1. Introduction

The mini PCI-E crypto card is the basic cryptographic device that independent researches and developed by Fisherman. Fisherman Information takes the lead in adopting PCI-E bus technology in crypto card and owns all independent intellectual property rights of the product. The mini PCI-E crypto card fully supports national cipher algorithms such as SM1, SM2, SM3, and SM4, which can fully meet the needs of users for various encryption applications.

The fisherman information mini PCI-E crypto card supports mainstream operating systems such as Windows and Linux and provides a national standard interface that meets the requirements of the "Cryptographic Device Application Interface Specification" to provide multi-threaded and multi-process cryptographic computing services. Products with digital signature/verification, data encryption/decryption, data integrity check, true random number generation, key generation and management and other related functions, it has been used on VPN security gateways, firewalls, routers, server cryptographs, signature verification servers, and other cryptographic devices to provide efficient encryption services. The product meets the technical requirements of Level 3 and above of Information System Security Level Protection.

2. Features

Key Generation: This product support SM2 key pair generation, RSA key pair generation, and symmetric key generation.

Key Storage: By default, our product stores 64 pairs of SM2 key pairs and 64 pairs of RSA key pairs, and it can be customized to store a maximum of 1024 pair of the symmetric key pair if customers needed.

Key Destruction: Our product supports destroying SM2 key pair, RSA key pair and traffic encryption keys. All the keys are unrecoverable after destruction.

Key Update: Our product support symmetric and asymmetric key updates.

Key Backup and Restore: Our Product supports backing up the internal key in ciphertext form to the external storage and protect the backup data by using threshold secret sharing function. The backed up secret key can be recovered to the same type of crypto card.

True Random Number Generation: Our product can generate true random numbers by using physical noise generator approved by the State Cryptography Administration to protect the secret key.

Asymmetric encryption and decryption: Our product support native SM2 elliptic curve cryptography algorithm encryption and decryption, the key length is 256 bits, and RSA encryption/decryption are also supported.

Symmetric encryption and decryption: Our product can support symmetric encryption by using native cipher algorithms like SM1, SM4, SM6, and international standard cipher algorithms like DES, 3DES, AES, AES192, AES256.

Integrity checking: Our product can check the integrity of data by using the native SM3 hash cipher algorithm and SHA1 algorithm.

Signature/Signature Verification: Our product can support using the asymmetric private key to sign the data and using the corresponding public key to verify the signature.

Identification: Our product can use the public key of the asymmetric algorithm to verify the user’s identity.

Support: Our product supports Microsoft PKCS#11 interface, JCE interface and other standard interfaces; it also supports customized interface development and national standard interface mentioned in “Cryptographic Device Application Interface Specification". Besides, it also supports multi-process, multi-threaded call.

Key management: Our product relies on the three-level key management system, including master key, key protection key, and application key. Keys are all stored in the crypto card in ciphertext form, which can make sure the keys are well protected.

Permission management: Our product adopts hierarchical authority management system, users are divided into operators and administrators. 3 or more, up to 5 administrators can be generated, and only more than half of the administrators logged in can satisfy the management permission requirement and perform various management operations. The identity of the administrator and operator can be authenticated by using two-factor authentication via USBKEY.

Document Management: Our product adopts an embedded file system with independent intellectual property rights. It supports the directories and files creation, deletion, enumeration, and reading/writing, and it also supports multi-level directory management and can set read and write permissions of files.

Certificate Management: Our product supports a dedicated digital certificate operation interface, it supports reading, writing, enumeration, and deletion of digital certificates, and can be used as a security carrier for digital certificates.

3.superiority

High security

Using SM1, SM2, SM3,SM4 and other cryptographic algorithm approved by the State Cryptography Administration　

Using real random number chips to generate random numbers, improved the quality of passwords and all types of keys.

It provides a variety of self-protection measures to protect sensitive information in crypto cards from unauthorized access, forgery and tampering.

Adopted a strict key protection security mechanism. Keys in the card cannot be exported in plaintext format.

High Performance

Using a high-performance DSP chip as the master chip of crypto card, which could meet the requirement of high performance calculation

The data transmission between the host and the crypto card uses high-performance DMA processing, significantly reduced the CPU usage of the host.

Uses a high-performance dedicated cryptographic algorithm chip approved the State Cryptography Administration, which is security and reliability.

High ease of use

Our product is suitable for PC, mini PC, Industrial PC, server and other hardware platforms. It supports mini PCI-E slots.

Our product supports x86, x64 operation system, supports multi-process, multi-threaded calls.

Our products support the user/kernel interface, national standard interface and JCE interfaces.

Our products has a complete file system, provides user storage space, and supports custom configuration of key numbers and file spaces.