A system, method, and apparatus for identity information protection, deployment, and verification

Abstract

The embodiment of the present application discloses a system, method and device for identity information protection, deployment and verification. In the embodiment of the present application, the system for identity information protection, deployment and verification comprises a continuous integration continuous delivery / deployment system, a resource arrangement scheduling system, a password module management system, a consumer application program machine and a provider application program machine. The password module management system is used for receiving business application identity information, encrypting the business application identity information, and generating a business application trusted identity information description file. The consumer application program machine is used for receiving the business application trusted identity information description file, decrypting the business application trusted identity information description file into plaintext information, and sending the plaintext information to the provider application program machine. The provider application program machine is used for receiving the business application trusted identity information description file and the plaintext information, and verifying the business application identity information. Through the above system, the identity information can be effectively protected, deployed and verified.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically, to a system, method, and apparatus for protecting, deploying, and verifying identity information. Background Technology

[0002] With the development of technologies such as cloud computing, big data, and the Internet of Things, business applications have developed rapidly. The scale, complexity, and diversity of these applications are constantly increasing, which not only brings more business opportunities but also puts forward higher requirements for the management and security of identity information in business applications. In complex network environments, identity forgery and theft incidents occur frequently, posing a huge threat to the security of business applications.

[0003] In the existing technology, business application A on server 1 obtains its own business-level key information from a public server using its own identity information, and then performs decryption and other processing on the business layer using the key information. Since the identity information of business application A is not effectively protected, business application B on server 2 can impersonate the identity information of business application A and obtain the business-level key information of business application A from the public server, that is, steal the identity information of business application A and pose a threat to business application A.

[0004] In conclusion, how to effectively protect, deploy, and verify identity information is a problem that needs to be solved. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a system, method, and apparatus for identity information protection, deployment, and verification. The system for identity information protection, deployment, and verification, which consists of a continuous integration continuous delivery / deployment system, a resource orchestration and scheduling system, a cryptographic module management system, a consumer application machine, and a provider application machine, can effectively protect, deploy, and verify identity information.

[0006] In a first aspect, embodiments of the present invention provide a system for identity information protection, deployment, and verification. The system includes: a continuous integration and continuous delivery / deployment system, a resource orchestration and scheduling system, a cryptographic module management system, a consumer application machine, and a provider application machine. The continuous integration and continuous delivery / deployment system is used to send business application identity information to the resource orchestration and scheduling system. The resource orchestration and scheduling system is used to forward the business application identity information to the cryptographic module management system, receive a trusted identity information description file for the business application sent by the cryptographic module management system, and send the trusted identity information description file for the business application to the consumer application machine and the provider application machine. The system comprises a program machine and a cryptographic module management system. The program machine receives the business application identity information, encrypts the business application identity information, generates a trusted identity information description file for the business application, and sends the trusted identity information description file to the resource orchestration and scheduling system. The consumer application machine receives the trusted identity information description file for the business application, decrypts it into plaintext information, and sends the plaintext information to the provider application machine. The plaintext information includes the business application identity information. The provider application machine receives the trusted identity information description file for the business application and the plaintext information, and performs signature verification based on the business application identity information.

[0007] Secondly, embodiments of the present invention provide a method for protecting, deploying, and verifying identity information. The method includes: receiving business application identity information, wherein the business application identity information includes an application unique identifier and machine environment type information; using a cryptographic module to manage a private key and signing the business application identity information using a set signature algorithm to generate a private key signature value; encrypting the business application identity information and the private key signature value using a white-box cryptographic algorithm and machine fingerprint information to generate a trusted identity information description file for the business application, wherein the machine fingerprint information is the fingerprint information of the machine to which the business application of the business application identity information belongs.

[0008] Optionally, the method further includes: receiving the machine fingerprint information.

[0009] Optionally, the step of encrypting the business application identity information and the private key signature value using a white-box cryptographic algorithm and machine fingerprint information to generate a trusted identity information description file for the business application specifically includes: encrypting the business application identity information and the private key signature value using a white-box cryptographic algorithm to generate ciphertext of the business application identity information and ciphertext of the private key signature value; binding the ciphertext of the business application identity information and the ciphertext of the private key signature value to the machine fingerprint information to generate the trusted identity information description file for the business application.

[0010] Optionally, the method further includes: sending a trusted identity information description file for the business application.

[0011] Thirdly, embodiments of the present invention provide a method for protecting, deploying, and verifying identity information, the method comprising: receiving business application identity information; allocating machine fingerprint information according to the business application identity information, wherein the machine fingerprint information is the fingerprint information of the machine to which the business application of the business application identity information belongs; and sending the business application identity information and the machine fingerprint information.

