WO2018028359A1 - Procédé et appareil de traitement de service, et support de stockage et dispositif électronique - Google Patents

Procédé et appareil de traitement de service, et support de stockage et dispositif électronique Download PDF

Info

Publication number
WO2018028359A1
WO2018028359A1 PCT/CN2017/091903 CN2017091903W WO2018028359A1 WO 2018028359 A1 WO2018028359 A1 WO 2018028359A1 CN 2017091903 W CN2017091903 W CN 2017091903W WO 2018028359 A1 WO2018028359 A1 WO 2018028359A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
module
agent module
service
data
Prior art date
Application number
PCT/CN2017/091903
Other languages
English (en)
Chinese (zh)
Inventor
杨藩
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201610643327.XA external-priority patent/CN106302422B/zh
Priority claimed from CN201611018871.1A external-priority patent/CN108076021B/zh
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2018028359A1 publication Critical patent/WO2018028359A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications

Definitions

  • the present application relates to the field of computers, and in particular to a service processing method, apparatus, storage medium, and electronic device.
  • the encryption method used when encrypting a service, mainly includes three types: mode one, directly writing a fixed key in the code or configuration file; and second, directly saving or encrypting in plain text in the shared memory.
  • the save mode saves the key; mode 3: The key is saved on the server managed by the special manager, and the service can periodically call and obtain the key in the server through the network.
  • the related art provides a method for encrypting and decrypting by using a proxy module.
  • the service module may send a ciphertext processing request carrying the data to be encrypted to the key proxy module.
  • the key proxy module obtains the target key from the extracted key list, and then encrypts the data to be encrypted using the target key to obtain the encrypted data, and finally, the secret.
  • the key broker module sends the encrypted data to the business module.
  • the agent encryption and decryption is used instead of the business process to directly encrypt and decrypt. Once the agent issues a BUG, all the encryption and decryption operations may fail, causing a great loss to the business.
  • the BUG may be introduced by the change that the Agent continuously supports the new requirements in practice, or it may be a rather concealed, extremely difficult to be triggered BUG (or even the operating system kernel BUG) is finally triggered. Or because the other services on the hardware server occupy a large amount of CPU, the service agent encryption and decryption request times out. Once the above problem occurs, the encryption and decryption operation will fail.
  • the embodiment of the present application provides a service processing method, device, storage medium, and electronic device, so as to at least solve the technical problem that the stability of the key is low when the service is encrypted and decrypted in the related art.
  • a service processing method including: acquiring first information, where the first information is used to indicate an execution result of a first type of key agent module to perform a ciphertext processing request Detecting whether the first information meets a predetermined type switching condition, wherein the matching the predetermined type switching condition indicates that a vulnerability occurs in the first type of key agent module; and detecting that the first information meets the predetermined In the case of a type switching condition, the ciphertext processing request of the service module is executed by the second type of key broker module.
  • a service processing method including: a first type of key agent module receives and executes a ciphertext processing request of a service module, and obtains an execution result; and a second type of key agent The module receives and executes a ciphertext processing request of the service module, where the service module is configured to: when the first information generated based on the execution result meets the predetermined type switching condition, to the second type The key broker module sends a ciphertext processing request, wherein the predetermined type of switching condition is met to indicate that the first type of key broker module is vulnerable.
  • a service processing method including: The key agent module acquires an execution result of the execution of the ciphertext processing request; the key agent module detects whether the execution result meets a predetermined mode switching condition, wherein the matching the predetermined mode switching condition indicates that the key agent module is determined A vulnerability is generated; if it is detected that the execution result meets a predetermined mode switching condition, the key agent module sends the indication information to the service module, where the indication information is used to indicate that the service module switches to the service The module executes the mode of the ciphertext processing request.
  • a service processing apparatus including: a first acquiring unit, configured to acquire first information, wherein the first information is used to represent a first type of key agent The module performs an execution result of the ciphertext processing request; the first detecting unit is configured to detect whether the first information meets a predetermined type switching condition, wherein the matching the predetermined type switching condition indicates that the first type of key agent is determined The module has a vulnerability, that is, the predetermined type of switching condition is met, indicating that the first type of key agent module cannot stably perform the ciphertext processing request; the first executing unit is configured to detect the first information In the case that the predetermined type of switching condition is met, the ciphertext processing request of the service module is executed by the second type of key agent module.
  • a service processing apparatus including: a first processing unit, configured in a first type of key agent module, configured to receive and execute a ciphertext processing request of a service module Obtaining an execution result; a first processing unit, disposed in the second type of key broker module, configured to receive and execute a ciphertext processing request of the service module, wherein the service module is set to perform based on the execution And if the first information generated by the result meets the predetermined type switching condition, sending a ciphertext processing request to the second type of key proxy module, wherein the predetermined type switching condition is met to determine the first type A vulnerability has occurred in the key broker module.
  • a service processing apparatus including: a first acquiring unit, configured to acquire an execution result of performing a ciphertext processing request; and a first detecting unit configured to detect the execution result Whether the predetermined mode switching condition is met, wherein the pre-compliance is met
  • the mode switching condition indicates that a vulnerability exists in the key agent module
  • the first sending unit is configured to: send the indication information to the service module if the execution result is consistent with the predetermined mode switching condition, where the indication is sent
  • the information is used to indicate that the service module switches to a mode in which the ciphertext processing request is performed by the service module.
  • a storage medium is further provided, where the storage medium may store an execution instruction for executing the service processing method in the foregoing embodiment.
  • an electronic device includes a memory, a processor, and a computer program stored on the memory and operable on the processor, wherein the processor passes the foregoing The computer program performs the above method.
  • the first information is obtained, where the first information is used to indicate that the first type of the key agent module performs the execution result of the ciphertext processing request; whether the first information meets the predetermined type switching condition; If the first information meets the predetermined type switching condition, the ciphertext processing request of the service module is executed by the second type of key proxy module.
  • the secret may be executed according to the first type of key proxy processing module.
  • the result of the file processing request determines whether the predetermined type switching condition is met, and if the switching condition is met, the ciphertext processing request is no longer performed by the first type of key agent processing module, but the second type of key agent is used.
  • the processing module executes the ciphertext processing request.
  • the first type of the key proxy processing module cannot continue to perform the ciphertext processing request stably, and the second type of the key proxy module is switched to stabilize the processing.
  • the text processing request solves the problem that the stability of the key is low when the service is encrypted and decrypted in the related art.
  • FIG. 1 is a schematic diagram of a hardware environment of a service processing method according to an embodiment of the present application
  • FIG. 2 is a flowchart of an optional service processing method according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of an optional service processing method according to an embodiment of the present application.
  • FIG. 5 is a flowchart of another optional service processing method according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a hardware environment of a service encryption method according to an embodiment of the present application.
  • FIG. 7 is a flowchart of an optional service encryption method according to an embodiment of the present application.
  • FIG. 8 is a flowchart of an optional service decryption method according to an embodiment of the present application.
  • FIG. 9 is a flowchart of another optional service encryption method according to an embodiment of the present application.
  • FIG. 10 is a flowchart of another optional service encryption method according to an embodiment of the present application.
  • FIG. 11 is a schematic diagram of an optional service processing apparatus according to an embodiment of the present application.
  • FIG. 12 is a schematic diagram of an optional service encryption apparatus according to an embodiment of the present application.
  • FIG. 13 is a schematic diagram of an optional service decryption apparatus according to an embodiment of the present application.
  • FIG. 14 is a structural block diagram of an electronic device according to an embodiment of the present application.
  • FIG. 15 is a structural block diagram of another electronic device according to an embodiment of the present application.
  • an embodiment of a method for service processing is provided.
  • the foregoing service processing method may be applied to a hardware environment formed by the server 102 and the terminal 104 as shown in FIG. 1.
  • the server 102 is connected to the terminal 104 through a network.
  • the network includes but is not limited to a wide area network, a metropolitan area network, or a local area network.
  • the terminal 104 is not limited to a PC, a mobile phone, a tablet, or the like.
  • the service processing method of the embodiment of the present application may be executed by the server 102, may be executed by the terminal 104, or may be jointly performed by the server 102 and the terminal 104.
  • the service processing method performed by the terminal 104 in the embodiment of the present application may also be performed by a client installed thereon.
  • the main working principle of the hardware environment system shown in FIG. 1 is that in the embodiment of the present application, the key agent module is installed in the terminal 104.
  • the ciphertext processing request carrying the data to be encrypted may be sent to the key agent module through the service module.
  • the key proxy module obtains the target key from the extracted key list, and then encrypts the data to be encrypted using the target key to obtain the encrypted data, and finally, the secret.
  • the key broker module sends the encrypted data to the business module.
  • the ciphertext processing request is a request to encrypt the data to be encrypted into ciphertext data.
  • the decryption data is similar to the encryption method in the above embodiment, and details are not described herein again.
  • the key list is a key list obtained by the key agent module from the server 104 (for example, a key server) when it is first turned on.
  • FIG. 2 is a flowchart of an optional service processing method according to an embodiment of the present application, as shown in FIG. As shown in 2, applied to the business module, the method may include the following steps:
  • Step S202 Acquire first information, where the first information is used to indicate that the key proxy module of the first type performs an execution result of the ciphertext processing request;
  • Step S204 detecting whether the first information meets a predetermined type switching condition
  • Step S206 The ciphertext processing request of the service module is executed by the second type of key proxy module in the case that the first information is detected to meet the predetermined type switching condition.
  • the first information is obtained by using the foregoing embodiment, where the first information is used to indicate that the first type of the key agent module performs the execution result of the ciphertext processing request; whether the first information meets the predetermined type switching condition; If the information meets the predetermined type switching condition, the ciphertext processing request of the service module is executed by the second type of key proxy module.
  • the ciphertext processing may be performed according to the first type of key proxy processing module.
  • the result of the request is used to determine whether the predetermined type of switching condition is met. If the switching condition is met, the ciphertext processing request is no longer performed by the first type of key agent processing module, but by the second type of key agent processing module. Executing a ciphertext processing request.
  • the second type of key proxy module is switched to stably process the ciphertext processing.
  • the request solves the problem that the stability of the key is low when the service is encrypted and decrypted in the related art.
  • the ciphertext processing request may be an encryption request or a decryption request
  • the execution result of the ciphertext processing request of the first type of key proxy module may be stored in the shared memory, and the service module may be shared from The execution result is read in the memory, and the execution result is counted to obtain the first information.
  • the key broker module can perform ciphertext processing requests as follows (take the encryption process as an example):
  • the key agent module receives the ciphertext processing request sent by the service module, where the ciphertext processing request carries data to be encrypted.
  • the key agent module (hereinafter referred to as the key agent) may be implemented in a single-process multi-thread manner; the service module is configured to send a ciphertext processing request to the key agent, wherein the key agent industry
  • the business modules are in the same physical single machine.
  • the service module may send a ciphertext processing request carrying the data to be encrypted to the key agent; after obtaining the ciphertext processing request, the key agent processes the request key according to the ciphertext processing. Get the target key in the list.
  • the key agent when the key agent module Agent is restarted, the key agent pulls the key list to the key server. It should be noted that the key agent only pulls the key list to the key server when restarting, and does not pull the key list at other times after startup.
  • the key agent may obtain the target key in the pre-pushed key list, where the target key is used to encrypt the data to be encrypted.
  • the data to be encrypted using the target key may be encrypted.
  • the key agent module encrypts the data to be encrypted using the target key, and after obtaining the encrypted data, the encrypted data can be sent to the service module.
  • the first public key may be sent to the key server by using the key proxy module, and the second public key is received from the key server, where
  • the key agent module has a pair of first public key and a first private key, and the key server has a pair of second public key and a second private key;
  • the key agent module sends a key list pull to the key server
  • the key agent module receives the encrypted key list sent by the key server, wherein the encrypted key list is obtained by encrypting the key list by using the first communication key on the key server side, first The communication key is generated by the key server according to the first public key and the second private key; the key agent module encrypts using the second communication key pair on the key agent module side
  • the subsequent key list is decrypted to obtain a key list, wherein the second communication key is generated by the key agent module according to the first private key and the second public key, and the first communication key and the second communication key are generated. the same.
  • the key list needs to be pulled from the key server, wherein the key list extracted from the key server is the encrypted key list. . Therefore, the key agent needs to decrypt the extracted key list.
  • the key list extracted by the key agent is obtained by encrypting the key list by using the first communication key on the key server side, and then the key agent module decrypts the key list.
  • the key list is decrypted using the same second communication key as the first communication key.
  • the first communication key is generated by the key server according to the first public key and the second private key
  • the second communication key is generated by the key agent module according to the first private key and the second public key.
  • the first public key and the second public key are a pair of public keys pubkey and key prikey generated by the key agent before sending the key list to the key server;
  • the first private key and the second private key are secret A pair of public keys pubkey and key prikey generated by the key server.
  • the second communication key is generated according to the first private key and the second public key. Therefore, before the key agent module sends the key list pull request to the key server, the key agent and the key server need to exchange the public key and the key of both parties. After the exchange, the key agent module may generate a second communication key for decrypting the key list after transmitting the key list pull request to the key server, and the key server may also generate the secret key.
  • the key list is encrypted with the first communication key.
  • the public key and the key of the exchanged parties are specifically: the agent sends the first public key to the key server SVR, and then the agent receives the second public key from the key server SVR. After the exchange, the agent can use the first The private key and the second public key encrypted key list are decrypted.
  • the key exchange protocol ie, the ECDH protocol
  • the key exchange protocol may be used to exchange the pubkeys of both parties. And the respective prikey.
  • the key list in the present application is encrypted using the first public key and the second private key, and decrypted using the first private key and the second public key.
  • the public key pubkey of the Agent and the key server is transmitted on the network. Therefore, by using the encryption method in the present application, even if the key is reversed by the tcp dump, the intranet is avoided. The phenomenon of key leakage caused by packet capture occurs.
  • the SVR should sign the ECDH public key with the private key, and verify the signature by deploying the public key in the agent, because the SVR is a high-density server managed by a dedicated person. It is difficult to steal the private key from there, and it effectively prevents others from forging SVR back packets.
  • the key agent After the key agent pulls the key list from the key server and decrypts the key list, the key agent needs to verify the legality of the business process, wherein the business process is a process represented by the data to be encrypted.
  • the key agent module sends the first public key to the key server, and receiving the second public key from the key server includes: when the key agent module is restarted, the key The proxy module sends the encrypted first public key to the key server, wherein the encrypted first public key is obtained by encrypting the first public key using the agreed key; the key proxy module receives the encryption from the key server a second public key, wherein the encrypted second public key is obtained by encrypting the second public key using the agreed key; the key proxy module decrypts the encrypted second public key by using the agreed key, A second public key is obtained; wherein the appointment key is set to be used only when the key broker module is restarted.
  • the key agent when the key agent is restarted, when the key agent sends the first public key to the key server, the first public key is encrypted by using the agreed key, and the first key is encrypted after using the agreed key. A public key is sent to the key server, and after the key server obtains the first public key, it can decrypt using the agreed key. Similarly, when the key server sends the second public key to the key agent, the second public key is also encrypted using the contract key and will be encrypted. The subsequent second public key is sent to the key agent, wherein after receiving the encrypted second public key, the key agent can decrypt the second public key using the agreed key.
  • the first public key and the second public key are encrypted and transmitted to each other only when the key agent is restarted, using the “contract key”. That is to say, only the maintainer of the key agent restarts the process when changing the key agent is the only time to legally use the agreed key, and any other situation is illegal. For example, the maintainer of the key agent uses the contract key to obtain the key list when the key agent is restarted. After that, if other users use the agreed key again to obtain the key list, the user is abused. By. Therefore, in the embodiment of the present application, the setting of the "contract key" is used only when the key agent is restarted, and the abuser can be detected quickly and effectively.
  • the key agent needs to decrypt the key list after pulling the key list.
  • the process PID of the service process may be acquired by the key agent module, where the service process sends the process of the data to be encrypted to the service module, and then The key agent module performs legality verification on the business process and the process PID; and in the case that the legality verification passes, the key agent module obtains the target key from the key list.
  • the process PID of the service process can be obtained through the key agent, and then the legality of the process PID and the service process is verified by the key agent. If the verification result of the process PID and the service process is legal, that is, if the verification is passed, the key agent module may obtain the target key from the key list, and encrypt the data to be encrypted by the target key. .
  • the key agent module may obtain a process PID that is authenticated by the kernel by the service process transmitted by the service module through the socket SCM_RIGHTS, and In the socket SCM_RIGHTS applies to the unix domain socket.
  • the key proxy module performs legality verification on the service process and the process PID, which is specifically as follows:
  • Step S1 the key agent module acquires a full path of the process corresponding to the process PID;
  • Step S2 The key agent module determines whether the full path of the process belongs to a path in a legal path acquired from the key server in advance;
  • Step S3 In the case that it is determined that the path of the process belongs to the path in the legal path, the key agent module performs an MD5 check operation on the service process to obtain a first MD5 check result; and determines that the process full path does not belong to the legal path. In the case of the path in the middle, it is judged that the validity check is not passed;
  • step S4 the key agent module determines whether the first MD5 check result is the same as the second MD5 check result corresponding to the service process acquired in advance;
