A method for providing a uniform interface for different models of encryption machines

Abstract

The application provides a method for providing a unified interface for different models of encryption machines, comprising deploying a password service instance, and providing a unified interface for a password service gateway to call; exporting the identification of a key from a password device, importing the key in a management platform, and specifying the password service instance, and generating a unique identifier; the password service gateway providing a unified KMIP interface to an application program; after the password service gateway receives a key operation request, determining a target password service instance, and forwarding the obtained key and parameters to the target password service instance; the target password service instance performing a password operation on the key in the corresponding encryption device according to the key, and returning the operation result to the application program. The application provides a unified key calling interface for different models of encryption machines, so that the application program can be flexibly connected to different models of encryption machines without redeveloping codes, thereby reducing the development cost and improving the scalability of the system.

Description

Technical Field

[0001] This invention relates to the field of key management technology, and more specifically to a method for providing a unified interface for keys of different types of encryption machines. Background Technology

[0002] In the existing cryptographic service system, different models of cryptographic devices (encryption machines) provide different user interfaces, and each device uses its own independent communication protocol and key management method. When an application needs to interface with different models of cryptographic devices, developers need to relearn the corresponding calling methods and readjust the code in the application that calls the cryptographic devices.

[0003] This approach not only increases the learning curve for developers but also raises the development and maintenance costs of applications. When an application needs to switch to using different models of encryption devices, it often requires secondary development and re-interfacing with cryptographic devices that provide different interfaces, severely restricting the flexibility and scalability of the application. Summary of the Invention

[0004] To address the various shortcomings of existing technologies, this invention provides a method for providing a unified interface for keys of different encryption machine models. By providing a unified key calling interface for different encryption machine models, applications can flexibly connect to different encryption machine models without redeveloping code, thereby reducing development costs and improving system scalability.

[0005] The present invention achieves the above objectives through the following technical solutions: A method for providing a unified interface for keys of different encryption device models includes: Deploy cryptographic service instances to connect to encryption devices with different interfaces, and provide a unified interface for the cryptographic service gateway to call; Configure the cryptographic service instance information on the management platform. The cryptographic service instance information includes the cryptographic service's call address, the encryption machine model corresponding to the cryptographic service, the deployment location of the cryptographic service, the location of the encryption machine, and a tag. The tag is a 6-digit number, and the tags of each cryptographic service instance are unique. The identifier of the key is exported from the cryptographic device and recorded as a key tag. The key tag is imported into the management platform and the cryptographic service instance to which it belongs is specified. The cryptographic service gateway generates a unique identifier based on the tag of the cryptographic service instance. The cryptographic service gateway provides a unified KMIP interface to applications; applications initiate key operation requests by calling the KMIP interface, and the key operation request carries a unique identifier of the key to be operated; After receiving a key operation request, the cryptographic service gateway parses the first 6 bits of the unique identifier to determine the target cryptographic service instance, obtains the corresponding key tag according to the mapping relationship between the unique identifier and the key tag, and forwards the key tag and other operation parameters to the target cryptographic service instance. The target cryptographic service instance calls the key in the corresponding encryption device to perform cryptographic operations based on the key tag, and returns the operation result to the application.

[0006] According to a method for providing a unified interface for keys of different types of encryption machines provided by the present invention, the writing and deployment of cryptographic service instances includes the following steps: For each type of encryption device, the native interface protocol of the encryption device is analyzed, and the key operation instruction set in the native interface protocol is extracted. The key operation instruction set includes one or more of the following: key creation instruction, key deletion instruction, key encryption instruction, key decryption instruction, key signing instruction, and key signature verification instruction. Define a unified internal interface method in the cryptographic service instance. The unified internal interface method includes a unified method name, a unified parameter format, and a unified return format. The parameter format includes a key tag field, an operation type field, and an operation data field. The key tag field is used to identify the key to be operated on, the operation type field is used to indicate the specific key operation type, and the operation data field is used to carry data related to the key operation.

[0007] According to the present invention, a method for providing a unified interface for keys of different types of encryption devices is provided. A mapping relationship between the native interface protocol and the unified internal interface is established in the cryptographic service instance. When the cryptographic service instance receives a unified internal interface call request from the cryptographic service gateway, the unified parameter format in the unified internal interface call request is converted into the native interface parameter format of the corresponding encryption device according to the mapping relationship. In this method, the key tag field is converted into a key identifier that can be recognized by the encryption device, the operation type field is converted into the corresponding key operation instruction in the native interface protocol of the encryption device, and the operation data field is converted into the parameter structure required by the native interface protocol of the encryption device. By calling the native interface of the encryption device through the module, the converted native interface parameter format is used to call the encryption device to perform key operations and obtain the native interface result returned by the encryption device. The results from the native interface returned by the encryption device are encapsulated in a unified internal interface return format and then returned to the cryptographic service gateway through the unified internal interface.

