CN118153025A - PCI-E interface password card design method and PCI-E interface password card - Google Patents

Abstract

The present invention provides a PCI-E interface password card design method and a PCI-E interface password card, wherein the PCI-E interface password card includes an encryption control chip, a security chip, a physical noise source chip, and an intelligent password key, wherein the encryption control chip is electrically connected to the security chip, the physical noise source chip, and the intelligent password key, respectively, and the method includes: obtaining a random number through the physical noise source chip; performing high-performance cryptographic operations, device management, key data management, key storage, and access control through the encryption control chip based on the random number obtained by the physical noise source chip; performing encrypted storage and authority management of key data through the security chip; and realizing operator and administrator identity authentication and key data backup through the intelligent password key. The present invention can further improve the security of the key, improve the communication rate, and meet the high-speed encryption requirements of devices such as cloud cryptographic machines.

Description

PCI-E interface password card design method and PCI-E interface password card

Technical Field

The present invention relates to the technical field of password cards, and in particular to a PCI-E interface password card design method and a PCI-E interface password card.

Background technique

The PCI-E interface cryptographic card has a standard PCI-E interface and has functions such as cryptographic operations, key management, random number generation and verification, access control, and file storage management. It has been applied to high-end hardware products such as SSL VPN gateways, SVS signature verification servers, timestamp servers, and server cryptographic machines.

However, the commonly used PCI-E cryptographic card interface has a low communication rate and insufficient cryptographic computing power, which cannot meet the high-speed encryption requirements of devices such as cloud cryptographic machines.

Summary of the invention

The present invention provides a PCI-E interface password card design method and a PCI-E interface password card, which are used to solve the defects in the prior art that the PCI-E interface communication rate is low, the password operation capability is insufficient, and the high-speed encryption requirements of devices such as cloud cryptographic machines cannot be met, the number of channels of the PCI-E interface password card is expanded, and the communication rate and the password operation capability are improved.

The present invention provides a method for designing a PCI-E interface password card, wherein the PCI-E interface password card comprises an encryption control chip, a security chip, a physical noise source chip, and an intelligent password key, wherein the encryption control chip is electrically connected to the security chip, the physical noise source chip, and the intelligent password key, respectively, and the method comprises:

Obtaining random numbers through the physical noise source chip;

Based on the random number obtained by the physical noise source chip, high-performance cryptographic operations, device management, key data management, key storage and access control are performed through the encryption control chip;

Encrypted storage and permission management of key data are performed through the security chip;

Operator and administrator identity authentication and key data backup are achieved through the smart password key.

According to the PCI-E interface password card design method provided by the present invention, the key data management includes:

The encryption control chip encrypts and manages key data through a three-level key structure, wherein the three-level key includes a first-level key, a second-level key, and a third-level key, wherein the first-level key is a protection key, and the second-level key includes a user key, a key encryption key, a backup key, a communication protection key encryption key, a communication protection key, a firmware protection key, a temporary key, a device key, and a device external authentication key, and the third-level key is a session key.

According to the PCI-E interface password card design method provided by the present invention, in the three-level key structure, the first-level key encrypts and protects the second-level key, and when the second-level key is stored inside the password card, it is encrypted and stored using the first-level key.

According to the PCI-E interface password card design method provided by the present invention, the role-based key access control includes: performing permission management inside the security chip, and synchronizing the permission status through the encrypted channel between the encryption control chip and the security chip to achieve collaborative access control between the encryption control chip and the security chip.

The present invention also provides a PCI-E interface password card obtained by the PCI-E interface password card design method, comprising:

Encryption control chip, used to achieve high-performance cryptographic operations based on random numbers obtained by physical noise source chips, and implement device management, key data management, key storage and access control functions;

Security chip, used for encrypting and storing key data processed by the encryption control chip and managing permissions;

Physical noise source chip, used to obtain random numbers;

Intelligent password key, used to realize operator and administrator identity authentication and back up the key data processed by the encryption control chip.

According to the PCI-E interface password card provided by the present invention, the physical noise source chip specifically includes: a first physical noise source chip and a second physical noise source chip, and the first physical noise source chip and the second physical noise source chip are electrically connected to the encryption control chip respectively.

The PCI-E interface password card provided according to the present invention also includes a power control chip, which is electrically connected to the encryption control chip and is used to convert the PCI-E interface voltage and supply power to other modules of the password card.