  • Step S5 if the first MD5 check result is the same as the second MD5 check result, it is determined that the validity check is passed; if the first MD5 check result is different from the second MD5 check result, the legality is determined. The test will not pass.
  • the key agent module acquires the first file descriptor sent by the service module, where the first file descriptor is used for the secret
  • the key agent module identifies the data sent by the service module as legal data, and then the key agent module generates a second file descriptor, wherein the second file descriptor is used by the service module to identify the data sent by the key agent module as legal data.
  • the key agent module transmits the second file descriptor to the service module.
  • the file descriptor is exchanged between the key agent module and the service module.
  • the key agent module may first obtain the first file descriptor of the service module, and after obtaining the first file descriptor, the key agent module may identify the data sent by the service module as legal data.
  • the business module has been assigned to the key generation.
  • the module exchanges file descriptors, which then requires the key broker module to exchange file descriptors with the business module.
  • the key agent module may transmit the generated second file descriptor to the service module, and after receiving the second file descriptor, the service module may identify the data sent by the key agent module as legal data.
  • the first file descriptor and the second file descriptor correspond to data blocks of the shared memory, where the shared memory is used to store the data to be encrypted of the ciphertext processing request and the to-be-checked after the encryption.
  • the encrypted data will be described in detail in the following embodiments.
  • the service module stores the data to be encrypted in the shared memory
  • the data to be encrypted is stored in the area corresponding to the first file descriptor in the shared memory.
  • the key agent module can learn that the service module stores the data to be encrypted in the shared memory, and then the key agent module goes to the area to obtain the data to be encrypted.
  • multiple file descriptors eventfd can be exchanged at one time, and more eventfd is exchanged by verification again when not enough, so that the number of verification requests can be significantly reduced, and the applicant finds through testing.
  • the maximum number of fd for the next performance exchange of the Linux system is 255.
  • the key agent module may further set a target authority for the first file descriptor, where the target authority includes at least one of the following: The key agent module is allowed to encrypt the data to be encrypted requested by the service module, and the key agent module is allowed to decrypt the data to be decrypted requested by the service module.
  • the key agent module may set the target authority for the first file descriptor after exchanging the file descriptor, where The specified target rights include: allowing the key agent module to encrypt the data to be encrypted requested by the service module, and allowing the key agent module to request the service module.
  • the decrypted data is decrypted.
  • the key agent module After the key agent module sets the target permission for the first file descriptor, the key agent module can encrypt the data to be encrypted according to the received ciphertext processing request, and then send the encrypted data to the service module.
  • the key agent module receives the ciphertext processing request sent by the service module, where the key agent module obtains the data to be encrypted stored by the service module from the shared memory, and the key agent module sends the encrypted data to the service module.
  • the method includes: the key agent module stores the encrypted data into the shared memory, so that the service module obtains the encrypted data from the shared memory.
  • the service module sends a ciphertext processing request to the key broker module
  • the ciphertext processing request is stored in the shared memory.
  • the key broker module can retrieve the stored data to be encrypted from the shared memory.
  • the key agent module encrypts the data to be encrypted using the target key
  • the data to be encrypted after the encryption process may also be stored in the shared memory. Enables the business module to obtain encrypted data from shared memory.
  • the key agent module has previously set a target authority for the first file descriptor. In this case, if the validity check is passed, the key agent module is from the key list. Obtaining the target key, specifically: when the target authority includes the key agent module to encrypt the data to be encrypted requested by the service module, the key agent module obtains the target key package from the key list.
  • the target authority may only allow the key agent module to decrypt the data to be decrypted requested by the service module or allow the key agent module to encrypt the data to be encrypted requested by the service module. Therefore, the key agent module can obtain the target key from the key list only when it is determined that the target authority is to allow the key agent module to encrypt the data to be encrypted requested by the service module, and use the obtained target secret. The key encrypts the encrypted data.
  • the key agent module acquires a service process.
  • the process PID includes: the key agent module obtains the process PID of the business process through the unix domain socket in the non-root mode; or the key agent module configures the socket socket option as SO_PEERCRED, and passes the socket socket. Get the process PID of the business process.
  • the process PID is transmitted through the socket SCM_RIGHTS in the unix domain socket. Because the unix domain sockets pass the exact process PID is based on the non-root mode running process, the local root mode must be approved before the process PID is passed. That is, the process PID (process ID) of the business process needs to be obtained through the unix domain socket in the non-root mode. Further, the option of the socket socket can be configured as SO_PEERCRED through the key proxy module, and the process PID of the business process can be obtained through the socket socket.
  • the data to be encrypted is indirectly encrypted and decrypted by the key agent; at the same time, the communication between the service module and the key agent may be any standard linux IPC communication means, including but not limited to a pipeline, Unix Socket pair, local disk file, etc., the linux eventfd adopted by this scheme is the most efficient, and is most suitable for the selection of massive encryption and decryption requests.
  • the method realizes the encryption and decryption program by fully utilizing the standard mechanism provided by the modern Linux operating system kernel, which not only improves the security of the key, but also minimizes the loss of encryption and decryption performance, and ensures the effectiveness in practice.
  • FIG. 3 is a flowchart of an optional service processing method according to an embodiment of the present application.
  • a key agent ie, a key agent module
  • a service module are in the same physical single machine.
  • the key agent when the key agent is restarted, the key agent encrypts the first public key by using the contract key, and sends the encrypted first public key to the key server, and the key agent module can also Receiving the encrypted second public key sent by the key server, wherein the second public key is also encrypted by using the agreed key.
  • the key agent After obtaining the second public key, the key agent decrypts the second public key by using the agreed key, and the key server also uses the first public key after obtaining the first public key.
  • the appointment key decrypts the first public key.
  • the key agent may send a pull request of the key list to the key server, and after receiving the key pull request, the key server transmits the encrypted key list to the key agent, where the key is encrypted.
  • the subsequent key list is obtained by encrypting the key list using the first communication key on the key server side, and the first communication key is generated by the key server according to the first public key and the second private key.
  • the key agent may decrypt using the same second communication key as the first communication key, wherein the second communication key is the key agent module according to the first private key. And the second public key is generated.
  • the first public key and the second public key are encrypted and transmitted to each other only when the key agent is restarted, using the “contract key”.
  • the service encryption provided in the embodiment of the present application decrypts the encrypted key list using the first private key and the second public key, so even the key list The key is not reversed by tcpdump, which avoids the key leakage caused by intranet capture.
  • the memory of the key agent and the key server may also be protected. Specifically, the binary of the key agent and the key server can be directly stripped off (ie, all debugging information is deleted), and then the code of the key agent and the key server is securely isolated, so that gdb is almost Dice, at least it is impossible to simply modify the variables.
  • the service module After decrypting the key list, the key agent needs to verify the PID legality of the business process and the business process.
  • the service module first establishes a unix domain socket, and establishes a first file descriptor, and then transmits the first file descriptor to the key agent by using the socket SCM_RIGHTS in the unix domain socket. And using the socket SCM_CREDENTIA to transfer the PID of the process authenticated by the kernel to the key agent.
  • SCM_RIGHTS and SCM_CREDENTIA are applicable to unix domain socket, SCM_RIGHTS is used to transfer descriptors in one process to another process.
  • This method can extend some IPCs that can only communicate between relative processes to non-affinity processes ( For example, linux eventfd); SCM_CREDENTIA is used to transfer the process PID whose process is authenticated by the kernel.
  • the key agent module may further send a first file descriptor eventfda to the service module, and the key agent module generates a second file after acquiring the first file descriptor eventfda.
  • Descriptor eventfdb and send the second file descriptor eventfdb to the business module to implement the exchange of file descriptors between the key agent module and the business module.
  • the key agent module may further set a target authority for the first file descriptor, where the target authority includes at least one of the following: allowing the key agent module to request the service module The encrypted data is encrypted, allowing the key agent module to decrypt the data to be decrypted requested by the service module.
  • the business module can go to the first file descriptor eventfda in shared memory.
  • the operation of writing data in the space is performed, that is, the data to be encrypted is written into the corresponding area of the first file descriptor eventfda in the shared memory (write eventfda).
  • the key agent module can know that the service module has written data.
  • the key agent module will read the data to be encrypted from the shared memory (ie, read the second file descriptor, read eventfdb). And read the target permissions previously configured for the first file descriptor eventfda.
  • the key agent module can obtain the target key from the key list, and then the key agent module can A ciphertext processing request is performed on the data to be encrypted according to the obtained target key.
  • the premise of the unix domain socket passing the accurate process PID is the process running in the non-root mode, so the requirement of the root mode of the key agent must be approved.
  • the key broker module can also configure the socket socket option as SO_PEERCRED and obtain the process PID of the business process through the socket socket.
  • test environment is the following environment:
  • Key Agent 10 processes; in which the business process and the key agent are free to run, and no CPU priority is set.
  • Bill main ticket + slave ticket
  • Bill main ticket + slave ticket
  • the requests of the five external test machines for the test business reached about 30W/S, of which 17% for the empty service, 31%-33% for the local decryption, and 33%-34% for the agent decryption.
  • the method may further include: sending a ciphertext processing request to the first type of key proxy module; acquiring the first type of the key proxy module to perform the ciphertext processing request As a result of the execution, the execution result can optionally be read from the shared memory.
  • a dual key proxy module can be run in the system, and the dual key proxy module can be two types of key proxy modules.
  • the two types are a first type and a second type.
  • the first type of key agent module is a development type key agent module
  • the second type key agent module is a stable type table key agent module
  • the stable key agent module is executed within a predetermined time period.
  • the ciphertext processing request is more accurate than the key agent module of the predetermined correct rate.
  • development type key agent module may be, but not limited to, an unauthenticated agent module, and the verification process is performed to obtain the stable stable key agent module.
  • the stable stable key proxy module is a key proxy module that has been determined to be able to run correctly for a period of time, and the developed developer key proxy module does not determine that the ciphertext processing is performed within a predetermined time period.
  • the key broker module whose request rate is higher than the predetermined correct rate.
  • the obtaining the first information may include: counting, according to the execution result, a success rate of the first type of the key agent module performing the ciphertext processing request, wherein the first information includes a success rate.
  • the total number of ciphertext processing requests performed by the first type of key proxy module is used as a denominator, and the total number of successful ciphertext processing requests of the first type of key proxy module is used as a numerator. Calculate the success rate.
  • the predetermined type switching condition includes the success rate being lower than the first predetermined threshold
  • detecting whether the first information meets the predetermined type switching condition may include: detecting whether the success rate is lower than a first predetermined threshold; if detecting If the success rate is lower than the first predetermined threshold, it is determined that the first information meets the predetermined type switching condition; if the detected success rate is not lower than the first predetermined threshold, it is determined that the first information does not meet the predetermined type switching condition.
  • the service module preferentially performs the encryption and decryption operation through the developed key proxy module (ie, the first type of key proxy module), and directly monitors the success of the developed key proxy module to perform the ciphertext processing request locally.
  • Rate when the success rate falls below a pre-configured first predetermined threshold (for example, 98%), then automatically switches to the second type of key agent module to perform a ciphertext processing request, which can ensure that the entire system processes the ciphertext processing request. stability.
  • the method before acquiring the first information, may further include: after updating the file in the key agent module in the system, recording the key agent module performing the update operation as the first a type of key agent module; if it is detected within a predetermined time period that the correct rate of the first type of key agent module performing the ciphertext processing request is higher than the predetermined correct rate, the first type of key agent module is recorded as The second type of key broker module.
  • the key proxy module that has been set may be fully tested and slowly run in the network.
  • the key agent module is recorded as a stable type. If the dual key agent module in the system meets the condition (for example, if the correct execution time is sufficient), the key agent module in the system can be recorded as a stable type.
  • the service module selects a stable agent with a modified time later, and needs to be changed. At the time, the changed stable agent becomes a development agent.
  • the dual agent is a dual stable agent
  • the stable agent whose file modification time is earlier that is, the modification time is earlier
  • the development agent During the development of the development agent, if the change is required, the development agent will continue to be released. Further, the development agent can be set to the stableAgent (ie, the second type of key broker module) only if the development agent is properly executed for a sufficiently long period of time (eg, 2 months) without any changes.
  • the stableAgent ie, the second type of key broker module
  • the method may further include: if the file in the key proxy module is updated during the running of the first type of the key proxy module in the system, The files in a type of key broker module are updated.
  • the development agent if the change is still needed, the development agent is continuously released, and the developer agent can execute correctly without any change. For a long enough time (such as 2 months), you can set its type to stable agent (the second type of key agent module).
  • the ciphertext processing request requested by the service module by the second type of key proxy module includes: if the system includes multiple second type key proxy modules (such as two), The second type of key agent module that obtains the latest update time in the two types of key agent modules performs the ciphertext processing request by the second type of key agent module that updates the latest time.
  • the service module may select an agent with a newer file modification time from the two stable agents, and the service module You can use this file to modify the agent with a newer time (that is, later modification time) to perform encryption and decryption operations.
  • the service is performed by the second type of key agent module
  • the method further includes: after receiving the input switching instruction, executing the ciphertext processing request by the first type of key proxy module in response to the switching instruction.
  • the input switching instruction is a manually input instruction. After the business module is switched from the developer agent to the stable agent, it can be manually restored to use the developer agent. This way, you can continue to use the developer agent after the manual 100% confirmation that the developer agent problem has been fixed, thus avoiding the random stalling. Switching from type to develop type, causing further loss of business.
  • the service module performs the disaster recovery process, and the encryption and decryption can be performed normally in the case of system upgrade, and when the system has a bug, the different types of key agent modules can be switched in time to perform the ciphertext processing request. To ensure the stability of the system.
  • the method further includes: after the validity of the validity check of the service process by the key proxy module, in the case that the validity check is passed, the service module Transmitting, to the key agent module, a first file descriptor, wherein the first file descriptor is used by the key agent module to identify data sent by the service module as legal data; and acquiring a plurality of second file descriptors generated by the key agent module The second file descriptor is used by the service module to identify the data sent by the key agent module as legal data.
  • the method further includes: saving the obtained plurality of second file descriptors into the queue; sequentially using the second stored in the queue The file descriptor communicates with the key broker module.
  • the number of the plurality of second file descriptors corresponds to the number of threads in the key broker module for executing the ciphertext processing request.
  • the services are in units of threads, each independently exchanges descriptors with the Agent, and the descriptors are independently managed in a queue manner, and the threads do not interfere with each other.
  • Each service thread independently passes the Agent to verify the identity, and then exchanges multiple second file descriptors (for example, an integer multiple of the number of Agent encryption and decryption threads), and the Agent side distributes the descriptors completely uniformly to each
  • the Agent encrypts and decrypts threads (so the number of descriptors managed by each thread is equal), so that load balancing of services can be achieved.
  • the key agent module acquires 100 first file descriptors sent by the service module, and then the key agent module generates 100 second file descriptors, and transmits the 100 second file descriptors to the service module, 100
  • the first file descriptor and the 100 second file descriptors are paired one by one to obtain 100 sets of descriptors.
  • the key agent module evenly distributes the 100 sets of descriptors to 10 encryption and decryption threads, and can be tried as follows:
  • the descriptor is assigned to the encryption and decryption thread 1
  • the second group of descriptors is assigned to the encryption and decryption thread 2
  • the tenth group of descriptors is assigned to the encryption and decryption thread 10
  • the eleventh group of descriptors is assigned to the encryption and decryption Thread 1
  • the twelfth group of descriptors are assigned to the encryption and decryption thread 2 and so on
  • the first hundred sets of descriptors are assigned to the encryption and decryption thread 10.
  • each business thread saves the exchanged plurality of descriptors into its own thread-level queue, and each time the business thread encrypts and decrypts the request, it first retrieves the descriptor from the queue to communicate with the agent, and after the communication is completed, The descriptor is placed back at the end of the queue; if the descriptor is taken from the first queue and the discovery queue is empty, then more descriptors are exchanged as described above.
  • the number of identity authentication is greatly reduced, and the MD5 (or other HASH algorithm) for identity verification is less efficient, so that it is not necessary to verify the identity of each request; each service thread Extremely even access to each Agent thread, completely avoiding the problem of uneven load of each Agent thread, and balancing the resources of multiple CPUs; the encryption and decryption request processing between the service and the Agent is highly independent, and the request-level lock is not required to ensure the exclusive use of resources. Improve the ability to concurrently throughput.
  • FIG. 5 shows an alternative embodiment. As shown in FIG. 5, the embodiment can be implemented by the following steps:
  • Step S502 The key agent module acquires an execution result of the execution of the ciphertext processing request.
  • Step S504 The key agent module detects whether the execution result meets a predetermined mode switching condition
  • Step S506 If it is detected that the execution result meets the predetermined mode switching condition, the key agent The module sends the indication information to the service module, where the indication information is used to indicate that the service module switches to a mode in which the ciphertext processing request is performed by the service module.
  • the mode of executing the ciphertext processing request by the key agent module is continued.
  • the key agent module acquires an execution result of the execution of the ciphertext processing request; the key agent module detects whether the execution result meets the predetermined mode switching condition; and if it detects that the execution result meets the predetermined mode switching condition, the key agent module The service module sends indication information, where the indication information is used to indicate that the service module switches to a mode in which the ciphertext processing request is performed by the service module.
  • the key agent module detects whether the execution result of the execution of the ciphertext processing request meets the predetermined mode switching condition, and if the predetermined mode switching condition is met, determining that the key agent module cannot continue to stably perform the ciphertext processing request. Then, the mode is switched, so that the service module can perform the ciphertext processing request by itself, so as to solve the problem that the related technology cannot be stably operated when the business data is encrypted and decrypted, and the stable operation of the system is realized.
