present.

[0120] Therefore, in order to solve the problems in the related art, the present disclosure provides a password policy updating method, which comprises: in response to a received target password policy message, updating a first local password suite library based on the target password policy to obtain an updated first local password suite library; wherein the target password policy message includes added, modified or disabled password suite information; starting a new service process based on the updated first local password suite library; and sending an update message containing the target password policy to the client, which realizes flexible adjustment and instant effect of the target password policy, without terminating the old service process, restarting the system or disconnecting the original connection communication, avoiding business data interruption, quickly responding to security needs, and improving the dynamic and instant updating capability of the target password policy.

[0121] The embodiments of the present disclosure are not exhaustive, but only illustrate some embodiments, and are not specific limitations on the protection scope of the present disclosure. In the case of no contradiction, each step in an embodiment can be implemented as an independent embodiment, and the steps can be combined arbitrarily, for example, the scheme after removing part of the steps in an embodiment can also be implemented as an independent embodiment, and the order of the steps in an embodiment can be exchanged arbitrarily, in addition, the optional implementation manners in an embodiment can be combined arbitrarily; in addition, the embodiments can be combined arbitrarily, for example, part or all steps of different embodiments can be combined arbitrarily, an embodiment can be combined with optional implementation manners of other embodiments.

[0122] In various embodiments of the present disclosure, the terms and / or descriptions between the embodiments are consistent if there is no special description and logical conflict, and can be referred to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0123] The terms used in the embodiments of the present disclosure are only for the purpose of describing the specific embodiments, and not as a limitation on the present disclosure.

[0124] In the embodiments of the present disclosure, unless otherwise specified, the elements expressed in singular form, such as "one", "a", "the", "above", "said", "preceding", "this" and the like, can represent "one and only one", or "one or more", "at least one" and the like. For example, in the case of using articles such as "a", "an", "the" and the like in English, the noun after the article can be understood as singular expression, or can be understood as plural expression.

[0125] In some embodiments, the terms "in response to", "in response to determining", "in the case of", "when", "when", "if", "if" and the like can be replaced with each other.

[0126] In some embodiments, the terms "greater than", "greater than or equal to", "not less than", "more than", "more than or equal to", "not less than", "higher than", "higher than or equal to", "not lower than", "above" and the like can be replaced with each other, and the terms "less than", "less than or equal to", "not greater than", "less than", "less than or equal to", "not more than", "lower than", "lower than or equal to", "not higher than", "below" and the like can be replaced with each other.

[0127] The prefix of "first", "second", and the like in the embodiments of the present disclosure are merely used to distinguish different description objects, and do not constitute limitation on the position, order, priority, quantity, or content of the description objects. The description of the description objects should refer to the description in the context of the claims or embodiments, and should not constitute redundant limitation because of the use of the prefix.

[0128] In the embodiments of the present disclosure, "a plurality of" refers to two or more.

[0129] In the embodiments of the present disclosure, the terms of "import", "input", "read in", and the like can be replaced with each other.

[0130] In some embodiments, the apparatus and the like can be interpreted as entities, and can also be interpreted as virtual, and the name thereof is not limited to the name recorded in the embodiments. The terms of "apparatus", "equipment", "device", "circuit", "network element", "node", "function", "unit", "section", "system", "network", "chip", "chip system", "entity", "subject", and the like can be replaced with each other.

[0131] In some embodiments, the terms of "terminal", "terminal device", "user equipment", "user terminal", "mobile station", "mobile terminal", "mobile unit", "subscriber unit", "wireless unit", "remote unit", "mobile device", "wireless device", "wireless communication device", "remote device", "mobile subscriber station", "access terminal", "mobile terminal", "wireless terminal", "remote terminal", "handset", "user agent", "mobile client", "client", and the like can be replaced with each other.

[0132] The updating method and device of the password policy, the system, the electronic device and the storage medium are described below with reference to the accompanying drawings.

[0133] Figure 1 A flowchart of the updating method of the password policy provided by the embodiments of the present disclosure is shown in FIG. 1. Figure 1 As shown in FIG. 1, the method is applied to a server, and the updating method of the password policy comprises steps 101-103.

[0134] In step 101, a first local password suite library is updated based on a target password policy in response to a received target password policy message, to obtain an updated first local password suite library; wherein the target password policy message comprises information of added, modified or disabled password suites.

[0135] When the server receives the message of the target password policy, the server updates the first local password suite library stored locally according to the target password policy, and obtains the first local password suite library after the update. The target password policy message may include but is not limited to added password suites (such as added post-quantum cryptography algorithm suites), modified priority of password suites (such as adjusted priority of post-quantum cryptography algorithms), disabled password suites (disabled password suites with security risks), and the like. The password suite is equivalent to a tool kit for encryption. The server performs the update operation according to the target password policy message, and obtains the updated first local password suite library. The first local password suite library is updated to ensure that the configuration of the local password suite library is consistent with the target password policy.

