CN108257319B - USBKEY safe storage cabinet with encryption and decryption functions and application method thereof - Google Patents

Abstract

The application discloses a USBKEY safe storage cabinet device with encryption and decryption functions and an application method thereof, wherein the device comprises a USB-KEY safe storage cabinet and a control server; the USBKEY safe storage cabinet comprises a main control unit, a drawer unit, a safety unit, an information authentication unit, an electronic seal unit, a USBKEY taking and returning unit, a data storage unit and a power supply unit; the USBKEY safe storage cabinet is used for safely storing the USBKEY, performs authentication communication with the control server and completes the taking out and returning of the USBKEY according to the received encryption control instruction; the control server comprises a parameter input unit, a data communication unit, a parameter setting unit and a control logic unit; the control server is used for carrying out authentication communication with the USBKEY safe storage cabinet and sending a control instruction to the USBKEY safe storage cabinet; the drawer unit comprises N drawer subunits, wherein each drawer subunit comprises a CPU module, a drawer mechanical structure and a drawer safety module.

Description

A USBKEY secure storage cabinet with encryption and decryption functions and its application method

Technical field

The present invention relates to the field of information security technology, and more specifically, to a USBKEY secure storage cabinet device with encryption and decryption functions and an application method thereof.

Background technique

As a commonly used key, USBKEY is widely used in various fields that require auditing. Taking the core business of the power marketing system - the cost control business as an example, it is directly related to the vital interests of power companies and power users, and its security is of utmost importance. It's important. During the implementation of fee control, the marketing system receives the arrears list generated by the marketing remote real-time fee control system. The corresponding county and city business departments are responsible for reviewing the arrears control list information, encrypting and signing the audit data, and generating the final trip control list. and trip control electronic work orders. The trip control list and trip control electronic work order are sent to the power consumption information collection system for processing through the unified interface service platform. The audit data of the trip control list needs to be encrypted and signed by the salesperson through USBKEY; the USBKEY currently used by marketing auditors lacks effective management methods and devices, and the USBKEY used by marketing auditors is more than one, and there are easily confused Problem, the security and traceability of fee control operations cannot be guaranteed. In order to solve the above problems, USBKEY must be managed safely and effectively.

Contents of the invention

In order to solve the problem that the USBKEY existing in the background technology lacks effective management methods and devices and cannot guarantee the safety and traceability of fee control operations, the present invention provides a USBKEY secure storage cabinet device with encryption and decryption functions and its application method; The device and method described above provide orderly storage and management of USBKEY by setting up a secure storage cabinet with encryption and decryption functions, and at the same time improve the security of USBKEY by establishing a two-way authentication mechanism and using ciphertext for data communication. The device and method have encryption and decryption functions. USBKEY secure storage cabinet devices with decryption capabilities include:

USBKEY secure storage cabinet and control server;

The USBKEY secure storage cabinet includes a main control unit, a drawer unit, a security unit and an information authentication unit; the USBKEY secure storage cabinet is used to securely store USBKEY, and the USBKEY secure storage cabinet communicates with the control server for authentication and encryption based on the received The control command completes the removal and return of USBKEY;

The main control unit is used to receive the two-way authentication request sent by the control server, and send the two-way authentication request to the information authentication unit; the main control unit is used to receive the encrypted control instruction sent by the control server, and according to the The control instructions generate corresponding operation instructions for data transmission with other units of the USBKEY safety storage cabinet;

The drawer unit includes N drawer sub-units. Each of the N drawer sub-units includes a CPU module, a drawer mechanical structure and a drawer safety module. The CPU module is used to receive encrypted drawer operations sent by the main control unit. After the instruction is decrypted and confirmed by the drawer safety module, the corresponding drawer execution instruction is processed and sent to the drawer mechanical structure; the CPU module is used to establish two-way authentication with the main control module through the drawer safety module; the CPU The module includes a USB interface, and the USBKEY is plugged and fixed with the USB interface in the drawer subunit and performs data communication;