[0008] According to a method for providing a unified interface for keys of different types of encryption machines provided by the present invention, after the cryptographic service gateway receives the key tag and the cryptographic service instance information sent by the management platform, it obtains the 6-digit digital tag of the cryptographic service instance. The password service gateway generates a random value and concatenates a 6-digit numeric label with the random value to generate a unique identifier. The format of the unique identifier is: password service instance label + random value. Establish and maintain a one-to-one mapping between unique identifiers and key tags, as well as a many-to-one mapping between unique identifiers and cryptographic service instances; wherein, a cryptographic service instance contains multiple unique identifiers, and each unique identifier uniquely corresponds to a key tag; The cryptographic service gateway determines the target cryptographic service instance to which it belongs by using the first 6 bits of the unique identifier based on the mapping relationship, and obtains the corresponding key tag through the one-to-one mapping relationship between the unique identifier and the key tag.

[0009] According to the present invention, a method for providing a unified interface for keys of different models of encryption devices is provided. When the management platform creates a key, it specifies a cryptographic service. The cryptographic service gateway forwards the creation operation to the corresponding cryptographic service instance. After creating a new key in the cryptographic device, it returns a key tag. The cryptographic service gateway generates a new unique identifier based on the tag of the cryptographic service instance and binds the key tag to the newly generated unique identifier in a one-to-one relationship, as well as the cryptographic service to which the unique identifier belongs.

[0010] According to the present invention, a method for providing a unified interface for keys of different encryption devices is provided. When an application needs to switch to use keys in different encryption devices, the application does not need to modify the code. It only needs to change the unique identifier in the KMIP interface call parameters from the current unique identifier to a new unique identifier bound to the key in the target encryption device. The cryptographic service gateway parses the first 6 bits of the new unique identifier to determine the new target cryptographic service instance. Based on the one-to-one mapping relationship between the new unique identifier and the key tag, it obtains the corresponding key tag and forwards the key tag and key operation-related parameters to the new target cryptographic service instance. The new target cryptographic service instance then calls the corresponding encryption device to complete the cryptographic operation and returns the result.

[0011] According to the present invention, a method for providing a unified interface for keys of different types of encryption devices is provided, wherein key a in cryptographic device 1 is denoted as tag1-a, and key a in cryptographic device 2 is denoted as tag2-a; Export keys tag1-a and tag2-a from cryptographic device 1 and cryptographic device 2 respectively, and import the key tags into the management platform; In the management platform, assign the first cryptographic service instance to key tag1-a and the second cryptographic service instance to key tag2-a; The cryptographic service gateway generates a random value based on the 6-digit numeric tag of the first cryptographic service instance and concatenates it to generate a unique identifier uid1-a. The format of the unique identifier uid1-a is: first cryptographic service instance tag + random value; at the same time, it generates a random value based on the 6-digit numeric tag of the second cryptographic service instance and concatenates it to generate a unique identifier uid2-a. The format of the unique identifier uid2-a is: second cryptographic service instance tag + random value. The cryptographic service gateway records the one-to-one mapping between the unique identifier uid1-a and the key tag1-a, and that the unique identifier uid1-a belongs to the first cryptographic service instance; it also records the one-to-one mapping between the unique identifier uid2-a and the key tag2-a, and that the unique identifier uid2-a belongs to the second cryptographic service instance. Among them, the unique identifier and the key tag have a one-to-one relationship, and the unique identifier and the cryptographic service instance have a many-to-one relationship. A cryptographic service instance contains multiple unique identifiers. According to the present invention, a method for providing a unified interface for keys of different encryption devices is provided. When an application calls the key tag1-a in the first encryption device to perform cryptographic operations through the KMIP interface carrying the first unique identifier uid1-a, the cryptographic service gateway parses the first 6 bits of the tag of uid1-a to determine the corresponding first cryptographic service instance, obtains the key tag1-a according to the one-to-one mapping relationship between the unique identifier and the key tag, forwards the key tag1-a and the operation parameters to the first cryptographic service instance, and the first cryptographic service instance calls the first encryption device to complete the operation and return the result.