  • the method of using the agent can be restored by manually (such as receiving a manual input recovery instruction).
  • the service automatically cleans up the key M at this time), this is for the manual 100% confirmation that the problem has been fixed, and the service will not be further suffered because of the random switching.
  • the maximum security loss can be guaranteed with minimal security loss. normal operation.
  • the agent generates a random key M (ie, key data) by the key server SVR to return to the Agent each time the latest key list is pulled, and the agent encrypts the key list using M. After saving to a piece of shared memory N.
  • M ie, key data
  • the method further The method includes: generating, by the service thread, a first end descriptor and a second end descriptor of the communication pipeline, wherein the first end descriptor is used by the key proxy module to identify the data sent by the service module as legal data, and the second end descriptor The service module identifies the data sent by the key agent module as legal data; and transmits the second end descriptor to the key agent module through the communication pipeline.
  • the service thread independently generates two pipeline descriptors, which are a read end descriptor and a write end descriptor (such as the first end descriptor and the second end descriptor described above), and the business thread passes the write end to the identity verification. Agent, Agent If the identity is passed, the write end is retained. At this time, the service thread closes the write end held by the service thread. At this time, the service thread holds the pipeline read end, and the agent holds the pipeline write end corresponding to the thread.
  • the request time A is filled in the request packet (for example, the time can be accurate to the millisecond).
  • the obtaining, by the key agent module, the execution result of the execution of the ciphertext processing request includes: after the ciphertext processing request is executed, the key proxy module determines, according to the request time and the current time in the ciphertext processing request, the execution of the current secret Whether the file processing request times out; if it is determined that the execution of the current ciphertext processing request times out, the key agent module determines that the execution of the current ciphertext processing request fails; the key agent module is based on the number of ciphertext processing requests that failed to be executed, and the statistics are dense.
  • the success rate of the key agent module performing the ciphertext processing request, and the execution result includes the success rate.
  • the key agent module detects whether the execution result meets the predetermined mode switching condition, including: the key agent module detects whether the success rate is lower than a second predetermined threshold; and if the success rate of executing the ciphertext processing request is lower than the second The predetermined threshold is determined, and it is determined that the execution result conforms to the predetermined mode switching condition.
  • the agent determines the current time (accurate to milliseconds), and sets the encryption and decryption timeout of the service setting to B ms, if the current time When the time difference C of A is more than (Bx) ms, the request is marked as failed.
  • the success rate falls below the second predetermined threshold (for example, 98%) of the implementation configuration, the key M is automatically written through each pipe. Sent to all business threads.
  • x can Thought it is 3.
  • the key agent module sends the indication information to the service module, where the key agent module sends the key data to the service module, where the key data is used to decrypt the key list stored in the shared memory, and the decrypted The key list, the service module is further configured to perform a ciphertext processing request through the decrypted key list.
  • the service module obtains the key data of the key agent module through the service thread, including: periodically reading data from the read end of the communication pipe through the service thread; if the data is read from the read end of the communication pipe, determining Get the key data.
  • the business thread periodically (for example, 3 seconds) determines whether its own pipeline reader has data readable. Once the data is read, it is considered to be the key M, and then each time M is used to decrypt the N memory.
  • the key list obtains the key of the encryption and decryption request, and degenerates into a local encryption and decryption mode of the business thread, completely ignoring the Agent.
  • the method before the key agent module receives and executes the ciphertext processing request of the service module, the method further includes: after updating the file in the key agent module, recording the key agent module that performs the update operation as a first type of key agent module; after the first type of key agent module receives and executes the ciphertext processing request of the service module, and obtains the execution result, the method further includes: detecting the first type within a predetermined time period The key broker module performs a ciphertext processing request with a higher correct rate than the predetermined correct rate, and records the first type of key proxy module as the second type of key proxy module.
  • the method further includes: if the file in the key agent module is to be updated, the first type of the key is The files in the agent module are updated.
  • the ciphertext processing request comprises: a request for encrypting the data to be encrypted into ciphertext data and/or a request for decrypting the ciphertext data into decrypted data.
  • the communication pipeline is further configured to detect whether the service module and the key agent module are restarted.
  • the pipeline (that is, the communication pipeline mentioned above) is also a powerful tool for the agent and the service to judge each other whether the other party restarts, and the service thread can transmit the pipeline descriptor to the agent once more, and the service holds the write end, and the agent holds There is a reader, once the business process is closed, the Agent can immediately find out through the EPOLLHUP error of epoll_wait(), and then immediately start cleaning up to prevent resource leakage; and the service can be triggered by the request, when the encryption and decryption request times out, by writing to the pipeline The write end writes a byte. If the Agent restarts, it will return EPIPE. At this time, it can also trigger resource cleanup and re-identify the identity with the newly started Agent.
  • the security may be sacrificed.
  • the method is to maintain the normal operation of the service, that is, to minimize the loss of security under the premise of ensuring normal business.
  • the agent determines whether to enter the disaster recovery mode; the security protection of the agent itself (root operation, difficult to be debugged, etc.) is far more than the general service. Usually, the service still does not hold the key, nor can it pass the simple DUMP. The encrypted key list shares the memory N to steal the key list, which improves the security. Further, the agent determines that the disaster tolerance mode is very reasonable. Since the descriptors of the two parties are shared, as long as the agent writes the return packet data.
  • the communication shared memory and communication descriptor buffer the business thread must be able to read unconditionally, and the Agent also reserved 3 milliseconds for the business to read the results, the time is very sufficient, if the business is still timed out, prove other parts It takes too long, and the performance problem has little relationship with the Agent; this way avoids the problem of non-shared descriptors, that is, the service and the agent use different descriptors to communicate, and the Agent writes the result to the own descriptor buffer. , but also rely on the kernel to "handle" this data into the buffer of the service descriptor, otherwise the business still can not read the result, so the Agent comes Disaster recovery system is not necessarily reasonable to open up.
  • N still maintains the encryption state, and the key list cannot be stolen by the simple DUMP encrypted key list shared memory N, but must be down-played to attack the service (such as debugging service).
  • Get M then steal the secret
  • the key list the erroneous person wants to steal the key list through the disaster recovery mode, and also has to make a relatively large movement, that is, at least one physical single machine manufacturing business failure or smashing the fault to steal, due to this time
  • the business has problems, it is more eye-catching, and its risk is higher.
  • the method further includes: acquiring the key data of the key proxy module by using the service thread, where And the key agent module is configured to: after detecting that the success rate of executing the ciphertext processing request is lower than a second predetermined threshold, transmitting the key data; decrypting the key list stored in the shared memory by using the key data, and obtaining the decrypted a list of keys; performing a ciphertext processing request through the service module using the decrypted key list.
  • the ciphertext processing request comprises: a request for encrypting the data to be encrypted into ciphertext data and/or a request for decrypting the ciphertext data into decrypted data.
  • the service processing method can also be applied in a system where the key agent module is located, and the solution can be implemented as follows: the first type of key agent module receives and executes the ciphertext processing of the service module. Requesting, obtaining an execution result; the second type of key agent module receives and executes a ciphertext processing request of the service module, wherein the service module is configured to: if the first information generated based on the execution result meets a predetermined type switching condition, The second type of key broker module sends a ciphertext processing request.
  • the first type of key agent module is a development type key agent module
  • the second type of key agent module is a stable key agent module
  • the stable key agent module is executed within a predetermined time period.
  • the ciphertext processing request is more accurate than the key agent module of the predetermined correct rate.
  • the method further includes: after updating the file in the key proxy module in the system, The key agent module that performs the update operation records as the first type of key agent module; after the first type of the key agent module receives and executes the ciphertext processing request of the service module, and obtains the execution result, the method further includes: Detecting that the correct rate of the first type of key agent module performing the ciphertext processing request is higher than the predetermined correct rate during the predetermined time period, The first type of key broker module is recorded as a second type of key broker module.
  • the method further includes: if the file in the key agent module is to be updated, the first type of the key is The files in the agent module are updated.
  • the method further includes: the key proxy module detecting whether the success rate of executing the ciphertext processing request is lower than a second predetermined threshold; if the ciphertext processing is detected If the success rate of the request is lower than the second predetermined threshold, the key data is sent to the service module, where the key data is used to decrypt the key list stored in the shared memory, and the decrypted key list is obtained, and the service module further uses The ciphertext processing request is performed through the decrypted key list.
  • the method further includes: after the ciphertext processing request is executed, the key proxy module processes the request based on the ciphertext The request time and the current time determine whether the execution of the current ciphertext processing request has timed out; if it is determined that the execution of the current ciphertext processing request timeout, it is determined that the execution of the current ciphertext processing request fails; Quantity, the success rate of the statistics key agent module to perform ciphertext processing requests.
  • the method further includes: receiving a second end descriptor of the communication pipeline transmitted by the service thread, where the service thread And configured to generate a first end descriptor for the key proxy module to identify data sent by the service module as legal data, and a second end descriptor for the service module to be dense The data sent by the key broker module is identified as legal data.
  • sending the key data to the service module includes: transmitting key data by using a write end of a communication pipeline of each service thread.
  • the method further includes: after the key proxy module performs the validity check on the service process, the validity check is passed.
  • the key agent module receives the first file descriptor sent by the service module, where the first file descriptor is used by the key agent module to identify the data sent by the service module as legal data; the key agent module generates multiple And a second file descriptor, wherein the second file descriptor is used by the service module to identify the data sent by the key agent module as legal data; and the key agent module transmits the plurality of second file descriptors to the service module.
  • the number of the plurality of second file descriptors corresponds to the number of threads in the key broker module for executing the ciphertext processing request.
  • the ciphertext processing request comprises: a request for encrypting the data to be encrypted into ciphertext data and/or a request for decrypting the ciphertext data into decrypted data.
  • the ciphertext processing is a request for encrypting data to be encrypted into ciphertext data
  • an embodiment of a method for service encryption is provided.
  • the foregoing service encryption method may be applied to a hardware environment formed by the server 602 and the terminal 604 as shown in FIG. 6.
  • the server 602 is connected to the terminal 604 through a network.
  • the network includes but is not limited to a wide area network, a metropolitan area network, or a local area network.
  • the terminal 604 is not limited to a PC, a mobile phone, a tablet, or the like.
  • the service encryption method in the embodiment of the present application may be executed by the server 602, may be executed by the terminal 604, or may be jointly performed by the server 602 and the terminal 604.
  • the service encryption method performed by the terminal 604 in the embodiment of the present application may also be performed by a client installed thereon.
  • the key agent module is installed in the terminal 604.
  • an encryption request carrying the data to be encrypted may be sent to the key agent module through the service module.
  • the key agent module obtains the target key from the extracted key list, and then encrypts the data to be encrypted using the target key to obtain the encrypted data, and finally, the key agent.
  • the module sends the encrypted data to the business module.
  • the key list is the key agent module for the first time.
  • the list of keys retrieved from the server 604 eg, a key server
  • the server 604 e.g. a key server
  • FIG. 7 is a flowchart of an optional service encryption method according to an embodiment of the present application. As shown in FIG. 7, the method may include the following steps:
  • Step S702 The key agent module receives an encryption request sent by the service module, where the encryption request carries data to be encrypted.
  • the key agent module (hereinafter referred to as the key agent) may be implemented in a single-process multi-thread manner; the service module is configured to send an encryption request to the key agent, wherein the key agent industry service module In the same physical stand-alone machine.
  • the service module may send an encryption request carrying the data to be encrypted to the key agent; after acquiring the encryption request, the key agent may perform the following step S704, that is, according to the encryption request. Get the target key in the key list.
  • Step S704 the key agent module acquires the target key from the key list, wherein the key list is previously extracted from the key server.
  • the key agent when the key agent module Agent is restarted, the key agent pulls the key list to the key server. It should be noted that the key agent only pulls the key list to the key server when restarting, and does not pull the key list at other times after startup.
  • the key agent may acquire the target key in the pre-pushed key list, where the target key is used to encrypt the data to be encrypted.
  • Step S706 the key agent module encrypts the data to be encrypted using the target key to obtain the encrypted data.
  • the data to be encrypted using the target key may be encrypted.
  • Step S708 the key agent module sends the encrypted data to the service module.
  • the key agent module encrypts the data to be encrypted using the target key, and after obtaining the encrypted data, the encrypted data can be sent to the service module.
  • the encryption request is received by the key agent module, and then the target key is acquired according to the key request.
  • the data to be encrypted is encrypted by the target key, and the service provided in the embodiment of the present application is provided.
  • the encryption method achieves the purpose of encrypting the service more securely, thereby realizing the technical effect of improving the key security when encrypting the service, thereby solving the security of the key when encrypting the service in the related art. Lower technical issues.
  • the first public key may be sent to the key server by using the key proxy module, and the second public key is received from the key server, where
  • the key agent module has a pair of first public key and a first private key, and the key server has a pair of second public key and a second private key;
  • the key agent module sends a key list pull request to the key server;
  • the key agent module receives the encrypted key list sent by the key server, wherein the encrypted key list is obtained by encrypting the key list by using the first communication key on the key server side, and the first communication secret is obtained.
  • the key is generated by the key server according to the first public key and the second private key; the key agent module decrypts the encrypted key list by using the second communication key on the key agent module side to obtain a key list.
  • the second communication key is generated by the key agent module according to the first private key and the second public key, and the first communication key is the same as the second communication key.
  • the key list needs to be pulled from the key server, wherein the key list pulled from the key server is the encrypted key list. Therefore, the key agent needs to decrypt the extracted key list.
  • the key list extracted by the key agent is obtained by encrypting the key list by using the first communication key on the key server side, and then the key agent module decrypts the key list.
  • the key list is decrypted using the same second communication key as the first communication key.
  • the first communication key is a key server according to the first public key and the second private key
  • the generated second communication key is generated by the key agent module according to the first private key and the second public key.
  • the first public key and the second public key are a pair of public keys pubkey and key prikey generated by the key agent before sending the key list to the key server; the first private key and the second private key are secret A pair of public keys pubkey and key prikey generated by the key server.
  • the second communication key is generated according to the first private key and the second public key. Therefore, before the key agent module sends the key list pull request to the key server, the key agent and the key server need to exchange the public key and the key of both parties. After the exchange, the key agent module may generate a second communication key for decrypting the key list after transmitting the key list pull request to the key server, and the key server may also generate the secret key.
  • the key list is encrypted with the first communication key.
  • the public key and the key of the exchanged parties are specifically: the agent sends the first public key to the key server SVR, and then the agent receives the second public key from the key server SVR. After the exchange, the agent can use the first The private key and the second public key encrypted key list are decrypted.
  • the agent and the key server may exchange the pubkeys of the two parties and the respective prikeys by using a key exchange protocol (ie, an ECDH protocol).
  • a key exchange protocol ie, an ECDH protocol
  • the key list in the present application is encrypted using the first public key and the second private key, and decrypted using the first private key and the second public key.
  • the public key pubkey of the Agent and the key server is transmitted on the network. Therefore, by using the encryption method in the present application, even if the key is reversed by the tcpdump, the intranet is avoided. The phenomenon of key leakage caused by the packet occurs.
  • the key agent After the key agent pulls the key list from the key server and decrypts the key list, the key agent needs to verify the legality of the business process, wherein the business process is a process represented by the data to be encrypted.
  • the key agent module sends the first public key to the key server, and receiving the second public key from the key server includes: when the key agent module is restarted, the key The proxy module sends the encrypted first public key to the key server, wherein the encrypted first public key is obtained by encrypting the first public key using the agreed key; the key proxy module receives the encryption from the key server a second public key, wherein the encrypted second public key is obtained by encrypting the second public key using the agreed key; the key proxy module decrypts the encrypted second public key by using the agreed key, A second public key is obtained; wherein the appointment key is set to be used only when the key broker module is restarted.
  • the key agent when the key agent is restarted, when the key agent sends the first public key to the key server, the first public key is encrypted by using the agreed key, and the first key is encrypted after using the agreed key. A public key is sent to the key server, and after the key server obtains the first public key, it can decrypt using the agreed key.
  • the key server sends the second public key to the key agent, the second public key is also encrypted using the agreed key, and the encrypted second public key is sent to the key agent, where the key After receiving the second public key after encryption, the agent can decrypt the second public key using the agreed key.
  • the first public key and the second public key are encrypted and transmitted to each other only when the key agent is restarted, using the “contract key”. That is to say, only the maintainer of the key agent restarts the process when changing the key agent is the only time to legally use the agreed key, and any other situation is illegal. For example, the maintainer of the key agent uses the contract key to obtain the key list when the key agent is restarted. After that, if other users use the agreed key again to obtain the key list, the user is abused. By. Therefore, in the embodiment of the present application, the setting of the "contract key" is used only when the key agent is restarted, and the abuser can be detected quickly and effectively.
  • the key agent needs to decrypt the key list after pulling the key list.
  • the key proxy module obtains the target key from the key list.
  • the process PID of the service process can be obtained through the key agent, and then the legality of the process PID and the service process is verified by the key agent. If the verification result of the process PID and the service process is legal, that is, if the verification is passed, the key agent module may obtain the target key from the key list, and encrypt the data to be encrypted by the target key. .
  • the key proxy module may obtain the process PID that is authenticated by the kernel by the service module transmitted by the service module through the socket SCM_RIGHTS, wherein the socket SCM_RIGHTS is applicable to the unix domain socket.