According to the PCI-E interface password card provided by the present invention, the physical noise source chip uses two RSP physical noise source chips T10 to realize two-way random sources that back up each other.

According to the PCI-E interface password card provided by the present invention, the PCI-E interface password card is connected to a PC via a PCI-EX16 interface.

The PCI-E interface password card provided according to the present invention further includes a key destruction module, which is electrically connected to the encryption control chip and the security chip respectively through a key destruction interface and is used for key destruction and key initialization operations.

According to the PCI-E interface password card provided by the present invention, the key destruction and key initialization operations include:

When the power is on, if a button is pressed, the encryption control chip starts the self-destruction program, destroys the temporary key inside the secondary key inside the password card, the user key, the password encryption key, the session key, the device external authentication key and the private key access control code hash value, and the device returns to the initial state.

According to the PCI-E interface password card provided by the present invention, a temperature sensor is electrically connected to the encryption control chip, and the temperature sensor is used to monitor the temperature of the encryption control chip;

The encryption control chip is electrically connected to the indicator light through an I/O interface, and the indicator light includes a first status indicator light, a second status indicator light and a smart password key access indicator light, wherein the first status indicator light is used to indicate whether the power supply is normal after the password card is powered on, the second status indicator light is used to indicate whether the power-on self-test of the password card has passed, and the smart password key access indicator light is used to indicate whether the smart password key is accessed to the password card.

According to the PCI-E interface password card provided by the present invention, the encryption control chip adopts the RSP-S20 chip, the security chip adopts the Z32HUA chip, and the smart password key adopts the Utap smart password key.

The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the PCI-E interface password card design method as described in any one of the above items are implemented.

The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the PCI-E interface password card design method as described in any one of the above items are implemented.

The PCI-E interface password card design method and the PCI-E interface password card provided by the present invention expand the number of channels of the PCI-E interface password card and improve the communication rate by setting an encryption control chip and a security chip in the PCI-E interface password card. At the same time, data is encrypted and stored through the security chip, which can further improve the security of the key, meet the high-speed encryption requirements of devices such as cloud cryptographic machines, and have stronger applicability and wider usage scenarios.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

1 is a block diagram of a PCI-E interface password card provided in an embodiment of the present invention;

FIG2 is the overall architecture of the PCI-E interface password card provided by the present invention;

3 is a flowchart of a power-on self-test of a password card provided by an embodiment of the present invention;

FIG4 is a PCB layout of a PCI-E interface password card provided by the present invention;

FIG. 5 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

The PCI-E interface cryptographic card has a standard PCI-E interface and has functions such as cryptographic operations, key management, random number generation and verification, access control, and file storage management. It has been applied to high-end hardware products such as SSL VPN gateways, SVS signature verification servers, timestamp servers, and server cryptographic machines.

Most of the password cards on the market use FPGA general-purpose chips as the management core and external password algorithm chips as the computing unit. There are many types of chips used, the technical implementation is complex, and the manufacturing cost is high. To address this problem, some high-end password cards use PCI-E X8/X4 interface as the interactive interface between the password card and the host computer.

However, the above-mentioned cryptographic cards have fewer PCI-E interface channels, lower interface communication rates, and insufficient cryptographic computing capabilities, and cannot meet the high-speed encryption requirements of devices such as cloud cryptographic machines.

To solve the above problems, the present invention proposes a PCI-E interface password card design method and a PCI-E interface password card. FIG1 is a structural block diagram of a PCI-E interface password card provided by an embodiment of the present invention. As shown in FIG1 , the PCI-E interface password card includes an encryption control chip, a security chip, a physical noise source chip, and an intelligent password key. The encryption control chip is electrically connected to the security chip, the physical noise source chip, and the intelligent password key, respectively. The method includes:

Obtaining random numbers through the physical noise source chip;

Based on the random number obtained by the physical noise source chip, high-performance cryptographic operations, device management, key data management, key storage and access control are performed through the encryption control chip;

Encrypted storage and permission management of key data are performed through the security chip;

Operator and administrator identity authentication and key data backup are achieved through the smart password key.

