CN109657449B

CN109657449B - Method and equipment for realizing password resource intercommunication based on password card

Info

Publication number: CN109657449B
Application number: CN201811535811.6A
Authority: CN
Inventors: 魏贵鹏; 谢演; 陈仕昌
Original assignee: Chengdu 30javee Microelectronics Co ltd
Current assignee: Chengdu 30javee Microelectronics Co ltd
Priority date: 2018-12-14
Filing date: 2018-12-14
Publication date: 2020-11-03
Anticipated expiration: 2038-12-14
Also published as: CN109657449A

Abstract

The invention discloses a method and equipment for realizing intercommunication of cipher resources based on a cipher card, wherein the method takes the realization of a PKCS #11 cipher interface as a basis, and transfers the cipher interfaces of CSP and SKF and the management mode of the cipher resources to PKCS #11, and comprises the steps of cipher interface transfer, cipher resource management mode transfer and cipher card firmware adaptation, wherein the cipher interface transfer takes a PKCS #11 system interface as a basis to transfer CSP and SKF; the password resource management mode conversion converts the applications and the container concepts of the CSP and the SKF into the objects of the PKCS #11 for management. The invention can effectively solve the problem that the password resources are not intercommunicated across the password interface system, and the method does not need the password card to realize three password interfaces and management, can greatly reduce the workload of cross adaptation of the three, has low requirement on the password card resources, reduces the code amount of the password card and improves the execution efficiency.

Description

Method and equipment for realizing password resource intercommunication based on password card

Technical Field

The invention relates to the technical field of password application and password interfaces, in particular to a method and equipment for realizing password resource intercommunication based on a password card.

Background

The current network information technology is developed at a high speed, a large amount of information data such as social contact, identity, finance and the like are transmitted and interacted on a network at all times, the information security problem occurs at all times, the information security is increasingly highlighted, and the indispensable and important properties of the password security service capable of providing security guarantee for application programs are highlighted. Several international and domestic cipher application interface specifications are formed at present, and representative and widely applied are PKCS #11, CSP and SKF.

PKCS #11, published by RSA laboratories, is a platform-independent API, and has cross-platform properties, developed as an abstraction layer for generic cryptographic tokens, mainly relating to the management and functionality of tokens, sessions, slots, and objects. CSP is a Microsoft encryption application interface, is specially designed for WIN32 application programs, and mainly relates to container management and functions. The SKF is a code application interface standard established by the China national code administration, and mainly relates to container and multi-application management and functions. The three password interface specifications have consistency and difference, all the specifications can provide uniform password function service, the password function use processes are similar and all relate to the authority management of PIN code users and the like, but the password interfaces of the three specifications are different in definition, the management modes of password resources such as keys, certificates and the like are different, the password resource management modes of SKF and CSP are containers, and the password resource management mode of PKCS #11 is an object.

In a password system and an application scenario, a special password TF card, i.e., a password card, carrying password resources and functions is used as a specific password device, and a secure and trusted system terminal, called a crypto-tube or a certificate authority (ca) system, is defined in addition to inject other password resources such as a certificate and a secret key into the password card, so that the password card passes authentication and has a legal and secure identity. The authenticated password card is applied to portable handheld android system terminals such as mobile phones and PADs to provide specific password services.

However, when the cryptographic card is injected with cryptographic resources by a crypto-pipe or CA system (generally, Windows system) using a CSP cryptographic interface or an SKF cryptographic interface, the cryptographic card cannot be directly applied to an android security application APP based on a PKCS #11 cryptographic interface, because the PKCS #11 cryptographic interface cannot find the required cryptographic resources in an object management manner.

Disclosure of Invention

The invention provides a switching method of a password resource management mode aiming at the problem that password resources managed by CSP and SKF password interfaces can not be used in PKCS #11 password interfaces, which is suitable for the three password interfaces, realizes the intercommunication and the use of the password resources and has simple and efficient whole realization mechanism.