[0136] In step 102, a new service process is started based on the updated first local password suite library.

[0137] After the update of the local password suite library (i.e., the formation of the first local password suite library), the server starts a new service process based on the first local password suite library. The new service process is used to indicate that the target password policy can actually take effect, to ensure that the new service process processes the subsequent newly initiated connection request according to the target password policy, while the old service process that is running continues to maintain the established connection request. In this way, the business continuity is ensured, and the target password policy is implemented in real time.

[0138] In step 103, an update message containing the target password policy is sent to the client.

[0139] Through the established secure connection between the server and the client, the server sends the update message of the target password policy to the client. The client then obtains the specific content of the target password policy, ensuring that the client obtains the latest password policy (target password policy) in real time. This provides a direct information transmission approach for the synchronization of the password policy between the client and the server.

[0140] In some embodiments, the server can be a server supporting a secure connection protocol, etc., or can be a security gateway supporting a secure connection protocol, the client can be a browser supporting a secure connection protocol, etc., or can be a security gateway supporting a secure connection protocol, and the specific embodiments are not limited.

[0141] In summary, the method for updating a password policy provided by the present disclosure includes: in response to a received target password policy message, updating a first local password suite library based on a target password policy to obtain an updated first local password suite library; wherein the target password policy message includes added, modified, or disabled password suite information; starting a new service process based on the updated first local password suite library; and sending an update message containing the target password policy to a client, which realizes flexible adjustment and immediate effect of the target password policy, without terminating an old service process, restarting the system, or disconnecting the original connection communication, thereby avoiding business data interruption, quickly responding to security requirements, and improving the dynamic and immediate updating capability of the target password policy.

[0142] Figure 2 Further, a flowchart of a method for updating a password policy provided by an embodiment of the present disclosure is shown. Based on the embodiment shown in Figure 1 The step 101 is further explained, Figure 2 may include the following steps:

[0143] Step 201, in response to the first local password suite library not supporting a target password suite, sending request information for obtaining the target password suite; wherein the target password suite is a password suite corresponding to the target password policy.

[0144] When the server detects that the first local password suite library does not support a target password suite corresponding to a target password policy, the server sends request information to a password policy management platform to obtain the target password suite, the target password suite is a password suite corresponding to the target password policy, and the sent request information includes but is not limited to an identifier of the target password suite, device information, etc., wherein the password policy management platform is responsible for management of the target password policy, distribution of the target password policy, updating of the local password suite, etc.

[0145] Step 202, updating the first local password suite library based on the received target password suite and corresponding target password policy to obtain the updated first local password suite library.

[0146] The server updates the first local cryptographic suite library based on the received target cryptographic suite and the corresponding target cryptographic policy, adds the received target cryptographic suite to a specified path of the first local cryptographic suite library, so that the target cryptographic suite becomes a callable resource in the library; at the same time, the configuration information in the first local cryptographic suite library is synchronously updated according to the requirements of the target cryptographic policy, and the first local cryptographic suite library that does not support the target cryptographic suite is updated to a state capable of meeting the requirements of the target cryptographic policy, that is, an updated first local cryptographic suite library is formed.

[0147] Figure 3 Further, a flowchart of a cryptographic policy updating method provided by the embodiments of the present disclosure is shown. Based on the embodiments shown in the figure, step 202 is further explained. Figure 2 Figure 3 may include the following steps:

[0148] Step 301, receiving a cryptographic suite library file corresponding to the target cryptographic suite.

[0149] When the server sends a request to obtain a target cryptographic suite to the cryptographic policy management platform, the cryptographic policy management platform packages a cryptographic suite library file corresponding to the target cryptographic suite, and the server receives the cryptographic suite library file sent by the cryptographic policy management platform. The cryptographic suite library file is a carrier for implementing the function of the target cryptographic suite. For example, for a target cryptographic suite of post-quantum cryptography algorithm, the corresponding cryptographic suite library file includes but is not limited to key generation, encryption, decryption and configuration parameter data of post-quantum cryptography algorithm, etc.

[0150] Step 302, updating the first local cryptographic suite library based on the cryptographic suite library file and the target cryptographic policy, to obtain the updated first local cryptographic suite library.

[0151] In the process of updating the first local cryptographic suite library, the server performs integrity check on the received cryptographic suite library file, and after the check is completed, stores the cryptographic suite library file under a directory of the first local cryptographic suite library. The directory is used to store all available cryptographic suite library files. The server parses the target cryptographic policy and updates the information in the first local cryptographic suite library according to the target cryptographic policy. If the target cryptographic policy contains adjustment requirements for the information in the first local cryptographic suite library, the server will synchronously update the information in the first local cryptographic suite library to obtain the updated first local cryptographic suite library.

[0152] In the case of determining the updated first local cryptographic suite library, in order to start a new service process, the method is also used for starting the new service process based on the updated first local cryptographic suite library in a preset hot loading manner.