[0012] According to the present invention, a method for providing a unified interface for keys of different encryption devices is provided. When an application needs to switch to using key tag2-a in the second encryption device, the application does not need to modify the code. It only needs to change the unique identifier in the KMIP interface call parameters from uid1-a to uid2-a. uid2-a is a unique identifier generated in advance by the cryptographic service gateway based on the tag of the second cryptographic service instance and bound to key tag2-a. The cryptographic service gateway parses the first 6 bits of the tag of uid2-a to determine the corresponding second cryptographic service instance, obtains key tag2-a according to the one-to-one mapping relationship between the unique identifier and the key tag, and forwards key tag2-a and operation parameters to the second cryptographic service instance. The second cryptographic service instance then calls the second encryption device to complete the calculation and return the result.

[0013] According to the present invention, a method for providing a unified interface for keys of different types of encryption machines is provided. When a certain encryption device or a certain cryptographic service instance fails, since the unique identifier and the cryptographic service instance have a many-to-one relationship, the failure only affects all unique identifiers under the tag of that instance, and the key calls under other instances are completely unaffected. When a key in the underlying encryption device is destroyed, the cryptographic service instance returns the destruction result. The cryptographic service gateway only needs to delete the mapping relationship between the unique identifier and the key tag. Since the application holds the unique identifier rather than the key tag, the application layer does not need to be aware that the key has been destroyed. It only needs to receive the error response returned by the gateway on the next call. Therefore, compared with the prior art, the method and system proposed in this invention for providing a unified interface for keys of different types of encryption machines have the following advantages: 1. This invention unifies the calling method of different models of cryptographic devices, allowing different cryptographic devices to be called using a unified interface, thereby reducing the learning and development costs for developers.

[0014] 2. When the application switches to use keys from different encryption devices, the present invention only requires changing the unique identifier in the interface call parameters, without the need for secondary application development or re-interfacing with cryptographic devices that provide different interfaces.

[0015] 3. The first 6 bits of the unique identifier are the password service instance label. This invention implements a zero-lookup routing mechanism based on the label prefix, with routing decision being O(1), and the gateway can be horizontally expanded without state.

[0016] 4. The one-to-one binding relationship between the unique identifier and the key tag in this invention completely decouples the key lifecycle from application calls, and key destruction, migration and other operations are transparent to the application layer.

[0017] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments. Attached Figure Description

[0018] Figure 1 This is a flowchart of an embodiment of a method for providing a unified interface for keys of different types of encryption machines according to the present invention.

[0019] Figure 2 This is a schematic diagram of an embodiment of the method for providing a unified interface for keys of different types of encryption machines according to the present invention.

[0020] Figure 3 This is a schematic diagram illustrating the writing and deployment of cryptographic service instances in an embodiment of a method for providing a unified interface for keys of different types of encryption machines according to the present invention.

[0021] Figure 4This is a schematic diagram illustrating the principle of generating unique identifiers and recording mapping relationships in an embodiment of a method for providing a unified interface for keys of different types of encryption machines according to the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0023] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0024] An embodiment of a method for providing a unified interface for keys of different encryption machine models See Figure 1 and Figure 2 This embodiment provides a method for providing a unified interface for keys of different encryption device models, including the following steps: Deploy cryptographic service instances to connect to encryption devices with different interfaces, and provide a unified interface for the cryptographic service gateway to call; Configure the cryptographic service instance information on the management platform. The cryptographic service instance information includes the cryptographic service's call address, the encryption machine model corresponding to the cryptographic service, the deployment location of the cryptographic service, the location of the encryption machine, and a tag. The tag is a 6-digit number, and the tags of each cryptographic service instance are unique. The identifier of the key is exported from the cryptographic device and recorded as a key tag. The key tag is imported into the management platform and the cryptographic service instance to which it belongs is specified. The cryptographic service gateway generates a unique identifier based on the tag of the cryptographic service instance. The cryptographic service gateway provides a unified KMIP interface to applications; applications initiate key operation requests by calling the KMIP interface, and the key operation request carries a unique identifier of the key to be operated; After receiving a key operation request, the cryptographic service gateway parses the first 6 bits of the unique identifier to determine the target cryptographic service instance, obtains the corresponding key tag according to the mapping relationship between the unique identifier and the key tag, and forwards the key tag and other operation parameters to the target cryptographic service instance. The target cryptographic service instance calls the key in the corresponding encryption device to perform cryptographic operations based on the key tag, and returns the operation result to the application.