The security unit includes a cryptographic chip with built-in multiple national secret algorithms; the security unit is used to decrypt the encrypted control instructions received by the main control unit, and encrypt each operation instruction generated by the main control unit;

The information authentication unit is used to receive a two-way authentication request transmitted by the main control unit, perform security authentication according to the two-way authentication request, and send the authentication result to the main control unit; the information authentication unit is used to perform security authentication according to the main control unit. The instruction generates a two-way authentication request between the main control unit and the drawer unit and between the main control unit and the control server;

The control server includes a parameter entry unit and a data communication unit; the control server is used to perform authentication communication with the USBKEY secure storage cabinet and send control instructions to the USBKEY secure storage cabinet;

The parameter entry unit is used to enter the operator's basic information and parameters including USBKEY aging; the parameter entry unit generates control instructions based on the information entered by the operator; the operator's basic information includes the operator number and operator password;

The data communication unit is used to establish two-way authentication with the USBKEY secure storage cabinet; the data communication unit encrypts the control instructions generated by the parameter entry unit and transmits them to the USBKEY secure storage cabinet.

Further, the USBKEY safety storage cabinet also includes an electronic seal unit, a USBKEY retrieval unit, a data storage unit and a power supply unit;

The electronic seal unit includes a cryptographic chip based on the national secret algorithm. The electronic seal unit is used to store device information of the USBKEY secure storage cabinet. The device information includes the unique number of the device and the purpose of the device;

The power supply unit is used to power the USBKEY safety storage cabinet. The power supply unit includes a main power supply AC-DC module and a backup AC-DC module. The two AC-DC modules are isolated from each other;

The data storage unit is used to store the operator's basic information and store the USBKEY information stored in each drawer unit; the USBKEY information includes USBKEY number and USBKEY status information;

The USBKEY retrieval and return unit is used to determine whether the feedback status of each sub-unit of the drawer unit is correct according to the operating instructions of the main control unit. The USBKEY retrieval and return unit is used to confirm whether the timeliness of returning the USBKEY is abnormal and to provide feedback on the abnormal status. to the main control unit.

Further, the control server also includes a parameter setting unit and a control logic unit;

The parameter setting unit is used to set the operator's basic information and the USBKEY safety storage cabinet device information; the parameter setting unit is used to update the USBKEY information;

The control logic unit is used to set preset rules for controlling the drawer unit according to the usage status of the drawer unit, USBKEY verification status and control instructions.

Further, the drawer mechanical structure of each drawer subunit includes a drawer shell, an electronic lock, a position sensor, a gear rack, a spring, a movable sleeve and a guide rail; the position sensor is used to sense whether the drawer shell is closed in place, When the position sensor senses that the drawer shell has been closed in place, the electronic lock automatically locks; the electronic lock is used to unlock according to the instructions of the CPU module. When unlocking, the drawer shell is pre-tightened by the spring. It pops up and achieves damping effect through the deceleration component composed of gear rack, movable sleeve and guide rail.

Further, brackets are provided on both sides of the drawer housing of each drawer sub-unit to support the drawer; the electronic lock is fixed on the inside of the bottom of the drawer housing; the spring, gear bar, and movable sleeve The tubes and rails are fixed to the bottom of the drawer housing.

Further, the device further includes a plurality of auxiliary control servers, and the auxiliary control servers include an auxiliary parameter entry unit. The auxiliary parameter entry unit is used to enter basic operator information and parameters including USBKEY aging; the parameter entry unit Generate control instructions according to operator instructions; the affiliated control server communicates with the control server and sends the operator's basic information, parameters and control instructions to the control server.

Further, the information authentication unit is used to verify the signature information of USBKEY; if the signature verification fails, the signature verification failure information is sent to the main control unit.

