Cryptographic component, information processing method and apparatus, and storage medium

Abstract

The present disclosure provides a password component, an information processing method and device, and a storage medium, and relates to the field of computers, in particular to the field of database security. The password component comprises: an authorization component configured to authorize the password service component and the database instance according to the plaintext authorization information of the database instance, transmit the ciphertext identity information of the password service component to the password service component, and transmit the ciphertext authorization key and the ciphertext authorization information of the database instance to the database instance; and the password service component configured to check the ciphertext authorization key and the ciphertext authorization information of the database instance transmitted by the database instance according to the ciphertext identity information of the password service component, to determine whether the database instance is allowed to use the password service component. The password function and the data management function are isolated from each other, the risk of being involved in the database native vulnerability is avoided, the attacker cannot obtain useful plaintext information, and information leakage is prevented.

Description

Technical Field

[0001] This disclosure relates to the field of computers, particularly to the field of database security, and especially to a cryptographic component, information processing method and apparatus, and storage medium. Background Technology

[0002] In some database products, password functionality is implemented as a component of the database management system, lacking a clear boundary with data management functions. This makes the implementation of password functionality dependent on the overall security of the database management system. If other parts of the database management system have vulnerabilities, attackers may exploit these vulnerabilities to bypass the password functionality. Summary of the Invention

[0003] Some embodiments of this disclosure propose a cryptographic component independent of the database instance, which isolates cryptographic functions from data management functions, avoiding the risk of being implicated by native database vulnerabilities. Furthermore, the authorization component provides encrypted authorization information to the cryptographic service component and the database instance, and determines the database instance's permission to use the cryptographic service component based on the encrypted authorization information of the cryptographic service component and the database instance. Attackers cannot obtain useful plaintext information from the cryptographic service component and the database instance, thus preventing information leakage.

[0004] This disclosure provides embodiments of a cryptographic component, including: an authorization component configured to authorize a cryptographic service component and the database instance based on plaintext authorization information of a database instance, transmit encrypted identity information of the cryptographic service component to the cryptographic service component, and transmit an encrypted authorization key and encrypted authorization information of the database instance to the database instance; and the cryptographic service component configured to verify the encrypted authorization key and encrypted authorization information of the database instance transmitted by the database instance based on the encrypted identity information of the cryptographic service component, to determine whether the database instance is allowed to use the cryptographic service component.

[0005] In some embodiments, the authorization component is configured to generate a pair of first public keys and first private keys, encrypt the first private key to obtain the ciphertext identity information of the cryptographic service component, and use the first public key to encrypt the plaintext authorization key and the plaintext authorization information of the database instance to obtain the ciphertext authorization key and the ciphertext authorization information of the database instance, respectively.

[0006] In some embodiments, the authorization component is configured to encrypt the first private key using a symmetric key to obtain the encrypted identity information of the cryptographic service component.

[0007] In some embodiments, the authorization component is configured to generate the symmetric key based on the network interface card address.

[0008] In some embodiments, the authorization component is configured to transmit a digest of the plaintext authorization key and a digest of the plaintext authorization information of the database instance to the cryptographic service component; the cryptographic service component is configured to decrypt the encrypted identity information of the cryptographic service component using a symmetric key to obtain the first private key, decrypt the encrypted authorization key and the encrypted authorization information of the database instance transmitted by the database instance using the first private key, and verify the decrypted digest of the plaintext authorization key and the digest of the plaintext authorization information of the database instance using the digest of the plaintext authorization key from the authorization component and the digest of the plaintext authorization information of the database instance.

[0009] In some embodiments, the cryptographic service component is configured to generate the symmetric key based on the network interface card address.

[0010] In some embodiments, the cryptographic service component is configured to decrypt the ciphertext master key stored internally by using the plaintext authorization key, and in response to successfully decrypting the plaintext master key, determine that the database instance is allowed to use the cryptographic service component.

[0011] In some embodiments, the authorization component is configured to, in response to an authorization request from a password administrator, verify the identity information of the password administrator, the authorization request including the identity information of the password administrator and plaintext authorization information of the database instance; and, in response to successful verification, execute the authorization steps; or the cryptographic service component is configured to, in response to a usage request from the database instance, verify the encrypted authorization key and the encrypted authorization information of the database instance in the usage request, wherein the database instance issues the usage request to the cryptographic service component in response to a startup command from a database administrator.

[0012] In some embodiments, the cryptographic service component includes a cryptographic function component, and further includes one or more of the following components: an initialization component, configured to call an initialization interface to initialize the cryptographic function component before it runs; and a self-test component, configured to call a self-test interface to perform a self-test on the cryptographic function component before it runs.

[0013] In some embodiments, the self-testing component is configured to input test data into a first component of the cryptographic function components, obtain a first test result output by the first component, and determine the self-test result of the first component by comparing the first test result with a reference test result of the test data.

[0014] In some embodiments, the self-testing component is configured to obtain the code of the second component in the cryptographic function component, determine the first check code of the code, and determine the self-test result of the second component by comparing the first check code with the reference check code of the code.

[0015] In some embodiments, the initialization component is configured to perform deinitialization processing in response to a stop request from the database instance, wherein the database instance issues the stop request in response to a stop instruction from a database administrator.

[0016] In some embodiments, the authorization component is configured to, in response to a zeroing request from a password administrator, clear the ciphertext first public key stored internally by the authorization component, the ciphertext first public key being obtained by encrypting a first public key using a symmetric key; instruct the password service component to clear the digests of the ciphertext identity information of the password service component, the ciphertext master key, the plaintext authorization key, and the plaintext authorization information of the database instance stored internally by the password service component; and instruct the database instance to clear the ciphertext authorization key and the ciphertext authorization information of the database instance stored internally by the database instance.

[0017] In some embodiments, the cryptographic functional components include one or more of the following: a cryptographic algorithm component, a random number generation component, a cryptographic authentication component, a key management component, a secure transmission component, and a certificate authentication component.

