Cryptography device management method and management platform

Abstract

The present application discloses a cryptography device management method and management platform. The method comprises: on the basis of a secure channel protocol and a predefined protocol message structure, performing information exchange with a cryptography device to establish a secure channel and negotiate a session key; and within the validity period of the secure channel, on the basis of the session key and the predefined protocol message structure, performing management and state monitoring on attributes of a managed object corresponding to each cryptography device, wherein the predefined protocol message structure comprises a message header, a message data part, and a message signature part which are described by using a JSON object, and information packaged by the protocol message structure is management monitoring configuration parameters of the cryptography device. According to the present application, a message structure of a cryptography device management protocol in REST style is predefined on the basis of an HTTP, thereby improving the usability and compatibility of the cryptography device management method, and satisfying the security requirements.

Description

Cryptographic device management method and management platform

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on August 9, 2023, with application number 202310996541.3 and invention name “Cryptographic Device Management Method and Management Platform”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of cryptographic application technology, and in particular to a cryptographic device management method and management platform. Background Art

[0003] GM / T 0050-2016, "Technical Specification for Cryptographic Equipment Management," is a technical standard for cryptographic equipment management in my country's commercial cryptography field. It defines the secure message format and secure channel establishment process for commercial cryptographic equipment management. The secure message format of GM / T 0050-2016 is based on the traditional TLV (Type / Length / Value) format, similar to SNMP (Simple Network Management Protocol). However, most current devices and operating systems use HTTP (Hypertext Transfer Protocol) for management and service control, making support for GM / T 0050 difficult.

[0004] The patent application document with publication number CN115412242A proposes a method for implementing a full browser calling a smart password key password application. By using the local HTTPS (Hypertext Transfer Protocol Secure) service, it solves the cross-domain problem when calling the smart password key and the problem that HTTPS pages are prohibited from loading HTTP service resources. However, this solution belongs to the browser local password service call, and the encapsulated message is the call parameter for the smart password key. The specific format is similar to the remote function call format.

[0005] Summary of the Invention

[0006] The technical problem to be solved by this application is how to provide a REST (Representational State Transfer) style cryptographic device management method based on the HTTP protocol and in compliance with the basic message structure and security attributes defined in GM / T 0050-2016 "Technical Specifications for Cryptographic Device Management".

[0007] This application solves the above technical problems through the following technical means:

[0008] On the one hand, the present application proposes a cryptographic device management method, the method comprising:

[0009] Based on the secure channel protocol and pre-defined protocol message structure, it exchanges information with the cryptographic device to establish a secure channel and negotiate session keys;

[0010] During the validity period of the secure channel, the attributes of the managed objects corresponding to each cryptographic device are managed and monitored based on the session key and the pre-defined protocol message structure;

[0011] The predefined protocol message structure uses JSON objects to encapsulate the management and monitoring configuration parameters of the cryptographic device.

[0012] Furthermore, the protocol message structure includes a message header, a message data portion payload, and a message signature portion signature described by a JSON object;

[0013] The parameters of the message header include security mode, message ID number, receiver identifier, sender identifier and interaction operation type.

[0014] Furthermore, the message header also includes the protocol version number, encryption algorithm, signature algorithm, and cryptographic hash algorithm with a key.

[0015] Furthermore, the security mode includes three Boolean type parameters, indicating whether to reply, whether to encrypt, and whether to sign or calculate a hash value;

[0016] Each Boolean parameter has a value of TRUE or FALSE.

[0017] Furthermore, the interaction operation types include secure channel establishment request, secure channel establishment response, secure channel data transmission, and secure channel restart notification.

[0018] Furthermore, the parameters of the message data payload include an initialization vector when an encryption algorithm is used, a management application type identifier, an information operation type, and a ciphertext.

[0019] Furthermore, information operation types include adding, deleting, modifying and updating, and reading.

[0020] Furthermore, the management application type identification includes key management, remote monitoring, parameter configuration, remote maintenance and validity verification.

[0021] Furthermore, the ciphertext is represented in base64 encoding format.

