WO2021164167A1

WO2021164167A1 - Key access method, apparatus, system and device, and storage medium

Info

Publication number: WO2021164167A1
Application number: PCT/CN2020/098033
Authority: WO
Inventors: 邢希双
Original assignee: 苏州浪潮智能科技有限公司
Priority date: 2020-02-21
Filing date: 2020-06-24
Publication date: 2021-08-26
Also published as: CN111339578A

Abstract

A key access method, apparatus, system and device, and a storage medium. The method comprises: when service data is received, generating an application identifier and key data corresponding to the service data according to a preset key generation rule; performing format conversion on the key data according to a set algorithm; storing the application identifier and the key data subjected to format conversion into a kernel memory and a set physical hard disk, so as to realize persistent storage of the key data; and when a key obtaining request carrying a target application identifier and sent by a service application is obtained, obtaining corresponding target key data from the kernel memory. When an operating system is started, a kernel space is started before all the applications are started, and key data can be well protected from being damaged by storing the key data into a kernel memory. Additional hardware devices are not needed, so that the confidentiality and availability of the key data are ensured, and the costs of carrying out security protection on the key data are reduced.

Description

Key access method, device, system, equipment and storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on February 21, 2020, the application number is 202010108469.2, and the invention title is "a key access method, device, system, equipment, and storage medium". The entire content is incorporated into this application by reference.

Technical field

The present invention relates to the technical field of data security, in particular to a key access method, device, system, equipment and computer-readable storage medium.

Background technique

With the development of new technologies such as cloud computing and big data, the security requirements for cloud hosts and servers are getting higher and higher. The application programs on the cloud host and the server are the bearers that provide services to the outside world, which provide users with the required services by processing a variety of business data.

Business data contains a lot of sensitive information. Hackers can easily obtain benefits after obtaining this sensitive information. Therefore, business data has attracted the attention of external hackers, and preventing the leakage of sensitive information in business data has become a top priority. The most commonly used means to protect sensitive information in business data is encryption, including encrypted storage and encrypted transmission. The most important aspect of encryption is key management.

Imagine that when a hacker faces a piece of encrypted business data, it is equivalent to facing a locked door and cannot obtain any valuable information. If the hacker obtains the key, it is equivalent to the key to the locked door, and can easily open the door and obtain any information needed at will. Key management is so important that it determines that the key management system must be sufficiently secure and robust. Key management methods are usually designed as independent hardware, such as hardware security modules (HSM), hardware devices with USB interfaces (USB Key); independent systems, such as key management systems (Key Management Service, KMS), Key Management Center (KMC); or an independent chip, such as a security chip (Trusted Platform Module, TPM), to achieve sufficient security independent of the operating system where the application program is located.

However, in the actual production environment, some small systems themselves have very low investment. If independent hardware/systems/chips are introduced, system manufacturers will not be able to accept them. In addition, for the security upgrades of some existing business systems, operators or customers are not allowed to add additional hardware/systems/chips.

It can be seen that how to reduce the cost of security protection of key data is a problem that needs to be solved by those skilled in the art.

Summary of the invention

The purpose of the embodiments of the present invention is to provide a key access method, device, system, equipment and storage medium, which can reduce the cost of security protection of key data.

To solve the above technical problems, an embodiment of the present invention provides a key access method, including:

When the service data is received, according to a preset key generation rule, an application identifier and key data corresponding to the service data are generated;

Format conversion of the key data according to the set algorithm;

Saving the application identifier and the key data after format conversion to the kernel memory and the set physical hard disk;

When the key acquisition request carrying the target application identifier sent by the business application is acquired, the corresponding target key data is acquired from the kernel memory.

Optionally, the storing the application identifier and the key data after the format conversion in a set physical hard disk includes:

Performing segmentation processing on the key data after the format conversion to obtain at least one data packet;

Store each of the data packets in a corresponding file; wherein, all files are set on the physical hard disk, and the file attributes of all files are set to hidden.

Optionally, after saving the key data after the application identification and format conversion to the kernel memory and the set physical hard disk, the method further includes:

When the operating system restarts, each data packet is copied from the physical hard disk, and the spliced data packets are stored in the kernel memory.

Optionally, when acquiring the key acquisition request carrying the target application identifier sent by the business application, acquiring the corresponding target key data from the kernel memory includes:

When the key acquisition request carrying the target application identifier sent by the business application is obtained, determine whether there is target key data matching the target application identifier in the kernel memory;

If yes, copy the target key data to the user state memory provided by the business application program.