[0018] This disclosure provides an information processing method for a cryptographic component independent of a database instance, comprising: an authorization component of the cryptographic component authorizing a cryptographic service component and the database instance based on plaintext authorization information of the database instance; transmitting encrypted identity information of the cryptographic service component to the cryptographic service component; and transmitting an encrypted authorization key and encrypted authorization information of the database instance to the database instance; and the cryptographic service component verifying the encrypted authorization key and encrypted authorization information transmitted by the database instance based on the encrypted identity information of the cryptographic service component, to determine whether the database instance is allowed to use the cryptographic service component.

[0019] In some embodiments, the authorization component authorizes the cryptographic service component of the cryptographic component and the database instance based on the plaintext authorization information of the database instance, including: the authorization component generating a pair of first public keys and first private keys, encrypting the first private key to obtain the ciphertext identity information of the cryptographic service component, and using the first public key to encrypt the plaintext authorization key and the plaintext authorization information of the database instance to obtain the ciphertext authorization key and the ciphertext authorization information of the database instance, respectively.

[0020] In some embodiments, the cryptographic service component verifies the ciphertext authorization key transmitted by the database instance and the ciphertext authorization information of the database instance based on the ciphertext identity information of the cryptographic service component. This includes: the authorization component transmitting a digest of the plaintext authorization key and a digest of the plaintext authorization information of the database instance to the cryptographic service component; the cryptographic service component decrypting the ciphertext identity information of the cryptographic service component using a symmetric key to obtain the first private key, decrypting the ciphertext authorization key transmitted by the database instance and the ciphertext authorization information of the database instance using the first private key, and verifying the digest of the decrypted plaintext authorization key and the digest of the plaintext authorization information of the database instance using the digest of the plaintext authorization key from the authorization component and the digest of the plaintext authorization information of the database instance; and / or the cryptographic service component decrypting the ciphertext master key stored internally by the cryptographic service component using the plaintext authorization key, and determining that the database instance is allowed to use the cryptographic service component in response to successfully decrypting the plaintext master key.

[0021] In some embodiments, the information processing method further includes: performing at least one of initialization and self-test on the cryptographic function component before the cryptographic function component in the cryptographic service component is run.

[0022] Some embodiments of this disclosure provide an information processing apparatus, including: a memory; and a processor coupled to the memory, the processor being configured to execute an information processing method based on instructions stored in the memory.

[0023] Some embodiments of this disclosure provide a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement an information processing method.

[0024] Some embodiments of this disclosure provide a computer program product including computer instructions that, when executed by a processor, implement an information processing method. Attached Figure Description

[0025] The accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. This disclosure can be more clearly understood from the following detailed description with reference to the accompanying drawings.

[0026] Obviously, the accompanying drawings described below are merely some embodiments of this disclosure. Those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0027] Figure 1 A schematic diagram illustrating cryptographic components of some embodiments of this disclosure is shown.

[0028] Figure 2 A schematic diagram showing the relationship between the parts in a cryptographic component of some embodiments of this disclosure is provided.

[0029] Figure 3 The diagram illustrates information processing methods according to some embodiments of this disclosure.

[0030] Figure 4 The diagram illustrates information processing methods according to some embodiments of this disclosure.

[0031] Figure 5 A schematic diagram of an information processing apparatus according to some embodiments of the present disclosure is shown.

[0032] It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of this disclosure.

[0033] Those skilled in the art will understand that the terms "first," "second," etc., in the embodiments of this disclosure are only used to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they indicate a necessary logical order between them.

[0034] It should also be understood that in the embodiments disclosed herein, "a plurality of" may refer to two or more, and "at least one" may refer to one, two or more.

[0035] It should also be understood that any component, data or structure mentioned in the embodiments of this disclosure can generally be understood as one or more unless expressly defined or given to the contrary in the context.

[0036] Furthermore, the term "and / or" in this disclosure is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this disclosure generally indicates that the preceding and following related objects have an "or" relationship.

[0037] It should also be understood that the description of the various embodiments in this disclosure emphasizes the differences between the various embodiments, and the similarities or similarities can be referred to each other. For the sake of brevity, they will not be described in detail.

[0038] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0039] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit this disclosure or its application or use.

[0040] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0041] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0042] Furthermore, in order to avoid obscuring this disclosure with unnecessary details, only processing steps and / or device structures closely related to the scheme at least according to this disclosure are shown in the accompanying drawings, while other details that are not closely related to this disclosure are omitted.

[0043] Figure 1 A schematic diagram illustrating cryptographic components of some embodiments of this disclosure is shown.

[0044] like Figure 1 As shown, the cryptographic component is independent of the database instance. The database instance includes, but is not limited to, instances of various types of databases, such as distributed database instances. The cryptographic component in this embodiment includes, for example, an authorization component and a cryptographic service component. The cryptographic service component includes, for example, a cryptographic function component, an initialization component, a self-checking component, a logging and auditing component, and an OpenSSL (Open Secure Sockets Layer) library. The cryptographic function component includes, for example, a cryptographic algorithm component, a random number generation component, a cryptographic authentication component, a key management component, a secure transmission component, and a certificate authentication component. The various parts of the cryptographic component are described below.

[0045] The authorization component is configured to authorize the cryptographic service component and the database instance, providing them with encrypted authorization information. This includes providing the cryptographic service component with its encrypted identity information and the database instance with its encrypted authorization key and encrypted authorization information. A cryptographic administrator, using their identity information, can run the authorization component to convert the cryptographic component from initial mode to ready mode, or reset it from ready mode to initial mode via a zeroing operation. The authorization component can be, for example, in the form of an executable file.

[0046] The password service component is configured to verify the identity of the database instance and, upon successful verification, provide various password services to the database instance. The password service component can be, for example, a dynamic link library. The various parts of the password service component are described below.