[0022] Furthermore, the message signature part signature includes a first digital signature corresponding to the interactive operation type being a secure channel establishment request, a second digital signature corresponding to the interactive operation type being a secure channel establishment response, a third digital signature corresponding to the interactive operation type being a secure channel establishment response, and a fourth digital signature corresponding to the interactive operation type being a secure channel data sending.

[0023] Furthermore, the first digital signature is obtained by encrypting the message header and the message data payload using the private key of the cryptographic device;

[0024] The second and third digital signatures are obtained by encrypting the message header and the message data payload using the private key of the cryptographic device management platform;

[0025] The fourth digital signature is a cryptographic hash value of the message header and the message data payload calculated using the session key.

[0026] Furthermore, the method further comprises:

[0027] After establishing a secure channel, a counter is used to record the message ID number. Each request message and the corresponding response request ID are consistent.

[0028] After the counter value exceeds the maximum value, the counter is cleared and a channel reset request is sent.

[0029] Furthermore, based on the secure channel protocol and the predefined protocol message structure, information is exchanged with the cryptographic device to establish a secure channel and negotiate a session key, including:

[0030] Based on the secure channel protocol, a secure channel establishment request is sent to the cryptographic device, and a secure channel establishment response is received from the cryptographic device to establish a secure channel and negotiate a session key.

[0031] Furthermore, during the validity period of the secure channel, the attributes of the managed objects corresponding to each cryptographic device are managed and the status is monitored based on the session key and the predefined protocol message structure, including:

[0032] During the validity period of the secure channel, the attributes of the managed objects corresponding to each cryptographic device are managed and the status is monitored using messages sent with the interactive operation type of secure channel data.

[0033] Furthermore, when the secure channel is a long connection, the validity period of the secure channel is specified in the secure channel establishment message;

[0034] When the secure channel is a short connection, the validity period of the secure channel and session key is the current request-response process.

[0035] Furthermore, before exchanging information with the cryptographic device, establishing a secure channel, and negotiating a session key based on the secure channel protocol and a predefined protocol message structure, the method further includes:

[0036] Receiving a registration request sent by a cryptographic device and a first certificate issued by the cryptographic device;

[0037] Verify and store the first certificate, return the unique identifier of the cryptographic device and the second certificate issued by the cryptographic device management platform to the cryptographic device, and complete the registration.

[0038] In addition, this application also proposes a cryptographic device management platform, which includes:

[0039] A channel establishment module is used to interact with the cryptographic device based on the secure channel protocol and a predefined protocol message structure to establish a secure channel and negotiate a session key;

[0040] A management module is used to manage and monitor the status of the managed object attributes corresponding to each cryptographic device based on the session key and the predefined protocol message structure during the validity period of the security channel;

[0041] The predefined protocol message structure uses JSON objects to encapsulate the management and monitoring configuration parameters of the cryptographic device.

[0042] The present application also proposes an electronic device, comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0043] The memory is used to store computer programs;

[0044] The processor is used to implement the method described in the embodiment of the present application when executing the program stored in the memory.

[0045] The present application also proposes a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, causes the processors to execute the method as described in the embodiments of the present application.

[0046] The advantages of this application are:

[0047] (1) This application predefines a JSON / REST-style message structure for a cryptographic device management protocol based on the HTTP protocol. The message structure uses JSON objects to encapsulate the management and monitoring configuration parameters of the cryptographic device. The message structure is used for information exchange when performing remote network cryptographic device management, thereby improving the usability and compatibility of the cryptographic device management method. The message structure complies with the basic message structure and security attributes defined in GM / T 0050-2016 "Technical Specifications for Cryptographic Device Management" and meets security requirements.