Optionally, after copying the target key data to the user mode memory provided by the business application program, the method further includes:

Format conversion of the target key data according to the set algorithm;

After the target key data after the format conversion is used to complete the encryption and decryption operation of the target service data, the user state memory is released.

Optionally, after obtaining the key obtaining request carrying the target application identifier sent by the business application, before the obtaining the corresponding target key data from the kernel memory, the method further includes:

Perform legality verification on the key acquisition request according to the set verification rule;

After the verification is passed, the step of obtaining the corresponding target key data from the kernel memory is executed.

Optionally, the format conversion of the key data according to a set algorithm includes:

The key data is XORed with the preset parameters, and the processing result is used as the key data after the format conversion.

Optionally, the key generation rule is stored in a code obfuscation manner.

The embodiment of the present invention also provides a key access device, which includes a generation unit, a conversion unit, a preservation unit, and an acquisition unit;

The generating unit is configured to generate application identification and key data corresponding to the service data according to a preset key generation rule when the service data is received;

The conversion unit is configured to perform format conversion on the key data according to a set algorithm;

The saving unit is configured to save the application identifier and the key data after format conversion to the kernel memory and the set physical hard disk;

The acquiring unit is configured to acquire the corresponding target key data from the kernel memory when the key acquisition request carrying the target application identifier sent by the business application program is acquired.

Optionally, the storage unit includes a segmentation subunit and a storage subunit;

The segmentation subunit is used to perform segmentation processing on the key data after the format conversion to obtain at least one data packet;

The storage subunit is used to store each of the data packets in a corresponding file; wherein, all files are set on the physical hard disk, and the file attributes of all files are set to hidden.

Optionally, it also includes a copy unit;

The copy unit is used for copying each data packet from the physical hard disk when the operating system restarts, and storing each spliced data packet in the kernel memory.

Optionally, the acquiring unit includes a judging subunit and a copying subunit;

The judging subunit is used for judging whether there is target key data matching the target application identifier in the kernel memory when the key acquisition request carrying the target application identifier sent by the business application program is acquired; if so, Then trigger the copy subunit;

The copy subunit is used to copy the target key data to the user state memory provided by the business application program.

Optionally, it further includes a release unit;

The conversion unit is further configured to perform format conversion on the target key data according to the set algorithm;

The releasing unit is configured to release the user state memory after the encryption and decryption operation of the target service data is completed by using the target key data after the format conversion.

Optionally, it also includes a verification unit;

The verification unit is configured to verify the validity of the key acquisition request according to the set verification rules; when the verification is passed, trigger the acquisition unit to execute the acquisition of the corresponding target secret from the kernel memory Key data steps.

Optionally, the conversion unit is specifically configured to perform XOR processing on the key data and preset parameters, and use the processing result as the key data after format conversion.

Optionally, the key generation rule is stored in a code obfuscation manner.

The embodiment of the present invention also provides a key access system, including a business application module and a filter driving module;

The service application module is configured to generate application identification and key data corresponding to the service data according to a preset key generation rule when the service data is received; Format conversion of the key data; use a preset secure communication verification mechanism to establish a communication connection with the filter drive module, and transmit the application identifier and the key data after format conversion to the filter drive module; When obtaining the key acquisition instruction, send a key acquisition request carrying the target application identifier to the filter driver module;

The filter driving module is used to save the application identifier and the key data after format conversion to the kernel memory and the set physical hard disk; when the key carrying the target application identifier sent by the business application is obtained, the key data is obtained Upon request, obtain the corresponding target key data from the kernel memory.

The embodiment of the present invention also provides a key access device, including:

Memory, used to store computer programs;

The processor is configured to execute the computer program to implement the steps of the key access method described in any one of the above.

The embodiment of the present invention also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the key access method as described in any one of the above is implemented A step of.

It can be seen from the above technical solution that when the service data is received, the application identification and key data corresponding to the service data are generated according to the preset key generation rules; the key data is formatted according to the set algorithm Conversion: The presentation of key data is changed through format conversion, thereby enhancing the security of key data. Save the key data after the application identification and format conversion to the kernel memory and the set physical hard disk; when the key acquisition request carrying the target application identification sent by the business application is obtained, the corresponding key data is obtained from the kernel memory The target key data. When the operating system is started, the kernel space is started before all application programs are started. By saving the key data to the kernel memory, the key data can be well protected from being damaged. And considering that the data in the kernel memory is lost when the system is powered off, the key data can be stored in the physical hard disk at the same time, realizing the persistent preservation of the key data. The storage of the key data of this technical solution only needs to rely on the kernel memory and physical hard disk inside the operating system, and no additional hardware equipment is needed. While ensuring the confidentiality and availability of the key data, the security of the key data is reduced. The cost of protection.