[0153] ​In the embodiments of the present disclosure, the new service process is started by means of an independent process or a containerized module. In the independent process mode, the server starts a new service process, the new service process is independent of the old service process currently running, both share the same network port, but each loads a different local password suite library, the old service process still relies on the first local password suite library, and the new service process loads the updated first local password suite library. In the containerized module mode, the updated first local password suite library is packaged into a new container (a reusable password suite library file set), the new container is isolated from the old container running the old service process, and only receives new connection requests through the network port to start the new service process. It should be noted that the specific way of starting the new service process is not limited.

[0154] The first local password suite in the first local password suite library is dynamically loaded or replaced by using the preset hot loading technology, and the new service process is started by using the preset hot loading mode, so that the new service process can process new connection requests based on the updated first local password suite library without interrupting the running of the old service process, ensuring the instant effect of the target password policy and avoiding business interruption caused by the restart of the old process.

[0155] Figure 4 Further, a flowchart of a password policy updating method provided by the embodiments of the present disclosure is shown. Based on the embodiments shown in Figure 1 The step 101 is further explained, Figure 4 may include the following steps:

[0156] Step 401, determining whether the target password policy is consistent with the password policy in the first local password suite library.

[0157] The server compares the received target password policy with the password policy in the first local password suite library to determine whether they are consistent. The comparison content includes the target password policy message (such as adding a post-quantum cryptography algorithm suite, adjusting the priority of the post-quantum cryptography algorithm, disabling a password suite with security risks, etc.).

[0158] For ease of understanding, the following examples are given: comparing whether the newly added password suite in the target password policy is already in the support list of the password policy in the first local password suite library, confirming whether the priority values of the target password policy and the password policy in the first local password suite library are the same, verifying whether the list of disabled password suites is completely consistent, etc. If the contents of all comparison items match, it is determined to be consistent. As long as there is any item content that does not match, it is determined to be inconsistent. It should be noted that the above examples are only illustrative and not limited to the specific content.

[0159] Step 402, in response to the target cipher policy being inconsistent with the cipher policy in the first local cipher suite library, updating the original cipher policy in the first local cipher suite library using the target cipher policy.

[0160] When it is determined that the target cipher policy is inconsistent with the cipher policy in the local cipher suite library, the server updates the content corresponding to the original policy in the first local cipher suite library according to the specific requirements of the target cipher policy; for example, if the target cipher policy adds a post-quantum cipher method suite, the identifier and related parameters of the post-quantum cipher method suite are added to the support list of the original cipher policy, if the target cipher policy reduces the priority of the post-quantum cipher method suite, the priority value of the post-quantum cipher method suite in the original policy is adjusted synchronously; if the target cipher policy disables the post-quantum cipher method suite, the post-quantum cipher method suite is removed from the available list of the original policy and marked as disabled, so that the content corresponding to the original policy in the first local cipher suite library is completely consistent with the target cipher policy. It should be noted that the above examples are only illustrative and not limited to the specific content.

[0161] In the case of determining the target cipher policy, in order to start a new service process, it is also used to start the new service process based on the target cipher policy in a preset hot loading manner.

[0162] The server ensures that the target cipher policy is directly applied when starting a new service process based on the target cipher policy (such as adding a post-quantum cryptography algorithm suite, adjusting the priority of the post-quantum cryptography algorithm, disabling a cipher suite with security risks, etc.), while not affecting the maintenance of existing connections by the old service process. The new service process will handle new connection requests based on the target cipher policy, so that the target cipher policy can be implemented and landed.

[0163] Figure 5 A flowchart of a cipher policy updating method provided by the embodiments of the present disclosure is shown in FIG. 5, which is applied to a client. The cipher policy updating method comprises steps 501-502. Figure 5

[0164] Step 501, in response to receiving an update message containing the target cipher policy, updating the second local cipher suite library based on the target cipher policy to obtain an updated second local target cipher suite library.

[0165] ​The client receives an update message of the target password policy, parses the update message, and determines specific operations to be performed (such as adding a post-quantum cryptography algorithm suite, adjusting the priority of the post-quantum cryptography algorithm, disabling a password suite with security risks, etc.), and updates the second local password suite library of the client according to the specific operations to be performed, wherein the second local password suite library of the client corresponds to the first local password suite library of the server.

[0166] In some embodiments, the client updates the second local password suite library through a transport layer security (TLS) protocol. In the TLS protocol, a TLS warning protocol can be used for extension, and in an established encrypted channel, a custom type is defined through a warning message of the TLS, and a uniform resource locator accessed by the password policy management platform is carried. Specifically, the protocol type is not limited.

[0167] Step 502, based on the updated second local target password suite library, starting a new service process.

[0168] The client starts a new service process according to the updated second local target password suite library. In the starting process, the updated second local target password suite library is loaded, so that it can process new connection requests according to the target password policy.

[0169] Figure 6 A flowchart of a password policy updating method provided by the embodiments of the present disclosure is shown in FIG. 6. Figure 6 The password policy updating method includes steps 601-604.