[0047] The initialization component is configured to perform authorization verification on the database instance. After successful verification, the password function component is initialized. When the database instance is shut down, the password function component can also be deinitialized.

[0048] The self-testing component is configured to perform self-tests on the cryptographic functional components. The self-testing content includes, but is not limited to, code integrity testing and algorithm function testing.

[0049] The cryptographic algorithm component is configured to implement common cryptographic algorithm functions such as digital signatures, digest calculation, and data encryption / decryption, including but not limited to SM2, SM3, and SM4 algorithms. SM2 is an elliptic curve cryptography algorithm based on public-key cryptography. SM3 is a one-way hash function capable of calculating hash values. SM4 is a block cipher algorithm belonging to the symmetric cryptography category.

[0050] The random number generation component is configured to generate random numbers, symmetric keys, etc. required by the user based on the operating system entropy source, such as generating random numbers based on the SM3-DRBG algorithm.

[0051] The key management component is configured to implement management functions such as key generation, use, update and destruction, including key generation interface, key storage interface, key loading interface, key destruction interface, and key lifecycle management framework.

[0052] The password authentication component is configured to provide password authentication services to external database instances, including password digest calculation and digest-based password comparison.

[0053] The certificate authentication component is configured to verify the validity of digital certificates, such as supporting X.509 format digital certificates and digital certificates based on CA (Certification Authority) root certificates.

[0054] Secure transport component: Supports TLS (Transport Layer Security) secure transport protocol and is configured to perform key exchange based on asymmetric encryption algorithms or data transmission based on symmetric encryption.

[0055] The logging and auditing components are configured to record logs and perform security audits to ensure the secure, controllable, and traceable operation of the cryptographic components.

[0056] The OpenSSL library is a cross-platform, open-source cryptographic library that also comes with a standalone command-line tool, including: a low-level cryptographic algorithm library that provides a programmable cryptographic interface; an SSL (Secure Sockets Layer) protocol library; and command-line tools.

[0057] This disclosure also proposes independent password administrators and database administrators, ensuring that password management permissions and database management permissions are inherently isolated. In traditional database systems, database administrators typically have access to all data, including encryption keys, which presents internal security challenges.

[0058] The password administrator uses the authorization component to grant access to the password service component to the database instance (the user of the password component). The authorization component can verify the password administrator's identity using the password administrator's identity information.

[0059] Database administrators can start or stop database instances within their authorized scope. Authorized database instances can call the cryptographic service component's interface to use the cryptographic service component's functions.

[0060] Figure 2 A schematic diagram showing the relationship between the parts in a cryptographic component of some embodiments of this disclosure is provided.

[0061] The password administrator runs the authorization component, entering their own identity information and the plaintext authorization information for the database instance to request authorization for that instance. The authorization component is configured to, in response to an authorization request from the password administrator, verify the password administrator's identity information (set as a PIN) and the plaintext authorization information for the database instance (set as A1); and, in response to successful verification, execute the authorization steps. If verification fails, authorization fails.

[0062] The authorization component is configured to authorize the cryptographic service component and the database instance based on the plaintext authorization information (A1) of the database instance, transmit the encrypted identity information (set as IDC1) of the cryptographic service component to the cryptographic service component, and transmit the encrypted authorization key (set as KC1) and the encrypted authorization information (set as AC1) of the database instance to the database instance.

[0063] The cryptographic service component is configured to verify the ciphertext authorization key (KC1) transmitted by the database instance and the ciphertext authorization information (AC1) of the database instance based on the ciphertext identity information (IDC1) of the cryptographic service component, in order to determine whether the database instance is allowed to use the cryptographic service component.

[0064] In some embodiments, the cryptographic service component is configured to verify the encrypted authorization key in the usage request and the encrypted authorization information of the database instance in response to a usage request from the database instance, wherein the database instance issues a usage request to the cryptographic service component in response to a startup command from the database administrator.

[0065] The cryptographic component is independent of the database instance, isolating cryptographic functions from data management functions, avoiding the risk of being implicated by native database vulnerabilities. Furthermore, the authorization component provides encrypted authorization information to the cryptographic service component and the database instance, determining the database instance's permissions to use the cryptographic service component based on the encrypted authorization information from the cryptographic service component and the database instance. Attackers cannot obtain useful plaintext information from the cryptographic service component and the database instance, preventing information leakage.

[0066] In some embodiments of generating encrypted authorization information, the authorization component is configured to generate a pair of first public keys (denoted as PUB1) and first private keys (denoted as ID1), encrypt the first private key (ID1) to obtain the encrypted identity information (IDC1) of the cryptographic service component, and use the first public key (PUB1) to encrypt the plaintext authorization key (K1) and the plaintext authorization information (A1, used to indicate which cryptographic functions the database instance has permission to use) to obtain the encrypted authorization key (KC1) and the encrypted authorization information (AC1) of the database instance.

[0067] In some embodiments, the authorization component generates a first public key (PUB1) and a first private key (ID1) based on, for example, the SM2 algorithm. The first private key (ID1) is used to represent the identity information of the cryptographic service component.

[0068] In some embodiments of generating ciphertext authorization information for a cryptographic service component, the authorization component is configured to encrypt a first private key (ID1) using a symmetric key (let's call it KD1) based on, for example, the SM4 algorithm, to obtain the ciphertext identity information (IDC1) of the cryptographic service component.

[0069] In some embodiments, the authorization component is configured to encrypt the first public key (PUB1) using a symmetric key (KD1) based on, for example, the SM4 algorithm, to obtain the ciphertext first public key (PUBC1), and store it inside the authorization component.

[0070] In some embodiments, the authorization component is configured to generate a symmetric key (KD1) based on the network interface card (NIC) address. The NIC address is, for example, the MAC (Media Access Control) address of the NIC.