Description of the drawings

In order to explain the embodiments of the present invention more clearly, the following will briefly introduce the drawings needed in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. As far as personnel are concerned, they can also obtain other drawings based on these drawings without creative work.

Figure 1 is a flowchart of a key access method provided by an embodiment of the present invention;

2 is a flowchart of a method for storing key data according to an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a key access device provided by an embodiment of the present invention;

4 is a schematic structural diagram of a key access system provided by an embodiment of the present invention;

Fig. 5 is a schematic structural diagram of a key access device provided by an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

In order to enable those skilled in the art to better understand the solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

Next, a key access method provided by an embodiment of the present invention will be described in detail. Fig. 1 is a flowchart of a key access method provided by an embodiment of the present invention, and the method includes:

S101: When the service data is received, according to a preset key generation rule, an application identifier and key data corresponding to the service data are generated.

The key data refers to the key information on which the business data is encrypted and decrypted.

The key generation rule is used to indicate the specific way of generating the key. In practical applications, the key data can be generated by transforming and combining the MAC address of the hardware network card, the ID of the hardware CPU, the current system time, and the currently generated random number.

In the embodiment of the present invention, the operating system relies on preset key generation rules to generate key data. In order to improve the security of the key generation rules, the key generation rules can be saved in a code obfuscation manner.

The key data used in the encryption processing of different business data is different. In order to facilitate the distinction between different business data, in the embodiment of the present invention, corresponding application identifiers can be set for different business data. The application identifier and the key data have a corresponding relationship.

S102: Perform format conversion on the key data according to the set algorithm.

In order to ensure the security of the key data, after the key data is generated, the presentation format of the key data can be converted to convert the key data into a data format that cannot be used directly. By converting the format of the key data, even if the key data is obtained illegally, the key data cannot be directly used to decrypt the business data.

There can be many ways to perform format conversion on the key data, for example, bit operations can be performed on the key data. Take the XOR operation as an example, the key data can be XORed with the preset parameters, and the processing result can be used as the key data after the format conversion.

S103: Save the key data after the application identifier and format conversion to the kernel memory and the set physical hard disk.

The operating system strictly distinguishes the memory used by the kernel mode and the user mode, and the application program cannot see and use the kernel memory. Therefore, in the embodiment of the present invention, in order to ensure the security of the key data, the key data is stored in the kernel memory .

Considering that the data in the kernel memory will be lost after the system is powered off and restarted, in order to ensure the persistence of the key data, the operating system can save the key data to the preset while saving the key data to the kernel memory. Physical hard drive. The physical hard disk has the characteristic of not being lost after power failure, so it can ensure the persistent storage of key data.

S104: When the key acquisition request carrying the target application identifier sent by the business application is acquired, acquire the corresponding target key data from the kernel memory.

When the encrypted business data needs to be decrypted, the required key data can be obtained from the kernel memory.

When saving the key data, it is saved according to the correspondence between the application ID and the key data. The application ID corresponding to the business data is fixed. Therefore, when the key data needs to be obtained, the target application can be sent to the operating system. Identified key acquisition request.

When the operating system receives the key acquisition request, it can query whether there is an application identifier that is the same as the target application identifier in the kernel memory. The key data corresponding to the application identifier that is the same as the target application identifier is what the user needs Target key data.

In the embodiment of the present invention, considering that the storage time of the key data on the physical hard disk is longer, the longer the storage time, the higher the security risk. In order to further improve the security of the key data storage, the key data can be split into Multiple data segments are stored separately.

Fig. 2 is a flowchart of a method for storing key data according to an embodiment of the present invention, and the method includes:

S201: When the service data is received, according to a preset key generation rule, an application identifier and key data corresponding to the service data are generated.

For the specific implementation of S201, please refer to the record of S101, which will not be repeated here.

S202: Perform format conversion on the key data according to the set algorithm.

For the specific implementation of S202, please refer to the record of S102, which will not be repeated here.

S203: Perform segmentation processing on the key data after the format conversion to obtain at least one data packet.