[0170] Step 601, in response to receiving the update information of the password policy sent by the server, based on the update information, determining whether to support a target password suite in the target password policy.

[0171] When the client receives the update information of the password policy sent by the server, the client determines whether the second local target password suite library supports the target password suite in the target password policy based on the update information.

[0172] Step 602, in response to supporting the target password suite, based on the target password policy and the second local target password suite library, starting the new service process.

[0173] In some embodiments, in order to ensure that the client supports the corresponding target cipher suite in the target cipher policy when starting a new service process, the new service process is started according to the target cipher policy and the second local target cipher suite library in the case that the client supports the target cipher suite; the target cipher policy specifies the usage specification of the target cipher suite, and the second local target cipher suite library provides the algorithm implementation, running dependency, etc. of the target cipher suite.

[0174] Step 603, in response to the second local cipher suite library not supporting the target cipher suite, sending request information for obtaining the target cipher suite.

[0175] When the second local cipher suite library does not support the target cipher suite, the client sends request information for obtaining the target cipher suite to the cipher policy management platform, and requests to update the target cipher suite in the second local cipher suite library so as to enable the second local cipher suite library to support the target cipher suite.

[0176] Step 604, updating the second local cipher suite library based on the received target cipher suite and corresponding target cipher policy, to obtain the updated second local cipher suite library.

[0177] The updated second local cipher suite library is consistent with the updated first local cipher suite library in a manner, and the detailed description of step 604 can continue to refer to the detailed description of step 202, and the embodiments of the present disclosure will not be described here.

[0178] Figure 7 Further, a flowchart of a cipher policy updating method provided by the embodiments of the present disclosure is shown. Based on the embodiments shown in Figure 6 The step 604 is further explained, Figure 7 may include the following steps:

[0179] Step 701, receiving a cipher suite library file corresponding to the target cipher suite.

[0180] Step 702, updating the second local cipher suite library based on the cipher suite library file and the target cipher policy, to obtain the updated second local cipher suite library.

[0181] For the description of steps 701-702, please continue to refer to the above Figure 3 The detailed description of related steps will not be described here.

[0182] Figure 8 Further, a flowchart of a cipher policy updating method provided by the embodiments of the present disclosure is shown. Based on the embodiments shown in Figure 5 The step 604 is further explained, Figure 8The method can comprise the following steps:

[0183] In step 801, in response to receiving the update message containing the target cipher policy, the second local cipher suite library is updated based on the target cipher policy, to obtain an updated second local target cipher suite library.

[0184] In step 802, a new service process is started based on the updated second local target cipher suite library.

[0185] For the description of steps 801-802, please refer to the above Figure 5 For the detailed description of the related steps, the embodiments of the present disclosure will not be described here.

[0186] In step 803, the original connection communication with the server is maintained based on the second local target cipher suite library that has not been updated.

[0187] The second local target cipher suite library that has not been updated is a set of second local target cipher suites stored in the client before the update operation is performed, and the set contains the second local target cipher suite used when the original connection communication is established. The original connection communication remains normal at this stage, and the client continues to send service data (such as intermediate data packets in a file transfer process, real-time response information of user operations, etc.) that is being processed to the server through the original connection, to ensure that the ongoing service data is not affected by the update operation.

[0188] In step 804, a new connection communication with the server is established based on the target cipher policy in the updated second local target cipher suite library.

[0189] The updated second local target cipher suite library contains update information of the target cipher policy, and the establishment process of the new connection communication complies with the update information of the target cipher policy to establish communication. When the client and the server negotiate the second local target cipher suite, the client preferentially selects the target cipher suite. The client and the server complete handshaking based on the target cipher suite, and establish the new connection communication with the server.

[0190] In step 805, the service data is migrated from the original connection communication to the new connection communication.

[0191] The client and the server implement the coexistence of the original connection communication and the new connection communication, gradually migrate the service data from the original connection communication to the new connection communication, and complete the transition from the old connection communication to the new connection communication.

[0192] In step 806, after the migration of the service data is completed, the original connection communication with the server is closed.

[0193] The uncompleted service data in the original connection communication has been completely transmitted through the new connection communication, the server returns the confirmation information of receiving the complete service data, and no new service data is generated in the original connection within the preset time window, at this time, the original connection communication between the client and the server is closed, and the memory resources released by the original connection communication are released.

[0194] As shown in Figure 9 The method is applied to a password policy management platform, and the method comprises the following steps:

[0195] In step 901, a target password policy message is sent to a server, so that the server updates a first local password suite library based on the target password policy, and obtains an updated first local password suite library.

[0196] The password policy management platform sends a target password policy message to the server, and the target password policy message is transmitted through an established encrypted channel to ensure the security of the target password policy. After receiving the target password policy message, the server parses the target password policy, compares the target password policy with original policies in the first local password suite library, and determines the original policies in the first local password suite library that need to be updated.