[0048] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0050] FIG1 is a flow chart of a cryptographic device management method according to an embodiment of the present application;

[0051] FIG2 is a schematic diagram of the structure of a cryptographic device management platform proposed in one embodiment of the present application;

[0052] FIG3 is a schematic diagram of the connection between the cryptographic device management platform and the cryptographic device in one embodiment of the present application;

[0053] FIG4 is a schematic diagram of the interaction process between the cryptographic device management platform and the cryptographic device in one embodiment of the present application;

[0054] FIG5 is a block diagram of an electronic device provided in an embodiment of the present application;

[0055] FIG6 is a schematic diagram of a computer-readable medium provided in an embodiment of the present application. Specific embodiments

[0056] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0057] As shown in FIG1 , an embodiment of the present application discloses a cryptographic device management method, which is applied to a cryptographic device management platform. The method includes the following steps:

[0058] S10, based on the secure channel protocol and the predefined protocol message structure, interact with the cryptographic device to establish a secure channel and negotiate a session key;

[0059] S20. During the validity period of the secure channel, the attributes of the managed objects corresponding to each cryptographic device are managed and the status of the managed objects is monitored based on the session key and the predefined protocol message structure.

[0060] The predefined protocol message structure uses JSON objects to encapsulate the management and monitoring configuration parameters of the cryptographic device.

[0061] This embodiment predefines the message structure of the JSON / REST style cryptographic device management protocol based on the HTTP protocol. The defined message structure complies with the basic message structure and security attributes defined in GM / T0050-2016 "Technical Specifications for Cryptographic Device Management" and is based on the cryptographic industry standard GM / T 0050-2016. It has the advantages of good security and strong compliance. Compared with the standard GM / T 0050-2016 protocol, it is based on the JSON / REST style, has good compatibility, readability, and portability, and is easy to implement. The message structure is described using data objects in JSON format. This message structure is used for information exchange when managing cryptographic devices, which improves the usability and compatibility of the cryptographic device management method and meets security requirements.

[0062] In one embodiment, the protocol message structure includes a message header, a message data portion payload, and a message signature portion signature described by a JSON object. The parameters of the message header include a security mode, a message ID number, a receiver identifier, a sender identifier, and an interaction operation type.

[0063] In one embodiment, the parameters of the message header also include a protocol version number, an encryption algorithm, a signature algorithm, and a cryptographic hash algorithm with a key.

[0064] In one embodiment, the security mode includes three Boolean type parameters, indicating whether to reply, whether to encrypt, and whether to sign or calculate a hash value;

[0065] The parameter value of each Boolean type parameter is TRUE (yes) or FALSE (no).

[0066] In one embodiment, the interaction operation types include secure channel establishment request, secure channel establishment response, secure channel data transmission, and secure channel restart notification.

[0067] Specifically, the parameters of the message header are described in the JSON "key": "value" format as follows:

[0068] "ver": protocol version number, which is "1.0" for this document;

[0069] "mode": security mode, which is a nested JSON object, including three Boolean parameters: "ifresponse" (whether to reply), "ifenc" (whether to encrypt), and "ifsign" (whether to sign or calculate MAC). Each parameter value is TRUE or FALSE;

[0070] "id": Message ID, also known as message identifier. A 64-bit counter is maintained within each cryptographic device and the cryptographic device management platform. After a secure channel is established, the counter starts counting from 1. Thereafter, the ID number of each request message in the channel increases monotonically. When the counter exceeds the maximum value, the counter is reset to zero, and the cryptographic device initiates a channel reset request. The IDs of each request message and the corresponding response request should be consistent to prevent replay attacks and improve security.

[0071] "receiver": Receiver ID, which is the unique ID of the cryptographic device obtained from the cryptographic device management platform when the receiver registers;

[0072] "sender": sender ID, which is the unique ID of the cryptographic device management platform;

[0073] "operation": interaction operation type, including "request-tunnel" (secure channel establishment request), "response-tunnel" (secure channel establishment response), "data-tunnel" (secure channel data transmission), and "restart-tunnel" (secure channel restart notification);

[0074] "alg_enc": the encryption algorithm used in this message, which should support "SM4-CBC" and other algorithms;

[0075] "alg_sig": signature algorithm, should support "SM2" etc.

[0076] alg_hmac: cryptographic hashing algorithm with a key, which should support SM3 and other algorithms.