[0071] In some embodiments, the authorization component is configured to transmit a digest of the plaintext authorization key (K1) and a digest of the plaintext authorization information (A1) of the database instance to the cryptographic service component so that the cryptographic service component can verify whether the database instance has usage rights.

[0072] In some embodiments, the authorization component is configured to compute a digest of the plaintext authorization key (K1) and a digest of the plaintext authorization information (A1) of the database instance based on, for example, the SM3 algorithm.

[0073] In some embodiments, the cryptographic service component is configured to decrypt the encrypted identity information (IDC1) of the cryptographic service component using a symmetric key (KD1) to obtain a first private key (ID1); to decrypt the encrypted authorization key (KC1) transmitted by the database instance and the encrypted authorization information (AC1) of the database instance using the first private key (ID1) to obtain a plaintext authorization key (K1) and plaintext authorization information (A1) of the database instance; to calculate the digest of the plaintext authorization key (K1) and the digest of the plaintext authorization information (A1) of the database instance; and to verify the decrypted digest of the plaintext authorization key (K1) and the digest of the plaintext authorization information (A1) of the database instance using the digest of the plaintext authorization key (K1) from the authorization component and the digest of the plaintext authorization information (A1) of the database instance. If the verification passes, the database instance is allowed to use the cryptographic service component; if the verification fails, the database instance is not allowed to use the cryptographic service component. The digest is calculated based on, for example, the SM3 algorithm.

[0074] In some embodiments, the cryptographic service component is configured to generate a symmetric key (KD1) based on the network interface card (NIC) address. The NIC address is, for example, the MAC address of the NIC.

[0075] In some embodiments, the cryptographic service component is configured to decrypt a ciphertext master key (KMC1) stored internally by using the (decrypted) plaintext authorization key (K1). Upon successful decryption of the plaintext master key (KM1), the database instance is determined to be allowed to use the cryptographic service component. If the plaintext master key (KM1) is not successfully decrypted, the database instance is not allowed to use the cryptographic service component. The master key is used to generate other keys. For example, an encrypted table can be created, and the encryption key for this table can be generated based on the master key. To prevent cracking, the master key can be changed periodically.

[0076] If the database instance passes verification and the plaintext master key is successfully decrypted, the database instance is allowed to use the cryptographic service component, which can then perform initialization and self-test.

[0077] In some embodiments, the initialization component is configured to call an initialization interface to initialize the cryptographic function component before the cryptographic function component runs. For example, the initialization interface of the cryptographic authentication component is called to initialize the cryptographic authentication component; the initialization interface of the key management component is called to initialize the key management component; and the initialization interface of the secure transmission component is called to initialize the secure transmission component.

[0078] In some embodiments, the self-testing component is configured to call a self-testing interface to perform a self-test on the cryptographic function component before the cryptographic function component runs. The self-testing interface may be, for example, a test interface that calls the test interface of the cryptographic algorithm component to perform a self-test based on the test results; calls the test interface of the random number generation component to perform a self-test based on the test results; or calls the test interface of the certificate authentication component to perform a self-test based on the test results.

[0079] In some embodiments of the self-testing method, the self-testing component is configured to input test data into a first component of the cryptographic function component, obtain a first test result output by the first component, and determine the self-testing result of the first component by comparing the first test result with a reference test result of the test data. If the first test result of the test data is consistent with the reference test result, it indicates that the algorithm of the first component has not been tampered with; if the first test result of the test data is inconsistent with the reference test result, it indicates that the algorithm of the first component has been tampered with. The first component includes, but is not limited to, a cryptographic algorithm component, a random number generation component, and a certificate authentication component.

[0080] In some embodiments of the self-testing method, the self-testing component is configured to obtain the code of a second component in the cryptographic function component, determine a first checksum of the code, and determine the self-test result of the second component by comparing the first checksum with a reference checksum of the code. If the first checksum matches the reference checksum, it indicates that the code of the second component has not been tampered with; if the first checksum does not match the reference checksum, it indicates that the code of the second component has been tampered with. The second component includes, but is not limited to, a cryptographic algorithm component, a random number generation component, and a certificate authentication component.

[0081] After initialization and self-test are completed, the cryptographic service component enters the service state. In the service state, various components in the cryptographic function component can be called by the database instance to provide various cryptographic algorithm services to the database instance.

[0082] For example, when a database instance needs to encrypt or decrypt data, it can call the cryptographic algorithm component; when it needs the encryption / decryption key, it can call the key management component; when it needs to generate random numbers, it can call the random number generation component; when it needs to support client or data subscriber authentication using username and password, it can call the password authentication component; when it needs to support key exchange for encrypted transmission using digital certificates, it can call the certificate authentication component to verify the validity of the digital certificate; and when the database instance transmits encrypted data with a client or data subscriber, it can call the secure transmission component. The certificate authentication component provides certificate authentication capabilities to the secure transmission component, the secure transmission component provides the digital certificate path to the certificate authentication component, and the certificate authentication component returns the digital certificate validity verification result. The cryptographic component provides cryptographic algorithm support through a wrapper around the OpenSSL library. When a user (database instance) calls the interface of the cryptographic component, the cryptographic component internally translates it into logic for calling the OpenSSL Application Programming Interface (API).

[0083] In some embodiments, the initialization component is configured to perform deinitialization processing in response to a stop request from the database instance, wherein the database instance issues a stop request in response to a stop command from the database administrator. This allows the database administrator to shut down the database instance.

[0084] In some embodiments, the authorization component is configured to, in response to a zeroing request from a cryptography administrator, clear the ciphertext first public key stored internally by the authorization component, instruct the cryptography service component to clear the digests of the cryptography service component's ciphertext identity information and ciphertext master key, as well as the digests of the plaintext authorization key and the plaintext authorization information of the database instance stored internally by the cryptography service component, and instruct the database instance to clear the ciphertext authorization key and the ciphertext authorization information of the database instance stored internally by the database instance. Thus, the cryptography administrator deletes the corresponding cryptography service-related critical security information (such as keys, authorization information, etc.) of the database instance, thereby rendering the database instance unable to use the services of the cryptography component.