Furthermore, the data transmission between the USBKEY secure storage cabinet and the control server, between the control server and other peripheral systems, and inside the USBKEY secure storage cabinet uses ciphertext plus MAC for data transmission.

Further, the main control unit includes a main control CPU, and the CPU module of each drawer sub-unit includes a drawer CPU; the main control CPU and each drawer CPU are high-performance series 32-bit CORTEX-M3 core processors.

The method for secure storage of USBKEY includes:

After receiving the input command, the control server establishes two-way authentication with the USBKEY secure storage cabinet;

After successful authentication, the control server sends encrypted control instructions to the USBKEY secure storage cabinet. The control instructions include the operator's basic information and USBKEY aging parameters;

The security unit of the USBKEY secure storage cabinet decrypts and verifies the encrypted control instructions, and sends the verified control instructions to the main control unit of the USBKEY secure storage cabinet;

The main control unit generates an operation instruction according to the control instruction and sends the operation instruction to the drawer unit;

The drawer unit retrieves and returns the USBKEY according to the operation instructions.

Further, before the main control unit sends the operation instruction to the drawer unit, the method also includes:

The main control unit establishes bidirectional authentication with the drawer security module of the drawer unit through the information authentication unit, and performs data transmission after the authentication is passed.

Further, the main control unit regularly queries the current feedback status of each drawer sub-unit of the drawer unit and uploads an operation log to the control server; the feedback status includes whether the drawer sub-unit is storing USBKEY.

Further, the method also includes:

The affiliated control server generates an authentication instruction after receiving the input instruction, and sends the authentication instruction to the control server;

The control server establishes two-way authentication with the USBKEY secure storage cabinet based on the received authentication instructions;

After the authentication is passed, the affiliated control server sends the control instruction generated according to the input instruction to the control server, and the control server encrypts the control instruction.

Further, when the operation instruction is to return the USBKEY, the drawer unit opens the corresponding drawer sub-unit according to the operation instruction, and the operator inserts the USBKEY into the USB interface of the drawer sub-unit;

The information authentication unit verifies the signature information of the USBKEY;

The USBKEY retrieval unit verifies whether the aging of the USBKEY is abnormal;

If all verifications pass, the operator closes the corresponding drawer sub-unit, and the drawer sub-unit is automatically locked;

If the verification fails, the USBKEY safe storage cabinet will issue an abnormality reminder.

Furthermore, the data transmission between the USBKEY secure storage cabinet and the control server, between the control server and other peripheral systems, and inside the USBKEY secure storage cabinet uses ciphertext plus MAC; the national secret algorithm is used. Encrypt and decrypt the data transmission.

The beneficial effects of the present invention are: the technical solution of the present invention provides a USBKEY safe storage cabinet device with encryption and decryption functions and its application method. The device and method are provided with a safe storage cabinet with encryption and decryption functions and corresponding The control server effectively stores and manages USBKEY, and at the same time improves the security of USBKEY by establishing a two-way authentication mechanism and using ciphertext for data communication; it realizes the automated and localized management of USBKEY assets and improves the management level of USBKEY.

Description of the drawings

A more complete understanding of exemplary embodiments of the invention may be obtained by reference to the following drawings:

Figure 1 is a structural diagram of a USBKEY secure storage cabinet device with encryption and decryption functions according to a specific embodiment of the present invention;

Figure 2 is a schematic structural diagram of a drawer subunit according to a specific embodiment of the present invention;

Figure 3 is a mechanical structural diagram of a drawer subunit according to a specific embodiment of the present invention;

Figure 4 is a flow chart of a method for secure storage using a USBKEY secure storage cabinet with encryption and decryption functions according to a specific embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present invention will now be described with reference to the accompanying drawings. However, the present invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided so that this disclosure will be thorough and complete. invention, and fully convey the scope of the invention to those skilled in the art. The terminology used in the exemplary embodiments represented in the drawings does not limit the invention. In the drawings, identical units/elements use the same reference numerals.