  • the key proxy module performs legality verification on the service process and the process PID, which is specifically as follows:
  • Step S1 the key agent module acquires a full path of the process corresponding to the process PID;
  • Step S2 The key agent module determines whether the full path of the process belongs to a path in a legal path acquired from the key server in advance;
  • Step S3 In the case that it is determined that the path of the process belongs to the path in the legal path, the key agent module performs an MD5 check operation on the service process to obtain a first MD5 check result; and determines that the process full path does not belong to the legal path. In the case of the path in the middle, it is judged that the validity check is not passed;
  • step S4 the key agent module determines whether the first MD5 check result is the same as the second MD5 check result corresponding to the service process acquired in advance;
  • Step S5 if the first MD5 check result is the same as the second MD5 check result, it is determined that the validity check is passed; if the first MD5 check result is different from the second MD5 check result, the legality is determined. The test will not pass.
  • the specific verification process is as follows: the key agent module first obtains the full path of the process corresponding to the process PID, and then determines the path of the process and the path in the legal path obtained from the key server in advance. If it is determined that the path of the process belongs to the path in the legal path, the MD5 of the service process is verified by the key agent module to obtain the first MD5 check result; if it is determined that the path of the process does not belong to the path in the legal path Then, the validity check of the business process and process PID does not pass. Next, it is determined whether the first MD5 check result is the same as the pre-acquired second MD5 check result, wherein if the same, the legality check passes, and if not, the legality check fails.
  • the key agent module acquires the first file descriptor sent by the service module, where the first file descriptor is used for the secret
  • the key agent module identifies the data sent by the service module as legal data, and then the key agent module generates a second file descriptor, wherein the second file descriptor is used by the service module to identify the data sent by the key agent module as legal data.
  • the key agent module transmits the second file descriptor to the service module.
  • the file descriptor is exchanged between the key agent module and the service module.
  • the key agent module may first obtain the first file descriptor of the service module, and after obtaining the first file descriptor, the key agent module may identify the data sent by the service module as legal data.
  • the business module has exchanged file descriptors with the key broker module, then the key broker module is required to exchange file descriptors with the business module.
  • the key agent module may transmit the generated second file descriptor to the service module, and after receiving the second file descriptor, the service module may identify the data sent by the key agent module as legal data.
  • the first file descriptor and the second file descriptor correspond to the shared memory.
  • the data block in which the data is stored, wherein the shared memory is used to store the data to be encrypted for the encryption request and the data to be checked after the encryption which will be described in detail in the following embodiments.
  • the service module stores the data to be encrypted in the shared memory
  • the data to be encrypted is stored in the area corresponding to the first file descriptor in the shared memory.
  • the key agent module can learn that the service module stores the data to be encrypted in the shared memory, and then the key agent module goes to the area to obtain the data to be encrypted.
  • multiple file descriptors eventfd can be exchanged at one time, and more eventfd is exchanged by verification again when not enough, so that the number of verification requests can be significantly reduced, and the applicant finds through testing.
  • the maximum number of fd for the next performance exchange of the Linux system is 255.
  • the key agent module may further set a target authority for the first file descriptor, where the target authority includes at least one of the following: The key agent module is allowed to encrypt the data to be encrypted requested by the service module, and the key agent module is allowed to decrypt the data to be decrypted requested by the service module.
  • the key agent module may set the target authority for the first file descriptor after exchanging the file descriptor, where The specified target rights include: allowing the key agent module to encrypt the data to be encrypted requested by the service module, and allowing the key agent module to decrypt the data to be decrypted requested by the service module.
  • the key agent module After the key agent module sets the target permission for the first file descriptor, the key agent module can encrypt the data to be encrypted according to the received encryption request, and then send the encrypted data to the service module.
  • the key agent module receives the encryption request sent by the service module, including: a key proxy module.
  • the block obtains the data to be encrypted stored by the service module from the shared memory; and the key agent module sends the encrypted data to the service module, including: the key agent module stores the encrypted data into the shared memory, so that The business module obtains the encrypted data from the shared memory.
  • the encryption request is stored in the shared memory.
  • the key broker module can retrieve the stored data to be encrypted from the shared memory.
  • the key agent module encrypts the data to be encrypted using the target key
  • the data to be encrypted after the encryption process may also be stored in the shared memory. Enables the business module to obtain encrypted data from shared memory.
  • the key agent module has previously set a target authority for the first file descriptor. In this case, if the validity check is passed, the key agent module is from the key list. Obtaining the target key, specifically: when the target authority includes the key agent module to encrypt the data to be encrypted requested by the service module, the key agent module obtains the target key package from the key list.
  • the target authority may only allow the key agent module to decrypt the data to be decrypted requested by the service module or allow the key agent module to encrypt the data to be encrypted requested by the service module. Therefore, the key agent module can obtain the target key from the key list only when it is determined that the target authority is to allow the key agent module to encrypt the data to be encrypted requested by the service module, and use the obtained target secret. The key encrypts the encrypted data.
  • the process PID of the key agent module acquiring the service process includes: obtaining, by the key agent module, the process PID of the service process through the unix domain socket in the non-root operation mode; or The key proxy module configures the socket socket option as SO_PEERCRED and obtains the process PID of the business process through the socket socket.
  • the process PID is transmitted through the socket SCM_RIGHTS in the unix domain socket. Because the unix domain sockets pass the exact process PID is based on the non-root mode running process, therefore, before the process PID is passed, the local root mode must be required. Seek approval. That is, the process PID of the business process needs to be obtained through the unix domain socket in the non-root mode. Further, the option of the socket socket can be configured as SO_PEERCRED through the key proxy module, and the process PID of the business process can be obtained through the socket socket.
  • the data to be encrypted is indirectly encrypted and decrypted by the key agent; at the same time, the communication between the service module and the key agent may be any standard linux IPC communication means, including but not limited to a pipeline, Unix Socket pair, local disk file, etc., the linux eventfd adopted by this scheme is the most efficient, and is most suitable for the selection of massive encryption and decryption requests.
  • the method realizes the encryption and decryption program by fully utilizing the standard mechanism provided by the modern Linux operating system kernel, which not only improves the security of the key, but also minimizes the loss of encryption and decryption performance, and ensures the effectiveness in practice.
  • the ciphertext processing is a request for decrypting ciphertext data into decrypted data
  • an embodiment of a method of service decryption is provided.
  • FIG. 8 is a flowchart of an optional service decryption method according to an embodiment of the present application. As shown in FIG. 8, the method may include the following steps:
  • Step S802 the key agent module receives the decryption request sent by the service module, where the decryption request carries data to be decrypted.
  • the key agent module (hereinafter referred to as an agent) may be implemented in a single-process multi-thread manner; the service module is configured to send a decryption request to the agent, wherein the agent industry service module is in the same physical single machine. .
  • the service module may send a decryption request carrying the data to be decrypted to the agent; after acquiring the decryption request, the agent may perform the following step S804, that is, according to the decryption request in the key list. Get the target key.
  • Step S804 the key agent module acquires the target key from the key list, wherein the key list is previously extracted from the key server.
  • the agent when the key agent module Agent is restarted, the agent pulls the key list to the key server. It should be noted that the agent only pulls the key list to the key server when restarting, and does not pull the key list at other times after startup.
  • the agent may acquire the target key in the pre-pushed key list, where the target key is used to decrypt the data to be decrypted.
  • Step S806 the key agent module decrypts the data to be decrypted using the target key to obtain the decrypted data.
  • the Agent may decrypt the data to be decrypted using the target key.
  • Step S808 the key agent module sends the decrypted data to the service module.
  • the key agent module decrypts the data to be decrypted using the target key, and after obtaining the decrypted data, the decrypted data can be sent to the service module.
  • the decryption request is received by the key agent module, and then the target key is acquired according to the key request, and then the data to be decrypted by the target key is decrypted, and the service provided in the embodiment of the present application is provided.
  • the decryption method achieves the purpose of decrypting the service more securely, thereby realizing the technical effect of improving the key security when decrypting the service, thereby solving the security of the key in decrypting the service in the related art. Lower technical issues.
  • the method further includes: the key proxy module sending the first public key to the key server, and receiving the second public key from the key server, where The key agent module has a pair of first public key and a first private key, and the key server has a pair of second public key and a second private key; the key agent module sends a key list pull request to the key server; The key agent module receives the encrypted key list sent by the key server, where The encrypted key list is obtained by encrypting the key list by using the first communication key on the key server side, and the first communication key is generated by the key server according to the first public key and the second private key; The key agent module decrypts the encrypted key list by using the second communication key on the key agent module side to obtain a key list, wherein the second communication key is a key agent module according to the first private key and the first The second public key is generated by the second public key, and the first communication key is the same as the second communication key.
  • the key list needs to be pulled from the key server, wherein the key list pulled from the key server is the encrypted key list. Therefore, the key agent needs to decrypt the extracted key list.
  • the key list extracted by the key agent is obtained by encrypting the key list by using the first communication key on the key server side, and then the key agent module decrypts the key list.
  • the key list is decrypted using the same second communication key as the first communication key.
  • the first communication key is generated by the key server according to the first public key and the second private key
  • the second communication key is generated by the key agent module according to the first private key and the second public key.
  • the first public key and the second public key are a pair of public keys pubkey and key prikey generated by the key agent before sending the key list to the key server;
  • the first private key and the second private key are secret A pair of public keys pubkey and key prikey generated by the key server.
  • the second communication key is generated according to the first private key and the second public key. Therefore, before the key agent module sends the key list pull request to the key server, the key agent and the key server need to exchange the public key and the key of both parties. After the exchange, the key agent module may generate a second communication key for decrypting the key list after transmitting the key list pull request to the key server, and the key server may also generate the secret key.
  • the key list is encrypted with the first communication key.
  • the public key and the key of the exchanged parties are specifically: the agent sends the first public key to the key server SVR, and then the agent receives the second public key from the key server SVR. After the exchange, the agent can use the first The private key and the second public key encrypted key list are decrypted.
  • the agent and the key server may exchange the pubkeys of the two parties and the respective prikeys by using a key exchange protocol (ie, an ECDH protocol).
  • a key exchange protocol ie, an ECDH protocol
  • the key list in the present application is encrypted using the first public key and the second private key, and decrypted using the first private key and the second public key.
  • the public key pubkey of the Agent and the key server is transmitted on the network. Therefore, by using the encryption method in the present application, even if the key is reversed by the tcpdump, the intranet is avoided. The phenomenon of key leakage caused by the packet occurs.
  • the key agent After the key agent pulls the key list from the key server and decrypts the key list, the key agent needs to verify the legality of the business process, wherein the business process is the process represented by the data to be decrypted.
  • the key agent module sends the first public key to the key server, and receiving the second public key from the key server includes: when the key agent module is restarted, the key agent module Sending the encrypted first public key to the key server, wherein the encrypted first public key is obtained by encrypting the first public key by using the agreed key; the key agent module receives the encrypted version from the key server a second public key, wherein the encrypted second public key is obtained by encrypting the second public key by using the contract key; the key proxy module decrypts the encrypted second public key by using the agreed key, and obtains the first A public key; wherein the appointment key is set to be used only when the key broker module is restarted.
  • the key agent when the key agent is restarted, when the key agent sends the first public key to the key server, the first public key is encrypted by using the agreed key, and the first key is encrypted after using the agreed key. A public key is sent to the key server, and after the key server obtains the first public key, it can decrypt using the agreed key.
  • the key server sends the second public key to the key agent, the second public key is also encrypted using the agreed key, and the encrypted second public key is sent to the key agent, where the key After receiving the second public key after encryption, the agent can decrypt the second public key using the agreed key.
  • the first public key and the second public key are encrypted and transmitted to each other only when the key agent is restarted, using the “contract key”. That is to say, only the maintainer of the key agent restarts the process when changing the key agent is the only time to legally use the agreed key, and any other situation is illegal. For example, the maintainer of the key agent uses the contract key to obtain the key list when the key agent is restarted. After that, if other users use the agreed key again to obtain the key list, the user is abused. By. Therefore, in the embodiment of the present application, the setting of the "contract key" is used only when the key agent is restarted, and the abuser can be detected quickly and effectively.
  • the key agent needs to decrypt the key list after pulling the key list.
  • the method before the key proxy module receives the decryption request sent by the service module, the method further includes: the key proxy module acquiring the process PID of the service process, where the service process sends the service module to be decrypted.
  • the process of the data the key agent module checks the legality of the business process and the process PID; the key agent module obtains the target key from the key list, including: in the case that the legality check passes, the key agent module Get the target key in the key list.
  • the process PID of the service process can be obtained through the key agent, and then the legality of the process PID and the service process is verified by the key agent. If the verification result of the process PID and the service process is legal, that is, if the verification is passed, the key agent module may obtain the target key from the key list, and decrypt the data to be decrypted by the target key. .
  • the key proxy module may obtain the process PID that is authenticated by the kernel by the service module transmitted by the service module through the socket SCM_RIGHTS, wherein the socket SCM_RIGHTS is applicable to the unix domain socket.
  • the key agent module performs legality verification on the service process and the process PID, including: the key agent module acquires a full path of the process corresponding to the process PID; and the key agent module determines the full path of the process. Whether it belongs to the path in the legal path obtained from the key server in advance; if it is determined that the path of the process belongs to the path in the legal path, the key agent module performs the MD5 check operation on the service process to obtain the first MD5 school. If the process full path does not belong to the path in the legal path, it is determined that the validity check fails; the key agent module determines whether the first MD5 check result is corresponding to the pre-acquired service process.
  • the second MD5 check result is the same; if the first MD5 check result is the same as the second MD5 check result, it is determined that the validity check is passed; if the first MD5 check result is different from the second MD5 check result, then It is judged that the legality check fails.
  • the specific verification process is as follows: the key agent module first obtains the full path of the process corresponding to the process PID, and then determines the path of the process and the path in the legal path obtained from the key server in advance. If it is determined that the path of the process belongs to the path in the legal path, the MD5 of the service process is verified by the key agent module to obtain the first MD5 check result; if it is determined that the path of the process does not belong to the path in the legal path Then, the validity check of the business process and process PID does not pass. Next, it is determined whether the first MD5 check result is the same as the pre-acquired second MD5 check result, wherein if the same, the legality check passes, and if not, the legality check fails.
  • the method further includes: When the verification passes, the key agent module acquires the first file descriptor sent by the service module, where the first file descriptor is used by the key agent module to identify the data sent by the service module as legal data; the key agent module Generating a second file descriptor, wherein the second file descriptor is used by the service module to identify data sent by the key agent module as legitimate data; and the key agent module transmits the second file descriptor to the service module.
  • the key agent module and the service module are required. Exchange file descriptors between. Specifically, the key agent module may first obtain the first file descriptor of the service module, and after obtaining the first file descriptor, the key agent module may identify the data sent by the service module as legal data. At this point, the business module has exchanged file descriptors with the key broker module, then the key broker module is required to exchange file descriptors with the business module. At this time, the key agent module may transmit the generated second file descriptor to the service module, and after receiving the second file descriptor, the service module may identify the data sent by the key agent module as legal data.
  • the first file descriptor and the second file descriptor correspond to a data block that stores data in the shared memory, where the shared memory is used to store the data to be decrypted of the decryption request and the to-be-decrypted after decryption.
  • the data will be described in detail in the following examples.
  • the service module stores the data to be decrypted in the shared memory
  • the data to be decrypted is stored in the area corresponding to the first file descriptor in the shared memory.
  • the key agent module can learn that the service module stores the data to be decrypted in the shared memory, and then the key agent module goes to the area to obtain the data to be decrypted.
  • multiple file descriptors eventfd can be exchanged at one time, and more eventfd is exchanged by verification again when not enough, so that the number of verification requests can be significantly reduced, and the applicant finds through testing.
  • the maximum number of fd for the next performance exchange of the Linux system is 255.
  • the key agent module may further set a target authority for the first file descriptor, where the target authority includes at least one of the following: The key agent module is allowed to decrypt the data to be decrypted requested by the service module, and the key agent module is allowed to decrypt the data to be decrypted requested by the service module.
  • the key agent module performs legality verification on the service process and the process PID.
  • the key agent module can set the target authority for the first file descriptor after exchanging the file descriptor, the set target authority includes: the data to be decrypted requested by the key agent module to the service module. Decryption is performed to allow the key agent module to decrypt the data to be decrypted requested by the service module.
  • the key agent module After the key agent module sets the target permission for the first file descriptor, the key agent module can decrypt the data to be decrypted according to the received decryption request, and then send the decrypted data to the service module.
  • the key agent module receives the decryption request sent by the service module, and the key agent module obtains the data to be decrypted stored by the service module from the shared memory, and the key agent module sends the decrypted data to the service module, including: The key agent module stores the decrypted data into the shared memory, so that the service module obtains the decrypted data from the shared memory.
  • the decryption request is stored in the shared memory.
  • the key agent module can retrieve the stored data to be decrypted from the shared memory.
  • the key agent module decrypts the data to be decrypted using the target key
  • the data to be decrypted after the decryption process can also be stored in the shared memory. Enables the business module to retrieve the decrypted data from the shared memory.