The invention provides a method for realizing intercommunication of cipher resources based on a cipher card, which is characterized in that based on the realization of a PKCS #11 cipher interface, the cipher interfaces of CSP and SKF and a cipher resource management mode are switched to the PKCS #11, the method comprises the steps of cipher interface switching, cipher resource management mode switching and cipher card firmware adaptation, wherein the cipher interface switching takes a PKCS #11 system interface as a basic switching CSP and SKF; the password resource management mode conversion converts the applications and the container concepts of the CSP and the SKF into the objects of the PKCS #11 for management.

Further, the password interface switching specifically includes: the PKCS #11 can be directly used by the application as a base library and is transferred to CSP and SKF cryptographic interface supply application calls through upper layer definition, interface and function migration, and the three cryptographic interfaces are converted into PKCS #11 cryptographic interfaces at the bottom layer for processing and management.

Further, the password interface switching specifically includes: the CSP and SKF container management interfaces are realized through the switching and calling of the PKCS #11 object management interface, the CSP and SKF password service interfaces are realized through the switching and calling of the PKCS #11 password service interface, and the CSP and SKF authority management interfaces are realized through the switching and calling of the PKCS #11 PIN and login management.

Further, the password resource management mode conversion specifically includes: the method comprises the steps of defining a new attribute CKA _ CONTAINER _ ATTRIBUTES to convert CSP and SKF CONTAINER names by relying on an extension definition CKA _ VENTOR _ DEFINED of a PKCS #11 system, defining a multi-APPLICATION concept of CKA _ APPLICATION _ ATTRIBUTES to convert SKF, using CKA _ TOKEN ATTRIBUTES of PKCS #11 to distinguish a permanent or temporary existing life cycle of a KEY or a CERTIFICATE in a CONTAINER for conversion, directly using CKO _ PUBLIC _ KEY, CKO _ PRIVATE _ KEY and CKO _ SECRET _ KEY ATTRIBUTES to describe KEY types, directly using CKO _ CERTIFICATE ATTRIBUTES to describe CERTIFICATEs, and directly using CKA _ VALUE ATTRIBUTES to describe entity data of the KEY and the CERTIFICATEs.

Further, the adaptation of the password card firmware specifically includes: realizing the service functions of PKCS #11 main body PIN management, authority management, algorithm function and object management based on the SDK; the cipher card firmware and the upper layer cipher application interface library carry out data interaction and service function definition through service frames, each PKCS #11 interface function is a service function command code, the service function definition and the service data are sent to the cipher card through the service frames, and the cipher card firmware receives the service frames, analyzes according to the definition and completes the designated service functions.

The equipment provided by the invention realizes the intercommunication of the cipher resources based on the cipher card, transfers the cipher interfaces of the CSP and the SKF and the management mode of the cipher resources to the PKCS #11 based on the realization of the cipher interface of the PKCS #11, and comprises a cipher interface transfer device, a cipher resource management mode transfer device and a cipher card firmware adapter device, wherein the cipher interface transfer device is used for transferring the CSP and the SKF by taking the interface of the PKCS #11 system as the basis; the cipher resource management mode conversion device is used for converting all the applications and container concepts of CSP and SKF into objects of PKCS #11 for management.

Further, the method for the password interface switching device to switch the password interface comprises the following steps: the CSP and SKF container management interfaces are realized through the switching and calling of the PKCS #11 object management interface, the CSP and SKF password service interfaces are realized through the switching and calling of the PKCS #11 password service interface, and the CSP and SKF authority management interfaces are realized through the switching and calling of the PKCS #11 PIN and login management.

Further, the method for performing the password resource management mode conversion by the password resource management mode conversion device includes: the method comprises the steps of defining a new attribute CKA _ CONTAINER _ ATTRIBUTES to convert CSP and SKF CONTAINER names by relying on an extension definition CKA _ VENTOR _ DEFINED of a PKCS #11 system, defining a multi-APPLICATION concept of CKA _ APPLICATION _ ATTRIBUTES to convert SKF, using CKA _ TOKEN ATTRIBUTES of PKCS #11 to distinguish a permanent or temporary existing life cycle of a KEY or a CERTIFICATE in a CONTAINER for conversion, directly using CKO _ PUBLIC _ KEY, CKO _ PRIVATE _ KEY and CKO _ SECRET _ KEY ATTRIBUTES to describe KEY types, directly using CKO _ CERTIFICATE ATTRIBUTES to describe CERTIFICATEs, and directly using CKA _ VALUE ATTRIBUTES to describe entity data of the KEY and the CERTIFICATEs.