[0025] In this embodiment, as Figure 3 As shown, the writing and deployment of a cryptographic service instance includes the following steps: For each type of encryption device, the native interface protocol of the encryption device is analyzed, and the key operation instruction set in the native interface protocol is extracted. The key operation instruction set includes one or more of the following: key creation instruction, key deletion instruction, key encryption instruction, key decryption instruction, key signing instruction, and key signature verification instruction. Define a unified internal interface method in the cryptographic service instance. The unified internal interface method includes a unified method name, a unified parameter format, and a unified return format. The parameter format includes a key tag field, an operation type field, and an operation data field. The key tag field is used to identify the key to be operated on, the operation type field is used to indicate the specific key operation type, and the operation data field is used to carry data related to the key operation.

[0026] In the cryptographic service instance, a mapping relationship is established between the native interface protocol and the unified internal interface. When the cryptographic service instance receives a unified internal interface call request from the cryptographic service gateway, the unified parameter format in the unified internal interface call request is converted into the native interface parameter format of the corresponding encryption device according to the mapping relationship. Specifically, the key tag field is converted into a key identifier that can be recognized by the encryption device, the operation type field is converted into the corresponding key operation instruction in the native interface protocol of the encryption device, and the operation data field is converted into the parameter structure required by the native interface protocol of the encryption device. By calling the native interface of the encryption device through the module, the converted native interface parameter format is used to call the encryption device to perform key operations and obtain the native interface result returned by the encryption device. The results from the native interface returned by the encryption device are encapsulated in a unified internal interface return format and then returned to the cryptographic service gateway through the unified internal interface.

[0027] In this embodiment, after receiving the key tag and the associated cryptographic service instance information sent by the management platform, the cryptographic service gateway obtains the 6-digit digital tag of the cryptographic service instance. The password service gateway generates a random value and concatenates a 6-digit numeric label with the random value to generate a unique identifier. The format of the unique identifier is: password service instance label + random value. Establish and maintain a one-to-one mapping between unique identifiers and key tags, as well as a many-to-one mapping between unique identifiers and cryptographic service instances; wherein, a cryptographic service instance contains multiple unique identifiers, and each unique identifier uniquely corresponds to a key tag; The cryptographic service gateway determines the target cryptographic service instance to which it belongs by using the first 6 bits of the unique identifier based on the mapping relationship, and obtains the corresponding key tag through the one-to-one mapping relationship between the unique identifier and the key tag.

[0028] In this embodiment, when the management platform creates a key, it specifies a cryptographic service. The cryptographic service gateway forwards the creation operation to the corresponding cryptographic service instance. After creating a new key in the cryptographic device, it returns a key tag. The cryptographic service gateway generates a new unique identifier based on the tag of the cryptographic service instance and binds the key tag to the one-to-one relationship with the newly generated unique identifier, as well as the cryptographic service to which the unique identifier belongs.

[0029] In this embodiment, when the application needs to switch to using keys from different encryption devices, the application does not need to modify the code. It only needs to change the unique identifier in the KMIP interface call parameters from the current unique identifier to a new unique identifier bound to the key in the target encryption device. The cryptographic service gateway parses the first 6 bits of the new unique identifier to determine the new target cryptographic service instance. Based on the one-to-one mapping relationship between the new unique identifier and the key tag, it obtains the corresponding key tag and forwards the key tag and key operation-related parameters to the new target cryptographic service instance. The new target cryptographic service instance then calls the corresponding encryption device to complete the cryptographic operation and returns the result.