  • the key agent module has previously set a target authority for the first file descriptor. In this case, if the validity check is passed, the key agent module is from the key list. Obtaining the target key, specifically: when the target authority includes the key agent module to decrypt the data to be decrypted requested by the service module, the key agent module obtains the target key package from the key list.
  • the target authority may only allow the key agent module to decrypt the data to be decrypted requested by the service module or allow the key agent module to decrypt the data to be decrypted requested by the service module. Therefore, the key agent module can obtain the target key from the key list only when determining that the target authority is to allow the key agent module to decrypt the data to be decrypted requested by the service module, and use the obtained target secret. Key to solve the decrypted data dense.
  • the process PID of the key agent module acquiring the service process includes: obtaining, by the key agent module, the process PID of the service process through the unix domain socket in the non-root operation mode; or, the key The proxy module configures the socket socket option as SO_PEERCRED and obtains the process PID of the business process through the socket socket.
  • the process PID is transmitted through the socket SCM_RIGHTS in the unix domain socket. Because the unix domain sockets pass the exact process PID is based on the non-root mode running process, the local root mode must be approved before the process PID is passed. That is, the process PID of the business process needs to be obtained through the unix domain socket in the non-root mode. Further, the option of the socket socket can be configured as SO_PEERCRED through the key proxy module, and the process PID of the business process can be obtained through the socket socket.
  • FIG. 9 is a flowchart of an optional service encryption method according to an embodiment of the present application. As shown in FIG. 9, the key agent and the service module are in the same physical single machine.
  • the key agent when the key agent is restarted, the key agent encrypts the first public key by using the contract key, and sends the encrypted first public key to the key server, and the key agent module can also Receiving the encrypted second public key sent by the key server, wherein the second public key is also encrypted by using the agreed key. After obtaining the second public key, the key agent decrypts the second public key by using the agreed key. After obtaining the first public key, the key server also decrypts the first public key by using the agreed key.
  • the key agent can send a pull request of the key list to the key server.
  • the key server transmits the encrypted key list to the key agent, where the encrypted key list is the first communication key pair key list using the key server side.
  • the first communication key obtained by the encryption is generated by the key server according to the first public key and the second private key.
  • the key agent may decrypt using the same second communication key as the first communication key, wherein the second communication key is the key agent module according to the first private key. And the second public key is generated.
  • the first public key and the second public key are encrypted and transmitted to each other only when the key agent is restarted, using the “contract key”.
  • the service encryption provided in the embodiment of the present application decrypts the encrypted key list using the first private key and the second public key, so even the key list The key is not reversed by tcpdump, which avoids the key leakage caused by intranet capture.
  • the memory of the key agent and the key server may also be protected. Specifically, the binary of the key agent and the key server can be directly stripped off (ie, all debugging information is deleted), and then the code of the key agent and the key server is securely isolated, so that gdb is almost Dice, at least it is impossible to simply modify the variables.
  • the service module After decrypting the key list, the key agent needs to verify the PID legality of the business process and the business process.
  • the service module first establishes a unix domain socket and establishes a first file descriptor, and then uses the socket in the unix domain socket.
  • SCM_RIGHTS transfers the first file descriptor to the key agent, and uses the socket SCM_CREDENTIA to transfer the process PID that the process is authenticated by the kernel to the key agent.
  • SCM_RIGHTS and SCM_CREDENTIA are applicable to unix domain socket
  • SCM_RIGHTS is used to transfer descriptors in one process to another process.
  • This method can extend some IPCs that can only communicate between relative processes to non-affinity processes ( For example, linux eventfd); SCM_CREDENTIA is used to transfer the process PID whose process is authenticated by the kernel.
  • the key agent module may further send a first file descriptor eventfda to the service module, and the key agent module generates a second file after acquiring the first file descriptor eventfda.
  • Descriptor eventfdb and send the second file descriptor eventfdb to the business module to implement the exchange of file descriptors between the key agent module and the business module.
  • the key agent module may further set a target authority for the first file descriptor, where the target authority includes at least one of the following: allowing the key agent module to request the service module The encrypted data is encrypted, allowing the key agent module to decrypt the data to be decrypted requested by the service module.
  • the service module can perform the operation of writing data to the first file descriptor eventfda in the corresponding space in the shared memory, that is, the data to be encrypted is written into the corresponding area of the first file descriptor eventfda in the shared memory.
  • Medium write eventfda
  • the key agent module can know that the business module has written data. At this time, the key agent module will be shared.
  • the data to be encrypted is read in memory (ie, the second file descriptor is read, read eventfdb), and the target permissions previously configured for the first file descriptor eventfda are read.
  • the key agent module can obtain the target key from the key list, and then the key agent module can Encrypt the data to be encrypted according to the obtained target key.
  • the premise of the unix domain socket passing the accurate process PID is the process running in the non-root mode, so the requirement of the root mode of the key agent must be approved.
  • the key broker module can also configure the socket socket option as SO_PEERCRED and obtain the process PID of the business process through the socket socket.
  • test environment is the following environment:
  • Key Agent 10 processes; in which the business process and the key agent are free to run, and no CPU priority is set.
  • Bill main ticket + slave ticket
  • Bill main ticket + slave ticket
  • the requests of the five external test machines for the test business reached about 30W/S, of which 17% for the empty service, 31%-33% for the local decryption, and 33%-34% for the agent decryption.
  • the requests of the 8 external test machines for the test business reached about 40W/S, of which 27-28% for the empty service, 55%-56% for the local decryption, and 60%-61% for the agent decryption.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present application which is essential or contributes to the related art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, CD-ROM).
  • the instructions include a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present application.
  • FIG. 11 is a schematic diagram of an optional service processing apparatus according to an embodiment of the present application. As shown in FIG. 11, the apparatus may include:
  • the first obtaining unit 1101 is configured to acquire first information, where the first information is used to indicate that the first type of the key agent module performs an execution result of the ciphertext processing request;
  • the first detecting unit 1103 is configured to detect whether the first information meets a predetermined type switching condition, wherein the predetermined type switching condition indicates that the configuration of the first type of the key agent module cannot stably perform the ciphertext processing request;
  • the first execution unit 1105 is configured to execute the ciphertext processing request of the service module by the second type of key proxy module in the case that the first information is detected to meet the predetermined type switching condition.
  • the first processing unit is configured to be to the first type before acquiring the first information
  • the key agent module sends a ciphertext processing request, and obtains an execution result of the first type of the key agent module to perform the ciphertext processing request; the first obtaining unit includes: performing, according to the execution result, the first type of the key agent module to perform ciphertext processing The success rate of the request, wherein the first information includes a success rate.
  • the predetermined type switching condition includes: the success rate is lower than the first predetermined threshold, and the detecting unit is specifically configured to: determine whether the success rate is lower than the first predetermined threshold; if the detected success rate is lower than the first predetermined threshold, determine The first information meets the predetermined type switching condition; if the detected success rate is not lower than the first predetermined threshold, it is determined that the first information does not meet the predetermined type switching condition.
  • the first type of key agent module is a development type key agent module
  • the second type of key agent module is a stable key agent module
  • the stable key agent module is executed within a predetermined time period.
  • the ciphertext processing request is more accurate than the key agent module of the predetermined correct rate.
  • development type key agent module may be, but not limited to, an unauthenticated agent module, and the verification process is performed to obtain the stable stable key agent module.
  • the second processing unit is configured to record the key agent module that performs the update operation as the first type after updating the file in the key agent module in the system before acquiring the first information.
  • a key agent module if it is detected that the correct rate of the first type of key agent module performing the ciphertext processing request is higher than the predetermined correct rate within a predetermined time period, the first type of the key agent module is recorded as the second A type of key broker module.
  • the third processing unit is configured to: before the first information of the first type of the key agent module in the system is running, if the file in the key agent module is updated, Update the files in the first type of key broker module.
  • the first execution unit includes: if a plurality of second type of key agent modules are included in the system, obtaining a second type of key with the latest update time from the plurality of second type of key agent modules
  • the proxy module performs the ciphertext processing request by the second type of key proxy module that updates the latest time.
  • the fourth processing unit is configured to, after receiving the ciphertext processing request of the service module by the second type of key proxy module, after receiving the input switching instruction, respond to the switching instruction, by using the first type
  • the key broker module performs a ciphertext processing request.
  • the fifth processing unit is configured to obtain the key of the key proxy module through the service thread in the process of performing the ciphertext processing request by the first type of key proxy module or the second type of key proxy module Data, wherein the key agent module is configured to transmit key data when detecting that the success rate of executing the ciphertext processing request is lower than a second predetermined threshold; decrypting the key list stored in the shared memory by using the key data, Obtaining a decrypted key list; performing a ciphertext processing request through the service module by using the decrypted key list.
  • the sixth processing unit is configured to generate, by the service thread, a first end descriptor and a second end descriptor of the communication pipeline before acquiring the key data of the key proxy module by the service thread, where the first end The descriptor is used by the key agent module to identify the data sent by the service module as legal data, and the second end descriptor is used by the service module to identify the data sent by the key agent module as legal data; the second end descriptor is sent through the communication pipeline. Transfer to the key broker module.
  • obtaining, by the service thread, the key data of the key agent module includes: periodically reading data from the read end of the communication pipe through the service thread; if the data is read from the read end of the communication pipe, determining to obtain Key data.
  • the communication pipeline is further configured to detect whether the service module and the key agent module are restarted.
  • the seventh processing unit is configured to, after performing the ciphertext processing request by the key proxy module, after the validity of the validity verification by the key proxy module,
  • the service module sends a first file descriptor to the key proxy module, where the first file descriptor is used by the key proxy module to identify the data sent by the service module as legal data; and the second key generated by the key proxy module is obtained.
  • a file descriptor wherein the second file descriptor is used by the service module to identify data sent by the key agent module as legitimate data.
  • the seventh processing unit is configured to acquire multiple seconds generated by the key agent module After the file descriptor, the obtained second file descriptors are saved in the queue; the second file descriptor stored in the queue is used to communicate with the key agent module.
  • the number of the plurality of second file descriptors corresponds to the number of threads in the key broker module for executing the ciphertext processing request.
  • the ciphertext processing request comprises: a request for encrypting the data to be encrypted into ciphertext data and/or a request for decrypting the ciphertext data into decrypted data.
  • the apparatus is applied in a key broker module, the apparatus comprising: a first processing unit, disposed in the first type of key broker module, configured to receive and execute the secret of the service module Processing the request, obtaining an execution result; the first processing unit is disposed in the second type of key agent module, configured to receive and execute the ciphertext processing request of the service module, wherein the service module is set to be generated based on the execution result When the first information conforms to the predetermined type switching condition, the ciphertext processing request is sent to the second type of key agent module.
  • the first type of key agent module is a development type key agent module
  • the second type of key agent module is a stable key agent module
  • the stable key agent module is executed within a predetermined time period.
  • the ciphertext processing request is more accurate than the key agent module of the predetermined correct rate.
  • the third processing unit is configured to: in the first type of the key agent module, receive and execute the ciphertext processing request of the service module, and update the file in the key agent module in the system before obtaining the execution result.
  • the key agent module that performs the update operation is recorded as the first type of key agent module; after the first type of the key agent module receives and executes the ciphertext processing request of the service module, and after obtaining the execution result, if The first type of key agent module is recorded as the second type of key agent module by detecting that the correct rate of the first type of key agent module performing the ciphertext processing request is higher than the predetermined correct rate within the predetermined time period.
  • the updating unit is configured to: when the first type of the key agent module performs the ciphertext processing request of the service module, if the file in the key agent module needs to be updated, the first type of the secret is The files in the key broker module are updated.
  • the detecting unit is configured to: when the key agent module performs the ciphertext processing request, the key agent module detects whether the success rate of executing the ciphertext processing request is lower than a second predetermined threshold; if the execution ciphertext is detected If the success rate of the processing request is lower than the second predetermined threshold, the key data is sent to the service module, where the key data is used to decrypt the key list stored in the shared memory, and the decrypted key list is obtained, and the service module further Used to perform a ciphertext processing request through the decrypted key list.
  • the fourth processing unit is configured to: after the key agent module detects whether the success rate of executing the ciphertext processing request is lower than a second predetermined threshold, the key agent module is based on the ciphertext after executing the ciphertext processing request The processing time in the request is compared with the current time, and it is determined whether the current ciphertext processing request is timed out; if it is determined that the current ciphertext processing request is timed out, it is determined that the execution of the current ciphertext processing request fails; The number of requests processed, and the success rate of the statistics key agent module to perform ciphertext processing requests.
  • the sixth processing unit is configured to receive the second end descriptor of the communication pipeline transmitted by the service thread before the key proxy module detects whether the success rate of executing the ciphertext processing request is lower than a second predetermined threshold, where
  • the service thread is configured to generate a first end descriptor and a second end descriptor, wherein the first end descriptor is used by the key proxy module to identify the data sent by the service module as legal data, and the second end descriptor is used for the service.
  • the module identifies the data sent by the key broker module as legitimate data.
  • sending the key data to the service module includes: transmitting key data by using a write end of a communication pipeline of each service thread.
  • the communication pipeline is further configured to detect whether the service module and the key agent module are restarted.
  • the sixth processing unit is configured to, after performing the ciphertext processing request by the key proxy module, after the validity of the validity verification by the key proxy module,
  • the key agent module receives the first file descriptor sent by the service module, where the first file descriptor is used by the key agent module to identify the data sent by the service module as legal data; the key agent module generates multiple second files. Descriptor, where the second file descriptor
  • the service module identifies the data sent by the key agent module as legal data; the key agent module transmits a plurality of second file descriptors to the service module.
  • the number of the plurality of second file descriptors corresponds to the number of threads in the key broker module for executing the ciphertext processing request.
  • the ciphertext processing request comprises: a request for encrypting the data to be encrypted into ciphertext data and/or a request for decrypting the ciphertext data into decrypted data.
  • the service processing device is applied in a key agent module, the device includes: a first obtaining unit configured to acquire an execution result of the execution of the ciphertext processing request; and a first detecting unit configured to detect execution Whether the result meets the predetermined mode switching condition, wherein the matching the predetermined type switching condition indicates that the first type of the key agent module is vulnerable, that is, the first type of the key agent module cannot stably execute the ciphertext Processing the request; the first sending unit is configured to: if the detection result is that the execution result meets the predetermined mode switching condition, send the indication information to the service module, where the indication information is used to indicate that the service module switches to the mode of performing the ciphertext processing request by the service module .
  • the first obtaining unit is configured to: after the ciphertext processing request is executed, determine, according to the request time and the current time in the ciphertext processing request, whether the current ciphertext processing request is timed out; If the execution of the current ciphertext processing request timeout occurs, the key agent module determines that the execution of the current ciphertext processing request fails; the key agent module performs the ciphertext processing request based on the number of ciphertext processing requests that failed to execute.
  • the success rate, the execution results include the success rate.
  • the first detecting unit is configured to: the key agent module detects whether the success rate is lower than a second predetermined threshold; if it is detected whether the success rate of executing the ciphertext processing request is lower than a second predetermined threshold, determining that the execution result is consistent Scheduled mode switching conditions.
  • the first sending unit is configured to: the key agent module sends the key data to the service module, where the key data is used to decrypt the key list stored in the shared memory, and obtain the decryption.
  • the service module is further configured to perform a ciphertext processing request through the decrypted key list.
  • the key agent module includes a first type of key agent module and a second type of key agent module, wherein the first type of key agent module is a development type key agent module, and the second type of secret
  • the key agent module is a stable key agent module, and the stable key agent module is a key agent module that performs a ciphertext processing request with a correct rate higher than a predetermined correct rate within a predetermined time period.
  • the first processing unit is configured to: after the key agent module receives and executes the ciphertext processing request of the service module, after the file in the key agent module is updated, the key agent that performs the update operation is set
  • the module records as a first type of key agent module; after the first type of key agent module receives and executes the ciphertext processing request of the service module, and obtains the execution result, the method further includes: if the predetermined time period is detected When the correct rate of the first type of key agent module performing the ciphertext processing request is higher than the predetermined correct rate, the first type of key agent module is recorded as the second type of key agent module.
  • the second processing unit is configured to: when the first type of the key agent module performs the ciphertext processing request of the service module, if the file in the key agent module needs to be updated, the first type is The files in the key broker module are updated.
  • the ciphertext processing request comprises: a request for encrypting the data to be encrypted into ciphertext data and/or a request for decrypting the ciphertext data into decrypted data.
  • FIG. 12 is a schematic diagram of an optional service encryption apparatus according to an embodiment of the present application.
  • the apparatus may include: a first encryption receiving unit 1201, a first encryption obtaining unit 1203, and a first encryption unit 1205. And a first encryption transmitting unit 1207, wherein:
  • the first encryption receiving unit 1201 is disposed in the key agent module and configured to receive an encryption request sent by the service module, where the encryption request carries data to be encrypted.
  • the first encryption obtaining unit 1203 is disposed in the key agent module and configured to acquire the target key from the key list, wherein the key list is previously extracted from the key server.
  • the first encryption unit 1205 sets the key agent module to encrypt the data to be encrypted using the target key to obtain the encrypted data.
  • the first encryption sending unit 1207 is disposed in the key agent module and configured to send the encrypted data to the service module.