Unless otherwise defined, the terms (including scientific and technical terms) used herein have the commonly understood meaning to one of ordinary skill in the art. In addition, it is understood that terms defined in commonly used dictionaries should be understood to have consistent meanings in the context of their relevant fields and should not be understood as having an idealized or overly formal meaning.

Figure 1 is a structural diagram of a USBKEY secure storage cabinet device with encryption and decryption functions according to a specific embodiment of the present invention; the device stores USBKEY in an orderly manner by providing a secure storage cabinet with encryption and decryption functions and a corresponding control server. Management, while improving the security of USBKEY by establishing a two-way authentication mechanism and using ciphertext for data communication; the USBKEY secure storage cabinet device with encryption and decryption functions includes:

USBKEY secure storage cabinet 110 and control server 120;

The USBKEY secure storage cabinet 110 includes a main control unit 111, a drawer unit 112, a security unit 113 and an information authentication unit 114; the USBKEY secure storage cabinet 110 is used to securely store USBKEY, and the USBKEY secure storage cabinet 110 and the control server 120 Carry out authentication communication and complete the removal and return of USBKEY according to the received encryption control instructions;

The USBKEY safety storage cabinet 110 and the control server 120 are connected to each other and perform data communication; the communication method includes USB data line connection;

The main control unit 111 is used to receive the two-way authentication request sent by the control server 120, and send the two-way authentication request to the information authentication unit; the main control unit 111 is used to receive the encrypted control instruction sent by the control server 120, And generate corresponding operation instructions according to the control instructions for data transmission with other units of the USBKEY secure storage cabinet 110;

The drawer unit 112 includes N drawer sub-units. As shown in Figure 2, each of the N drawer sub-units includes a CPU module 201, a drawer mechanical structure 202 and a drawer safety module 203. The CPU module 201 uses After receiving the encrypted drawer operation command sent by the main control unit 111, after decryption and confirmation by the drawer security module 203, the corresponding drawer execution command is processed and sent to the drawer mechanical structure 202; the CPU module 201 is used to pass the drawer safety module 203. The drawer security module 203 establishes two-way authentication with the main control module 111; the CPU module 201 includes a USB interface, and the USBKEY is plugged and fixed in the drawer sub-unit with the USB interface and performs data communication;

Further, each drawer sub-unit of the drawer unit is connected to the main control unit and performs data communication;

Further, the drawer mechanical structure 202 of each drawer subunit includes a drawer shell, an electronic lock, a position sensor, a gear rack, a spring, a movable sleeve and a guide rail; the position sensor is used to sense whether the drawer shell is closed in place. , when the position sensor senses that the drawer shell has been closed in place, the electronic lock automatically locks; the electronic lock is used to unlock according to the instructions of the CPU module. When unlocking, the drawer shell is pre-tightened by the spring The force pops out, and the damping effect is achieved through the deceleration component composed of gear rack, movable sleeve and guide rail;

Further, Figure 3 is a mechanical structural diagram of a drawer sub-unit. Each drawer sub-unit can be disassembled and assembled separately. Each drawer sub-unit is provided with brackets on both sides of the drawer housing to support the drawer; The electronic lock is fixed on the inside of the bottom of the drawer housing; the spring, gear rack, movable sleeve and guide rail are fixed on the bottom of the drawer housing;

The security unit 113 includes a cryptographic chip with built-in multiple national secret algorithms; the security unit 113 is used to decrypt the encrypted control instructions received by the main control unit 111, and encrypt each operation instruction generated by the main control unit 111;

Further, the security unit 113 is connected to the main control unit 111 and performs data communication;

The information authentication unit 114 is configured to receive the two-way authentication request transmitted by the main control unit 111, perform security authentication according to the two-way authentication request, and send the authentication result to the main control unit 111; the information authentication unit 114 is used to Bidirectional authentication requests between the main control unit 111 and the drawer unit 112 and between the main control unit 111 and the control server 120 are generated according to the instructions of the main control unit 111 .