[0012] Optionally, the method further includes: receiving a trusted identity information description file for a business application.

[0013] Optionally, the method further includes: mounting the trusted identity information description file of the business application to a set path within the machine to which the business application belongs, wherein the trusted identity information description file of the business application has read-only permissions within the machine, and the machine includes the consumer application machine and the provider application machine.

[0014] Fourthly, embodiments of the present invention provide a method for protecting, deploying, and verifying identity information. The method includes: receiving a trusted identity information description file for a business application; decrypting the trusted identity information description file for the business application using a decryption tool to determine the business application identity information and a private key signature value; and sending the business application identity information and the private key signature value through a middleware tool, wherein the business application identity information and the private key signature value are used to access the provider application machine.

[0015] Fifthly, embodiments of the present invention provide a method for protecting, deploying, and verifying identity information, the method comprising: receiving business application identity information and a private key signature value; and verifying the business application identity information and the private key signature value based on a public key.

[0016] Optionally, the method further includes: receiving a trusted identity information description file for a business application; and determining the public key in the trusted identity information description file for the business application.

[0017] Sixthly, embodiments of the present invention provide an apparatus for protecting, deploying, and verifying identity information. The apparatus includes: a first receiving unit, configured to receive business application identity information, wherein the business application identity information includes an application unique identifier and machine environment type information; a first generating unit, configured to use a cryptographic module to manage a private key and sign the business application identity information using a set signature algorithm to generate a private key signature value; the first generating unit is further configured to encrypt the business application identity information and the private key signature value using a white-box cryptographic algorithm and machine fingerprint information to generate a trusted identity information description file for the business application, wherein the machine fingerprint information is the fingerprint information of the machine to which the business application of the business application identity information belongs.

[0018] Optionally, the first receiving unit is further configured to: receive the machine fingerprint information.

[0019] Optionally, the first generation unit is specifically used to: encrypt the business application identity information and the private key signature value using a white-box cryptographic algorithm to generate ciphertext of the business application identity information and ciphertext of the private key signature value; bind the ciphertext of the business application identity information and the ciphertext of the private key signature value to the machine fingerprint information to generate a trusted identity information description file for the business application.

[0020] Optionally, the apparatus further includes: a sending unit for sending the trusted identity information description file of the service application.

[0021] In a seventh aspect, embodiments of the present invention provide an apparatus for protecting, deploying, and verifying identity information, the apparatus comprising: a second receiving unit for receiving business application identity information; an allocation unit for allocating machine fingerprint information according to the business application identity information, wherein the machine fingerprint information is fingerprint information of the machine to which the business application of the business application identity information belongs; and a first sending unit for sending the business application identity information and the machine fingerprint information.

[0022] Optionally, the second receiving unit is further configured to: receive a trusted identity information description file for a business application.

[0023] Optionally, the apparatus further includes a processing unit, configured to mount the trusted identity information description file of the business application to a set path within the machine to which the business application belongs, wherein the trusted identity information description file of the business application has read-only access within the machine, and the machine includes a consumer application machine and a provider application machine.

[0024] Eighthly, embodiments of the present invention provide an apparatus for protecting, deploying, and verifying identity information, the apparatus comprising: a third receiving unit for receiving a trusted identity information description file for a business application; a decryption unit for decrypting the trusted identity information description file for the business application using a decryption tool to determine the business application identity information and a private key signature value; and a second sending unit for sending the business application identity information and the private key signature value through a middleware tool, wherein the business application identity information and the private key signature value are used to access the provider application machine.

[0025] Ninthly, embodiments of the present invention provide an apparatus for protecting, deploying, and verifying identity information, the apparatus comprising:

[0026] The fourth receiving unit is used to receive the business application identity information and the private key signature value;

[0027] The signature verification unit is used to verify the identity information of the business application and the signature value of the private key based on the public key.

[0028] Optionally, the fourth receiving unit is further configured to: receive a trusted identity information description file for a business application; the apparatus further includes: a determining unit, configured to determine the public key in the trusted identity information description file for the business application.

[0029] In a tenth aspect, embodiments of the present invention provide an electronic device, including a memory and a processor, the memory being used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method as described in any one of the second aspect, any one of the second aspect, the third aspect, any one of the third aspect, the fourth aspect, the fifth aspect, and any one of the fifth aspects.

[0030] Eleventhly, embodiments of the present invention provide a computer-readable storage medium storing computer program instructions thereon, which, when executed by a processor, implement the method as described in any one of the second aspect, any one of the second aspect, the third aspect, any one of the third aspect, the fourth aspect, the fifth aspect, and any one of the fifth aspects.