[0077] In one embodiment, the parameters of the message data payload include an initialization vector when an encryption algorithm is used, a management application type identifier, an information operation type, and a ciphertext expressed in a base64 encoding format.

[0078] Specifically, the data payload of the message structure is encrypted using the session key negotiated between the cryptographic device management platform and the cryptographic device when establishing a secure channel. It includes the following parameters:

[0079] "iv": initialization vector when using CBC encryption mode;

[0080] "type-app": Management application type identifier. Currently, five types are defined: "KMS" (key management), "RMON" (remote monitoring), "CONF" (parameter configuration), "MAIN" (remote maintenance), and "VALID" (validity verification);

[0081] "type-opr": information operation type, including "CREATE" (add), "DELETE" (delete), "UPDATE" (modify and update), and "READ" (read);

[0082] "ciphertext": ciphertext encrypted using the algorithm identified by alg_enc, expressed in base64 encoding format. For the specific encrypted content and format, see 6.2 Management Interface Description and 7.2 Status Monitoring Interface Description in GM / T 0050-2016 "Technical Specifications for Cryptographic Device Management".

[0083] It should be noted that the specific information included in the management application type identifier and the information operation type is only used as an example in this embodiment, and those skilled in the art can expand it according to actual needs.

[0084] In one embodiment, the message signature part signature includes a first digital signature corresponding to the interactive operation type being a secure channel establishment request, a second digital signature corresponding to the interactive operation type being a secure channel establishment response, a third digital signature corresponding to the interactive operation type being a secure channel establishment response, and a fourth digital signature corresponding to the interactive operation type being a secure channel data sending.

[0085] Furthermore, the first digital signature is obtained by encrypting the message header and the message data payload using the private key of the cryptographic device;

[0086] The second and third digital signatures are obtained by encrypting the message header and the message data payload using the private key of the cryptographic device management platform;

[0087] The fourth digital signature is a cryptographic hash value of the message header and the message data payload calculated using the session key.

[0088] It should be noted that the values ​​of the first to fourth digital signatures are expressed in base64 encoding format.

[0089] Specifically, the signature portion of the message, for messages whose header operation type is "request-tunnel" (secure channel establishment request), is the digital signature of the device's private key on the message header + payload. For messages whose header operation types are "response-tunnel" (secure channel establishment response) and "restart-tunnel" (secure channel restart notification), the signature portion is the digital signature of the management center's private key on the message header + payload. For messages whose header operation type is "data-tunnel" (secure channel data transmission), the signature portion is the cryptographic hash value of the message header + payload calculated using the secure channel session key.

[0090] In one embodiment, after establishing the security notification, the method further includes the following steps:

[0091] After establishing a secure channel, a counter is used to record the message ID number. Each request message and the corresponding response request ID are consistent.

[0092] After the counter value exceeds the maximum value, the counter is cleared and a channel reset request is sent.

[0093] In one embodiment, step S10: based on the secure channel protocol and a predefined protocol message structure, information interaction is performed with the cryptographic device to establish a secure channel and negotiate a session key, specifically including:

[0094] Based on the secure channel protocol, a secure channel establishment request is sent to the cryptographic device, and a secure channel establishment response is received from the cryptographic device to establish a secure channel and negotiate a session key.

[0095] In one embodiment, step S20: during the validity period of the secure channel, managing and monitoring the state of the managed object attributes corresponding to each cryptographic device based on the session key and the predefined protocol message structure includes:

[0096] During the validity period of the secure channel, the attributes of the managed objects corresponding to each cryptographic device are managed and the status is monitored using messages sent with the interactive operation type of secure channel data.

[0097] Specifically, within the validity period of the secure channel, the cryptographic device management platform and the managed cryptographic device use the negotiated session key and the protocol message structure described in this embodiment, and according to the managed object attributes defined in GM / T 0050-2016 "Technical Specifications for Cryptographic Device Management", use "secure channel data sending" type messages for management and secure transmission of status monitoring information.