Further, the information authentication unit 114 is connected to the main control unit 111 and performs data communication; the information authentication unit 114 is used to verify the signature information of USBKEY; if the signature verification fails, the signature verification failure information is Sent to main control unit 111.

Further, the USBKEY safe storage cabinet 110 also includes an electronic seal unit 115, a USBKEY retrieval unit 116, a data storage unit 117 and a power supply unit 118;

The electronic seal unit 115 includes a cryptographic chip based on the national secret algorithm. The electronic seal unit 115 is used to store device information of the USBKEY secure storage cabinet 110. The device information includes a unique device number and device usage;

The power supply unit 118 is used to power the USBKEY safety storage cabinet 110. The power supply unit 118 includes a main power supply AC-DC module and a backup AC-DC module. The two AC-DC modules are isolated from each other;

The data storage unit 117 is used to store the operator's basic information and store the USBKEY information stored in each drawer unit 112; the USBKEY information includes USBKEY number and USBKEY status information;

The USBKEY retrieval unit 116 is used to determine whether the feedback status of each sub-unit of the drawer unit 112 is correct according to the operating instructions of the main control unit 111. The USBKEY retrieval unit 116 is used to confirm whether the timeliness of returning the USBKEY is abnormal, and Abnormal status is fed back to the main control unit 111.

Further, the electronic seal unit 115, USBKEY retrieval unit 116, data storage unit 117 and power supply unit 118 are all connected to the main control unit 111 and perform data communication;

The control server 120 includes a parameter entry unit 121 and a data communication unit 122; the control server 120 is used to perform authentication communication with the USBKEY secure storage cabinet 110 and send control instructions to the USBKEY secure storage cabinet 110;

The parameter entry unit 121 is used to enter the operator's basic information and parameters including USBKEY aging; the parameter entry unit 121 generates control instructions according to the information entered by the operator; the operator's basic information includes the operator number and operator password ;

The data communication unit 122 is used to establish two-way authentication with the USBKEY secure storage cabinet 110; the data communication unit 122 encrypts the control instructions generated by the parameter entry unit 121 and transmits them to the USBKEY secure storage cabinet 110.

Further, the control server 120 also includes a parameter setting unit 123 and a control logic unit 124;

The parameter setting unit 123 is used to set the operator's basic information and the USBKEY secure storage cabinet 110 device information; the parameter setting unit 123 is used to update the USBKEY information;

The control logic unit 124 is configured to set preset rules for controlling the drawer unit 112 according to the usage status of the drawer unit 112, the USBKEY verification status, and control instructions.

Further, the device further includes a plurality of auxiliary control servers, and the auxiliary control servers include an auxiliary parameter entry unit. The auxiliary parameter entry unit is used to enter basic operator information and parameters including USBKEY aging; the parameter entry unit Generate control instructions according to operator instructions; the affiliated control server communicates with the control server 120 and sends the operator's basic information, parameters and control instructions to the control server 120 .

Furthermore, the data transmission between the USBKEY secure storage cabinet 110 and the control server 120, between the control server 120 and other peripheral systems, and inside the USBKEY secure storage cabinet 110 uses ciphertext plus MAC for data transmission.

Further, the main control unit 111 includes a main control CPU, and the CPU modules of each drawer sub-unit include a drawer CPU; the main control CPU and each drawer CPU are high-performance series 32-bit CORTEX-M3 core processors.