  • the encryption request is received by the key agent module, and then the target key is obtained according to the key request, and then the data to be encrypted is encrypted by the target key, and the service encryption provided in the embodiment of the present application is encrypted.
  • the method achieves the purpose of encrypting the service more securely, thereby achieving the technical effect of improving the key security when encrypting the service, thereby solving the security of the key when decrypting the service in the related art. Low technical issues.
  • the second encryption sending unit is disposed in the key agent module, and is configured to send the first public key to the key server and receive the key server before receiving the encryption request sent by the service module by the key agent module.
  • Receiving a second public key wherein the key agent module has a pair of first public key and a first private key, the key server has a pair of second public key and a second private key; and the third encrypted sending unit sets In the key agent module, configured to send a key list pull request to the key server; the second encryption receiving unit is set in the key agent module, and is configured to receive the encrypted key list sent by the key server,
  • the encrypted key list is obtained by encrypting the key list by using the first communication key on the key server side, and the first communication key is generated by the key server according to the first public key and the second private key.
  • a decryption unit configured in the key agent module, configured to decrypt the encrypted key list using the second communication key on the side of the key agent module to obtain a key list, wherein Communication module generates the proxy key is a key obtained by the first private key and a second public key, same as the first key and a second communication communication key.
  • the second encryption sending unit includes: a first sending module, configured to send the encrypted first public key to the key server when the key agent module is restarted, where the encrypted first public key is The first public key is encrypted by using a contract key; the receiving module is set to be connected Receiving the encrypted second public key, wherein the encrypted second public key is obtained by encrypting the second public key using the agreed key; and the decrypting module is set to use the agreed key pair to encrypt the second public key Decrypting is performed to obtain a second public key; wherein the appointment key is set to be used only when the key broker module is restarted.
  • a first sending module configured to send the encrypted first public key to the key server when the key agent module is restarted, where the encrypted first public key is The first public key is encrypted by using a contract key
  • the receiving module is set to be connected Receiving the encrypted second public key, wherein the encrypted second public key is obtained by encrypting the second public key using the agreed key
  • the decrypting module is set to use the agreed key pair to
  • the device includes: a second encryption acquiring unit, configured in the key agent module, configured to acquire a process PID of the service process, where the service process is a process, before the key agent module receives the encryption request sent by the service module a process of sending the data to be encrypted by the service module; the verification unit is set in the key agent module, and is set to perform legality verification on the service process and the process PID; and the first encryption acquisition unit includes: a first acquisition module, and a setting In the key proxy module, the key proxy module obtains the target key from the key list if the validity check is passed.
  • the verification unit includes: a second obtaining module, configured to acquire a full path of the process corresponding to the process PID; and a first determining module, configured to determine whether the full path of the process belongs to a legal path obtained from the key server in advance
  • the path of the verification module is set to perform the MD5 verification operation on the service process to obtain the first MD5 verification result when the path of the process is determined to belong to the path in the legal path;
  • the first determining module is set to If it is determined that the path of the process does not belong to the path in the legal path, it is determined that the validity check fails;
  • the second determining module is configured to determine whether the first MD5 check result is corresponding to the pre-acquired service process.
  • the second MD5 check result is the same; the second determining module is configured to determine that the validity check is passed when it is determined that the first MD5 check result is the same as the second MD5 check result; and the third determining module is set to When it is determined that the first MD5 check result is different from the second MD5 check result, it is determined that the validity check fails.
  • the device further includes: a third encryption acquiring unit, configured in the key agent module, configured to perform the validity check on the service process and the process PID after the key agent module, and receive the service in the key agent module Before the encryption request sent by the module, in the case that the validity check is passed, the first file descriptor sent by the service module is obtained, where the first file descriptor is used for
  • the key agent module identifies the data sent by the service module as legal data;
  • the generating unit is disposed in the key agent module and configured to generate a second file descriptor, wherein the second file descriptor is used by the service module to use the key agent
  • the data sent by the module is identified as legal data;
  • the transmission unit is disposed in the key agent module and configured to transmit the second file descriptor to the service module.
  • the first encryption receiving unit includes: a third acquiring module, configured in the key proxy module, and configured to receive the encryption request sent by the service module, where the key proxy module obtains the service module from the shared memory
  • the encrypted data includes: a second sending module, configured in the key proxy module, configured to store the encrypted data in the shared memory, so that the service module obtains the encrypted content from the shared memory. data.
  • the device further includes: a setting unit, configured in the key agent module, configured to perform a validity check on the service process and the process PID of the key agent module, and receive the service module sent by the key agent module Before the encryption request, in the case that the legality verification is passed, the key agent module sets the target authority for the first file descriptor, wherein the target authority includes at least one of the following: the key agent module is requested to encrypt the service module.
  • the data is encrypted, allowing the key agent module to decrypt the data to be decrypted requested by the service module.
  • the first obtaining module includes: an obtaining submodule, configured to allow the key proxy module to encrypt the data to be encrypted requested by the service module, and the key proxy module obtains the target key from the key list.
  • the second encryption obtaining unit includes: a fourth obtaining module, configured to acquire a process PID of the service process through the unix domain socket in the non-root running mode; or, the fifth obtaining module is configured to socket the socket
  • the word option is configured as SO_PEERCRED, and the process PID of the business process is obtained through the socket socket.
  • the first encryption receiving unit 1201 in this embodiment may be configured to perform step S702 in the first embodiment of the present application.
  • the first encryption obtaining unit 1203 in this embodiment may be configured to perform the first embodiment of the present application.
  • the first encryption unit 1205 in this embodiment may be configured to perform step S706 in Embodiment 1 of the present application, in this embodiment
  • the first encryption transmitting unit 1207 may be configured to perform step S708 in Embodiment 1 of the present application.
  • FIG. 13 is a schematic diagram of an optional service decryption apparatus according to an embodiment of the present application.
  • the apparatus may include: a first decryption receiving unit 1301, a first decryption acquisition unit 1303, and a first decryption unit 1305. And a first decryption transmitting unit 1307, wherein:
  • the first decryption receiving unit is disposed in the key proxy module and configured to receive the decryption request sent by the service module, where the decryption request carries data to be decrypted.
  • the first decryption obtaining unit is disposed in the key agent module and configured to obtain the target key from the key list, wherein the key list is previously extracted from the key server.
  • the first decryption unit sets the key agent module to decrypt the data to be decrypted using the target key to obtain the decrypted data.
  • the first decryption sending unit is disposed in the key agent module and configured to send the decrypted data to the service module.
  • the decryption request is received by the key agent module, and then the target key is obtained according to the key request, and then the data to be decrypted is decrypted by the target key, and the service decryption provided in the embodiment of the present application is decrypted.
  • the method achieves the purpose of decrypting the service more securely, thereby realizing the technical effect of improving the security of the key when decrypting the service, thereby solving the security of the key when decrypting the service in the related art. Low technical issues.
  • the second decryption sending unit is disposed in the key agent module, and configured to send the first public key to the key server and receive the key server before the key agent module receives the decryption request sent by the service module Receiving a second public key, wherein the key agent module has a pair of first public key and a first private key, the key server has a pair of second public key and a second private key; and the third decryption sending unit sets In the key agent module, configured to send a key list pull request to the key server; the second decryption receiving unit is set in the key agent module, and is configured to receive the encrypted key list sent by the key server, Where the encrypted key list is a key service The first communication key of the device side is obtained by encrypting the key list, and the first communication key is generated by the key server according to the first public key and the second private key; and the second decryption unit is set in the key agent.
  • the second key of the key agent module is used to decrypt the encrypted key list to obtain a key list, wherein the second communication key is a key agent module according to the first private key and The second public key is generated, and the first communication key is the same as the second communication key.
  • the second decryption sending unit includes: a first sending module, configured to send the encrypted first public key to the key server when the key agent module is restarted, where the encrypted first public key is The first public key is obtained by encrypting the first public key; the receiving module is configured to receive the encrypted second public key from the key server, wherein the encrypted second public key is the second key using the agreed key The key is encrypted; the decryption module is configured to decrypt the encrypted second public key by using the contract key to obtain a second public key; wherein the appointment key is set to be only in the key agent module Used when restarting.
  • the device includes: a second decryption acquiring unit, configured to be configured in the key agent module, configured to acquire a process PID of the service process, where the key process module receives the decryption request sent by the service module, where the service process is The process of sending the data to be decrypted by the service module;
  • the verification unit is set in the key agent module, and is set to perform legality verification on the service process and the process PID;
  • the first decryption acquisition unit includes: a first acquisition module, which is set in In the key agent module, it is set that the key agent module obtains the target key from the key list if the validity check is passed.
  • the verification unit includes: a second obtaining module, configured to acquire a full path of the process corresponding to the process PID; and a first determining module, configured to determine whether the full path of the process belongs to a legal path obtained from the key server in advance
  • the path of the verification module is set to perform the MD5 verification operation on the service process to obtain the first MD5 verification result when the path of the process is determined to belong to the path in the legal path;
  • the first determining module is set to If it is determined that the path of the process does not belong to the path in the legal path, it is determined that the validity check fails;
  • the second determining module is configured to determine whether the first MD5 check result is corresponding to the pre-acquired service process.
  • the second MD5 check result is the same; the second determining module is configured to determine that the validity check is passed when it is determined that the first MD5 check result is the same as the second MD5 check result; the third determining module sets In order to determine that the first MD5 check result is different from the second MD5 check result, it is determined that the validity check fails.
  • the device further includes: a third decryption acquiring unit, configured in the key agent module, configured to receive the service after the key agent module performs the validity check on the service process and the process PID, and in the key agent module Before the decryption request sent by the module, if the validity check is passed, the first file descriptor sent by the service module is obtained, where the first file descriptor is used by the key agent module to identify the data sent by the service module as legal.
  • a data generating unit configured to generate a second file descriptor, wherein the second file descriptor is used by the service module to identify the data sent by the key proxy module as legal data; the transmission unit, setting In the key broker module, it is set to transmit the second file descriptor to the service module.
  • the first decryption receiving unit includes: a third obtaining module, configured in the key proxy module, configured to receive the decryption request sent by the service module, where the key proxy module obtains the service module from the shared memory Decrypted data;
  • the first decryption sending unit comprises: a second sending module, disposed in the key proxy module, configured to store the decrypted data in the shared memory, so that the service module obtains the decrypted data from the shared memory data.
  • the device further includes: a setting unit, configured in the key agent module, configured to perform a validity check on the service process and the process PID of the key agent module, and receive the service module sent by the key agent module Before the decryption request, in the case that the legality verification is passed, the key agent module sets the target authority for the first file descriptor, wherein the target authority includes at least one of the following: the key agent module is allowed to encrypt the service module request The data is encrypted, allowing the key agent module to decrypt the data to be decrypted requested by the service module.
  • a setting unit configured in the key agent module, configured to perform a validity check on the service process and the process PID of the key agent module, and receive the service module sent by the key agent module Before the case that the legality verification is passed, the key agent module sets the target authority for the first file descriptor, wherein the target authority includes at least one of the following: the key agent module is allowed to encrypt the service module request The data is encrypted, allowing the key agent module to decrypt
  • the first obtaining module includes: an obtaining submodule, configured to allow the key proxy module to decrypt the data to be decrypted requested by the service module, and the key proxy module obtains the target key from the key list.
  • the second decryption acquiring unit includes: a fourth acquiring module, configured to acquire a process PID of the service process through the unix domain socket in the non-root running mode; or, the fifth acquiring module is configured to socket the socket
  • the word option is configured as SO_PEERCRED, and the process PID of the business process is obtained through the socket socket.
  • the first decryption receiving unit 701 in this embodiment may be configured to perform step S302 in the first embodiment of the present application.
  • the first decryption obtaining unit 703 in this embodiment may be configured to perform the first embodiment of the present application.
  • the first decryption unit 705 in this embodiment may be configured to perform step S306 in the first embodiment of the present application
  • the first decryption sending unit 707 in this embodiment may be configured to perform the first embodiment in the present application. Step S308.
  • the above modules are the same as the examples and application scenarios implemented by the corresponding steps, but are not limited to the contents disclosed in the above embodiment 1. It should be noted that the foregoing module may be implemented in a hardware environment as shown in FIG. 1 as part of the device, and may be implemented by software or by hardware, where the hardware environment includes a network environment.
  • an electronic device for implementing the foregoing service processing method is also provided.
  • FIG. 14 is a structural block diagram of an electronic device according to an embodiment of the present application.
  • the electronic device may include: one or more (only one is shown) processor 1401 (as in the above embodiment) The key agent module), the memory 1403, and the transmission device 1405 (such as the transmitting device in the above embodiment), as shown in FIG. 14, the electronic device may further include an input/output device 1407.
  • the memory 1403 can be configured to store software programs and modules, as implemented in the present application.
  • the processor 1401 executes various functional applications and data processing by executing the software program and the module stored in the memory 1403, that is, implementing the above-described business processing method.
  • Memory 1403 can include high speed random access memory, and can also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 1403 can further include memory remotely located relative to processor 1401, which can be connected to the terminal over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the above-described transmission device 1405 is configured to receive or transmit data via a network, and may also be configured as data transmission between the processor and the memory. Specific examples of the above network may include a wired network and a wireless network.
  • the transmission device 1405 includes a Network Interface Controller (NIC) that can be connected to other network devices and routers via a network cable to communicate with the Internet or a local area network.
  • the transmission device 1405 is a Radio Frequency (RF) module configured to communicate with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • the memory 1403 is configured to store an application.
  • the processor 1401 may invoke the application stored in the memory 1403 via the transmission device 1405 to perform the step of: acquiring first information, wherein the first information is used to indicate that the first type of key agent module performs execution of the ciphertext processing request a result of detecting whether the first information meets a predetermined type switching condition, wherein the matching the predetermined type switching condition indicates that a vulnerability occurs in the first type of key agent module; and when detecting that the first information meets the predetermined type switching condition, The second type of key agent module executes the ciphertext processing request of the service module.
  • the processor 1401 may invoke the application stored in the memory 1403 by the transmission device 1405 to perform the following steps: before acquiring the first information, sending a ciphertext processing request to the first type of key proxy module; acquiring the first type of key
  • the proxy module executes the execution result of the ciphertext processing request; obtaining the first information includes: counting the first type of the key proxy module based on the execution result The success rate of the ciphertext processing request, wherein the first information includes a success rate.
  • the predetermined type switching condition includes the success rate being lower than the first predetermined threshold
  • the processor 1401 may invoke the application stored in the memory 1403 by the transmitting device 1405 to perform the step of: detecting whether the success rate is lower than the first predetermined threshold. And if the detected success rate is lower than the first predetermined threshold, determining that the first information meets the predetermined type switching condition; and if the detected success rate is not lower than the first predetermined threshold, determining that the first information does not meet the predetermined type switching condition.
  • the first type of key agent module is a development type key agent module
  • the second type of key agent module is a stable key agent module
  • the stable key agent module is executed within a predetermined time period.
  • the ciphertext processing request is more accurate than the key agent module of the predetermined correct rate.
  • the processor 1401 may call the application stored in the memory 1403 through the transmission device 1405 to perform the following steps, and after updating the file in the key agent module in the system before the first information is acquired, the update operation will be performed.
  • the key agent module is recorded as a first type of key agent module; if it is detected within a predetermined time period that the correct rate of the first type of key agent module performing the ciphertext processing request is higher than the predetermined correct rate, then A type of key broker module is recorded as a second type of key broker module.
  • the processor 1401 may invoke the application stored in the memory 1403 through the transmission device 1405 to perform the following steps.
  • the files in the key broker module are updated to update the files in the first type of key broker module.
  • the processor 1401 may invoke the application stored in the memory 1403 through the transmission device 1405 to perform the following steps. If the system includes multiple second type of key agent modules, from the plurality of second type of key agent modules Obtaining the second type of key agent module with the latest update time, and executing the ciphertext processing request by the second type of key agent module with the latest update time.
  • the processor 1401 may call the application stored in the memory 1403 through the transmission device 1405 to perform the following steps: performing the confidentiality of the service module by using the second type of key agent module After processing the request, after receiving the input switching instruction, the ciphertext processing request is executed by the first type of key agent module in response to the switching instruction.
  • the processor 1401 may call the application stored in the memory 1403 through the transmission device 1405 to perform the following steps, in the process of executing the ciphertext processing request by the first type of key agent module or the second type of key agent module, Obtaining key data of the key agent module by the service thread, wherein the key agent module is configured to send the key data when detecting that the success rate of executing the ciphertext processing request is lower than a second predetermined threshold; using the key
  • the data decrypts the key list stored in the shared memory to obtain a decrypted key list; and uses the decrypted key list to execute the ciphertext processing request through the service module.