[0085] During the process of the cryptographic component providing cryptographic services to the outside world, the logging and auditing components provide logging and security auditing services for the initialization component, the self-testing component, and various cryptographic functional components.

[0086] Figure 3 The diagram illustrates an information processing method according to some embodiments of the present disclosure, which is applied to a cryptographic component independent of a database instance. The information processing method includes steps 310 to 320, and may further include step 330 if necessary.

[0087] In step 310, the authorization component authorizes the cryptographic service component and the database instance based on the plaintext authorization information of the database instance, transmits the encrypted identity information of the cryptographic service component to the cryptographic service component, and transmits the encrypted authorization key and the encrypted authorization information of the database instance to the database instance.

[0088] In some embodiments, the authorization component authorizes the cryptographic service component and the database instance based on the plaintext authorization information of the database instance, including: the authorization component generating a pair of first public keys and first private keys, encrypting the first private key to obtain the ciphertext identity information of the cryptographic service component, and using the first public key to encrypt the plaintext authorization key and the plaintext authorization information of the database instance to obtain the ciphertext authorization key and the ciphertext authorization information of the database instance, respectively.

[0089] In step 320, the cryptographic service component verifies the encrypted authorization key transmitted by the database instance and the encrypted authorization information of the database instance based on the encrypted identity information of the cryptographic service component, in order to determine whether the database instance is allowed to use the cryptographic service component.

[0090] In some embodiments, the verification of the ciphertext authorization key and the ciphertext authorization information transmitted by the database instance by the cryptographic service component based on the ciphertext identity information of the cryptographic service component includes: the authorization component transmitting a digest of the plaintext authorization key and a digest of the plaintext authorization information of the database instance to the cryptographic service component; the cryptographic service component decrypting the ciphertext identity information of the cryptographic service component using a symmetric key to obtain a first private key, decrypting the ciphertext authorization key and the ciphertext authorization information transmitted by the database instance using the first private key, and verifying the digest of the decrypted plaintext authorization key and the digest of the plaintext authorization information of the database instance using the digest of the plaintext authorization key from the authorization component and the digest of the plaintext authorization information of the database instance.

[0091] In some embodiments, the verification content of the cryptographic service component further includes: the cryptographic service component decrypting the ciphertext master key (KMC1) stored internally by using the (decrypted) plaintext authorization key (K1); and in response to successfully decrypting the plaintext master key (KM1), determining that the database instance is allowed to use the cryptographic service component. If the plaintext master key (KM1) is not successfully decrypted, the database instance is not allowed to use the cryptographic service component.

[0092] In step 330, before the cryptographic function component runs, at least one of the following is performed: initialization and self-test.

[0093] The initialization component calls the initialization interface to initialize the password function component; the self-test component calls the self-test interface to perform a self-test on the password function component.

[0094] The self-testing component inputs test data into the first component of the cryptographic function component, obtains the first test result output by the first component, and determines the self-test result of the first component by comparing the first test result with the reference test result of the test data. If the first test result of the test data is consistent with the reference test result, it means that the algorithm of the first component has not been tampered with; if the first test result of the test data is inconsistent with the reference test result, it means that the algorithm of the first component has been tampered with. The first component may include, but is not limited to, a cryptographic algorithm component, a random number generation component, and a certificate authentication component.

[0095] The self-test component retrieves the code of the second component within the cryptographic function component, determines the first checksum of the code, and compares the first checksum with a reference checksum to determine the self-test result of the second component. If the first checksum matches the reference checksum, it indicates that the code of the second component has not been tampered with; if the first checksum does not match the reference checksum, it indicates that the code of the second component has been tampered with. The second component may include, but is not limited to, cryptographic algorithm components, random number generation components, and certificate authentication components.

[0096] After initialization and self-test are complete, the cryptographic component enters the service state. In the service state, each component of the cryptographic function component can be invoked by the database instance to provide cryptographic algorithm services.

[0097] Figure 4 The diagram illustrates information processing methods according to some embodiments of this disclosure.

[0098] The password administrator requests the authorization tool to authorize the database instance and the password service component, enabling the database instance to use the functionality of the password service component, as detailed in steps 410, 421, and 422.

[0099] In step 410, the password administrator sends an authorization request to the authorization tool (set as AT1). The authorization request includes the password administrator's identity information (PIN) and the plaintext authorization information (A1) of the database instance.

[0100] In cases where no authorization is granted, the cryptographic component is in its initial mode.

[0101] The authorization component generates a first public key (PUB1) and a first private key (ID1) based on, for example, the SM2 algorithm. The first private key (ID1) is used to represent the identity information of the cryptographic service component. A symmetric key (KD1) is generated based on the network card address. Based on, for example, the SM4 algorithm, the first public key (PUB1) is encrypted using the symmetric key (KD1) to obtain the ciphertext first public key (PUBC1), which is stored inside the authorization component. Based on, for example, the SM4 algorithm, the first private key (ID1) is encrypted using the symmetric key (KD1) to obtain the ciphertext identity information (IDC1) of the cryptographic service component. The plaintext authorization key (K1) and the plaintext authorization information (A1) of the database instance are encrypted using the first public key (PUB1) to obtain the ciphertext authorization key (KC1) and the ciphertext authorization information (AC1) of the database instance, respectively. Based on, for example, the SM3 algorithm, the authorization component calculates the digest of the plaintext authorization key (K1) and the digest of the plaintext authorization information (A1) of the database instance.

[0102] In step 421, the authorization tool transmits the first encrypted authorization information to the database instance, including the encrypted authorization key (KC1) and the encrypted authorization information (AC1) of the database instance. The authorization tool receives a response message returned by the database instance, such as authorization success or authorization failure.