Figure 4 is a flow chart of a method for secure storage using a USBKEY secure storage cabinet with encryption and decryption functions according to a specific embodiment of the present invention; as shown in Figure 4, the method includes:

Step 410: After receiving the input command, the control server establishes two-way authentication with the USBKEY secure storage cabinet;

Step 420: After successful authentication, the control server sends encrypted control instructions to the USBKEY secure storage cabinet. The control instructions include the operator's basic information and USBKEY aging parameters;

Step 430: The security unit of the USBKEY secure storage cabinet decrypts and verifies the encrypted control instructions, and sends the verified control instructions to the main control unit of the USBKEY secure storage cabinet;

Step 440, the main control unit generates an operation instruction according to the control instruction and sends the operation instruction to the drawer unit;

Step 450: The drawer unit retrieves and returns the USBKEY according to the operation instructions.

Further, before the main control unit sends the operation instruction to the drawer unit, the method also includes:

The main control unit establishes bidirectional authentication with the drawer security module of the drawer unit through the information authentication unit, and performs data transmission after the authentication is passed.

Further, the main control unit regularly queries the current feedback status of each drawer sub-unit of the drawer unit and uploads an operation log to the control server; the feedback status includes whether the drawer sub-unit is storing USBKEY.

Further, the method also includes:

The affiliated control server generates an authentication instruction after receiving the input instruction, and sends the authentication instruction to the control server;

The control server establishes two-way authentication with the USBKEY secure storage cabinet based on the received authentication instructions;

After the authentication is passed, the affiliated control server sends the control instruction generated according to the input instruction to the control server, and the control server encrypts the control instruction.

Further, when the operation instruction is to return the USBKEY, the drawer unit opens the corresponding drawer sub-unit according to the operation instruction, and the operator inserts the USBKEY into the USB interface of the drawer sub-unit;

The information authentication unit verifies the signature information of the USBKEY;

The USBKEY retrieval unit verifies whether the aging of the USBKEY is abnormal;

If all verifications pass, the operator closes the corresponding drawer sub-unit, and the drawer sub-unit is automatically locked;

If the verification fails, the USBKEY safe storage cabinet will issue an abnormality reminder.

Furthermore, the data transmission between the USBKEY secure storage cabinet and the control server, between the control server and other peripheral systems, and inside the USBKEY secure storage cabinet uses ciphertext plus MAC; the national secret algorithm is used. Encrypt and decrypt the data transmission.

In the instructions provided here, a number of specific details are described. However, it is understood that embodiments of the present disclosure may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this description.

Those skilled in the art will understand that modules in the devices in the embodiment can be adaptively changed and arranged in one or more devices different from that in the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore they may be divided into a plurality of sub-modules or sub-units or sub-components. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of the equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise. The step numbers involved in this manual are only used to distinguish each step, and are not used to limit the time or logical relationship between the steps. Unless there is an explicit limit in the text, the relationship between each step includes various possible relationships. Condition.

Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features included in other embodiments but not other features, combinations of features of different embodiments are meant to be within the scope of the present disclosure. within and form different embodiments. For example, any of the embodiments claimed in the claims may be used in any combination.

Various component embodiments of the present disclosure may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. The present disclosure may also be implemented as a device or system program (eg, computer program and computer program product) for performing part or all of the methods described herein. Such a program implementing the present disclosure may be stored on a computer-readable medium, or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, or provided on a carrier signal, or in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the disclosure, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present disclosure may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the element claim enumerating several systems, several of these systems can be embodied by the same item of hardware.

The above are only specific embodiments of the present disclosure. It should be noted that those of ordinary skill in the art can make several improvements, modifications, and deformations without departing from the spirit of the present disclosure. These improvements, modifications, and variations can be made without departing from the spirit of the present disclosure. Modifications and transformations shall be deemed to fall within the protection scope of this application.