[0098] In one embodiment, when the secure channel is a long connection, the validity period of the secure channel is specified in the secure channel establishment message;

[0099] When the secure channel is a short connection, the validity period of the secure channel and session key is the current request-response process.

[0100] Specifically, the secure channel establishment message must specify the connection type. If the secure channel established between the cryptographic device management platform and the managed cryptographic device is a persistent connection, the validity period of the secure channel is specified in the secure channel establishment message. If the secure channel established between the management center and the managed device is a transient connection, the validity period of the secure channel and session key is limited to a single request-response process.

[0101] In one embodiment, before step S10: exchanging information with a cryptographic device based on a secure channel protocol and a predefined protocol message structure, establishing a secure channel, and negotiating a session key, the method further includes:

[0102] Receiving a registration request sent by a cryptographic device and a first certificate issued by the cryptographic device;

[0103] Verify and store the first certificate, return the unique identifier of the cryptographic device and the second certificate issued by the cryptographic device management platform to the cryptographic device, and complete the registration.

[0104] In one embodiment, the communication protocol framework used between the cryptographic device management platform and the cryptographic device can be divided into four layers in the overall framework structure: transport layer, message layer, operation layer, and content layer.

[0105] (1) Transport layer: provides a communication path for message interaction between the cryptographic device management platform and the cryptographic devices, using HTTP or HTTPS as the bearer protocol.

[0106] (2) Message layer: Provides a simple request and response mechanism based on the HTTP protocol. The cryptographic device management platform encapsulates the request content in an HTTP request and sends it to the cryptographic device; the cryptographic device encapsulates the request processing result in an HTTP response and returns it to the cryptographic device management platform; the message structure is uniformly encoded using base64.

[0107] (3) Operation layer: Based on the HTTP POST method and various interface definitions, the cryptographic device management platform provides RPC operations such as adding, deleting, modifying, and checking various configuration and monitoring data of the cryptographic device. POST / interfaces / {1.0} / interface_xxx, where interface_xxx corresponds to a specific management or monitoring interface definition, constitutes an RPC operation of the management platform on the device.

[0108] (4) Content layer: describes the configuration and monitoring data involved between the cryptographic device management platform and the cryptographic devices. These data are combined with the RPC definition of the operation layer and form different management interfaces and status monitoring interfaces based on the managed object attributes defined in GM / T 0050-2016 "Technical Specifications for Cryptographic Device Management" and the message structure below.

[0109] The conversion rules from the main data types in GM / T 0050-2016 to the corresponding HTTP formats are shown in Table 1:

[0110] Table 1 GM / T 0050-2016 Conversion rules for main data types to HTTP format

[0111] This embodiment designs a REST-style cryptographic device management protocol based on the HTTP protocol and in compliance with the basic message structure and security attributes defined in GM / T 0050-2016 "Technical Specifications for Cryptographic Device Management", and implements it on the cryptographic device management platform and cryptographic devices.

[0112] In addition, as shown in FIG2 , the embodiment of the present application discloses a cryptographic device management platform, including:

[0113] The channel establishment module 10 is used to exchange information with the cryptographic device based on the secure channel protocol and the predefined protocol message structure, establish a secure channel and negotiate a session key;

[0114] The management module 20 is used to manage and monitor the status of the managed object attributes corresponding to each cryptographic device based on the session key and the predefined protocol message structure during the validity period of the secure channel;

[0115] The predefined protocol message structure uses JSON objects to encapsulate the management and monitoring configuration parameters of the cryptographic device.

[0116] It should be noted that the communication protocol framework and message structure used by the cryptographic device management platform and the cryptographic device for information interaction are described in the first embodiment above and will not be repeated here.

[0117] In one embodiment, a counter is maintained in the cryptographic device management platform, and the cryptographic device management platform further includes:

[0118] After establishing a secure channel, a counter is used to record the message ID number. Each request message and the corresponding response request ID are consistent.

[0119] The channel reset module is used to clear the counter and send a channel reset request after the counter value exceeds the maximum value.