[0031] In this embodiment of the invention, the system for identity information protection, deployment, and verification includes a continuous integration and continuous delivery / deployment system, a resource orchestration and scheduling system, a cryptographic module management system, a consumer application machine, and a provider application machine. The continuous integration and continuous delivery / deployment system sends business application identity information to the resource orchestration and scheduling system. The resource orchestration and scheduling system forwards the business application identity information to the cryptographic module management system, receives a trusted identity information description file for the business application sent by the cryptographic module management system, and sends the trusted identity information description file to the consumer application machine and the provider application machine. The cryptographic module management system receives the business application identity information, encrypts the business application identity information, generates the trusted identity information description file for the business application, and sends the trusted identity information description file to the resource orchestration and scheduling system. The consumer application machine receives the trusted identity information description file for the business application, decrypts it into plaintext information, and sends the plaintext information to the provider application machine, wherein the plaintext information includes the business application identity information. The provider application machine receives the trusted identity information description file for the business application and the plaintext information, and performs signature verification based on the business application identity information. The above system can effectively protect, deploy, and verify identity information. Attached Figure Description

[0032] The above and other objects, features and advantages of the present invention will become clearer from the following description of embodiments of the invention with reference to the accompanying drawings, in which:

[0033] Figure 1 This is a schematic diagram of a system for identity information protection, deployment, and verification in an embodiment of the present invention;

[0034] Figure 2 This is a schematic diagram of another system for identity information protection, deployment, and verification in an embodiment of the present invention;

[0035] Figure 3 This is a flowchart of a method for protecting, deploying, and verifying identity information according to an embodiment of the present invention;

[0036] Figure 4 This is a flowchart of another method for protecting, deploying, and verifying identity information in an embodiment of the present invention;

[0037] Figure 5 This is a flowchart of another method for protecting, deploying, and verifying identity information in an embodiment of the present invention;

[0038] Figure 6 This is a flowchart of another method for protecting, deploying, and verifying identity information in an embodiment of the present invention;

[0039] Figure 7 This is a flowchart of a method for protecting, deploying, and verifying identity information according to an embodiment of the present invention;

[0040] Figure 8 This is a flowchart of another method for protecting, deploying, and verifying identity information in an embodiment of the present invention;

[0041] Figure 9 This is a flowchart of another method for protecting, deploying, and verifying identity information in an embodiment of the present invention;

[0042] Figure 10 This is a schematic diagram of an identity information protection, deployment, and verification device according to an embodiment of the present invention;

[0043] Figure 11 This is a schematic diagram of another device for protecting, deploying, and verifying identity information in an embodiment of the present invention;

[0044] Figure 12 This is a schematic diagram of another device for protecting, deploying, and verifying identity information in an embodiment of the present invention;

[0045] Figure 13 This is a schematic diagram of another device for protecting, deploying, and verifying identity information in an embodiment of the present invention;

[0046] Figure 14 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0047] The present application is described below based on embodiments, but it is not limited to these embodiments. In the detailed description of the present application below, certain specific details are described in detail. Those skilled in the art can fully understand the present application without these details. To avoid obscuring the substance of the present application, well-known methods, processes, flows, elements, and circuits are not described in detail.

[0048] Furthermore, those skilled in the art should understand that the accompanying drawings provided herein are for illustrative purposes only and are not necessarily drawn to scale.

[0049] Unless the context explicitly requires it, words such as "including" or "contains" throughout the application should be interpreted as including rather than exclusive or exhaustive; that is, meaning "including but not limited to".

[0050] In the description of this application, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0051] In existing technologies, business applications, also known as applications (APPs), are highly sensitive to their identity information. Based on this identity information, business application keys can be obtained from their corresponding servers. Business applications can then use these keys to perform decryption and other processing. The loss of these keys poses a security threat to the business application. Specifically, if the business application's identity information is forged or stolen, the keys will be lost, thus compromising the application's security. For example, business application A on server 1 obtains its own business-level keys from a public server using its identity information and then uses these keys to decrypt business applications. Since business application A's identity information is not effectively protected, business application B on server 2 can impersonate it and obtain business application A's business-level keys from the public server, thus stealing its identity and threatening its security. Therefore, how to effectively protect, deploy, and verify identity information is a problem that needs to be solved.

[0052] In this embodiment of the invention, the server may also be referred to as a machine, container, etc., depending on the actual situation.

[0053] In this embodiment of the invention, to address the aforementioned problems and effectively protect, deploy, and verify identity information, a system for identity information protection, deployment, and verification is proposed, specifically as follows: Figure 1 As shown, the system includes: a continuous integration and continuous delivery / deployment system 101, a resource orchestration and scheduling system 102, a cryptographic module management system 103, and a machine 104;

[0054] Specifically, the Continuous Integration (CI) and Continuous Delivery / Deployment (CD) system 101 is used to generate unique application identifiers for business applications, determine machine environment type information when the application is released or scaled up, generate business application identity information, and send the business application identity information to the resource orchestration and scheduling system; wherein, the CI / CD system is a process and toolchain for automating software development, testing, and deployment, aiming to improve the efficiency, quality, and reliability of software delivery through automation.