Claims (14)

1. The device comprises a USBKEY safe storage cabinet and a control server;

the USBKEY safe storage cabinet comprises a main control unit, a drawer unit, a safety unit and an information authentication unit; the USBKEY safe storage cabinet is used for safely storing the USBKEY, performs authentication communication with the control server and completes the taking out and returning of the USBKEY according to the received encryption control instruction;

the main control unit is used for receiving a bidirectional authentication request sent by the control server and sending the bidirectional authentication request to the information authentication unit; the main control unit is used for receiving the encrypted control instruction sent by the control server, generating a corresponding operation instruction according to the control instruction, and carrying out data transmission with other units of the USBKEY safe storage cabinet;

the drawer unit comprises N drawer subunits, each of the N drawer subunits comprises a CPU module, a drawer mechanical structure and a drawer safety module, the CPU module is used for receiving encrypted drawer operation instructions sent by the main control unit, and after decryption confirmation is carried out through the drawer safety module, the corresponding drawer execution instructions are processed and then sent to the drawer mechanical structure; the CPU module is used for establishing bidirectional authentication with the main control module through the drawer security module; the CPU module comprises a USB interface, and the USBKEY is fixed in the drawer subunit through being inserted into the USB interface and performs data communication; the drawer mechanical structure of each drawer subunit comprises a drawer shell, an electronic lock, a position sensor, a gear bar, a spring, a movable sleeve and a guide rail; the position sensor is used for sensing whether the drawer shell is closed in place, and the electronic lock is automatically locked when the position sensor senses that the drawer shell is closed in place; the electronic lock is used for unlocking according to a CPU module instruction, when the electronic lock is unlocked, the drawer shell is ejected out through the pretightening force of the spring, and a damping effect is achieved through a speed reduction part consisting of a gear bar, a movable sleeve and a guide rail;

the safety unit comprises a cipher chip with a plurality of built-in national cipher algorithms; the security unit is used for decrypting the encryption control instruction received by the main control unit and encrypting each operation instruction generated by the main control unit;

the information authentication unit is used for receiving the bidirectional authentication request transmitted by the main control unit, carrying out security authentication according to the bidirectional authentication request, and sending an authentication result to the main control unit; the information authentication unit is used for generating bidirectional authentication requests between the main control unit and the drawer unit and between the main control unit and the control server according to the main control unit instruction;

the control server comprises a parameter input unit and a data communication unit; the control server is used for carrying out authentication communication with the USBKEY safe storage cabinet and sending a control instruction to the USBKEY safe storage cabinet;

the parameter input unit is used for inputting basic information of an operator and parameters including aging of the USBKEY; the parameter input unit generates a control instruction according to information input by an operator; the basic operator information comprises an operator number and an operator password;

the data communication unit is used for establishing bidirectional authentication with the USBKEY safe storage cabinet; and the data communication unit encrypts the control instruction generated by the parameter input unit and transmits the control instruction to the USBKEY safe storage cabinet.

2. The device according to claim 1, wherein the USBKEY safe storage cabinet further comprises an electronic seal unit, a USBKEY retrieval unit, a data storage unit and a power supply unit;

the electronic seal unit comprises a cryptographic chip based on a national seal algorithm and is used for storing the device information of the USBKEY safe storage cabinet, wherein the device information comprises a device unique number and a device purpose;

the power supply unit is used for supplying power to the USBKEY safe storage cabinet and comprises a main power supply AC-DC module and a standby AC-DC module, wherein the two AC-DC modules are mutually isolated;

the data storage unit is used for storing basic information of operators and storing USBKEY information stored in each drawer unit and operation logs of the USBKEY safe storage cabinet; the USBKEY information comprises a USBKEY number and USBKEY state information;

the USBKEY taking and returning unit is used for judging whether the feedback state of each subunit of the drawer unit is correct according to the operation instruction of the main control unit, and the USBKEY taking and returning unit is used for confirming whether the aging of the USBKEY is abnormal or not and feeding back the abnormal state to the main control unit.

3. The apparatus according to claim 2, wherein: the control server also comprises a parameter setting unit and a control logic unit;

the parameter setting unit is used for setting basic information of an operator and equipment information of the USBKEY safe storage cabinet; the parameter setting unit is used for updating USBKEY information;

the control logic unit is used for setting a preset rule for controlling the drawer unit according to the use state of the drawer unit, the USBKEY verification state and the control instruction.