[0030] In this embodiment, as Figure 4 As shown, the key 'a' in cryptographic device 1 is denoted as tag1-a, and the key 'a' in cryptographic device 2 is denoted as tag2-a; Export keys tag1-a and tag2-a from cryptographic device 1 and cryptographic device 2 respectively, and import the key tags into the management platform; In the management platform, assign the first cryptographic service instance to key tag1-a and the second cryptographic service instance to key tag2-a; The cryptographic service gateway generates a random value based on the 6-digit numeric tag of the first cryptographic service instance and concatenates it to generate a unique identifier uid1-a. The format of the unique identifier uid1-a is: first cryptographic service instance tag + random value; at the same time, it generates a random value based on the 6-digit numeric tag of the second cryptographic service instance and concatenates it to generate a unique identifier uid2-a. The format of the unique identifier uid2-a is: second cryptographic service instance tag + random value. The cryptographic service gateway records the one-to-one mapping between the unique identifier uid1-a and the key tag1-a, and that the unique identifier uid1-a belongs to the first cryptographic service instance; it also records the one-to-one mapping between the unique identifier uid2-a and the key tag2-a, and that the unique identifier uid2-a belongs to the second cryptographic service instance. The unique identifier and the key tag have a one-to-one relationship, while the unique identifier and the cryptographic service instance have a many-to-one relationship. A cryptographic service instance contains multiple unique identifiers. The application can transparently switch the underlying encryption device by changing the unique identifier, thus achieving seamless access to keys in different models of encryption devices.

[0031] In this embodiment, when the application calls the key tag1-a in the first encryption device to perform cryptographic operations through the KMIP interface carrying the first unique identifier uid1-a, the cryptographic service gateway parses the first 6 bits of the tag of uid1-a to determine the corresponding first cryptographic service instance, obtains the key tag1-a according to the one-to-one mapping relationship between the unique identifier and the key tag, and forwards the key tag1-a and operation parameters to the first cryptographic service instance, which then calls the first encryption device to complete the operation and return the result.

[0032] When the application needs to switch to using the key tag2-a in the second encryption device, the application does not need to modify the code. It only needs to change the unique identifier in the KMIP interface call parameters from uid1-a to uid2-a. uid2-a is a unique identifier that the cryptographic service gateway generates in advance based on the tag of the second cryptographic service instance and is bound to the key tag2-a. The cryptographic service gateway parses the first 6 bits of the tag uid2-a to determine the corresponding second cryptographic service instance, obtains the key tag2-a according to the one-to-one mapping relationship between the unique identifier and the key tag, and forwards the key tag2-a and operation parameters to the second cryptographic service instance. The second cryptographic service instance then calls the second encryption device to complete the calculation and return the result.

[0033] When a particular encryption device or cryptographic service instance fails, because the relationship between the unique identifier and the cryptographic service instance is many-to-one, the failure only affects all unique identifiers under that instance label, while key calls under other instances remain completely unaffected. The mapping relationship itself constitutes a natural fault isolation boundary, eliminating the need for additional circuit breaker or degradation logic. In existing multi-device key management schemes, the same routing table is typically shared, making single-point failures prone to propagation. This scheme achieves physical isolation of fault domains at the identifier structure level.

[0034] When a key in the underlying encryption device is destroyed, the cryptographic service instance returns the destruction result. The cryptographic service gateway only needs to delete the mapping between the unique identifier and the key tag. Since the application holds the unique identifier rather than the key tag, the application layer does not need to be aware that the key has been destroyed; it only needs to receive an error response from the gateway on the next call. If recovery is required, simply re-import the new key and bind it to the original unique identifier in the management platform; the application's call parameters do not need to be changed. In existing technologies, key destruction often requires synchronous notification to the application layer and modification of configuration. This solution achieves complete decoupling of the key lifecycle from application calls.

[0035] In this embodiment, the password service instance label is fixed to 6 digits, a design that is not arbitrary. 6 digits can support 1 million instance labels, meeting the needs of most large-scale deployments; at the same time, the fixed length of the first 6 digits means that the gateway does not need variable-length decoding when parsing routes, and can complete the process in O(1) time directly through string slicing or bitwise operations, which has a definite performance advantage over hash table lookup in high-concurrency scenarios.

[0036] When a key needs to be migrated from cryptographic device 1 to cryptographic device 2, the operation process is as follows: On the management platform, the key tag is unbound from the original instance and rebound to the new instance. The cryptographic service gateway automatically generates a new unique identifier for the new instance and updates the mapping relationship. If the application wants to continue using the original unique identifier after the migration, it only needs to modify the mapping relationship on the gateway side, pointing the original unique identifier to the new key tag under the new instance. The application's calling parameters remain completely unchanged. Therefore, this invention achieves cross-device key migration by modifying the gateway-side mapping relationship. In existing technologies, this requires the application layer to modify the device address or key ID, thus achieving complete transparency of the migration process to the application layer.

[0037] In practical applications, cryptographic service instances are written to connect to encryption devices with different interfaces, and a unified interface is provided in the cryptographic service instance for the cryptographic service gateway to call.