[0103] In step 422, the authorization tool transmits second ciphertext authorization information to the cryptographic service component, including the cryptographic service component's ciphertext identity information (IDC1), a digest of the plaintext authorization key (K1), and a digest of the database instance's plaintext authorization information (A1). The authorization tool receives a response message from the cryptographic service component, such as authorization success or authorization failure. If authorization is successful, the cryptographic component transitions from initial mode to ready mode.

[0104] Once the database instance is authorized, the database administrator can start the database instance, and the password component will initialize and perform a self-check, as detailed in steps 430 to 480.

[0105] In step 430, the database administrator sends a startup command to the database instance.

[0106] In step 440, in response to the startup command, the database instance sends an initialization request (i.e., a usage request) to the initialization component. The initialization request includes the encrypted authorization key (KC1) and the encrypted authorization information (AC1) of the database instance.

[0107] The cryptographic service component uses the symmetric key (KD1) to decrypt the encrypted identity information (IDC1) of the cryptographic service component to obtain the first private key (ID1). The first private key (ID1) is then used to decrypt the encrypted authorization key (KC1) transmitted by the database instance and the encrypted authorization information (AC1) of the database instance to obtain the plaintext authorization key (K1) and the plaintext authorization information (A1) of the database instance. The digests of the plaintext authorization key (K1) and the plaintext authorization information (A1) of the database instance are calculated. The digests of the plaintext authorization key (K1) from the authorization component and the plaintext authorization information (A1) of the database instance are then used to verify the decrypted digests of the plaintext authorization key (K1) and the plaintext authorization information (A1) of the database instance.

[0108] The cryptographic service component uses the (decrypted) plaintext authorization key (K1) to decrypt the ciphertext master key (KMC1) stored internally by the cryptographic service component. In response to the successful decryption of the plaintext master key (KM1), it is determined that the database instance is allowed to use the cryptographic service component.

[0109] If the database instance passes verification and the plaintext master key is successfully decrypted, the database instance is allowed to use the cryptographic service component, which can then perform initialization and self-test.

[0110] In step 450, the initialization component calls the initialization interface to initialize the password function component; the self-test component calls the self-test interface to perform a self-test on the password function component.

[0111] After initialization and self-test are complete, the cryptographic component enters the service state. In the service state, each component of the cryptographic function component can be invoked by the database instance to provide cryptographic algorithm services.

[0112] In step 460, the initialization component sends an initialization response to the database instance, such as initialization success or initialization failure.

[0113] After successful initialization, the cryptographic component enters the service state. In the service state, the cryptographic component supports encryption algorithms such as SM2, SM3, and SM4, as well as a random number generator based on the SM3-DRBG algorithm (introducing operating system entropy sources to enhance randomness), and supports the X.509 digital certificate management protocol and the TLS (compatible with TLSv1.2 and TLSv1.3) transport security protocol. In the service state, the key management component uses random numbers generated based on the SM3-DRBG algorithm when generating new symmetric keys.

[0114] In step 470, the database instance (acting as a server) initiates a listening service for client connections, passing its digital certificate (path) to the secure transport component. The certificate authentication component authenticates the incoming digital certificate based on the CA root certificate and returns the authentication result to the secure transport component. The secure transport component then returns a listening instruction to the database instance. If the digital certificate authentication is successful, the database instance begins listening for client connections.

[0115] The cryptographic component manages the server (database instance) for the TLS transport security protocol. Key negotiation between the server and client uses, for example, the SM2-ECDHE (Ad hoc Elliptic Curve Diffie-Hellman) protocol. The cryptographic component supports X.509 digital certificates issued using SM2 and SM3 algorithms for TLS handshake and client authentication. When starting server listening, it supports verifying the server's local public / private key certificates using CA root certificates issued using SM2 and SM3 algorithms; when accepting client connections, it also uses CA root certificates issued using SM2 and SM3 algorithms to verify the validity of client certificates. After accepting a new TLS connection, the server encrypts the transmitted content using the SM4 symmetric encryption algorithm.

[0116] By relying on two layers of verification—CA root certificate and server certificate (such as X.509 certificate)—man-in-the-middle attacks cannot be forged by legitimate certificates, thus preventing man-in-the-middle attacks between the database instance and the client.

[0117] In step 480, the database instance sends a startup response to the database administrator, such as startup complete or startup failed.

[0118] Database administrators can also shut down database instances as needed, see steps 490 to 4130 for details.

[0119] In step 490, the database administrator sends a stop command to the database instance to shut it down.

[0120] In step 4100, the database instance responds to the stop command by sending a deinitialization request (i.e., a stop request) to the initialization component.

[0121] The initialization component responds to deinitialization requests (i.e., stop requests) from the database instance and performs deinitialization processing. Deinitialization processing includes, but is not limited to, flushing dirty data to disk, closing connections, and reclaiming memory.

[0122] In step 4110, the initialization component interacts with the secure transport component, and the initialization component requests the secure transport component to stop listening to client connections. The initialization component then closes its listening to client connections.

[0123] In step 4120, the initialization component sends a deinitialization response to the database instance, such as deinitialization completed or deinitialization failed.

[0124] In step 4130, the database instance sends a stop response to the database administrator, such as the database instance process terminating.

[0125] The password administrator can also delete critical security information (such as keys, authorization information, etc.) related to the password service of the database instance as needed, thereby making the database instance unable to use the password component service. See steps 4140 to 4160 for details.

[0126] In step 4140, the password administrator sends a reset request to the authorization component.

[0127] In step 4150, the authorization component responds to the zeroing request by clearing security-related information in the password component, including the following processing:

[0128] The authorization component clears the encrypted first public key (PUBC1) stored internally.