Optionally, the key data management includes:

The encryption control chip encrypts and manages key data through a three-level key structure, wherein the three-level key includes a first-level key, a second-level key, and a third-level key, wherein the first-level key is a protection key, and the second-level key includes a user key, a key encryption key, a backup key, a communication protection key encryption key, a communication protection key, a firmware protection key, a temporary key, a device key, and a device external authentication key, and the third-level key is a session key.

Optionally, in the three-level key structure, the first-level key encrypts and protects the second-level key, and when the second-level key is stored inside the password card, it is encrypted and stored using the first-level key.

Optionally, the role-based key access control includes: performing permission management inside the security chip, and synchronizing permission status through an encrypted channel between the encryption control chip and the security chip to achieve collaborative access control between the encryption control chip and the security chip.

Optionally, the encryption control chip adopts an RSP-S20 chip, the security chip adopts a Z32HUA chip, the smart password key adopts an Utap smart password key, and the physical noise source chip uses two RSP physical noise source chips T10 to realize two random sources that back up each other.

FIG. 2 is the overall architecture of the PCI-E interface password card provided by the present invention. As shown in FIG. 2 , in the embodiment of the present invention, the password card hardware includes the following five parts:

RSP-S20 chip: It is the core chip of PCI-E cryptographic card, which realizes PCI-E communication upward and connects various hardware functional modules downward. It mainly obtains random numbers through T10, realizes SM1, SM2, SM3, SM4 and RSA high-performance cryptographic operations, device management, key management, key storage and access control, etc.

Physical noise source chip: Use two RSP physical noise source chips T10 to realize two-way random sources that backup each other;

Security chip: Use Z32HUA security chip to implement key negotiation and other functions;

Smart password key: Use Utap smart password key of Beijing Zhongjin Guoxin Technology Co., Ltd. to realize the identity and key backup of operators and administrators (password supervisors);

Power management: Convert the PCI-E interface voltage to provide power for each hardware module.

Specifically, the PCI-E interface password card provided in the embodiment of the present invention is connected to the PC through the PCI-E X16 interface, is implemented by the PCI-E interface module of the RSP-S20 chip, and complies with the PCI Express Base Specification v2.0.

Optionally, in an embodiment of the present invention, the PCI-E password card provides the user with two operating status indicator lights and one smart password key access indicator light, and the two operating status indicator lights are a power indicator light and a power-on self-test indicator light.

Specifically, after the PCI-E password card is powered on, if the power supply is normal, the power indicator light (red light) will be on; if the power-on self-test is completed and passed, the power-on self-test indicator light (green light) will be on; when the smart password key is connected to the PCI-E password card, the smart password key access indicator light will be green, otherwise, if the smart password key is not connected, the access indicator light will be yellow.

Optionally, the PCI-E cryptographic card provided in the embodiment of the present invention realizes the emergency destruction function by means of a button.

Specifically, when powered on, if a button is detected, the RSP-S20 chip starts the self-destruction program, destroying the temporary key, user key, key encryption key, session key, device external authentication key and private key access control code hash value inside the password card, and the device returns to its initial state.

In this embodiment, the smart password key interface complies with the USB Mass storage protocol.

It is understandable that the main function of the PCI-E cryptographic card is the high-performance operation of the cryptographic algorithm, which is completed by the encryption control chip high-speed algorithm engine module and the key cache and algorithm operation module.

For example, Table 1 shows the types and uses of the PCI-E cryptographic card keys provided by the present invention.

Table 1

As shown in Table 1, in a specific embodiment, the basic operation functions of the national secret algorithm provided by the RSP-S20 chip include: SM2 algorithm signature, signature verification, kP, kG, encryption, decryption, SM3 algorithm operation, SM4 algorithm (ECB, CBC, OFB, CFB and CTR mode). When in use, the key data is mainly obtained through the key cache and algorithm operation module, and the corresponding cryptographic operation function is set using the high-speed algorithm engine to complete the calculation. The SM2, SM3, and SM4 algorithm application functions provided to the upper layer include key management and access control.

Specifically, the PCI-E password card supports a three-level key structure, the first level is the protection key; the second level is the user key, key encryption key, backup key, communication protection key encryption key, communication protection key, firmware protection key, temporary key, device key and device external authentication key; the third level is the session key. In the three-level key structure, the protection key encrypts and protects the second-level key. That is, when the key is stored inside the password card, it is encrypted with the protection key before being stored.