[0038] After the cryptographic service instance is deployed, configure the cryptographic service instance information (the calling address of the cryptographic service, the corresponding encryption device model, the deployment location of the cryptographic service, and the location of the encryption device) and tags on the management platform. The tag configuration rule is a 6-digit number, and the tag must not be duplicated with the tags of other cryptographic service instances. The tag is used for routing selection. The tag is used to generate a unique identifier for the key in the corresponding cryptographic device of the cryptographic service instance. The generated key identifier is: cryptographic service instance tag + random value. The routing rules forward requests to the specific cryptographic service instance by recognizing the unique identifier prefix.

[0039] The key identifier, hereinafter referred to as the key tag, is exported from the cryptographic device. The key tag is imported into the management platform and the cryptographic service instance to which it belongs is specified. The cryptographic service gateway generates a new unique identifier (cryptographic service instance tag + random value) and records the one-to-one relationship between the newly generated unique identifier and the key tag, as well as which cryptographic service the unique identifier belongs to.

[0040] When the management platform creates a key, it specifies a cryptographic service. The cryptographic service gateway forwards the creation operation to the corresponding cryptographic service instance, creates a new key in the cryptographic device, and returns a key tag. The cryptographic service gateway generates a new unique identifier based on the tag of the cryptographic service instance and binds the key tag and the unique identifier to a one-to-one relationship, as well as which cryptographic service the unique identifier belongs to.

[0041] The cryptographic service gateway provides a unified KMIP interface for applications to call. Applications can invoke the KMIP interface to access the cryptographic device interface. The KMIP carries a unique identifier for the key to be manipulated. The cryptographic service routing parses the first 6 bits of this unique identifier to determine which cryptographic service instance to forward the request to, and retrieves the key tag from the binding relationship between the unique identifier and the key tag. The cryptographic service instance uses the key tag to invoke the key in the encryption machine for computation, and finally returns the result to the client.

[0042] The key 'a' in cryptographic device 1 is denoted as tag1-a, and the key 'a' in cryptographic device 2 is denoted as tag2-a. After exporting the tags from the cryptographic devices and importing them into the management platform, two unique identifiers, uid1-a and uid2-a, are generated by selecting the corresponding cryptographic service. The association between the unique identifier, the key tag, and the cryptographic service is recorded. There is a one-to-one relationship between the unique identifier and the key tag, and a many-to-one relationship between the unique identifier and the cryptographic service; a cryptographic service can have multiple unique identifiers. When the application uses the tag1-a key from cryptographic device 1 for encryption, it directly calls the KMPI interface, including uid1-a as the specified encryption key, along with other encryption-related information. The cryptographic service gateway extracts the unique identifier, obtains the associated key tag, and the cryptographic service information. It forwards the tag and other encryption-related information as parameters to the specified cryptographic service instance. The cryptographic service calls the cryptographic device to encrypt the data and returns the result. When the application switches to using the key from cryptographic device 2, it only needs to change the interface call parameter to uid2-a. No secondary application development or re-interfacing with cryptographic devices providing different interfaces is required.

[0043] This embodiment also provides a system that provides a unified interface for keys of different types of encryption machines, including: The cryptographic service instance module is used to connect to the different native interfaces of different models of encryption devices and provide a unified internal interface. The cryptographic service instance module is written separately for each model of encryption device, and the native interface protocol of the encryption device is encapsulated into a unified internal interface to shield the interface differences between different encryption devices. The management platform module is used to configure cryptographic service instance information, which includes the cryptographic service's calling address, the encryption machine model corresponding to the cryptographic service, the deployment location of the cryptographic service, the location of the encryption machine, and a tag. The tag is a 6-digit number, and the tags of each cryptographic service instance module are unique. The management platform module is also used to import key tags from cryptographic devices, specify the cryptographic service instance module to which the key tag belongs, and specify the cryptographic service instance module when creating a key. The cryptographic service gateway module receives the key tag and associated cryptographic service instance information sent by the management platform module. It then generates a unique identifier based on the 6-digit tag of the cryptographic service instance. The unique identifier is in the format: cryptographic service instance tag + random value. The cryptographic service gateway module also maintains a one-to-one mapping between unique identifiers and key tags, as well as a many-to-one mapping between unique identifiers and cryptographic service instance modules. Furthermore, the cryptographic service gateway module provides a unified KMIP interface to applications, receives key operation requests initiated by applications through the KMIP interface, parses the first 6 digits of the unique identifier carried in the key operation request to determine the target cryptographic service instance module, obtains the corresponding key tag based on the mapping between the unique identifier and key tags, and forwards the key tag and other operation parameters to the target cryptographic service instance module. After receiving the key tag and operation parameters forwarded by the cryptographic service gateway module, the cryptographic service instance module calls the key in the corresponding encryption device to perform cryptographic operations and returns the operation result to the cryptographic service gateway module, which then returns the operation result to the application.