[0055] The resource orchestration and scheduling system 102 is used to forward the business application identity information to the cryptographic module management system 103, receive the business application trusted identity information description file sent by the cryptographic module management system 103, and send the business application trusted identity information description file to the machine 104; wherein, the purpose of the resource orchestration and scheduling system 102 can be a K8s resource orchestration and scheduling system to achieve efficient and automated deployment, expansion and management of business applications.

[0056] The resource orchestration and scheduling system 102 assigns machine fingerprint information to the business application identity information, that is, it assigns a machine to the business application to which the business application identity information belongs, and runs the business application on the machine. When the resource orchestration and scheduling system 102 sends the business application identity information to the cryptographic module management system (CMMS) 103, it also sends the machine fingerprint information to the cryptographic module management system 103. The CMMS can also be called a secret management system.

[0057] The cryptographic module management system 103 is used to receive the business application identity information and the machine fingerprint information, encrypt the business application identity information, generate a trusted identity information description file for the business application (which can be simply referred to as the cmms.info file), and send the trusted identity information description file for the business application to the resource orchestration and scheduling system. By using the cryptographic module management system 103 to encrypt the business application identity information, the business application identity information can be protected, making it unbreakable, unforgeable, and unalterable.

[0058] The machine 104 receives the trusted identity information description file of the business application sent by the resource orchestration and scheduling system, and realizes the verification of the identity information of the business application.

[0059] In one possible implementation, the machine 104 includes a consumer application machine 1041 and a provider application machine 1042, specifically as follows: Figure 2 As shown:

[0060] Specifically, the consumer application machine 1041 is used to receive the trusted identity information description file of the business application, decrypt it into plaintext information, and send the plaintext information to the provider application machine, wherein the plaintext information includes the identity information of the business application; the provider application machine 1042 is used to receive the trusted identity information description file of the business application and the plaintext information, and perform signature verification based on the identity information of the business application.

[0061] The following describes in detail the cryptographic module management system, the resource orchestration and scheduling system, and the consumer application machine and the provider application machine through four specific embodiments. Specific Implementation Example 1

[0063] The Cryptographic Module Management System (CMMS) is a crucial component of the identity information protection, deployment, and verification system. The flowchart of the method for identity information protection, deployment, and verification, using the CMMS as the executing entity, is as follows: Figure 3 As shown, it includes the following:

[0064] Step S301: Receive business application identity information.

[0065] Specifically, the cryptographic module management system (CMMS) receives business application identity information. The CMMS is a server. The business application identity information includes a unique application identifier and machine environment type information. The machine environment type information includes daily environment, pre-release environment, and online environment, specifically referring to the environment in which the business application to which the business application identity information belongs is located.

[0066] In one possible implementation, the cryptographic module management system (CMMS) receives the machine fingerprint information along with the business application identity information. The machine fingerprint information includes the machine serial number (SN), the machine Internet Protocol (IP) address, and the Media Access Control Address (MAC).

[0067] Step S302: The cryptographic module manages the private key and signs the identity information of the business application by setting a signature algorithm to generate a private key signature value.

[0068] Specifically, the signature algorithm can be an asymmetric encryption algorithm (Rivest–Shamir–Adleman, RSA) signature algorithm. The RSA signature algorithm is an asymmetric encryption technology based on the RSA public-key cryptosystem, used for digital signatures. The basic principle is to use a pair of public and private keys. The public key is publicly disclosed and used for signature verification; the private key must be kept strictly confidential and used for signing. The CMMS uses its own private key to sign the identity information of the business application through the RSA signature algorithm to generate a private key signature value.

[0069] Step S303: Encrypt the business application identity information and the private key signature value using a white-box cryptographic algorithm and machine fingerprint information to generate a trusted identity information description file for the business application, wherein the machine fingerprint information is the fingerprint information of the machine to which the business application belongs.

[0070] Specifically, the business application identity information and the private key signature value are encrypted using a white-box cryptographic algorithm to generate ciphertext of the business application identity information and ciphertext of the private key signature value; the ciphertext of the business application identity information and the ciphertext of the private key signature value are then bound to the machine fingerprint information to generate the cmms.info file.

[0071] In this embodiment of the invention, the white-box cryptography algorithm is a special encryption method. Its core idea is to make the internal operation mechanism of the algorithm completely transparent during the encryption and decryption process, so that even if an attacker knows all the internal details, it is difficult for them to deduce the key or other sensitive information from this information.