Further, the method for the adapter device of the firmware of the password card to adapt the firmware of the password card comprises the following steps: realizing the service functions of PKCS #11 main body PIN management, authority management, algorithm function and object management based on the SDK; the cipher card firmware and the upper layer cipher application interface library carry out data interaction and service function definition through service frames, each PKCS #11 interface function is a service function command code, the service function definition and the service data are sent to the cipher card through the service frames, and the cipher card firmware receives the service frames, analyzes according to the definition and completes the designated service functions.

Another aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method as described above.

The invention provides a method for intercommunication of password resources by taking a password interface as a basis to transfer other password interfaces as an idea, which is particularly suitable for a CA (certification service provider) or crypto management system of Windows to inject the password resources by using a CSP (chip scale package) or SKF (secret scale format) password interface, and then a PKCS #11 of an Android system uses an application scene of the password resources, so that the problem that the password resources are not intercommunicated across the password interface system can be effectively solved, and the method does not need the password card to realize three password interfaces and management, can greatly reduce the workload of cross adaptation of the three, has low requirements on the password card resources, reduces the code quantity of the password card and improves the execution efficiency.

Drawings

The invention will now be described, by way of example, with reference to the accompanying drawings, in which:

FIG. 1 is a diagram illustrating a cryptographic interface switch implementation according to an embodiment of the present invention;

FIG. 2 is a container and object translation diagram according to an embodiment of the present invention;

fig. 3 is a schematic diagram of a password card according to an embodiment of the invention.

Detailed Description

All of the features disclosed in this specification, or all of the steps in any method or process so disclosed, may be combined in any combination, except combinations of features and/or steps that are mutually exclusive.

Any feature disclosed in this specification may be replaced by alternative features serving equivalent or similar purposes, unless expressly stated otherwise. That is, unless expressly stated otherwise, each feature is only an example of a generic series of equivalent or similar features.

The invention takes the realization of PKCS #11 password interface (comprising PKCS #11 library and password card firmware) as the basis, switches the password interface and the password resource management mode of CSP and SKF to PKCS #11, unifies the password interface and the password resource management mode of three sets of password interface specifications, and switches two main aspects from the password interface switching and the password resource management mode to realize intercommunication.

1) Password interface switching

The CSP, SKF and PKCS #11 specifications each define an API interface, mainly a cryptographic service class interface, a cryptographic resource management class interface (container management and object management) and a rights management interface.

Based on a simple and convenient implementation mode, the interfaces of the PKCS #11 system are used as the basic transfer CSP and SKF, as shown in FIG. 1, the PKCS #11 as the basic library can be directly used by applications, and transferred to be used for the cryptographic interfaces supply of the CSP and the SKF through upper layer definition, interface and function transplantation, and the three cryptographic interfaces are converted into the cryptographic interfaces of the PKCS #11 at the bottom layer for processing and management. The CSP and SKF container management interfaces are realized through the switching and calling of the PKCS #11 object management interface, the CSP and SKF password service interfaces are realized through the switching and calling of the PKCS #11 password service interface, and the CSP and SKF authority management interfaces are realized through the switching and calling of the PKCS #11 PIN and login management.