4. The apparatus according to claim 1, wherein: brackets are arranged on two sides of the interior of the drawer shell of each drawer subunit and used for supporting drawers; the electronic lock is fixed on the inner side of the bottom of the drawer shell; the spring, the gear strip, the movable sleeve and the guide rail are fixed at the bottom of the drawer shell.

5. The apparatus according to claim 1, further comprising a plurality of auxiliary control servers, the auxiliary control servers comprising an auxiliary parameter entry unit for entering operator basic information and parameters including USBKEY aging; the parameter input unit generates a control instruction according to an operator instruction; the auxiliary control server communicates with the control server and transmits the operator basic information, parameters and control instructions to the control server.

6. The apparatus according to claim 1, wherein: the information authentication unit is used for checking signature information of the USBKEY; if the signature verification is not passed, the signature verification non-passing information is sent to the main control unit.

7. The apparatus according to claim 1, wherein: and data transmission is carried out between the USBKEY safe storage cabinet and the control server, between the control server and other peripheral systems and in the USBKEY safe storage cabinet by using a ciphertext and MAC (media access control) mode.

8. The apparatus according to claim 1, wherein: the main control unit comprises a main control CPU, and the CPU module of each drawer subunit comprises a drawer CPU; the main control CPU and each drawer CPU are high-performance serial 32-bit CORTEX-M3 core processors.

9. A method of using the apparatus of claim 1 for secure storage of a usb key, the method comprising:

after receiving the input command, the control server establishes bidirectional authentication with the USBKEY safe storage cabinet;

after successful authentication, the control server sends an encrypted control instruction to the USBKEY safe storage cabinet, wherein the control instruction comprises basic information of an operator and aging parameters of the USBKEY;

the safety unit of the USBKEY safety storage cabinet decrypts and verifies the encrypted control instruction, and sends the verified control instruction to the main control unit of the USBKEY safety storage cabinet;

the main control unit generates an operation instruction according to the control instruction and sends the operation instruction to the drawer unit;

and the drawer unit fetches and returns the USBKEY according to the operation instruction.

10. The method according to claim 9, wherein: before the main control unit sends the operation instruction to the drawer unit, the method further comprises:

and the main control unit establishes bidirectional authentication with the drawer safety module of the drawer unit through the information authentication unit, and performs data transmission after the authentication is passed.

11. The method according to claim 9, wherein: the main control unit queries the feedback state of each drawer subunit of the drawer unit at regular time and uploads an operation log to the control server; the feedback status includes whether the drawer subunit is storing a USBKEY.

12. The method according to claim 9, wherein the method further comprises:

the auxiliary control server receives the input command, generates an authentication command and sends the authentication command to the control server;

the control server establishes bidirectional authentication with the USBKEY safe storage cabinet according to the received authentication instruction;

after the authentication is passed, the auxiliary control server sends a control instruction generated according to the input instruction to the control server, and the control server encrypts the control instruction.

13. The method according to claim 9, wherein:

when the operation instruction is USBKEY, the drawer unit opens the corresponding drawer subunit according to the operation instruction, and an operator inserts the USBKEY into a USB interface of the drawer subunit;

the information authentication unit verifies the signature information of the USBKEY;

the USBKEY taking and returning unit verifies whether the aging of the USBKEY is abnormal or not;

if both the verification passes, closing the corresponding drawer subunit by an operator, wherein the drawer subunit is automatically locked;

if the verification is not passed, the USBKEY safe storage cabinet carries out abnormal reminding.

14. The method according to claim 9, wherein: the data transmission is carried out between the USBKEY safe storage cabinet and the control server, between the control server and other peripheral systems and in the USBKEY safe storage cabinet by using a ciphertext and MAC (media access control) mode; and encrypting and decrypting the data transmission by using a national encryption algorithm.