[0072] In one possible implementation, after step S303, other steps are included, specifically as follows: Figure 4 As shown, it includes the following:

[0073] Step S304: Send the trusted identity information description file for the business application.

[0074] Specifically, the cryptographic module management system sends the cmms.info file to the resource orchestration and scheduling system. Specific Implementation Example 2

[0076] When the resource orchestration and scheduling system is the executing entity, the flowchart of the method for identity information protection, deployment, and verification is as follows: Figure 5 As shown, it includes the following:

[0077] Step S501: Receive the business application identity information.

[0078] Specifically, the resource orchestration and scheduling system receives the business application identity information sent by the CI / CD system.

[0079] Step S502: Assign machine fingerprint information according to the business application identity information.

[0080] Specifically, the machine fingerprint information is the fingerprint information of the machine to which the business application identity information belongs.

[0081] Step S503: Send the business application identity information and the machine fingerprint information.

[0082] Specifically, the resource orchestration and scheduling system sends the business application identity information and the machine fingerprint information to the CMMS system.

[0083] In one possible implementation, after step S503, other steps are included, specifically as follows: Figure 6 As shown, it includes the following:

[0084] Step S504: Receive the trusted identity information description file for the business application.

[0085] Specifically, the resource orchestration and scheduling system receives a trusted identity information description file for business applications sent by the CMMS system.

[0086] Step S505: Mount the trusted identity information description file of the business application to the set path on the machine to which the business application belongs.

[0087] The trusted identity information description file for the business application is read-only within the machine, which includes consumer application machines and provider application machines.

[0088] Specifically, the resource orchestration and scheduling system mounts the cmms.info file to a designated path within the machine to which the business application belongs, and ensures that the cmms.info file within the machine has read-only permissions. Since the cmms.info file is bound to machine fingerprint information, it can only be successfully decrypted within the correct machine. Specific Implementation Example 3

[0090] When the consumer application machine is the executing entity, the flowchart of the method for identity information protection, deployment, and verification is as follows: Figure 7 As shown, it includes the following:

[0091] Step S701: Receive the trusted identity information description file for the business application.

[0092] Specifically, the consumer application machine receives the cmms.info file sent by the resource orchestration and scheduling system.

[0093] Step S702: Decrypt the trusted identity information description file of the business application using a decryption tool to determine the business application identity information and private key signature value.

[0094] Specifically, the decryption tool is a designated Software Development Kit (SDK). The consumer application machine uses the SDK to decrypt the cmms.info file into plaintext. The plaintext includes business application identity information and a private key signature value. The SDK is a set of tools provided to developers to simplify the integration and development of specific platforms, technologies, or services. It typically includes library files, API interfaces, documentation, sample code, debugging tools, etc., helping developers efficiently build applications.

[0095] Step S703: Send the business application identity information and the private key signature value through a middleware tool.

[0096] The business application identity information and the private key signature value are used to access the provider application machine.

[0097] Specifically, the consumer application machine accesses the provider application machine through the Middleware SDK, carrying the business application identity information and the private key signature value. The Middleware is an independent system software or service program located between the operating system and the application, used to help different applications or systems communicate, manage data, and share resources. Specific Implementation Example 4

[0099] When the provider application machine is the execution subject, the flowchart of the method for identity information protection, deployment, and verification is as follows: Figure 8 As shown, it includes the following:

[0100] Step S801: Receive the business application identity information and private key signature value.

[0101] Specifically, the provider application machine receives the business application identity information and private key signature value sent by the consumer application machine.

[0102] Step S802: Verify the identity information of the business application and the signature value of the private key based on the public key.

[0103] Specifically, the provider application machine calls the SDK signature verification interface and uses its own public key to verify the identity information of the business application using the RSA signature verification algorithm. If the signature verification is successful, it means that the identity information of the business application is correct; if the signature verification fails, it means that the identity information of the business application is incorrect.

[0104] In one possible implementation, prior to step S802, other steps are included, specifically as follows: Figure 9 As shown, it includes the following:

[0105] Step S803: Receive the trusted identity information description file for the business application.

[0106] Specifically, the application's trusted identity information description file includes a public key.

[0107] Step S804: Determine the public key in the trusted identity information description file of the business application.

[0108] In one possible implementation, the public key may also be included within the SDK.

[0109] In this embodiment of the invention, the CMMS system uses white-box cryptography algorithms and machine fingerprint information to encrypt and protect the business application identity information and private key signature value. The cmms.info file is bound to the machine fingerprint information and can only be successfully decrypted on a designated machine. Copying the cmms.info file to other machines will prevent decryption. Furthermore, the CMMS system, in conjunction with the CI / CD system and the K8s resource orchestration and scheduling system, constructs a closed-loop trust chain to achieve automated deployment of business application identity information. Within the provider application machine, signature verification is completed by calling the SDK signature verification interface, which can verify the legitimacy of the business application identity on the consumer application machine, effectively solving the problem of sensitive data leakage caused by the tampering and impersonation of business application identities.