[0129] The authorization component instructs the cryptographic service component to clear the configuration information stored internally by the cryptographic service component, including the digests of the cryptographic service component's ciphertext identity information (IDC1), ciphertext master key (KMC1), plaintext authorization key (K1), and plaintext authorization information (A1) of the database instance.

[0130] The authorization component instructs the database instance to clear the encrypted authorization key (KC1) and encrypted authorization information (AC1) stored internally by the database instance.

[0131] In step 4160, the authorization component sends a reset response to the password administrator, such as "reset complete". After the reset operation is completed, the password component returns to its initial mode.

[0132] The cryptographic components and information processing methods disclosed herein have the following effects:

[0133] (1) The cryptographic components and the database are independent of each other, avoiding the risk of being implicated by the database's native vulnerabilities.

[0134] Traditional database encryption functions are deeply coupled with database management system code, resulting in a jumbled mix of modules. This makes the encryption logic vulnerable to attacks stemming from database vulnerabilities and permission flaws. This disclosure encapsulates cryptographic encryption capabilities as an independent component, decoupling it from the database system and business applications, thus isolating code, functionality, and deployment. Even if the database itself has security vulnerabilities, attackers cannot bypass the protection mechanisms of the independent cryptographic component to steal or tamper with encrypted data, fundamentally solving the problems of blurred protection boundaries and susceptibility to penetration inherent in traditional encryption schemes.

[0135] (2) The cryptographic component has an independent authorization system to achieve separation of permissions and responsibilities.

[0136] Traditional database encryption authorization relies on the database's native permission system, which centralizes permissions and blurs responsibilities, failing to achieve role isolation and easily leading to security risks such as unauthorized operations and permission abuse. This disclosure features an authorization mechanism independent of the database management system, granting encrypted authorization to database instances using cryptographic components. Plaintext authorization information cannot be obtained by external parties. It separates the roles of database administrator and password administrator, as well as their permissions and responsibilities, eliminating the security risks caused by excessive privileges of a single administrator.

[0137] (3) The cryptographic component has independent key lifecycle management to prevent the risk of key leakage.

[0138] Traditional database key management is deeply integrated with the database system. Key storage, retrieval, updating, and destruction all rely on the database's own mechanisms, resulting in strong coupling and vulnerability to theft due to database vulnerabilities. This disclosure adopts an independent key lifecycle management system. The generation, storage, authorization, updating, and destruction of keys are all independently controlled by the cryptographic component, completely isolated from the database and business applications.

[0139] (4) The cryptographic component provides static data protection and transmission data protection. On this basis, runtime protection is added. The cryptographic component has independent self-testing capabilities. When it starts up, it can actively verify the code integrity and functional availability of the cryptographic component to prevent the cryptographic component from being hijacked, tampered with, or intruded. It can effectively defend against runtime attacks.

[0140] (5) The cryptographic components adopt a black box system to eliminate backdoors and human risks from the root.

[0141] For database developers and users, the cryptographic component is a black box system, outputting only ciphertext and never revealing any sensitive information such as plaintext keys, authorization details, or internal operating status. Developers cannot implant backdoors or vulnerabilities in the cryptographic component, and users cannot access its internal implementation details. Even if the business application is compromised, attackers cannot obtain the keys or core encryption parameters, thus fundamentally ensuring the security of the cryptographic algorithm itself, the keys, and the encrypted data.

[0142] Figure 5 Schematic diagrams of information processing apparatuses according to some embodiments of the present disclosure are shown. Figure 5 As shown, the information processing apparatus 500 of this embodiment includes a memory 510 and a processor 520 coupled to the memory 510. The processor 520 is configured to execute the information processing methods of any of the foregoing embodiments based on instructions stored in the memory 510.

[0143] The information processing device 500 may also include an input / output interface 530, a network interface 540, a storage interface 550, etc. These interfaces 530, 540, 550, as well as the memory 510 and the processor 520, may be connected, for example, via a bus 560.

[0144] The memory 510 may include, for example, system memory, fixed non-volatile storage media, etc. The system memory may store, for example, the operating system, application programs, boot loader, and other programs.

[0145] The processor 520 can be implemented using a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates, or transistors, or other discrete hardware components.

[0146] The input / output interface 530 provides a connection interface for input / output devices such as monitors, mice, keyboards, and touchscreens. The network interface 540 provides a connection interface for various networked devices. The storage interface 550 provides a connection interface for external storage devices such as SD cards and USB flash drives. The bus 560 can use any bus architecture from a variety of bus structures. For example, bus architectures include, but are not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, and Peripheral Component Interconnect (PCI) bus.

[0147] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more (non-transitory) computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, cloud storage, etc.) containing computer program code. A computer program product should be understood as a software product that primarily implements its solution through a computer program.

[0148] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0149] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0150] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

Claims

1. A cryptographic component, comprising: The authorization component is configured to authorize the cryptographic service component and the database instance based on the plaintext authorization information of the database instance, transmit the encrypted identity information of the cryptographic service component to the cryptographic service component, and transmit the encrypted authorization key and the encrypted authorization information of the database instance to the database instance. as well as The cryptographic service component is configured to verify the ciphertext authorization key transmitted by the database instance and the ciphertext authorization information of the database instance based on the ciphertext identity information of the cryptographic service component, so as to determine whether the database instance is allowed to use the cryptographic service component.

2. The cryptographic component according to claim 1, wherein, The authorization component is configured to generate a pair of first public keys and first private keys, encrypt the first private key to obtain the ciphertext identity information of the cryptographic service component, and use the first public key to encrypt the plaintext authorization key and the plaintext authorization information of the database instance to obtain the ciphertext authorization key and the ciphertext authorization information of the database instance, respectively.

3. The cryptographic component according to claim 2, wherein, The authorization component is configured to encrypt the first private key using a symmetric key to obtain the encrypted identity information of the cryptographic service component.