[0197] In some embodiments, the target password policy message includes, but is not limited to, information of added, modified or disabled password suites, and the like.

[0198] In step 902, a new service process is started based on the updated first local password suite library.

[0199] The server starts a new service process to load the updated first local password suite library in a preset hot loading manner without affecting a currently running old service process.

[0200] In actual application, before updating the first local password suite library or the second local password suite library, a password suite library file needs to be sent, which can be implemented in the following manner, but is not limited thereto. In response to received request information for obtaining a target password suite corresponding to the target password policy sent by the server, a password suite library file corresponding to the target password suite is sent to the server. In response to received request information for obtaining a target password suite corresponding to the target password policy sent by the client, a password suite library file corresponding to the target password suite is sent to the client. For example, when the server or the client needs to obtain a password suite library file to update the first local password suite library or the second local password suite library, request information (the request information includes an identifier of the target password suite, device information, and the like) is sent to the server or the client.

[0201] As an extension of the embodiments of the present disclosure, in order to facilitate better understanding of the update of the password policy, as shown inFigure 10 As shown, Figure 10 A flowchart of a password policy updating method provided by an embodiment of the present disclosure is shown. The password policy updating method is an interactive updating method between a password policy management platform, a server and a client, and includes the following steps.

[0202] In step 1001, the client establishes a secure connection with the server through an old connection communication.

[0203] In step 1002, the cryptography security policy management platform (CSPM) formulates a target password policy and sends a target password policy message to the server.

[0204] In step 1003, the server receives the target password policy and determines whether the first local password suite library supports a target password suite corresponding to the target password policy.

[0205] When it is determined that the first local password suite library does not support the target password suite, the server sends request information for obtaining the target password suite to the CSPM.

[0206] In step 1004, the CSPM receives the request information for obtaining the target password suite corresponding to the target password policy sent by the server, and sends a password suite library file corresponding to the target password suite to the server.

[0207] In step 1005, the server receives the password suite library file corresponding to the target password suite, and updates the first local password suite library based on the password suite library file and the target password policy to obtain an updated first local password suite library. The server determines whether the target password policy is consistent with a password policy in the first local password suite library.

[0208] When it is determined that the target password policy is consistent with the password policy in the first local password suite library.

[0209] In step 1006, the server starts the new service process in a preset hot loading mode based on the updated first local password suite library.

[0210] When it is determined that the target password policy is not consistent with the password policy in the first local password suite library.

[0211] In step 1007, the server starts the new service process in a preset hot loading mode based on the target password policy. According to the new service process, the server sends an updating message of the target password policy to the client.

[0212] Step 1008, the client receives an update message containing the target password policy, and determines whether to support the target password suite in the target password policy based on the update information; when it is determined that the update message of the target password policy supports the target password suite, the client starts the new service process based on the target password policy and the second local target password suite library.

[0213] Step 1009, when it is determined that the update message of the target password policy does not support the target password suite, the client sends request information of the target password suite to the CSPM.

[0214] Step 1010, the CSPM receives a password suite library file corresponding to the target password suite according to the request information of the target password suite; the CSPM sends the password suite library file and the target password policy to the client.

[0215] Step 1011, the client receives the password suite library file and the target password policy, and updates the second local password suite library to obtain an updated second local password suite library; based on the updated second local target password suite library, a new service process is started.

[0216] Step 1012, the client maintains original connection communication with the server based on the un-updated second local target password suite library; the client establishes new connection communication with the server based on the target password policy in the updated second local target password suite library; the business data between the client and the server is migrated from the original connection communication to the new connection communication, and after the migration of the business data is completed, the original connection communication between the client and the server is closed.

[0217] Corresponding to the above-mentioned password policy updating method, the application also provides a password policy updating method. Since the device embodiment of the application corresponds to the above-mentioned method embodiment, for details not disclosed in the device embodiment, reference can be made to the above-mentioned method embodiment, which will not be described herein again.

[0218] Figure 11 A structural diagram of a password policy updating device provided by the embodiment of the present disclosure is shown in the figure, and the device is applied to a server, as shown in the figure, which comprises: Figure 11

[0219] A first updating unit 51 is configured to update a first local password suite library based on a target password policy message to obtain an updated first local password suite library in response to the received target password policy message; wherein the target password policy message comprises added, modified or disabled password suite information.

[0220] ​The first starting unit 52 is configured to start a new service process based on the updated first local cipher suite library.

[0221] The first sending unit 53 is configured to send an update message containing the target cipher policy to the client.

[0222] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 12 The first updating unit 51 comprises:

[0223] The first sending module 511 is configured to send request information for obtaining the target cipher suite in response to the first local cipher suite library not supporting the target cipher suite, wherein the target cipher suite is a cipher suite corresponding to the target cipher policy.

[0224] The first updating module 512 is configured to update the first local cipher suite library based on the received target cipher suite and corresponding target cipher policy, to obtain the updated first local cipher suite library.