[0110] In this embodiment of the invention, an apparatus for protecting, deploying, and verifying identity information is provided, such as... Figure 10 As shown, it specifically includes: a first receiving unit 1001 and a first generating unit 1002; wherein, the first receiving unit 1001 is used to receive business application identity information, wherein the business application identity information includes a unique application identifier and machine environment type information; the first generating unit 1002 is used to use a cryptographic module to manage the private key of the system and sign the business application identity information by setting a signature algorithm to generate a private key signature value; the first generating unit 1002 is also used to encrypt the business application identity information and the private key signature value by using a white-box cryptographic algorithm and machine fingerprint information to generate a trusted identity information description file for the business application, wherein the machine fingerprint information is the fingerprint information of the machine to which the business application of the business application identity information belongs.

[0111] Furthermore, the first receiving unit is also configured to: receive the machine fingerprint information.

[0112] Further, the first generation unit is specifically used to: encrypt the business application identity information and the private key signature value using a white-box cryptographic algorithm to generate ciphertext of the business application identity information and ciphertext of the private key signature value; bind the ciphertext of the business application identity information and the ciphertext of the private key signature value to the machine fingerprint information to generate a trusted identity information description file for the business application.

[0113] Furthermore, the apparatus further includes: a sending unit for sending the trusted identity information description file of the service application.

[0114] In this embodiment of the invention, an apparatus for protecting, deploying, and verifying identity information is provided, such as... Figure 11 As shown, it specifically includes: a second receiving unit 1101, an allocation unit 1102, and a first sending unit 1103; wherein, the second receiving unit is used to receive business application identity information; the allocation unit is used to allocate machine fingerprint information according to the business application identity information, wherein the machine fingerprint information is the fingerprint information of the machine to which the business application of the business application identity information belongs; the first sending unit is used to send the business application identity information and the machine fingerprint information.

[0115] Furthermore, the second receiving unit is also used to: receive a trusted identity information description file for business applications.

[0116] Furthermore, the device further includes a processing unit, configured to mount the trusted identity information description file of the business application to a set path within the machine to which the business application belongs, wherein the trusted identity information description file of the business application has read-only access within the machine, and the machine includes a consumer application machine and a provider application machine.

[0117] In this embodiment of the invention, an apparatus for protecting, deploying, and verifying identity information is provided, such as... Figure 12 As shown, it specifically includes: a third receiving unit 1201, a decryption unit 1202, and a second sending unit 1203; wherein, the third receiving unit 1201 is used to receive a trusted identity information description file for a business application; the decryption unit 1202 is used to decrypt the trusted identity information description file for a business application using a decryption tool to determine the business application identity information and the private key signature value; the second sending unit 1203 is used to send the business application identity information and the private key signature value through a middleware tool, wherein the business application identity information and the private key signature value are used to access the provider application machine.

[0118] In this embodiment of the invention, an apparatus for protecting, deploying, and verifying identity information is provided, such as... Figure 13As shown, it specifically includes: a fourth receiving unit 1301 and a signature verification unit 1302; wherein, the fourth receiving unit 1301 is used to receive business application identity information and private key signature value; the signature verification unit 1302 is used to verify the business application identity information and the private key signature value according to the public key.

[0119] Furthermore, the fourth receiving unit is also configured to: receive a trusted identity information description file for a business application; the apparatus further includes: a determining unit, configured to determine the public key in the trusted identity information description file for the business application.

[0120] Figure 14 This is a schematic diagram of the structure of the electronic device described in an embodiment of the present invention. For example... Figure 14 As shown, it includes a general computer hardware architecture, which includes at least a processor 1401 and a memory 1402. The processor 1401 and the memory 1402 are connected via a bus 1403. The memory 1402 is adapted to store instructions or programs executable by the processor 1401. The processor 1401 can be a standalone microprocessor or a collection of one or more microprocessors. Thus, the processor 1401 executes the instructions stored in the memory 1402 to perform the method flow of the embodiments of the present invention as described above, thereby realizing data processing and control of other devices. The bus 1403 connects the above-mentioned components together, and also connects the above-mentioned components to the display controller 1404, the display device, and the input / output (I / O) device 1405. The input / output (I / O) device 1405 can be a mouse, keyboard, modem, network interface, touch input device, motion-sensing input device, printer, and other devices known in the art. Typically, the input / output device 1405 is connected to the system via an input / output (I / O) controller 1406.