  • the processor 1401 may invoke the application stored in the memory 1403 by the transmission device 1405 to perform the following steps: before acquiring the key data of the key agent module by the service thread, generating the first end descriptor of the communication pipe through the service thread and a second end descriptor, wherein the first end descriptor is used by the key proxy module to identify the data sent by the service module as legal data, and the second end descriptor is used by the service module to identify the data sent by the key proxy module as legal Data; the second end descriptor is transmitted to the key broker module through the communication pipe.
  • the processor 1401 can call the application stored in the memory 1403 through the transmission device 1405 to perform the steps of periodically reading data from the read end of the communication pipe through the service thread; if the data is read from the read end of the communication pipe, Make sure to get the key data.
  • the communication pipeline is further configured to detect whether the service module and the key agent module are restarted.
  • the processor 1401 may call the application stored in the memory 1403 by the transmission device 1405 to perform the following steps: during the execution of the ciphertext processing request by the key agent module, the validity of the business process is verified by the key agent module. Then, in the case that the validity check is passed, the service module sends a first file descriptor to the key proxy module, where the first file descriptor is used by the key proxy module to identify the data sent by the service module as legal data; Obtaining a plurality of second file descriptors generated by the key agent module, wherein the second file descriptor is used by the service module to identify the data sent by the key agent module as legal data.
  • the processor 1401 may call the application stored by the memory 1403 through the transmission device 1405 to perform the following steps, after acquiring the plurality of second file descriptors generated by the key agent module, the acquired second file descriptors Save to the queue; sequentially communicate with the key broker module using the second file descriptor stored in the queue.
  • the processor 1401 may call the application stored in the memory 1403 via the transmission device 1405 to perform the following steps, the number of the plurality of second file descriptors corresponding to the number of threads in the key agent module for executing the ciphertext processing request.
  • the ciphertext processing request includes: a request for encrypting the data to be encrypted into ciphertext data and/or a request for decrypting the ciphertext data into the decrypted data.
  • the processor 1401 may invoke the application stored in the memory 1403 by the transmission device 1405 to perform the following steps.
  • the first type of key agent module receives and executes the ciphertext processing request of the service module to obtain an execution result; the second type of secret
  • the key agent module receives and executes the ciphertext processing request of the service module, wherein the service module is configured to send the ciphertext to the second type of key agent module if the first information generated based on the execution result meets the predetermined type switching condition Processing the request, wherein conforming to the predetermined type of switching condition indicates determining that the first type of key agent module is vulnerable.
  • the first type of key agent module is a development type key agent module
  • the second type of key agent module is a stable key agent module
  • the stable key agent module is executed within a predetermined time period.
  • the ciphertext processing request is more accurate than the key agent module of the predetermined correct rate.
  • the processor 1401 may call the application stored in the memory 1403 through the transmission device 1405 to perform the following steps, the key agent module acquires an execution result of executing the ciphertext processing request; and the key agent module detects whether the execution result meets the predetermined mode switching condition, Wherein, meeting the predetermined mode switching condition indicates that the key agent module is vulnerable;
  • the key agent module sends the indication information to the service module, where the indication information is used to indicate that the service module switches to the service module.
  • the processor 1401 may invoke the application stored in the memory 1403 by the transmission device 1405 to perform the following steps.
  • the key agent module obtains the execution result of the execution of the ciphertext processing request, including: after the cryptographic processing request is executed by the key agent module, Determining whether to execute the current ciphertext processing request timeout based on the request time and the current time in the ciphertext processing request; if it is determined that the current ciphertext processing request is timed out, the key agent module determines that the execution of the current ciphertext processing request fails.
  • the key agent module calculates the success rate of the ciphertext processing request based on the number of ciphertext processing requests that fail to execute, and the execution result includes the success rate.
  • the processor 1401 may invoke the application stored in the memory 1403 by the transmission device 1405 to perform the following steps.
  • the key agent module detects whether the execution result meets the predetermined mode switching condition, including: the key agent module detects whether the success rate is lower than the second predetermined a threshold; if it is detected whether the success rate of executing the ciphertext processing request is lower than a second predetermined threshold, determining that the execution result conforms to the predetermined mode switching condition.
  • the processor 1401 may invoke an application stored in the memory 1403 via the transmission device 1405 to perform the following steps.
  • the key agent module transmits key data to the service module, wherein the key data is used to decrypt the key list stored in the shared memory.
  • the decrypted key list is obtained, and the service module is further configured to execute the ciphertext processing request through the decrypted key list.
  • an electronic device for implementing the above-described service encryption (or service decryption) method is also provided.
  • FIG. 15 is a structural block diagram of an electronic device according to an embodiment of the present application.
  • the electronic device may include: one or more (only one is shown) processor 1501 (as in the above embodiment) The key agent module), the memory 1503, and the transmission device 1505 (such as the transmitting device in the above embodiment), as shown in FIG. 15, the electronic device may further include an input/output device 1507.
  • the memory 1503 can store software programs and modules, as in the embodiment of the present application.
  • the service encryption (or service decryption) method and the program instruction/module corresponding to the device, the processor 1501 performs various function applications and data processing by executing the software program and the module stored in the memory 1503, that is, implementing the above-mentioned service encryption ( Or business decryption) method.
  • the memory 1503 may include a high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 1503 can further include memory remotely located relative to processor 1501, which can be connected to the terminal over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the above-mentioned transmission device 1505 receives or transmits data via a network, and can also transfer data between the processor and the memory.
  • Specific examples of the above network may include a wired network and a wireless network.
  • the transmission device 1505 includes a Network Interface Controller (NIC) that can be connected to other network devices and routers via a network cable to communicate with the Internet or a local area network.
  • the transmission device 1505 is a Radio Frequency (RF) module for communicating with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • the memory 1503 is used to store an application.
  • the processor 1501 can call the application stored in the memory 1503 through the transmission device 1505 to perform the following steps:
  • the processor 1501 is further configured to perform the following steps in the service encryption method provided by the application:
  • the encryption request carries data to be encrypted; obtaining a target key from the key list, wherein the key list is previously extracted from the key server; using the target key
  • the encrypted data is encrypted to obtain the encrypted data; the key agent module sends the encrypted data to the service module.
  • the processor 1501 is further configured to: send a first public key to the key server, and receive a second public key from the key server, where the key agent module has a pair of a first public key and a first private key, the key server having a pair of the second public key And a second private key; transmitting a key list pull request to the key server; the key proxy module receiving the encrypted key list sent by the key server, wherein the encrypted key The list is obtained by encrypting the key list using a first communication key on the key server side, the first communication key being the key server according to the first public key and the first Generating the second private key; decrypting the encrypted key list using the second communication key on the key proxy module side to obtain the key list, wherein the second communication key is The key agent module generates the first communication key and the second public key according to the first private key and the second public key.
  • the processor 1501 is further configured to: when the key agent module is restarted, send the encrypted first public key to the key server, where the encrypted first The public key is obtained by encrypting the first public key using a contract key; receiving the encrypted second public key from the key server, wherein the encrypted second public key is Obtaining the second public key by using the agreement key; decrypting the encrypted second public key by using the agreement key to obtain the second public key; wherein the agreement The key is set to be used only when the key broker module is restarted.
  • the processor 1501 is further configured to: before the key proxy module receives the encryption request sent by the service module, acquire a process PID of the service process, where the service process sends a process of the data to be encrypted to the service module; The legality check is performed with the process PID; obtaining the target key from the key list includes: when the validity check is passed, the key agent module obtains the target key from the key list.
  • the processor 1501 is further configured to: obtain a process full path corresponding to the process PID; determine whether the process full path belongs to a path in a legal path obtained from the key server in advance; and determine that the process full path belongs to the legal path.
  • the MD5 check operation is performed on the service process to obtain the first MD5 check result; if it is determined that the process full path does not belong to the path in the legal path, it is determined that the validity check fails; Determining whether the first MD5 check result is the same as the second MD5 check result corresponding to the pre-acquired service process; If the first MD5 check result is the same as the second MD5 check result, it is determined that the validity check is passed; if the first MD5 check result is different from the second MD5 check result, it is determined that the validity check fails.
  • the processor 1501 further performs the following steps: after the key agent module performs the validity check on the service process and the process PID, and before the key agent module receives the encryption request sent by the service module, and passes the validity check.
  • the first file descriptor sent by the service module is obtained, where the first file descriptor is used by the key agent module to identify the data sent by the service module as legal data; and the second file descriptor is generated, where the second file is generated.
  • the descriptor is used by the service module to identify the data sent by the key proxy module as legal data; the second file descriptor is transmitted to the service module.
  • the processor 1501 is further configured to: perform the following steps: receiving the encryption request sent by the service module includes: acquiring data to be encrypted stored by the service module from the shared memory; and transmitting the encrypted data to the service module, including: encrypting The data is stored in the shared memory so that the business module obtains the encrypted data from the shared memory.
  • the processor 1501 is further configured to perform the following steps: after the key agent module performs the validity check on the service process and the process PID, and before the key agent module receives the encryption request sent by the service module, and the validity check
  • the target permission is set, wherein the target authority includes at least one of the following: the key agent module is allowed to encrypt the data to be encrypted requested by the service module, and the key agent module is allowed to the service module. The requested data to be decrypted is decrypted.
  • the processor 1501 is further configured to perform the following steps: in the case that the legality verification is passed, when the target authority includes allowing the key proxy module to encrypt the data to be encrypted requested by the service module, the key proxy module is from the key Get the target key in the list.
  • the processor 1501 is further configured to: the key proxy module acquires the process PID of the service process through the unix domain socket in the non-root operation mode; or the key proxy module configures the option of the socket socket as the SO_PEERCRED And through the socket socket acquisition industry Process PID of the process.
  • the processor 1501 is further configured to perform the following steps in the service decryption method provided by the application:
  • the decryption request carries data to be decrypted; obtaining a target key from the key list, wherein the key list is previously extracted from the key server; using the target key
  • the decrypted data is decrypted to obtain the decrypted data; the key agent module sends the decrypted data to the service module.
  • the processor 1501 is further configured to: send a first public key to the key server, and receive a second public key from the key server, where the key agent module has a pair of a first public key having a pair of the second public key and a second private key; and a key list pull request sent to the key server; the key The proxy module receives the encrypted key list sent by the key server, wherein the encrypted key list is obtained by encrypting the key list by using the first communication key on the key server side.
  • the first communication key is generated by the key server according to the first public key and the second private key; using the second communication key on the key proxy module side Decrypting the encrypted key list to obtain the key list, wherein the second communication key is generated by the key agent module according to the first private key and the second public key, The first communication key is the same as the second communication key.
  • the processor 1501 is further configured to: when the key agent module is restarted, send the encrypted first public key to the key server, where the encrypted first The public key is obtained by encrypting the first public key using a contract key; receiving the encrypted second public key from the key server, wherein the encrypted second public key is Obtaining the second public key by using the agreement key; decrypting the encrypted second public key by using the agreement key to obtain the second public key; wherein the agreement The key is set to be used only when the key broker module is restarted.
  • the processor 1501 is further configured to: obtain the process PID of the service process, where the service process is a service mode, before the key agent module receives the decryption request sent by the service module.
  • the process of sending the data to be decrypted by the block; verifying the legality of the business process and the process PID; and obtaining the target key from the key list includes: in the case that the legality verification is passed, the key agent module is from the key list Get the target key.
  • the processor 1501 is further configured to: obtain a process full path corresponding to the process PID; determine whether the process full path belongs to a path in a legal path obtained from the key server in advance; and determine that the process full path belongs to the legal path.
  • the MD5 check operation is performed on the service process to obtain the first MD5 check result; if it is determined that the process full path does not belong to the path in the legal path, it is determined that the validity check fails; Determining whether the first MD5 check result is the same as the second MD5 check result corresponding to the service process obtained in advance; if the first MD5 check result is the same as the second MD5 check result, determining that the validity check is passed; If the first MD5 check result is different from the second MD5 check result, it is determined that the validity check fails.
  • the processor 1501 is further configured to perform the following steps: after the key agent module performs the validity check on the service process and the process PID, and before the key agent module receives the decryption request sent by the service module, and the validity check And obtaining, by the first file descriptor sent by the service module, where the first file descriptor is used by the key agent module to identify the data sent by the service module as legal data; and the second file descriptor is generated, where The second file descriptor is used by the service module to identify the data sent by the key agent module as legal data; and the second file descriptor is transmitted to the service module.
  • the processor 1501 is further configured to: perform the following steps: the receiving the decryption request sent by the service module comprises: acquiring data to be decrypted stored by the service module from the shared memory; and sending the decrypted data to the service module comprises: decrypting the decrypted The data is stored in the shared memory so that the business module obtains the decrypted data from the shared memory.
  • the processor 1501 is further configured to perform the following steps: after the key agent module performs the validity check on the service process and the process PID, and before the key agent module receives the decryption request sent by the service module, and the validity check In the case of passing, set the target right for the first file descriptor
  • the target authority includes at least one of the following: the key proxy module is allowed to decrypt the data to be decrypted requested by the service module, and the key proxy module is allowed to decrypt the data to be decrypted requested by the service module.
  • the processor 1501 is further configured to perform the following steps: in the case that the legality verification is passed, when the target authority includes the key agent module to decrypt the data to be decrypted requested by the service module, the key agent module slave key Get the target key in the list.
  • the processor 1501 is further configured to: the key proxy module acquires the process PID of the service process through the unix domain socket in the non-root operation mode; or the key proxy module configures the option of the socket socket as the SO_PEERCRED And get the process PID of the business process through the socket socket.
  • a scheme of service encryption (or service decryption) is provided.
  • Receiving an encryption (or decryption) request by the key agent module, and then acquiring the target key according to the key request, and then encrypting the data to be encrypted (or to be decrypted) by the target key which is provided in the embodiment of the present application.
  • the service encryption (or decryption) method achieves the purpose of encrypting (or decrypting) the service more securely, thereby realizing the technical effect of improving the key security when encrypting (or decrypting) the service, thereby solving the present problem.
  • Embodiments of the present application also provide a storage medium.
  • the foregoing storage medium may be used to execute program code of a service processing method.
  • the foregoing storage medium may be located on at least one of the plurality of network devices in the network shown in the foregoing embodiment.
  • the storage medium is arranged to store program code for performing the following steps:
  • first information wherein the first information is used to indicate that the first type of key agent module performs an execution result of the ciphertext processing request; and detecting whether the first information meets a predetermined type switching condition, wherein the predetermined type switching condition is determined to be determined
  • a vulnerability occurs in the first type of key agent module; in the case where it is detected that the first information conforms to the predetermined type of switching condition, the ciphertext processing request of the service module is executed by the second type of key agent module.
  • the storage medium is arranged to store program code for performing the following steps:
  • the key agent module receives an encryption request sent by the service module, where the encryption request carries data to be encrypted.
  • the key agent module obtains a target key from a key list, where the key list is previously extracted from the key server;
  • the key agent module encrypts the data to be encrypted by using the target key, and obtains the encrypted data.
  • the key agent module sends the encrypted data to the service module.
  • the storage medium is arranged to store program code for performing the following steps:
  • the key agent module receives a decryption request sent by the service module, where the decryption request Carrying data to be decrypted;
  • the key agent module obtains a target key from a key list, where the key list is previously extracted from the key server.
  • the key agent module decrypts the data to be decrypted by using the target key to obtain the decrypted data.
  • the key agent module sends the decrypted data to the service module.
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • the integrated unit in the above embodiment if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in the above-described computer readable storage medium.
  • the technical solution of the present application in essence or the contribution to the prior art, or all or part of the technical solution may be embodied in the form of a software product, which is stored in a storage medium.
  • a number of instructions are included to cause one or more computer devices (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the disclosed client may be implemented in other manners.
  • the device embodiments described above are only schematic, for example, the division of the unit is only a logical function division, and the actual implementation may have another The manner of division, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, unit or module, and may be electrical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the first information is obtained, where the first information is used to indicate that the first type of the key agent module performs the execution result of the ciphertext processing request; whether the first information meets the predetermined type switching condition; If the first information meets the predetermined type switching condition, the ciphertext processing request of the service module is executed by the second type of key proxy module.
  • the secret may be executed according to the first type of key proxy processing module.
  • the result of the file processing request determines whether the predetermined type switching condition is met, and if the switching condition is met, the ciphertext processing request is no longer performed by the first type of key agent processing module, but the second type of key agent is used.
  • the processing module executes the ciphertext processing request.
  • the first type of the key proxy processing module cannot continue to perform the ciphertext processing request stably, and the second type of the key proxy module is switched to stabilize the processing.
  • the text processing request solves the prior art and is in the business The problem of low key stability during encryption and decryption.