[0120] In one embodiment, the channel establishment module 10 is specifically configured to: send a secure channel establishment request to the cryptographic device based on a secure channel protocol, receive a secure channel establishment response returned by the cryptographic device, establish a secure channel, and negotiate a session key.

[0121] In one embodiment, the management module 20 is specifically configured to manage and monitor the status of the managed object attributes corresponding to each cryptographic device by using messages sent with the interactive operation type of secure channel data during the validity period of the secure channel.

[0122] In one embodiment, when the secure channel is a long connection, the validity period of the secure channel is specified in the secure channel establishment message;

[0123] When the secure channel is a short connection, the validity period of the secure channel and session key is the current request-response process.

[0124] In one embodiment, the cryptographic device management platform further includes:

[0125] A registration request receiving module, configured to receive a registration request sent by a cryptographic device and a first certificate issued by the cryptographic device;

[0126] The registration module is used to verify and store the first certificate, return the unique identifier of the cryptographic device and the second certificate issued by the cryptographic device management platform to the cryptographic device to complete the registration.

[0127] It should be noted that other embodiments or implementation methods of the cryptographic device management platform of the present application can refer to the above-mentioned method embodiments, which will not be repeated here.

[0128] In addition, as shown in Figures 3 and 4, the communication process between the cryptographic device management platform and the cryptographic device is as follows:

[0129] (1) Initialization of the managed cryptographic device, including the generation of the device's public and private key pairs and the issuance of the device's first certificate;

[0130] (2) The managed cryptographic device registers with the cryptographic device management platform and uploads the device's first certificate. The management platform verifies and stores the device's first certificate and returns the unique identifier of the cryptographic device and the second certificate generated by the management platform.

[0131] (3) The managed cryptographic device verifies and stores the second certificate, completing device registration;

[0132] (4) The managed cryptographic device and the management platform shall establish a secure channel and negotiate the session key using messages of the type "Secure Channel Establishment Request" and "Secure Channel Establishment Response" in accordance with the description of Appendix B "Secure Channel Protocol Framework" of GM / T 0050-2016 and the protocol message structure described above;

[0133] (5) During the validity period of the secure channel, the cryptographic device management platform and the managed cryptographic device use the negotiated session key and the protocol message structure described in this embodiment, and use the "secure channel data transmission" type message to manage and securely transmit status monitoring information based on the managed object attributes defined in GM / T 0050-2016 "Technical Specifications for Cryptographic Device Management".

[0134] In addition, an embodiment of the present application further provides an electronic device, as shown in FIG5 , including a processor 501, a communication interface 502, a memory 503, and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other via the communication bus 504.

[0135] Memory 503, used for storing computer programs;

[0136] The processor 501 is used to implement the model training method described in the above embodiment when executing the program stored in the memory 503.

[0137] The communication bus mentioned in the terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0138] The communication interface is used for communication between the above terminal and other devices.

[0139] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage. Alternatively, the memory may be at least one storage device located away from the processor.

[0140] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0141] As shown in FIG6 , in another embodiment provided in the present application, a computer-readable storage medium 601 is further provided, in which instructions are stored. When the computer-readable storage medium 601 is run on a computer, the computer executes the model training method described in the above embodiment.

[0142] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0143] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present application. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0144] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of such features. Throughout the description of this application, "plurality" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0145] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for managing a cryptographic device, wherein: The method comprises: Based on the secure channel protocol and pre-defined protocol message structure, it exchanges information with the cryptographic device to establish a secure channel and negotiate session keys; During the validity period of the secure channel, the attributes of the managed objects corresponding to each of the cryptographic devices are managed and the status is monitored based on the session key and the predefined protocol message structure; The predefined protocol message structure uses data objects to encapsulate the management and monitoring configuration parameters of the cryptographic device.

2. The cryptographic device management method according to claim 1, wherein: The protocol message structure includes a message header, a message data part and a message signature part described by a data object; The parameters of the message header include a security mode, a message identifier, a receiver identifier, a sender identifier, and an interactive operation type.