[0121] The instructions stored in memory 1402 are executed by at least one processor 1401 to achieve the following: receiving business application identity information, wherein the business application identity information includes a unique application identifier and machine environment type information; using a cryptographic module to manage the private key and signing the business application identity information with a set signature algorithm to generate a private key signature value; encrypting the business application identity information and the private key signature value with a white-box cryptographic algorithm and machine fingerprint information to generate a trusted business application identity information description file, wherein the machine fingerprint information is the fingerprint information of the machine to which the business application of the business application identity information belongs.

[0122] Specifically, the electronic device includes: one or more processors 1401 and a memory 1402. Figure 14 Take processor 1401 as an example. Processor 1401 and memory 1402 can be connected via a bus or other means.Figure 14 Taking a bus connection as an example, memory 1402, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Processor 1401 executes various functional applications and data processing of the device by running the non-volatile software programs, instructions, and modules stored in memory 1402, thereby realizing the aforementioned methods for identifying, protecting, deploying, and verifying identity information.

[0123] Memory 1402 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; the data storage area may store an option list, etc. Furthermore, memory 1402 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, memory 1402 may optionally include memory remotely located relative to processor 1401, and these remote memories may be connected to external devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0124] One or more modules are stored in memory 1402 and, when executed by one or more processors 1401, perform the methods for identity information protection, deployment, and verification in any of the above method embodiments.

[0125] As those skilled in the art will recognize, various aspects of the embodiments of the present invention can be implemented as a system, method, or computer program product. Therefore, various aspects of the embodiments of the present invention can take the form of a completely hardware implementation, a completely software implementation (including firmware, resident software, microcode, etc.), or an implementation combining software and hardware aspects, which may generally be referred to herein as a "circuit," "module," or "system." Furthermore, various aspects of the embodiments of the present invention can take the form of a computer program product implemented in one or more computer-readable media having computer-readable program code implemented thereon.

[0126] Any combination of one or more computer-readable media can be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, (but not limited to) an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination thereof. More specific examples (not an exhaustive list) of computer-readable storage media will include: an electrical connection having one or more wires, a portable computer floppy disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable optical disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the context of embodiments of the present invention, a computer-readable storage medium can be any tangible medium capable of containing or storing a program used by or in conjunction with an instruction execution system, device, or apparatus.

[0127] Computer-readable signal media may include propagated digital signals having computer-readable program code implemented therein, such as in baseband or as part of a carrier wave. Such propagated signals may take any of a variety of forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium that is not a computer-readable storage medium and can communicate, propagate, or transmit a program used by or in conjunction with an instruction execution system, device, or apparatus.

[0128] Program code implemented on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, fiber optic cable, RF, or any suitable combination thereof.

[0129] Computer program code for performing operations relating to various aspects of embodiments of the present invention can be written in any combination of one or more programming languages, including: object-oriented programming languages ​​such as Java, Smalltalk, C++, etc.; and conventional procedural programming languages ​​such as the "C" programming language or similar programming languages. The program code can be executed as a standalone software package entirely on the user's computer, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet provided by an Internet service provider).

[0130] The flowchart illustrations and / or block diagrams of the methods, apparatus (systems), and computer program products according to embodiments of the present invention describe various aspects of the embodiments of the present invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions (executed via the processor of the computer or other programmable data processing apparatus) create means for implementing the functions / actions specified in the flowchart and / or block diagram blocks or blocks.

[0131] These computer program instructions may also be stored in a computer-readable medium that can direct a computer, other programmable data processing apparatus or other means to operate in a particular manner, such that the instructions stored in the computer-readable medium produce an article of writing that includes instructions that implement the functions / actions specified in flowchart and / or block diagram blocks or blocks.

[0132] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus or other device to cause a series of operable steps to be performed on the computer, other programmable apparatus or other device to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide for implementing the functions / actions specified in flowchart and / or block diagram blocks or blocks.

[0133] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0134] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of such data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding access points are provided for users to choose to authorize or refuse processing. A user's refusal to process personal information beyond what is necessary for basic functions will not affect the user's use of basic functions.

Claims

1. A system for protecting, deploying, and verifying identity information, characterized in that, The system includes: Continuous integration includes continuous delivery / deployment systems, resource orchestration and scheduling systems, cryptographic module management systems, consumer application machines, and provider application machines; The continuous integration and continuous delivery / deployment system is used to send business application identity information to the resource orchestration and scheduling system. The resource orchestration and scheduling system is used to forward the business application identity information to the cryptographic module management system, receive the business application trusted identity information description file sent by the cryptographic module management system, and send the business application trusted identity information description file to the consumer application machine and the provider application machine. The cryptographic module management system is used to receive the identity information of the business application, encrypt the identity information of the business application, generate a trusted identity information description file of the business application, and send the trusted identity information description file of the business application to the resource orchestration and scheduling system. The consumer application machine is used to receive the trusted identity information description file of the business application, decrypt it into plaintext information, and then send the plaintext information to the provider application machine, wherein the plaintext information includes the identity information of the business application; The provider application machine is used to receive the trusted identity information description file of the business application and the plaintext information, and to perform signature verification based on the identity information of the business application.