4. The cryptographic component according to claim 3, wherein, The authorization component is configured to generate the symmetric key based on the network interface card address.

5. The cryptographic component according to claim 2, wherein, The authorization component is configured to transmit a digest of the plaintext authorization key and a digest of the plaintext authorization information of the database instance to the cryptographic service component. The cryptographic service component is configured to decrypt the encrypted identity information of the cryptographic service component using a symmetric key to obtain the first private key, decrypt the encrypted authorization key transmitted by the database instance and the encrypted authorization information of the database instance using the first private key, and verify the digest of the decrypted plaintext authorization key and the digest of the plaintext authorization information of the database instance using the digest of the plaintext authorization key from the authorization component and the digest of the plaintext authorization information of the database instance.

6. The cryptographic component according to claim 5, wherein, The cryptographic service component is configured to generate the symmetric key based on the network interface card address.

7. The cryptographic component according to claim 2, wherein, The cryptographic service component is configured to decrypt the ciphertext master key stored internally by using the plaintext authorization key, and in response to successfully decrypting the plaintext master key, determine that the database instance is allowed to use the cryptographic service component.

8. The cryptographic component according to claim 1, wherein: The authorization component is configured to, in response to an authorization request from a password administrator, verify the identity information of the password administrator, the authorization request including the identity information of the password administrator and the plaintext authorization information of the database instance; and, in response to successful verification, execute the authorization steps. or The cryptographic service component is configured to verify the encrypted authorization key and the encrypted authorization information of the database instance in response to a usage request from the database instance, wherein the database instance sends the usage request to the cryptographic service component in response to a startup command from the database administrator.

9. The cryptographic component according to claim 1, wherein, The cryptographic service component includes cryptographic function components, and also includes one or more of the following components: The initialization component is configured to call the initialization interface to initialize the cryptographic function component before the cryptographic function component runs; The self-test component is configured to call the self-test interface to perform a self-test on the cryptographic function component before the cryptographic function component runs.

10. The cryptographic component according to claim 9, wherein, The self-testing component is configured to input test data into the first component of the cryptographic function component, obtain the first test result output by the first component, and determine the self-test result of the first component by comparing the first test result with the reference test result of the test data.

11. The cryptographic component according to claim 9, wherein, The self-testing component is configured to obtain the code of the second component in the password function component, determine the first check code of the code, and determine the self-test result of the second component by comparing the first check code with the reference check code of the code.

12. The cryptographic component according to claim 9, wherein, The initialization component is configured to perform deinitialization processing in response to a stop request from the database instance, wherein the database instance issues the stop request in response to a stop command from the database administrator.

13. The cryptographic component according to claim 7, wherein, The authorization component is configured to, in response to a zeroing request from a password administrator, clear the ciphertext first public key stored internally by the authorization component, the ciphertext first public key being obtained by encrypting the first public key using a symmetric key; instruct the password service component to clear the digest of the ciphertext identity information of the password service component, the ciphertext master key, the plaintext authorization key, and the plaintext authorization information digest of the database instance stored internally by the password service component; and instruct the database instance to clear the ciphertext authorization key and the ciphertext authorization information of the database instance stored internally by the database instance.

14. The cryptographic component according to claim 9, wherein, The cryptographic functional components include one or more of the following: cryptographic algorithm component, random number generation component, cryptographic authentication component, key management component, secure transmission component, and certificate authentication component.

15. An information processing method applied to a cryptographic component independent of a database instance, comprising: The authorization component of the cryptographic component authorizes the cryptographic service component and the database instance based on the plaintext authorization information of the database instance, transmits the encrypted identity information of the cryptographic service component to the cryptographic service component, and transmits the encrypted authorization key and the encrypted authorization information of the database instance to the database instance. as well as The cryptographic service component verifies the encrypted authorization key transmitted by the database instance and the encrypted authorization information of the database instance based on the encrypted identity information of the cryptographic service component, in order to determine whether the database instance is allowed to use the cryptographic service component.

16. The information processing method according to claim 15, wherein, The authorization component authorizes the cryptographic service component of the cryptographic component and the database instance based on the plaintext authorization information of the database instance, including: The authorization component generates a pair of first public keys and first private keys, encrypts the first private key to obtain the ciphertext identity information of the cryptographic service component, and uses the first public key to encrypt the plaintext authorization key and the plaintext authorization information of the database instance to obtain the ciphertext authorization key and the ciphertext authorization information of the database instance, respectively.

17. The information processing method according to claim 16, wherein, The cryptographic service component verifies the encrypted authorization key transmitted by the database instance and the encrypted authorization information of the database instance based on the encrypted identity information of the cryptographic service component, including: The authorization component transmits the digest of the plaintext authorization key and the digest of the plaintext authorization information of the database instance to the cryptographic service component; the cryptographic service component uses a symmetric key to decrypt its encrypted identity information to obtain the first private key, uses the first private key to decrypt the encrypted authorization key and the encrypted authorization information transmitted by the database instance, and uses the digest of the plaintext authorization key from the authorization component and the digest of the plaintext authorization information of the database instance to verify the decrypted digest of the plaintext authorization key and the digest of the plaintext authorization information of the database instance; and / or The cryptographic service component uses the plaintext authorization key to decrypt the ciphertext master key stored internally within the cryptographic service component. In response to successfully decrypting the plaintext master key, it is determined that the database instance is allowed to use the cryptographic service component.

18. The information processing method according to claim 15, further comprising: Before the cryptographic function component in the cryptographic service component runs, at least one of the following is performed: initialization and self-test.

19. An information processing apparatus, comprising: Memory; And a processor coupled to the memory, the processor being configured to execute the information processing method of any one of claims 15-18 based on instructions stored in the memory.

20. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the information processing method of any one of claims 15-18.

21. A computer program product comprising computer instructions that, when executed by a processor, implement the information processing method according to any one of claims 15-18.

Images