[0225] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 12 The first updating module 512 comprises:

[0226] The first receiving submodule 5121 is configured to receive a cipher suite library file corresponding to the target cipher suite.

[0227] The first updating submodule 5122 is configured to update the first local cipher suite library based on the cipher suite library file and the target cipher policy, to obtain the updated first local cipher suite library.

[0228] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 12 The first starting unit 52 comprises:

[0229] The first starting module 521 is configured to start the new service process in a preset hot loading mode based on the updated first local cipher suite library.

[0230] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 12 The first updating unit 51 further comprises:

[0231] The judging module 513 is configured to judge whether the target cipher policy is consistent with a cipher policy in the first local cipher suite library.

[0232] The second updating module 514 is configured to update the original cipher policy in the first local cipher suite library using the target cipher policy in response to the target cipher policy being inconsistent with the cipher policy in the first local cipher suite library.

[0233] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 12 The first starting unit 52 further includes:

[0234] The second starting module 522 is configured to start the new service process in a preset hot loading manner based on the target cipher policy.

[0235] Figure 13 A structural schematic diagram of a cipher policy updating device provided by the embodiment of the present disclosure is provided, and the device is applied to a client, as shown in Figure 13 The device includes:

[0236] The second updating unit 61 is configured to update a second local cipher suite library based on the target cipher policy in response to receiving an updating message containing the target cipher policy, to obtain an updated second local target cipher suite library.

[0237] The second starting unit 62 is configured to start a new service process based on the updated second local target cipher suite library.

[0238] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 14 The device further includes a judging unit 63.

[0239] The judging unit 63 is configured to start the new service process based on the target cipher policy and the second local target cipher suite library in response to supporting the target cipher suite.

[0240] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 14 The second updating unit 61 includes:

[0241] The second sending module 611 is configured to send request information for obtaining the target cipher suite in response to the second local cipher suite library not supporting the target cipher suite.

[0242] The third updating module 612 is configured to update the second local cipher suite library based on the received target cipher suite and corresponding target cipher policy, to obtain the updated second local cipher suite library.

[0243] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 14As shown, the third updating module 612 comprises:

[0244] The second receiving sub-module 6121 is configured to receive a cipher suite library file corresponding to the target cipher suite.

[0245] The second updating sub-module 6122 is configured to update the second local cipher suite library based on the cipher suite library file and the target cipher policy, to obtain the updated second local cipher suite library.

[0246] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 14 The device further comprises:

[0247] The communication unit 64 is configured to, after the second starting unit starts a new service process based on the updated second local target cipher suite library, maintain original connection communication with the server based on an un-updated second local target cipher suite library.

[0248] The establishing unit 65 is configured to establish new connection communication with the server based on the target cipher policy in the updated second local target cipher suite library.

[0249] The migrating unit 66 is configured to migrate service data from the original connection communication to the new connection communication.

[0250] The closing unit 67 is configured to, after the service data is migrated, close the original connection communication with the server.

[0251] Figure 15 A structural diagram of a cipher policy updating device provided by the embodiment of the present disclosure, which is applied to a cipher policy management platform, comprises: Figure 15 As shown, the device comprises:

[0252] The third updating unit 71 is configured to send a target cipher policy message to the server, so that the server updates a first local cipher suite library based on the target cipher policy to obtain an updated first local cipher suite library.

[0253] The third starting unit 72 is configured to start a new service process based on the updated first local cipher suite library.

[0254] The target cipher policy message comprises information of a newly added, modified or disabled cipher suite.

[0255] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 16 The device further comprises:

[0256] The second sending unit 73, in response to the received request information for obtaining the target cipher suite corresponding to the target cipher policy sent by the server, sends the cipher suite library file corresponding to the target cipher suite to the server.

[0257] Further, in a possible implementation manner of the embodiment of the present disclosure, as shown in Figure 16 The apparatus further includes:

[0258] The third sending unit 74, in response to the received request information for obtaining the target cipher suite corresponding to the target cipher policy sent by the client, sends the cipher suite library file corresponding to the target cipher suite to the client.

[0259] It should be noted that the foregoing explanation and description of the method embodiment are also applicable to the apparatus of the embodiment of the present disclosure, and the principle is the same, which is not limited in the embodiment of the present disclosure.

[0260] Figure 17 A structural schematic diagram of a cipher policy updating system according to the embodiment of the present disclosure is provided, the system includes a cipher policy management platform 81, a server 82 and a client 83; wherein,

[0261] The server 82 includes the cipher policy updating apparatus as shown in Figure 11

[0262] The client 83 includes the cipher policy updating apparatus as shown in Figure 13

[0263] The cipher policy management platform 81 includes the cipher policy updating apparatus as shown in Figure 15 According to the embodiment of the present disclosure, the present disclosure further provides an electronic device, a readable storage medium and a computer program product.