2. A method for protecting, deploying, and verifying identity information, characterized in that, The method includes: Receive business application identity information, wherein the business application identity information includes a unique application identifier and machine environment type information; The cryptographic module manages the private key and signs the identity information of the business application by setting a signature algorithm to generate a private key signature value; The business application identity information and the private key signature value are encrypted using a white-box cryptographic algorithm and machine fingerprint information to generate a trusted identity information description file for the business application. The machine fingerprint information is the fingerprint information of the machine to which the business application belongs.

3. The method according to claim 2, characterized in that, The method further includes: Receive the machine fingerprint information.

4. The method according to claim 2, characterized in that, The step of encrypting the business application identity information and the private key signature value using white-box cryptography algorithms and machine fingerprint information to generate a trusted identity information description file for the business application specifically includes: The business application identity information and the private key signature value are encrypted using a white-box cryptographic algorithm to generate ciphertext of business application identity information and ciphertext of private key signature value. The encrypted business application identity information and the encrypted private key signature value are bound to the machine fingerprint information to generate a trusted identity information description file for the business application.

5. The method according to claim 2, characterized in that, The method further includes: Send the trusted identity information description file for the aforementioned business application.

6. A method for protecting, deploying, and verifying identity information, characterized in that, The method includes: Received the business application's identity information; Machine fingerprint information is assigned based on the business application identity information, wherein the machine fingerprint information is the fingerprint information of the machine to which the business application of the business application identity information belongs; Send the business application identity information and the machine fingerprint information.

7. The method according to claim 6, characterized in that, The method further includes: Receive trusted identity information description documents for business applications.

8. The method according to claim 7, characterized in that, The method further includes: The trusted identity information description file for the business application is mounted to a designated path within the machine to which the business application belongs. The trusted identity information description file for the business application has read-only permissions within the machine, which includes the consumer application machine and the provider application machine.

9. A method for protecting, deploying, and verifying identity information, characterized in that, The method includes: Receive trusted identity information description document for business applications; The trusted identity information description file of the business application is decrypted using a decryption tool to determine the business application identity information and the private key signature value. The middleware tool sends the business application identity information and the private key signature value, wherein the business application identity information and the private key signature value are used to access the provider application machine.

10. A method for protecting, deploying, and verifying identity information, characterized in that, The method includes: Receive the business application's identity information and private key signature value; The identity information of the business application and the signature value of the private key are verified based on the public key.

11. The method according to claim 10, characterized in that, The method further includes: Receive trusted identity information description document for business applications; The public key is determined in the trusted identity information description file of the business application.

12. An apparatus for protecting, deploying, and verifying identity information, characterized in that, The device includes: The first receiving unit is used to receive business application identity information, wherein the business application identity information includes a unique application identifier and machine environment type information; The first generation unit is used to manage the private key of the cryptographic module and sign the identity information of the business application by setting a signature algorithm to generate a private key signature value. The first generation unit is further configured to encrypt the business application identity information and the private key signature value using a white-box cryptographic algorithm and machine fingerprint information to generate a business application trusted identity information description file, wherein the machine fingerprint information is the fingerprint information of the machine to which the business application of the business application identity information belongs.

13. An apparatus for protecting, deploying, and verifying identity information, characterized in that, The device includes: The second receiving unit is used to receive the identity information of the business application. The allocation unit is configured to allocate machine fingerprint information according to the business application identity information, wherein the machine fingerprint information is the fingerprint information of the machine to which the business application of the business application identity information belongs; The first sending unit is used to send the business application identity information and the machine fingerprint information.

14. An apparatus for protecting, deploying, and verifying identity information, characterized in that, The device includes: The third receiving unit is used to receive the trusted identity information description file for business applications. The decryption unit is used to decrypt the trusted identity information description file of the business application using a decryption tool, and to determine the identity information of the business application and the private key signature value. The second sending unit is used to send the business application identity information and the private key signature value through a middleware tool, wherein the business application identity information and the private key signature value are used to access the provider application machine.

15. An apparatus for protecting, deploying, and verifying identity information, characterized in that, The device includes: The fourth receiving unit is used to receive the business application identity information and the private key signature value; The signature verification unit is used to verify the identity information of the business application and the signature value of the private key based on the public key.

Images