In a specific implementation, multiple files can be set on the physical hard disk, and when the operating system obtains the format-converted key data, the format-converted key data can be segmented to obtain at least one data packet.

S204: Store each data packet in a corresponding file.

Among them, all files are set on the physical hard disk.

In the embodiment of the present invention, the number of files can be preset, and in which file each data packet is specifically stored can also be preset. For example, according to the combination order of the data packets, the first data packet can be stored in the first file, the second data packet can be stored in the last file, and the third data packet can be stored in the second file , Store the fourth data packet in the penultimate file, and so on to complete the storage of each data packet. When the number of data packets is greater than the number of files, polling can be performed again in the above manner, or all remaining data packets can be stored in the last remaining file. By disrupting the storage order of data packets, the security of key data storage can be further improved.

In order to improve the security of files, the file attributes of all files can be set to hidden, and the operating system can block all non-business applications from accessing these hidden files.

S205: When the key acquisition request carrying the target application identifier sent by the business application is acquired, acquire the corresponding target key data from the kernel memory.

For the specific implementation of S205, please refer to the record of S104, which will not be repeated here.

In the embodiment of the present invention, the key data after the format conversion is stored in segments, which effectively improves the security of the key data. When a certain piece of key data is maliciously obtained by an illegal user, due to the secret obtained by the illegal user The key data is not complete, so illegal users cannot directly use the key data to perform data decryption operations. Even if the illegal user obtains all the data packets corresponding to the key data, since the illegal user does not know the combination sequence of all the data packets, they cannot directly use the obtained data packets to perform data decryption operations.

Considering that the kernel memory has the problem of data loss when the system is powered off, after saving the key data after the application identification and format conversion to the kernel memory and the set physical hard disk, whenever the operating system restarts, it can be automatically downloaded from Each data packet is copied in the physical hard disk, and the spliced data packets are stored in the kernel memory, so as to ensure that the operating system can obtain the key data from the kernel memory.

In practical applications, when the operating system needs to obtain key data, a user-mode memory can be allocated to store the key data by calling a function. When the target key data that matches the target application identifier exists in the kernel memory, then Copy the target key data to the user-mode memory provided by the business application.

Since the target key data is the data after format conversion, when encrypting and decrypting the target business data, it is necessary to first convert the target key data format according to the set algorithm, and then use the target secret after format conversion. The key data completes the encryption and decryption operations on the target business data.

After the encryption and decryption operations on the target business data are completed, the user mode memory can be released.

By releasing the user state memory, the storage time of the target key data in the user state memory can be reduced, thereby improving the security of the target key data.

In the embodiment of the present invention, in order to prevent other non-business applications from accessing the kernel memory, after obtaining the key acquisition request carrying the target application identifier sent by the business application, the corresponding target is obtained from the kernel memory. Before the key data, the legality of the key acquisition request can be verified according to the set verification rules; after the verification is passed, the step of obtaining the corresponding target key data from the kernel memory is executed.

There are many ways to verify. For example, you can pre-set a specific string that a business application needs to carry when accessing the operating system to obtain key data. When the key acquisition request sent by the business application carries the specific string , It means that the key acquisition request is a legality request.

By verifying the legality of the key acquisition request, it is possible to effectively reduce the occurrence of illegal acquisition of key data by impersonating a business application when a non-business application illegally acquires the application identifier of the business application.

FIG. 3 is a schematic structural diagram of a key access device provided by an embodiment of the present invention, which includes a generation unit 31, a conversion unit 32, a storage unit 33, and an acquisition unit 34;

The generating unit 31 is configured to generate application identification and key data corresponding to the service data according to the preset key generation rule when the service data is received;

The conversion unit 32 is used for format conversion of the key data according to the set algorithm;

The saving unit 33 is used to save the key data after the application identification and format conversion to the kernel memory and the set physical hard disk;

The obtaining unit 34 is configured to obtain the corresponding target key data from the kernel memory when the key obtaining request carrying the target application identifier sent by the business application is obtained.

The storage sub-unit is used to store each data packet in a corresponding file; among them, all the files are set on the physical hard disk, and the file attributes of all the files are set to hidden.

Optionally, it also includes a copy unit;

The copy unit is used to copy data packets from the physical hard disk when the operating system restarts, and store the spliced data packets in the kernel memory.

The judging subunit is used for judging whether there is target key data matching the target application identifier in the kernel memory when the key acquisition request carrying the target application identifier sent by the business application program is obtained; if so, trigger the copy sub unit;

The copy subunit is used to copy the target key data to the user state memory provided by the business application.