[0264]

[0265] A schematic block diagram of an example electronic device 1800 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present disclosure described and / or claimed in this document. Figure 18 As shown in

[0266] Figure 18 ​​​As shown, the electronic device 1800 includes a computing unit 1801 that can perform various appropriate actions and processes in accordance with a computer program stored in a ROM (Read-Only Memory) 1802 or a computer program loaded into a RAM (Random Access Memory) 1803 from a storage unit 1808. Various programs and data required for the operation of the electronic device 1800 can also be stored in the RAM 1803. The computing unit 1801, the ROM 1802, and the RAM 1803 are connected to each other through a bus 1804. An I / O (Input / Output) interface 1805 is also connected to the bus 1804.

[0267] Various components in the electronic device 1800 are connected to the I / O interface 1805, including an input unit 1806 such as a keyboard, a mouse, and the like, an output unit 1807 such as various types of displays, a speaker, and the like, a storage unit 1808 such as a magnetic disk, an optical disk, and the like, and a communication unit 1809 such as a network card, a modem, a wireless communication transceiver, and the like. The communication unit 1809 allows the electronic device 1800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0268] The computing unit 1801 can be various general and / or special purpose processing components having processing and computing capabilities. Some examples of the computing unit 1801 include, but are not limited to, a CPU (Central Processing Unit), a GPU (Graphic Processing Unit), various special-purpose AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, a DSP (Digital Signal Processor), and any appropriate processor, controller, microcontroller, and the like. The computing unit 1801 performs various methods and processes described above, such as the password policy updating method. For example, in some embodiments, the password policy updating method can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 1808. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 1800 via the ROM 1802 and / or the communication unit 1809. When the computer program is loaded into the RAM 1803 and executed by the computing unit 1801, one or more steps of the methods described above can be performed. Alternatively, in other embodiments, the computing unit 1801 can be configured to perform the aforementioned password policy updating method by any other appropriate means (e.g., by means of firmware).

[0269] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a Field Programmable Gate Array (FPGA), an Application-Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a System on a Chip (SOC), a Complex Programmable Logic Device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0270] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces a means for implementing the functions / operations specified in the flowcharts and / or block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0271] In the context of this disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include a linearly-programmed electrical connection, a portable computer diskette, a hard disk, RAM, ROM, EPROM (Electrically Programmable Read-Only-Memory), or flash memory, an optical fiber, a CD-ROM (Compact Disc Read-Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0272] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0273] The systems and techniques described here can be implemented in a computing system that includes a back-end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, and a blockchain network.

[0274] The computer system can include clients and servers. This relationship can be between a client and a server that are typically remote from each other and typically interact through a communication network. The relationship between client and server exists by virtue of computer programs running on the respective computer systems and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS (Virtual Private Server, or VPS for short) services. The server can also be a server of a distributed system, or a server combined with a blockchain.

[0275] It should be noted that artificial intelligence is a discipline that studies enabling computers to simulate some thinking processes and intelligent behaviors of humans (such as learning, reasoning, thinking, planning, etc.), both hardware and software technologies. Artificial intelligence hardware technology generally includes technologies such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing, etc.; artificial intelligence software technology mainly includes computer vision technology, speech recognition technology, natural language processing technology, and machine learning / deep learning, big data processing technology, knowledge graph technology, etc. several major directions.

[0276] It should be understood that the various forms of the flow shown above can be used to reorder, add or delete steps. For example, each step described in the present disclosure can be executed in parallel, sequentially or in a different order, as long as the desired results of the technical solutions disclosed in the present disclosure can be achieved, which is not limited herein.

[0277] The above detailed description does not constitute a limitation on the protection scope of the present disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for updating a cryptographic strategy, characterized in that, The method is applied to the server side and includes: In response to the received target cryptographic policy message, the first local cipher suite library is updated based on the target cryptographic policy to obtain the updated first local cipher suite library; wherein, the target cryptographic policy message includes information on newly added, modified, or disabled cipher suites; Based on the updated first local cryptographic suite library, start the new service process; Send an update message containing the target password policy to the client.

2. The method according to claim 1, characterized in that, The step of updating the first local cipher suite library based on the target cryptographic policy to obtain the updated first local cipher suite library includes: In response to the fact that the first local cipher suite library does not support the target cipher suite, a request to obtain the target cipher suite is sent; wherein, the target cipher suite is the cipher suite corresponding to the target cryptographic policy; The first local cipher suite library is updated based on the received target cipher suite and the corresponding target cryptographic policy to obtain the updated first local cipher suite library.

3. The method according to claim 2, characterized in that, The step of updating the first local cipher suite library based on the received target cipher suite and the corresponding target cryptographic policy to obtain the updated first local cipher suite library includes: Receive the cipher suite library file corresponding to the target cipher suite; Based on the cipher suite library file and the target cryptographic policy, the first local cipher suite library is updated to obtain the updated first local cipher suite library.

4. The method according to claim 3, characterized in that, The process of starting a new service based on the updated first local cryptographic suite library includes: Based on the updated first local cryptographic suite library, the new service process is started using a preset hot-loading method.