In this embodiment, for access control, the PCI-E cryptographic card uses a role-based access control policy.

Specifically, the operator logs in using the smart password key, performs permission management inside the password card security chip, and synchronizes permission status through the encrypted channel between the password card RSP-S20 chip and the security chip to achieve collaborative access control between the password card RSP-S20 and the security chip.

In detail, in the development and manufacturing stage of the password card, it is mainly hardware design, software development and program download. In the initial application stage of the password card, the first step is to generate a protection key, which is controlled by the RSP-S20 chip and sets the life cycle, and prohibits operations outside this life cycle; the second step is to install the device information, which is also controlled by the RSP-S20 chip and sets the life cycle, and prohibits operations outside this life cycle; the third step is to set the initial PIN code for the smart password key; the fourth step is to generate or install a backup key, which also needs to be controlled by the RSP-S20 chip and set the life cycle, and prohibit operations outside this life cycle. In the use stage of the password card, all operations except the first three steps are completed in this stage, which also needs to be controlled by the RSP-S20 chip and set the life cycle, and prohibit operations outside this life cycle. In the abolition stage of the password card, all users in the password card are logged out, and the registered administrator (password supervisor) and operator smart password keys are all locked to achieve safe destruction, and the password card will be unusable afterwards.

In terms of permission management, the PCI-E password card includes:

No permission. After the PCI-E password card hardware power-on self-test succeeds, it enters the no permission state.

User (operator) authority, after successfully logging into the PCI-E password card using the operator smart password key, enter the operator authority state.

Administrator (password supervisor) authority: After successfully logging into the PCI-E password card using the administrator (password supervisor) smart password key, you will enter the administrator (password supervisor) authority state.

Super administrator privileges: After successfully logging in more than half of the administrators' (password supervisors') smart password keys, you will enter the super administrator privilege state. You can register up to 3 administrators (password supervisors). If the number of registered administrators' (password supervisors') smart password keys is less than 3, key backup and recovery cannot be performed.

Based on the above permission management status, a permission status conversion mechanism is set.

Specifically, according to the power-on status of the PCI-E password card and the login status of the operator and administrator (password supervisor) smart password keys, the RSP-S20 chip implements the conversion of the global permission status, and transmits the unauthorized status, operator permission status and private key access control code verification status to the key cache module of the security chip in a secure manner.

Optionally, the PCI-E interface password card provided in the embodiment of the present invention further includes a self-test module, and the self-test module specifically includes:

Equipment self-test module: The PCI-E cryptographic card equipment self-test module mainly completes the power-on self-test and use self-test functions, and cooperates with the PC-side software to complete the equipment factory inspection and periodic inspection. The main detection functions of the equipment self-test module include: hardware module interface detection, hardware abnormality self-test, physical noise source chip detection, random number detection, cryptographic algorithm correctness detection, firmware and data integrity detection.

Self-check of algorithm operation function: The self-check module will perform self-check on the algorithm operation function when the device leaves the factory, is powered on, generates a key pair, and the PC calls the self-check API interface. When the device leaves the factory, is powered on, and the PC calls the self-check API interface, the algorithm operation function is fully checked, and the correctness of the key pair is tested when the key pair is generated.

Specifically, the password card RSP-S20 chip implements SM2 key pair consistency self-test, SM2 algorithm signature verification self-test, SM2 algorithm encryption and decryption self-test, SM3 algorithm self-test, SM4 ECB mode algorithm self-test, SM4 CBC mode algorithm self-test, SM4 MAC mode algorithm self-test, SM4 OFB mode algorithm self-test, SM4 CFB mode algorithm self-test, and SM4 CTR mode algorithm self-test by giving preset data; the password card Z32HUA security chip implements SM1 ECB mode algorithm self-test, SM1 CBC mode algorithm self-test, SM1 OFB mode algorithm self-test, SM1 CFB mode algorithm self-test, SM1 MAC mode algorithm self-test, RSA2048 key pair consistency self-test, RSA2048 signature verification algorithm self-test, and RSA2048 encryption and decryption algorithm self-test.