2) Cryptographic resource management mode conversion

The management mode of CSP and SKF password resources is a container, the container can be regarded as a password resource aggregate, and password resources such as a secret key (pair), a certificate and the like can be stored in the container according to the CSP and SKF specification requirements. The management mode of the PKCS #11 password resource is an object, the object is a multi-attribute aggregate and can be divided into three types of objects of data, certificate and key. The method comprises the steps of converting all CONTAINERs of CSP and SKF into objects of PKCS #11 for management, defining a new attribute CKA _ CONTAINER _ ATTRIBUTES to convert CSP and SKF CONTAINER names by means of the expanded definition CKA _ VENTOR _ DEFINED of a PKCS #11 system, defining CKA _ APPLICATION _ ATTRIBUTES to convert a multi-APPLICATION concept of SKF, distinguishing CKA _ TOKEN ATTRIBUTES of PKCS #11 for the permanent or temporary existing life cycle of KEYs or CERTIFICATEs in the CONTAINERs, directly describing CKO _ PUBLIC _ KEY, CKO _ PRIVATE _ KEY and CKO _ SECRET _ KEY ATTRIBUTES, directly describing the CKO _ CERTIFICATE ATTRIBUTES of the KEYs or CERTIFICATEs, directly describing entity data of the KEYs and the CERTIFICATEs by using the LUA _ VAE ATTRIBUTES, and thus converting all the APPLICATIONs of CSP and SKF and the CONTAINER concepts into objects of PKCS #11 for management, as shown in a drawing 2. The PKCS #11 can find out all the KEYs and certificate cryptographic resources issued by the CSP or SKF by using the CKA _ content _ ATTRIBUTES and the CKA _ APPLICATION _ ATTRIBUTES when using cryptographic resources, and can know whether a specific object is a public KEY or a private KEY or a certificate by obtaining the CKA _ KEY _ TYPE ATTRIBUTES, so that the PKCS #11 can be used for specific cryptographic services.

3) Cipher card fastener adaptation

As shown in fig. 3, the cryptocard body firmware implements service functions such as PKCS #11 body PIN management, rights management, algorithm function, and object management based on the SDK. The cipher card firmware and the upper layer cipher application interface library carry out data interaction and service function definition through service frames, each PKCS #11 interface function is a service function command code, the service function definition and the service data are sent to the cipher card through the service frames, and the cipher card firmware receives the service frames, analyzes according to the definition and completes the designated service functions.

The invention also provides a device corresponding to the method, which takes the realization of the PKCS #11 password interface as a basis, and transfers the password interfaces of the CSP and the SKF and the password resource management mode to the PKCS #11, and comprises a password interface transfer device, a password resource management mode conversion device and a password card firmware adapter device, wherein the password interface transfer device is used for transferring the CSP and the SKF by taking the PKCS #11 system interface as the basis; the cipher resource management mode conversion device is used for converting all the applications and container concepts of CSP and SKF into objects of PKCS #11 for management.

Those skilled in the art will appreciate that all or part of the steps in the methods of the above embodiments may be implemented by hardware associated with program instructions, and the program may be stored in a computer readable storage medium, which may include: read Only Memory (ROM), Random Access Memory (RAM), magnetic or optical disks, and the like.

The invention is not limited to the foregoing embodiments. The invention extends to any novel feature or any novel combination of features disclosed in this specification and any novel method or process steps or any novel combination of features disclosed.

Claims

1. A method for realizing intercommunication of cipher resources based on cipher card is characterized in that a CA or crypto-control system for Windows uses a CSP or SKF cipher interface to inject the cipher resources, then a PKCS #11 of an Android system uses an application scene of the cipher resources, and based on the realization of the PKCS #11 cipher interface, the cipher interfaces and the cipher resource management modes of the CSP and the SKF are switched to the PKCS #11, including cipher interface switching, cipher resource management mode switching and cipher card firmware adaptation, wherein the cipher interface switching takes a PKCS #11 system interface as a basis to switch the CSP and the SKF; the password resource management mode conversion converts the CSP and SKF application and container concepts into PKCS #11 objects for management;

the password interface switching specifically comprises: the PKCS #11 can be directly used by the application as a base library and is transferred to CSP and SKF cryptographic interface supply application calls through upper layer definition, interface and function migration, and the three cryptographic interfaces are converted into PKCS #11 cryptographic interfaces at the bottom layer for processing and management.

2. The method for implementing intercommunication of cipher resources based on cipher card according to claim 1, wherein said cipher interface switching specifically includes: the CSP and SKF container management interfaces are realized through the switching and calling of the PKCS #11 object management interface, the CSP and SKF password service interfaces are realized through the switching and calling of the PKCS #11 password service interface, and the CSP and SKF authority management interfaces are realized through the switching and calling of the PKCS #11 PIN and login management.