[0044] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0045] The above embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of protection of the present invention. Any non-substantial changes and substitutions made by those skilled in the art based on the present invention shall fall within the scope of protection claimed by the present invention.

Claims

1. A method for providing a unified interface for keys of different types of encryption machines, characterized in that, Includes the following steps: Deploy cryptographic service instances to connect to encryption devices with different interfaces, and provide a unified interface for the cryptographic service gateway to call; Configure the cryptographic service instance information on the management platform. The cryptographic service instance information includes the cryptographic service's call address, the encryption machine model corresponding to the cryptographic service, the deployment location of the cryptographic service, the location of the encryption machine, and a tag. The tag is a 6-digit number, and the tags of each cryptographic service instance are unique. The identifier of the key is exported from the cryptographic device and recorded as a key tag. The key tag is imported into the management platform and the cryptographic service instance to which it belongs is specified. The cryptographic service gateway generates a unique identifier based on the tag of the cryptographic service instance. The cryptographic service gateway provides a unified KMIP interface to applications; The application initiates a key operation request by calling the KMIP interface, and the key operation request carries a unique identifier of the key to be operated; After receiving a key operation request, the cryptographic service gateway parses the first 6 bits of the unique identifier to determine the target cryptographic service instance, obtains the corresponding key tag according to the mapping relationship between the unique identifier and the key tag, and forwards the key tag and other operation parameters to the target cryptographic service instance. The target cryptographic service instance calls the key in the corresponding encryption device to perform cryptographic operations based on the key tag, and returns the operation result to the application.

2. The method according to claim 1, characterized in that, The writing and deployment of a cryptographic service instance includes the following steps: For each type of encryption device, the native interface protocol of the encryption device is analyzed, and the key operation instruction set in the native interface protocol is extracted. The key operation instruction set includes one or more of the following: key creation instruction, key deletion instruction, key encryption instruction, key decryption instruction, key signing instruction, and key signature verification instruction. Define a unified internal interface method in the cryptographic service instance. The unified internal interface method includes a unified method name, a unified parameter format, and a unified return format. The parameter format includes a key tag field, an operation type field, and an operation data field. The key tag field is used to identify the key to be operated on, the operation type field is used to indicate the specific key operation type, and the operation data field is used to carry data related to the key operation.

3. The method according to claim 2, characterized in that: In the cryptographic service instance, a mapping relationship is established between the native interface protocol and the unified internal interface. When the cryptographic service instance receives a unified internal interface call request from the cryptographic service gateway, the unified parameter format in the unified internal interface call request is converted into the native interface parameter format of the corresponding encryption device according to the mapping relationship. Specifically, the key tag field is converted into a key identifier that can be recognized by the encryption device, the operation type field is converted into the corresponding key operation instruction in the native interface protocol of the encryption device, and the operation data field is converted into the parameter structure required by the native interface protocol of the encryption device. By calling the native interface of the encryption device through the module, the converted native interface parameter format is used to call the encryption device to perform key operations and obtain the native interface result returned by the encryption device. The results from the native interface returned by the encryption device are encapsulated in a unified internal interface return format and then returned to the cryptographic service gateway through the unified internal interface.

4. The method according to claim 1, characterized in that: After receiving the key tag and the associated cryptographic service instance information sent by the management platform, the cryptographic service gateway obtains the 6-digit numeric tag of the cryptographic service instance. The password service gateway generates a random value and concatenates a 6-digit numeric label with the random value to generate a unique identifier. The format of the unique identifier is: password service instance label + random value. Establish and maintain a one-to-one mapping between unique identifiers and key tags, as well as a many-to-one mapping between unique identifiers and cryptographic service instances; wherein, a cryptographic service instance contains multiple unique identifiers, and each unique identifier uniquely corresponds to a key tag; The cryptographic service gateway determines the target cryptographic service instance to which it belongs by using the first 6 bits of the unique identifier based on the mapping relationship, and obtains the corresponding key tag through the one-to-one mapping relationship between the unique identifier and the key tag.