Furthermore, during the algorithm operation function self-test, only if SM1, SM2, SM3, SM4 and RSA2048 all pass the self-test, the password card is considered to have passed the algorithm operation self-test. If any algorithm is inconsistent with the expected result during the self-test, it is considered that the algorithm operation function self-test has failed, and the password card algorithm operation function self-test has failed. When the algorithm operation function self-test fails, the password card can only provide the functions of querying hardware fault codes and obtaining device information.

Firmware integrity self-check: The PCI-E password card firmware is divided into the embedded COS firmware inside the RSP-S20 chip and the Z32HUA security chip. Before leaving the factory, they are burned into the FLASH inside the RSP-S20 chip and the Z32HUA security chip respectively. During use, the internal firmware of the PCI-E password card cannot be erased or modified, and the embedded firmware only runs inside the RSP-S20 chip and the security chip.

Specifically, firmware integrity is achieved by using a firmware protection key, which is generated by a production smart password key (SJK1977 smart password key).

Before the PCI-E password card leaves the factory, after the password card RSP-S20 chip and Z32HUA security chip download the COS firmware, the production tool software first obtains the hash value of the COS firmware, and then calls the "SM2 Signature" application interface of the production-specific smart password key to sign the firmware hash value using the production key. Finally, the signature result and the production key public key are imported into the RSP-S20 chip and Z32HUA security chip respectively and saved in the internal storage area.

Each time the device is powered on, it determines whether a firmware integrity self-check is required based on the life cycle status. If the life cycle is a state after the manufacturing stage, the device will perform a firmware integrity self-check.

After the factory device is powered on, the embedded COS firmware in the RSP-S20 chip and the Z32HUA security chip will read the code area and calculate the hash value, then read the signature result and production key public key of the production device, and finally verify the signature. If the signature verification passes, the integrity check of the firmware passes, otherwise the integrity check of the firmware fails and the device enters an error state.

The PCI-E cryptographic card RSP-S20 chip and Z32HUA security chip firmware do not provide an interface for exporting or modifying production key data and internal firmware. The device mainly combines the security protection functions of the RSP-S20 chip and Z32HUA security chip and the security control measures of the embedded COS firmware to ensure the integrity and confidentiality of the firmware and sensitive security parameters stored internally, making it difficult to be illegally stolen and tampered with.

Static storage data integrity self-check: Z32HUA chip data integrity self-check is performed when the device is powered on. The key data and sensitive data stored in the PCI-E password card are saved with the SM3 result of the data. SM3 is recalculated after decrypting the key data and sensitive data, and then the calculated result is compared with the stored original value to determine the integrity of the data.

Hardware module interface self-test: The self-test module confirms that each hardware module interface can communicate normally through test instructions. The test instructions mainly include the test instructions between RSP-S20 and the security chip, the test instructions between RSP-S20 and the smart password key adapter, etc.

When the password card leaves the factory, is powered on, and the PC calls the self-check API interface, the algorithm operation function is checked, and when the key pair is generated, the correctness of the key pair is checked to achieve self-check of the algorithm operation function;

Verify the embedded COS firmware in the encryption control chip and security chip to achieve firmware integrity self-check;

The integrity of the statically stored data can be self-checked by performing decryption calculations on the key data and sensitive data stored in the password card and comparing them with the original stored values to determine the integrity of the data.

FIG3 is a flowchart of the power-on self-test of the password card provided by an embodiment of the present invention. As shown in FIG3 , the power-on self-test mainly includes: hardware interface self-test, physical noise source chip self-test, random number self-test, algorithm self-test, security chip firmware integrity self-test, RSP-S20 firmware and key integrity self-test. After all the power-on self-tests are passed, the RSP-S20 chip controls the lighting of the password card working status light. If a certain self-test fails, the working status light is off, and the fault status bit is set. Only some functions of querying hardware fault codes and obtaining device information are executed, and other functions such as cryptographic operations are prohibited. The detailed process of the password card power-on self-test is as follows:

Step 301: Hardware interface self-check:

In this step, the hardware interface self-test mainly detects the SPI communication interface between the password card RSP-S20 and the security chip, the RSP-S20 PCI-E communication interface, and the SPI communication interface between the RSP-S20 and the smart password key controller;

Step 302: Physical noise source chip self-test:

In this step, the password card RSP-S20 obtains random numbers through a single physical noise source chip, and performs randomness detection on the random numbers, and determines whether the physical noise source chip is in normal working condition based on the detection results. In serial mode, two physical noise source chips are self-tested separately. If any physical noise source chip fails the self-test, the power-on self-test of the physical noise source chip fails;