3. The cryptographic device management method according to claim 2, wherein: The message header also includes a protocol version number, an encryption algorithm, a signature algorithm, and a cryptographic hash algorithm with a key.

4. The cryptographic device management method according to claim 2, wherein: The security mode includes three Boolean type parameters, which respectively indicate whether to reply, whether to encrypt, and whether to sign or calculate a hash value; Each Boolean parameter has a value of Yes or No.

5. The cryptographic device management method according to claim 2, wherein: The interactive operation types include secure channel establishment request, secure channel establishment response, secure channel data transmission and secure channel restart notification.

6. The cryptographic device management method according to claim 2, wherein: The parameters of the message data part include an initialization vector when an encryption algorithm is used, a management application type identifier, an information operation type, and a ciphertext.

7. The cryptographic device management method according to claim 6, wherein: The information operation types include adding, deleting, modifying, updating and reading.

8. The cryptographic device management method according to claim 6, wherein: The management application type identifier includes key management, remote monitoring, parameter configuration, remote maintenance and validity verification.

9. The cryptographic device management method according to claim 5, wherein: The message signature part includes a first digital signature corresponding to a secure channel establishment request when the interactive operation type is a secure channel establishment response, a second digital signature corresponding to a secure channel establishment response when the interactive operation type is a secure channel establishment response, and a fourth digital signature corresponding to a secure channel data sending when the interactive operation type is a secure channel establishment response.

10. The cryptographic device management method according to claim 9, wherein: The first digital signature is obtained by encrypting the message header and the message data part using the private key of the cryptographic device; The second digital signature and the third digital signature are obtained by encrypting the message header and the message data part using the private key of the cryptographic device management platform; The fourth digital signature is a cryptographic hash value of the message header and the message data portion calculated using the session key.

11. The cryptographic device management method according to claim 1, wherein: The method further comprises: After the secure channel is established, a counter is used to record the message identifier, and the identifier of each request message and the corresponding response request are consistent; After the counter count value exceeds the maximum value, the counter is cleared and a channel reset request is sent.

12. The cryptographic device management method according to claim 5, wherein: The method of performing information interaction with a cryptographic device based on a secure channel protocol and a predefined protocol message structure, establishing a secure channel and negotiating a session key includes: Based on the secure channel protocol, a secure channel establishment request is sent to the cryptographic device, and a secure channel establishment response returned by the cryptographic device is received to establish a secure channel and negotiate a session key.

13. The cryptographic device management method according to claim 5, wherein: During the validity period of the secure channel, the managed object attributes corresponding to each of the cryptographic devices are managed and the status is monitored based on the session key and the predefined protocol message structure, including: During the validity period of the secure channel, the attributes of the managed objects corresponding to each of the cryptographic devices are managed and the status is monitored using messages sent with the interactive operation type of secure channel data.

14. The cryptographic device management method according to claim 1, wherein: When the secure channel is a long connection, specifying a validity period of the secure channel in a secure channel establishment message; When the secure channel is a short connection, the validity period of the secure channel and the session key is the current request-response process.

15. The cryptographic device management method according to claim 1, wherein: Before exchanging information with a cryptographic device, establishing a secure channel and negotiating a session key based on the secure channel protocol and a predefined protocol message structure, the method further includes: Receiving a registration request sent by the cryptographic device and a first certificate issued by the cryptographic device; The first certificate is verified and stored, and the unique identifier of the cryptographic device and the second certificate issued by the cryptographic device management platform are returned to the cryptographic device to complete the registration.

16. A cryptographic device management platform, wherein: The cryptographic device management platform includes: A channel establishment module is used to exchange information with the cryptographic device, establish a secure channel and negotiate a session key based on a secure channel protocol and a predefined protocol message structure; A management module, used for managing and monitoring the status of the managed object attributes corresponding to each of the cryptographic devices based on the session key and a predefined protocol message structure during the validity period of the secure channel; The predefined protocol message structure uses data objects to encapsulate the management and monitoring configuration parameters of the cryptographic device.

17. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 15 when executing the program stored in the memory.

18. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 15.

Images