3. The method for implementing intercommunication of cipher resources based on cipher card according to claim 1, wherein said cipher resource management mode conversion specifically includes: the method comprises the steps of defining a new attribute CKA _ CONTAINER _ ATTRIBUTES to convert CSP and SKF CONTAINER names by relying on an extension definition CKA _ VENTOR _ DEFINED of a PKCS #11 system, defining a multi-APPLICATION concept of CKA _ APPLICATION _ ATTRIBUTES to convert SKF, using CKA _ TOKEN ATTRIBUTES of PKCS #11 to distinguish a permanent or temporary existing life cycle of a KEY or a CERTIFICATE in a CONTAINER for conversion, directly using CKO _ PUBLIC _ KEY, CKO _ PRIVATE _ KEY and CKO _ SECRET _ KEY ATTRIBUTES to describe KEY types, directly using CKO _ CERTIFICATE ATTRIBUTES to describe CERTIFICATEs, and directly using CKA _ VALUE ATTRIBUTES to describe entity data of the KEY and the CERTIFICATEs.

4. The method according to claim 1, wherein the adapting of the firmware of the cryptographic card specifically comprises: realizing the service functions of PKCS #11 main body PIN management, authority management, algorithm function and object management based on the SDK; the cipher card firmware and the upper layer cipher application interface library carry out data interaction and service function definition through service frames, each PKCS #11 interface function is a service function command code, the service function definition and the service data are sent to the cipher card through the service frames, and the cipher card firmware receives the service frames, analyzes according to the definition and completes the designated service functions.

5. A device for realizing intercommunication of cipher resources based on cipher cards is characterized in that the device is used for a Windows CA or crypto-system to inject the cipher resources by using a CSP or SKF cipher interface, then a PKCS #11 of an Android system uses an application scene of the cipher resources, and the cipher interfaces and the cipher resource management modes of the CSP and the SKF are switched to the PKCS #11 based on the realization of the PKCS #11 cipher interface, and the device comprises a cipher interface switching device, a cipher resource management mode switching device and a cipher card firmware adapting device, wherein the cipher interface switching device is used for switching the CSP and the SKF by using the PKCS #11 system interface as a basis; the cipher resource management mode conversion device is used for converting all CSP and SKF applications and container concepts into PKCS #11 objects for management;

6. The apparatus according to claim 5, wherein the method for performing cryptographic interface switching by the cryptographic interface switching apparatus comprises: the CSP and SKF container management interfaces are realized through the switching and calling of the PKCS #11 object management interface, the CSP and SKF password service interfaces are realized through the switching and calling of the PKCS #11 password service interface, and the CSP and SKF authority management interfaces are realized through the switching and calling of the PKCS #11 PIN and login management.

7. The apparatus according to claim 5, wherein the method for performing the switching of the cryptographic resource management mode by the cryptographic resource management mode switching device comprises: the method comprises the steps of defining a new attribute CKA _ CONTAINER _ ATTRIBUTES to convert CSP and SKF CONTAINER names by relying on an extension definition CKA _ VENTOR _ DEFINED of a PKCS #11 system, defining a multi-APPLICATION concept of CKA _ APPLICATION _ ATTRIBUTES to convert SKF, using CKA _ TOKEN ATTRIBUTES of PKCS #11 to distinguish a permanent or temporary existing life cycle of a KEY or a CERTIFICATE in a CONTAINER for conversion, directly using CKO _ PUBLIC _ KEY, CKO _ PRIVATE _ KEY and CKO _ SECRET _ KEY ATTRIBUTES to describe KEY types, directly using CKO _ CERTIFICATE ATTRIBUTES to describe CERTIFICATEs, and directly using CKA _ VALUE ATTRIBUTES to describe entity data of the KEY and the CERTIFICATEs.

8. The apparatus according to claim 5, wherein the method for adapting the firmware of the cryptocard by the firmware adapting device of the cryptocard comprises: realizing the service functions of PKCS #11 main body PIN management, authority management, algorithm function and object management based on the SDK; the cipher card firmware and the upper layer cipher application interface library carry out data interaction and service function definition through service frames, each PKCS #11 interface function is a service function command code, the service function definition and the service data are sent to the cipher card through the service frames, and the cipher card firmware receives the service frames, analyzes according to the definition and completes the designated service functions.

9. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 4.