Step 303, random number self-check:

In this step, the password card RSP-S20 performs XOR calculation on the random numbers generated by the two physical noise source chips, and performs a random number self-test on the XOR calculation results;

Step 304: Algorithm self-check:

In this step, the algorithm self-test is completed by Z32HUA, and the algorithm operation function is self-tested according to the algorithm self-test process in this article. If any algorithm fails the self-test, the algorithm power-on self-test fails;

Step 305: Security chip firmware integrity self-check:

In this step, the security chip of the cryptographic card implements a firmware integrity self-check;

Step 306, RSP-S20 firmware and key integrity self-check:

In this step, the RSP-S20 chip of the password card implements firmware integrity self-check and key integrity self-check;

Step 307: The password card RSP-S20 establishes an encrypted channel for data transmission with the security chip.

Optionally, the PCI-E interface cryptographic card provided by the embodiment of the present invention further includes a key management module.

Specifically, the Z32HUA chip defines a key storage structure internally to securely store keys. The Z32HUA chip uses a protection key to encrypt and store key data. The key data format is the same as the SM2 key pair and symmetric key data structure defined in the relevant standards of the National Cryptography Administration.

In a specific embodiment, data transmission between the PCI-E cryptographic card RSP-S20 chip and the security chip is implemented using the internal SPI interface of the cryptographic card. The RSP-S20 and the security chip encrypt the key through a communication protection key, and the communication protection key between the RSP-S20 and the security chip is shared in a digital envelope to ensure the security of data transmission between the RSP-S20 and the security chip.

Specifically, before the password card leaves the factory, it is necessary to use the device initialization tool to generate a communication protection key encryption key and encrypt and store it in the RSP-S20 chip. When the password card is used, the security chip generates a set of random numbers as the communication protection key between the security chip and the RSP-S20. The security chip reads the public key of the communication protection key encryption key from the RSP-S20 and uses a digital envelope mechanism to share the communication protection key. Except for the hardware interface detection instructions, all data transmitted between the RSP-S20 and the security chip are encrypted using the communication protection key.

In this embodiment, the authority management and access control functions are mainly completed by the authority management control module of RSP-S20 and some authority control modules of the security chip. RSP-S20 synchronizes the current authority status to the security chip through the RSP-S20 and security chip encryption channel inside the password card.

Specifically, the user authority management control module of RSP-S20 mainly combines life cycle management, uses smart password keys for registration and login, and divides and controls the functions of each authority to realize the authority management control function. The partial authority control module of the security chip realizes the key usage authority control function according to the authority status synchronized to the security chip by the security chip and the RSP-S20 data security transmission channel of the security chip.

Figure 4 is the PCB layout of the PCI-E interface password card provided by the present invention. As shown in Figure 4, the present invention designs a PCI-E interface password card based on the RSP_S20 chip. The number of PCI-E interface channels of the password card is X16, and the maximum transmission rate of each channel is 4Gb/s, which solves the problem of few channels and low communication rate of existing PCI-E interface password cards, meets the high-speed encryption requirements of devices such as cloud cryptographic machines, and has stronger applicability and wider usage scenarios.

FIG5 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. As shown in FIG5, the electronic device 500 may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the PCI-E interface password card design method, which includes: obtaining a random number through the physical noise source chip; based on the random number obtained by the physical noise source chip, performing high-performance cryptographic operations, device management, key data management, key storage and access control through the encryption control chip; encrypting and storing key data and managing permissions through the security chip; and realizing operator and administrator identity authentication and key data backup through the smart password key.

In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute a PCI-E interface password card design method, which includes: obtaining a random number through the physical noise source chip; based on the random number obtained by the physical noise source chip, performing high-performance cryptographic operations, device management, key data management, key storage and access control through the encryption control chip; encrypting and storing key data and managing permissions through the security chip; and realizing operator and administrator identity authentication and key data backup through the smart password key.

On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute a PCI-E interface password card design method, the method comprising: obtaining a random number through the physical noise source chip; based on the random number obtained by the physical noise source chip, performing high-performance cryptographic operations, device management, key data management, key storage and access control through the encryption control chip; encrypting and storing key data and performing permission management through the security chip; and realizing operator and administrator identity authentication and key data backup through the smart password key.