5. The method according to claim 1, characterized in that: When the management platform creates a key, it specifies a cryptographic service. The cryptographic service gateway forwards the creation operation to the corresponding cryptographic service instance. After creating a new key in the cryptographic device, it returns a key tag. The cryptographic service gateway generates a new unique identifier based on the tag of the cryptographic service instance and binds the key tag to the newly generated unique identifier in a one-to-one relationship, as well as the cryptographic service to which the unique identifier belongs.

6. The method according to claim 1, characterized in that: When an application needs to switch to using keys from different encryption devices, the application does not need to modify the code; it only needs to change the unique identifier in the KMIP interface call parameters from the current unique identifier to a new unique identifier that is bound to the key in the target encryption device. The cryptographic service gateway parses the first 6 bits of the new unique identifier to determine the new target cryptographic service instance. Based on the one-to-one mapping relationship between the new unique identifier and the key tag, it obtains the corresponding key tag and forwards the key tag and key operation-related parameters to the new target cryptographic service instance. The new target cryptographic service instance then calls the corresponding encryption device to complete the cryptographic operation and returns the result.

7. The method according to claim 6, characterized in that: The key 'a' in cryptographic device 1 is denoted as tag1-a, and the key 'a' in cryptographic device 2 is denoted as tag2-a; Export keys tag1-a and tag2-a from cryptographic device 1 and cryptographic device 2 respectively, and import the key tags into the management platform; In the management platform, assign the first cryptographic service instance to key tag1-a and the second cryptographic service instance to key tag2-a; The cryptographic service gateway generates a random value based on the 6-digit numeric tag of the first cryptographic service instance and concatenates them to generate a unique identifier uid1-a. The format of the unique identifier uid1-a is: first cryptographic service instance tag + random value. Simultaneously, a random value is generated based on the 6-digit number tag of the second cryptographic service instance and concatenated to generate a unique identifier uid2-a. The format of the unique identifier uid2-a is: second cryptographic service instance tag + random value; The cryptographic service gateway records the one-to-one mapping between the unique identifier uid1-a and the key tag1-a, and that the unique identifier uid1-a belongs to the first cryptographic service instance; it also records the one-to-one mapping between the unique identifier uid2-a and the key tag2-a, and that the unique identifier uid2-a belongs to the second cryptographic service instance. Among them, the unique identifier and the key tag have a one-to-one relationship, and the unique identifier and the cryptographic service instance have a many-to-one relationship. A cryptographic service instance contains multiple unique identifiers.

8. The method according to claim 1, characterized in that: When an application calls the key tag1-a in the first encryption device to perform cryptographic operations via the KMIP interface, carrying the first unique identifier uid1-a, the cryptographic service gateway parses the first 6 bits of the tag uid1-a to determine the corresponding first cryptographic service instance. Based on the one-to-one mapping relationship between the unique identifier and the key tag, it obtains the key tag1-a, forwards the key tag1-a and operation parameters to the first cryptographic service instance, and the first cryptographic service instance calls the first encryption device to complete the operation and return the result.

9. The method according to claim 8, characterized in that: When the application needs to switch to using the key tag2-a in the second encryption device, the application does not need to modify the code. It only needs to change the unique identifier in the KMIP interface call parameter from uid1-a to uid2-a. uid2-a is a unique identifier that the cryptographic service gateway generates in advance based on the tag of the second cryptographic service instance and is bound to the key tag2-a. The cryptographic service gateway parses the first 6 bits of the uid2-a tag to determine the corresponding second cryptographic service instance. Based on the one-to-one mapping relationship between the unique identifier and the key tag, it obtains the key tag2-a and forwards the key tag2-a and operation parameters to the second cryptographic service instance. The second cryptographic service instance then calls the second encryption device to complete the calculation and returns the result.

10. The method according to any one of claims 1 to 9, characterized in that: When a certain encryption device or a certain cryptographic service instance fails, since the unique identifier and the cryptographic service instance have a many-to-one relationship, the failure only affects all unique identifiers under that instance label, and the key calls under other instances are completely unaffected. When a key in the underlying encryption device is destroyed, the cryptographic service instance returns the destruction result. The cryptographic service gateway only needs to delete the mapping relationship between the unique identifier and the key tag. Since the application holds the unique identifier rather than the key tag, the application layer does not need to be aware that the key has been destroyed. It only needs to receive the error response returned by the gateway on the next call.

Images