Landscapes

  • Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

L'invention concerne un procédé et un appareil de traitement de service, un support de stockage et un dispositif électronique. Le procédé consiste à : acquérir des premières informations, les premières informations étant utilisées pour représenter un résultat d'exécution obtenu par un module proxy de clé de premier type exécutant une requête de traitement de texte chiffré ; détecter si les premières informations répondent à un état de commutation de type prédéterminé, la condition de commutation de type prédéterminé représentant la détection d'un bogue au sein du module proxy de clé de premier type ; et lorsqu'il est détecté que les premières informations répondent à la condition de commutation de type prédéterminé, exécuter la requête de traitement de texte chiffré du module de service au moyen d'un module proxy de clé de second type. La présente invention résout le problème technique de la stabilité relativement faible d'une clé lorsque le cryptage et le décryptage sont effectués sur un service selon la technique antérieure.
PCT/CN2017/091903 2016-08-08 2017-07-05 Procédé et appareil de traitement de service, et support de stockage et dispositif électronique WO2018028359A1 (fr)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201610643327.XA CN106302422B (zh) 2016-08-08 2016-08-08 业务加密、解密方法和装置
CN201610643327.X 2016-08-08
CN201611018871.1 2016-11-18
CN201611018871.1A CN108076021B (zh) 2016-11-18 2016-11-18 业务处理方法和装置

Publications (1)

Publication Number Publication Date
WO2018028359A1 true WO2018028359A1 (fr) 2018-02-15

Family

ID=61162768

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/091903 WO2018028359A1 (fr) 2016-08-08 2017-07-05 Procédé et appareil de traitement de service, et support de stockage et dispositif électronique

Country Status (1)

Country Link
WO (1) WO2018028359A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111626865A (zh) * 2020-05-22 2020-09-04 泰康保险集团股份有限公司 数据处理方法、装置、电子设备及存储介质
CN112464212A (zh) * 2020-03-30 2021-03-09 上海汇招信息技术有限公司 基于成熟复杂业务系统的数据权限控制改造方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1671099A (zh) * 2004-03-16 2005-09-21 株式会社东芝 自动更新共享密钥的加密密钥共享方案
CN103024716A (zh) * 2012-11-27 2013-04-03 中兴通讯股份有限公司 一种WiFi流量统计方法、装置和系统
CN103516702A (zh) * 2012-06-29 2014-01-15 北京新媒传信科技有限公司 一种对称加密方法和系统以及一种中心服务器
CN104268488A (zh) * 2006-02-28 2015-01-07 塞尔蒂卡姆公司 用于产品注册的系统和方法
WO2016003491A1 (fr) * 2014-06-30 2016-01-07 Nicira, Inc. Architecture de cryptage

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1671099A (zh) * 2004-03-16 2005-09-21 株式会社东芝 自动更新共享密钥的加密密钥共享方案
CN104268488A (zh) * 2006-02-28 2015-01-07 塞尔蒂卡姆公司 用于产品注册的系统和方法
CN103516702A (zh) * 2012-06-29 2014-01-15 北京新媒传信科技有限公司 一种对称加密方法和系统以及一种中心服务器
CN103024716A (zh) * 2012-11-27 2013-04-03 中兴通讯股份有限公司 一种WiFi流量统计方法、装置和系统
WO2016003491A1 (fr) * 2014-06-30 2016-01-07 Nicira, Inc. Architecture de cryptage

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112464212A (zh) * 2020-03-30 2021-03-09 上海汇招信息技术有限公司 基于成熟复杂业务系统的数据权限控制改造方法
CN111626865A (zh) * 2020-05-22 2020-09-04 泰康保险集团股份有限公司 数据处理方法、装置、电子设备及存储介质
CN111626865B (zh) * 2020-05-22 2023-10-03 泰康保险集团股份有限公司 数据处理方法、装置、电子设备及存储介质

Similar Documents

Publication Publication Date Title
EP3937424B1 (fr) Méthodes et appareils de traitement des données de la blockchain basés sur le cloud computing
CN109347835B (zh) 信息传输方法、客户端、服务器以及计算机可读存储介质
US10462114B2 (en) System and associated software for providing advanced data protections in a defense-in-depth system by integrating multi-factor authentication with cryptographic offloading
CN110492990B (zh) 区块链场景下的私钥管理方法、装置及系统
EP3937045B1 (fr) Procédés et appareils de mise à jour de hash de station intégrée blockchain
Kim et al. Predictability of Android OpenSSL's pseudo random number generator
WO2016107203A1 (fr) Procédé et dispositif d'authentification d'identité
WO2019019887A1 (fr) Procédé, appareil, et système d'authentification de serveur pour un accès de terminal, et serveur et support de stockage lisible par ordinateur
US20220109667A1 (en) Cryptographic trust enabled devices of cybersecurity systems
US8745389B2 (en) Avoiding padding oracle attacks
US11755499B2 (en) Locally-stored remote block data integrity
Nguyen et al. LogSafe: Secure and scalable data logger for IoT devices
CN110781140B (zh) 区块链中数据签名的方法、装置、计算机设备及存储介质
JP2010514000A (ja) 電子装置にプログラム状態データをセキュアに記憶するための方法
US11570213B2 (en) Collaborative security for application layer encryption
CN113014444A (zh) 一种物联网设备生产测试系统及安全保护方法
US11606193B2 (en) Distributed session resumption
WO2023051337A1 (fr) Procédé et appareil de traitement de données, dispositif, et support de stockage
CN107959569B (zh) 一种基于对称密钥池的密钥补充方法和密钥补充装置、密钥补充系统
CN113347143A (zh) 一种身份验证方法、装置、设备及存储介质
WO2018028359A1 (fr) Procédé et appareil de traitement de service, et support de stockage et dispositif électronique
US11792003B2 (en) Distributed storage system and method of reusing symmetric keys for encrypted message transmissions
CN108154037B (zh) 进程间的数据传输方法和装置
CN115174188A (zh) 一种消息传输方法、装置、电子设备和存储介质
CN108076021B (zh) 业务处理方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17838489

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17838489

Country of ref document: EP

Kind code of ref document: A1