The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM/RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiment.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (13)

1. The PCI-E interface cipher card design method is characterized in that the PCI-E interface cipher card comprises an encryption control chip, a security chip, a physical noise source chip and an intelligent cipher key, wherein the encryption control chip is respectively and electrically connected with the security chip, the physical noise source chip and the intelligent cipher key, and the method comprises the following steps:

Acquiring a random number through the physical noise source chip;

based on the random number acquired by the physical noise source chip, performing high-performance password operation, equipment management, key data management, key storage and access control through the encryption control chip;

encrypting, storing and managing authority of the key data through the security chip;

And the intelligent cipher key is used for realizing the authentication and key data backup of operators and administrators.

2. The PCI-E interface cryptographic card design method according to claim 1, wherein the key data management includes:

The encryption control chip performs encryption management on key data through a three-level key structure, the three-level key comprises a first-level key, a second-level key and a third-level key, the first-level key is a protection key, the second-level key comprises one or more of a user key, a key encryption key, a backup key, a communication protection key encryption key, a communication protection key, a firmware protection key, a temporary key, a device key and an external authentication key of the device, and the third-level key is a session key.

3. The method for designing a PCI-E interface cryptographic card according to claim 2, wherein in the three-level key structure, the primary key performs encryption protection on the secondary key, and when the secondary key is stored in the cryptographic card, the primary key is used for performing encryption and then stored.

4. The PCI-E interface cryptographic card design method according to claim 1, wherein the role-based key access control includes: and performing authority management in the security chip, and synchronizing the authority state through an encryption channel between the encryption control chip and the security chip to realize cooperative access control of the encryption control chip and the security chip.

5. The PCI-E interface password card obtained by the PCI-E interface password card design method is characterized by comprising the following steps:

the encryption control chip is used for realizing high-performance password operation based on the random number acquired by the physical noise source chip and realizing the functions of equipment management, key data management, key storage and access control;

The security chip is used for carrying out encryption storage and authority management on the key data processed by the encryption control chip;

A physical noise source chip for acquiring random numbers;

the intelligent cipher key is used for realizing the authentication of operators and administrators and backing up the key data processed by the encryption control chip.

6. The PCI-E interface cryptographic card of claim 5, wherein said physical noise source chip specifically comprises: the first physical noise source chip and the second physical noise source chip are respectively and electrically connected with the encryption control chip.

7. The PCI-E interface card of claim 5, further comprising a power control chip electrically connected to the encryption control chip for converting a PCI-E interface voltage and powering other modules of the card.

8. The PCI-E interface cryptographic card of claim 7, wherein said physical noise source chip uses 2 RSP physical noise source chips T10 to implement 2 random sources that are backup to each other.

9. The PCI-E interface card as in claim 5, wherein said PCI-E interface card interfaces with a PC through a PCI-E X interface.

10. The PCI-E interface cryptographic card of claim 5, further comprising a key destruction module electrically connected to the encryption control chip and the security chip, respectively, through a key destruction interface for key destruction and key initialization operations.

11. The PCI-E interface cryptographic card of claim 10, wherein the key destruction and key initialization operations comprise:

Under the condition of power-on, the key is detected to be pressed, the encryption control chip starts a self-destruction program, destroys a temporary key, a user key, a password encryption key, a session key, an equipment external authentication key and a private key access control code hash value in a secondary key in the password card, and returns the equipment to an initial state.

12. The PCI-E interface password card according to claim 5, wherein the encryption control chip is electrically connected with a temperature sensor, and the temperature sensor is used for monitoring the temperature of the encryption control chip;

The encryption control chip is electrically connected with the indicator lamp through the I/O interface, the indicator lamp comprises a first state indicator lamp, a second state indicator lamp and an intelligent password key access indicator lamp, wherein the first state indicator lamp is used for representing whether power supply is normal after the password card is electrified, the second state indicator lamp is used for representing whether the password card is electrified and self-checked to pass through, and the intelligent password key access indicator lamp is used for representing whether the intelligent password key is accessed to the password card.

13. The PCI-E interface cryptographic card according to claim 5, wherein said encryption control chip is an RSP-S20 chip, said security chip is a Z32HUA chip, and said smart key is a Utap smart key.