Optionally, it further includes a release unit;

The conversion unit is also used for format conversion of the target key data according to the set algorithm;

The releasing unit is used to release the user state memory after the encryption and decryption operation of the target service data is completed by using the target key data after the format conversion.

Optionally, it also includes a verification unit;

The verification unit is used to verify the validity of the key acquisition request according to the set verification rules; when the verification is passed, the acquisition unit is triggered to execute the step of acquiring the corresponding target key data from the kernel memory.

Optionally, the key generation rule is stored in a code obfuscation manner.

For the description of the features in the embodiment corresponding to FIG. 3, reference may be made to the relevant description of the embodiment corresponding to FIG. 1 and FIG. 2, which will not be repeated here.

4 is a schematic structural diagram of a key access system 40 provided by an embodiment of the present invention, which includes a service application module 41 and a filter driver module 42;

The business application module 41 is used to generate the application identification and key data corresponding to the business data according to the preset key generation rules when the business data is received; to convert the key data format according to the set algorithm ; Use the preset secure communication verification mechanism to establish a communication connection with the filter driver module, and transmit the key data after the application identification and format conversion to the filter driver module; when the key acquisition instruction is obtained, the filter driver The module sends a key acquisition request carrying the target application identifier;

The filter driver module 42 is used to save the key data of the application identification and format conversion to the kernel memory and the set physical hard disk; when the key acquisition request carrying the target application identification sent by the business application is obtained, Obtain the corresponding target key data from the kernel memory.

When the business application module 41 is started, it generates key data according to the key generation rules, and connects to the filter driver module 42 through a preset secure communication verification mechanism. The business application module 41 delivers its own application identification and key data to the filter driver module 42. The business application module 41 does not store the key data itself, and applies to the filter driver module 42 to obtain the key data when the key is needed. The drive module 42 is integrated in the operating system kernel and runs together with the operating system, which is not perceivable by upper-layer applications, thereby effectively ensuring the security of the key data.

After the filter driver module 42 is started, it removes itself from the kernel module linked list, and any other application program except the service application module 41 cannot find the filter driver module 42 and cannot communicate with it.

The application identification and key data are stored in the kernel memory of the filter driver module 42, and the key data is stored in hidden files designated by the physical hard disk in blocks. The filter driver module 42 can intercept all access to the file storing the key data , To improve the security of key data storage.

In the embodiment of the present invention, when the service application module 41 obtains and uses the key data, anti-debugging technology can be adopted to prevent illegal users from obtaining the key data dynamically allocated to the user-mode memory before use through the debugging method.

FIG. 5 is a schematic structural diagram of a key access device 50 provided by an embodiment of the present invention, including:

The memory 51 is used to store computer programs;

The processor 52 is configured to execute a computer program to implement the steps of the key access method described in any one of the above embodiments.

The embodiment of the present invention also provides a computer-readable storage medium, and a computer program is stored on the computer-readable storage medium. step.

The key access method, device, system, equipment, and storage medium provided by the embodiments of the present invention have been described in detail above. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method part. It should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Professionals may further realize that the units and algorithm steps of the examples described in the embodiments disclosed in this article can be implemented by electronic hardware, computer software, or a combination of the two, in order to clearly illustrate the possibilities of hardware and software. Interchangeability, in the above description, the composition and steps of each example have been generally described in accordance with the function. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered as going beyond the scope of the present invention.

The steps of the method or algorithm described in the embodiments disclosed in this document can be directly implemented by hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or all areas in the technical field. Any other known storage media.

Claims

A key access method, characterized in that it comprises:

When the service data is received, according to a preset key generation rule, an application identifier and key data corresponding to the service data are generated;

Format conversion of the key data according to the set algorithm;

Saving the application identifier and the key data after format conversion to the kernel memory and the set physical hard disk;

When the key acquisition request carrying the target application identifier sent by the business application is acquired, the corresponding target key data is acquired from the kernel memory.
The method according to claim 1, wherein the storing the application identifier and the key data after format conversion to a set physical hard disk comprises:

Performing segmentation processing on the key data after the format conversion to obtain at least one data packet;

Store each of the data packets in a corresponding file; wherein, all files are set on the physical hard disk, and the file attributes of all files are set to hidden.
The method according to claim 2, characterized in that, after saving the key data after the application identification and format conversion to the kernel memory and the set physical hard disk, the method further comprises:

When the operating system restarts, each data packet is copied from the physical hard disk, and the spliced data packets are stored in the kernel memory.
The method according to claim 3, wherein when obtaining the key obtaining request carrying the target application identifier sent by the business application, obtaining the corresponding target key data from the kernel memory comprises:

When the key acquisition request carrying the target application identifier sent by the business application is obtained, determine whether there is target key data matching the target application identifier in the kernel memory;

If yes, copy the target key data to the user state memory provided by the business application program.
The method according to claim 4, characterized in that, after copying the target key data into the user mode memory provided by the business application program, the method further comprises:

Format conversion of the target key data according to the set algorithm;

After the target key data after the format conversion is used to complete the encryption and decryption operation of the target service data, the user state memory is released.
The method according to claim 1, wherein after obtaining the key obtaining request carrying the target application identifier sent by the business application, before obtaining the corresponding target key data from the kernel memory include:

Perform legality verification on the key acquisition request according to the set verification rule;

After the verification is passed, the step of obtaining the corresponding target key data from the kernel memory is executed.
The method according to claim 1, wherein the format conversion of the key data according to a set algorithm comprises:

The key data is XORed with the preset parameters, and the processing result is used as the key data after the format conversion.
The method according to any one of claims 1-7, wherein the key generation rule is stored in a manner of code obfuscation.
A key access device, characterized in that it comprises a generating unit, a converting unit, a storing unit and an acquiring unit;

The generating unit is configured to generate application identification and key data corresponding to the service data according to a preset key generation rule when the service data is received;

The conversion unit is configured to perform format conversion on the key data according to a set algorithm;

The saving unit is configured to save the application identifier and the key data after format conversion to the kernel memory and the set physical hard disk;

The acquiring unit is configured to acquire the corresponding target key data from the kernel memory when the key acquisition request carrying the target application identifier sent by the business application program is acquired.
The device according to claim 9, wherein the storage unit comprises a segmentation subunit and a storage subunit;

The segmentation subunit is used to perform segmentation processing on the key data after the format conversion to obtain at least one data packet;

The storage subunit is used to store each of the data packets in a corresponding file; wherein, all files are set on the physical hard disk, and the file attributes of all files are set to hidden.
The device according to claim 10, further comprising a copying unit;

The copy unit is configured to copy each data packet from the physical hard disk when the operating device restarts, and store the spliced data packet in the kernel memory.
The device according to claim 11, wherein the acquiring unit comprises a judging subunit and a copying subunit;

The judging subunit is used for judging whether there is target key data matching the target application identifier in the kernel memory when the key acquisition request carrying the target application identifier sent by the business application program is acquired; if so, Then trigger the copy subunit;

The copy subunit is used to copy the target key data to the user state memory provided by the business application program.
The device according to claim 12, further comprising a release unit;

The conversion unit is further configured to perform format conversion on the target key data according to the set algorithm;

The releasing unit is configured to release the user state memory after the encryption and decryption operation of the target service data is completed by using the target key data after the format conversion.
The device according to claim 9, further comprising a verification unit;

The verification unit is configured to verify the validity of the key acquisition request according to the set verification rules; when the verification is passed, trigger the acquisition unit to execute the acquisition of the corresponding target secret from the kernel memory Key data steps.
The device according to claim 9, wherein the conversion unit is specifically configured to perform exclusive OR processing on the key data and preset parameters, and use the processing result as the key data after format conversion.
The device according to any one of claims 9-15, wherein the key generation rule is stored in a code obfuscation manner.
A key access system, characterized in that it includes a business application module and a filter drive module;

The service application module is configured to generate application identification and key data corresponding to the service data according to a preset key generation rule when the service data is received; Format conversion of the key data; use a preset secure communication verification mechanism to establish a communication connection with the filter drive module, and transmit the application identifier and the key data after format conversion to the filter drive module; When obtaining the key acquisition instruction, send a key acquisition request carrying the target application identifier to the filter driver module;

The filter driving module is used to save the application identifier and the key data after format conversion to the kernel memory and the set physical hard disk; when the key carrying the target application identifier sent by the business application is obtained, the key data is obtained Upon request, obtain the corresponding target key data from the kernel memory.
A key access device, characterized in that it comprises:

Memory, used to store computer programs;

The processor is configured to execute the computer program to implement the steps of the key access method according to any one of claims 1 to 8.
A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the key access according to any one of claims 1 to 8 is realized Method steps.