5. The method according to claim 1, characterized in that, The step of updating the first local cipher suite library based on the target cryptographic policy to obtain the updated first local cipher suite library includes: Determine whether the target cryptographic policy is consistent with the cryptographic policy in the first local cryptographic suite library; In response to the inconsistency between the target cryptographic policy and the cryptographic policy in the first local cryptographic suite library, the original cryptographic policy in the first local cryptographic suite library is updated using the target cryptographic policy.

6. The method according to claim 5, characterized in that, The process of starting a new service based on the updated first local cryptographic suite library includes: Based on the target password policy, the new service process is started using a preset hot-loading method.

7. A method for updating a cryptographic strategy, characterized in that, The method is applied to the client and includes: In response to receiving an update message containing the target cryptographic policy, the second local cipher suite library is updated based on the target cryptographic policy to obtain the updated second local target cipher suite library; Based on the updated second local target cipher suite library, a new service process is started.

8. The method according to claim 7, characterized in that, The step of responding to receiving the updated information of the cryptographic policy sent by the server, and determining whether the target cipher suite in the target cryptographic policy is supported based on the updated information, further includes: In response to supporting the target cipher suite, the new service process is initiated based on the target cipher policy and the second local target cipher suite library.

9. The method according to claim 7, characterized in that, The step of updating the second local cipher suite library based on the target cryptographic policy to obtain the updated second local target cipher suite library includes: In response to the fact that the second local cipher suite library does not support the target cipher suite, a request to obtain the target cipher suite is sent; The second local cipher suite library is updated based on the received target cipher suite and the corresponding target cryptographic policy to obtain the updated second local cipher suite library.

10. The method according to claim 9, characterized in that, The step of updating the second local cipher suite library based on the received target cipher suite and the corresponding target cryptographic policy to obtain the updated second local cipher suite library includes: Receive the cipher suite library file corresponding to the target cipher suite; Based on the cipher suite library file and the target cryptographic policy, the second local cipher suite library is updated to obtain the updated second local cipher suite library.

11. The method according to claim 7, characterized in that, After starting the new service process based on the updated second local target cipher suite library, the process also includes: Based on the unupdated second local target cipher suite library, maintain the original connection and communication with the server; Based on the target cryptographic policy in the updated second local target cryptographic suite library, establish a new connection communication with the server; Migrate business data from the original connection communication to the new connection communication; Once the business data migration is complete, close the original connection communication with the server.

12. A method for updating a cryptographic strategy, characterized in that, The method is applied to a cryptographic policy management platform, including: A target cryptographic policy message is sent to the server so that the server updates the first local cryptographic suite library based on the target cryptographic policy, obtains the updated first local cryptographic suite library, and starts a new service process based on the updated first local cryptographic suite library. The target cryptographic policy message includes information on newly added, modified, or disabled cipher suites.

13. The method according to claim 12, characterized in that, The method further includes: In response to the received request from the server to obtain the target cipher suite corresponding to the target cipher policy, the cipher suite library file corresponding to the target cipher suite is sent to the server.

14. The method according to claim 12, characterized in that, The method further includes: In response to a request from a client to obtain the target cipher suite corresponding to the target cipher policy, the cipher suite library file corresponding to the target cipher suite is sent to the client.

15. A cryptographic policy update device, characterized in that, The device is used on the server side and includes: The first update unit is configured to update the first local cipher suite library based on the target cipher policy in response to the received target cipher policy message, thereby obtaining the updated first local cipher suite library; wherein the target cipher policy message includes information on newly added, modified, or disabled cipher suites. The first startup unit is used to start a new service process based on the updated first local cryptographic suite library; The first sending unit is used to send an update message containing the target cryptographic policy to the client.

16. A cryptographic policy update device, characterized in that, The device is applied to a client and includes: The second update unit is configured to update the second local cipher suite library based on the target cipher policy in response to receiving an update message containing the target cipher policy, thereby obtaining the updated second local target cipher suite library; The second startup unit is used to start a new service process based on the updated second local target cryptographic suite library.

17. A cryptographic policy update device, characterized in that, The device is used in a cryptographic policy management platform and includes: The third update unit is used to send a target cryptographic policy message to the server so that the server updates the first local cryptographic suite library based on the target cryptographic policy and obtains the updated first local cryptographic suite library. The third startup unit is used to start a new service process based on the updated first local cryptographic suite library; The target cryptographic policy message includes information on newly added, modified, or disabled cipher suites.

18. A cryptographic policy update system, characterized in that, The system includes a cryptographic policy management platform, a server, and a client, wherein; The cryptographic policy management platform includes the cryptographic policy updating device as described in claim 17; The server includes the cryptographic policy update device as described in claim 15; The client includes the cryptographic policy update device as described in claim 16.

19. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6, 7-11, or 12-14.

20. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6, 7-11, or 12-14.

21. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method according to any one of claims 1-6, 7-11, or 12-14.

Images