Secret key protection method, system and equipment of software cipher module and storage medium

Abstract

The invention discloses a key protection method, system and device for a software cipher module and a storage medium, and belongs to the technical field of information security technologies. The key protection method of the software password module comprises the following steps: receiving a user password, and judging whether the user password is correct or not; if yes, biological characteristics of a user are collected, and local hardware characteristics of equipment where the software password module is located are obtained; performing key derivation calculation by using the user password, the biological characteristics and the local hardware characteristics to obtain a root key; using the root key to protect a protection key; wherein the protection key is used for protecting target data. The security of the software password module can be improved, and information leakage is avoided.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a key protection method, system, device and storage medium for a software cryptographic module. Background Art

[0002] Cryptography technology is the cornerstone of information security. How to ensure safe and efficient cryptographic computing capabilities is a crucial part of ensuring information security. It is necessary to carefully design the cryptographic computing security protection model to reduce the risk of leakage and tampering of important computing parameters such as keys and sensitive parameters due to the storage environment and computing process, thereby ensuring that the cryptographic module can provide the expected secure computing services for the application.

[0003] Cryptography technology is gaining more and more attention and is widely used in various applications. Products that provide cryptographic computing functions include various types of cryptographic machines, cryptographic cards, cryptographic chips, and software and hardware cryptographic modules. Among them, software cryptographic modules are popular because of their irreplaceable advantages such as flexible use, convenient operation, and low cost.

[0004] Existing mainstream software cryptographic module products lack hardware protection, run in an untrusted semi-honest computing environment, and lack a reasonable and reliable security protection model design, which causes their root keys to be in a weak security protection state. This in turn leads to the risk of leakage and tampering of other working keys and sensitive parameters in the software cryptographic module.

[0005] Therefore, how to improve the security of software cryptographic modules and avoid information leakage is a technical problem that those skilled in the art currently need to solve. Summary of the invention

[0006] The purpose of this application is to provide a key protection method for a software cryptographic module, a key protection system for a software cryptographic module, a data decryption method for a software cryptographic module, an electronic device and a storage medium, which can improve the security of the software cryptographic module and avoid information leakage.

[0007] In order to solve the above technical problems, the present application provides a key protection method for a software cryptographic module, the key protection method comprising:

[0008] Receive a user password and determine whether the user password is correct;

[0009] If so, collecting the user's biometric features and obtaining the local hardware features of the device where the software password module is located;

[0010] Performing a key derivation calculation using the user password, the biometric feature, and the local hardware feature to obtain a root key;

[0011] The root key is used to protect the protection key, wherein the protection key is used to protect the target data.

[0012] Optionally, collect the user's biometrics, including:

[0013] Collecting facial images, fingerprint images, voice information and posture information of the user;

[0014] Feature extraction is performed on the facial image, the fingerprint image, the sound information and the posture information to obtain the biological feature.

[0015] Optionally, also include:

[0016] After the protection key is protected by using the root key, the root key is deleted.

[0017] Optionally, after deleting the key generation factor and the root key, the method further includes:

[0018] If a data decryption request is received, the user password is received and it is determined whether the user password is correct;

[0019] If yes, collect the user's biometric features, and use the user password, the biometric features and the local hardware features to perform key derivation calculation to obtain the root key;

[0020] The protection key is decrypted using the root key, and the target data is decrypted using the decrypted protection key.

[0021] Optionally, performing a key derivation calculation using the user password, the biometric feature, and the local hardware feature to obtain a root key includes:

[0022] A digest calculation is performed on the user password, the biometric feature and the local hardware feature to obtain a 256-bit hash value, and a key derivation calculation is performed using the hash value to obtain the root key.

[0023] The present application provides a data decryption method for a software cryptographic module, comprising:

[0024] If a data decryption request is received, the user password is received and it is determined whether the user password is correct;

[0025] If so, collecting the user's biometric features and obtaining the local hardware features of the device where the software password module is located;

[0026] Performing a key derivation calculation using the user password, the biometric feature, and the local hardware feature to obtain the root key;

[0027] The protection key is decrypted using the root key, and the target data is decrypted using the decrypted protection key.

[0028] The present application also provides a key protection system for a software cryptographic module, the system comprising:

[0029] A password receiving module is used to receive a user password and determine whether the user password is correct;

[0030] A feature collection module, used to collect the user's biometric features if the user password is correct, and obtain the local hardware features of the device where the software password module is located;

[0031] A derivation calculation module, used to perform key derivation calculation using the user password, the biometric feature and the local hardware feature to obtain a root key;

[0032] A key protection module is used to protect a protection key using the root key; wherein the protection key is used to protect target data.

[0033] The present application also provides a data decryption system of a software cryptographic module, comprising:

[0034] A password verification module, for receiving the user password and determining whether the user password is correct if a data decryption request is received;

[0035] A feature acquisition module, used to collect the user's biometric features if the user password is correct, and to acquire the local hardware features of the device where the software password module is located;

[0036] A root key calculation module, used to perform key derivation calculation using the user password, the biometric feature and the local hardware feature to obtain the root key;

[0037] The decryption module is used to decrypt the protection key using the root key, and decrypt the target data using the decrypted protection key.

[0038] The present application also provides a storage medium on which a computer program is stored. When the computer program is executed, the steps of the key protection method of the software cryptographic module or the data decryption method of the software cryptographic module are implemented.

[0039] The present application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, it implements the steps of the key protection method of the software cryptographic module or the data decryption method of the software cryptographic module.

[0040] The present application provides a key protection method for a software password module, comprising: receiving a user password and determining whether the user password is correct; if so, collecting the user's biometric features and obtaining the local hardware features of the device where the software password module is located; performing key derivation calculations using the user password, the biometric features and the local hardware features to obtain a root key; and protecting a protection key using the root key; wherein the protection key is used to protect target data.

[0041] After verifying that the user password is correct, the present application collects the user's biometrics and local hardware features, uses the user password, biometrics and local hardware features to perform password-derived calculations to obtain a root key, and accesses the protection key using the above-mentioned root key pair. Biometrics are not easy to counterfeit, and combined with cryptographic technology, they are easy to use and highly secure. This embodiment uses three factors, user password, biometrics and local hardware features, to jointly generate a root key, which can avoid security risks caused by the loss of user passwords and reduce key attacks caused by information leakage. The present application can improve the security of software cryptographic modules and avoid information leakage. The present application also provides a key protection system for a software cryptographic module, a data decryption method for a software cryptographic module, an electronic device and a storage medium, which have the above-mentioned beneficial effects and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 A flowchart of a key protection method for a software cryptographic module provided in an embodiment of the present application;

[0044] Figure 2 A schematic diagram of a key protection model for a software cryptographic module based on biometrics provided in an embodiment of the present application;

[0045] Figure 3 A schematic diagram of the structure of a key protection system for a software cryptographic module provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0047] See below Figure 1 , Figure 1 A flowchart of a key protection method for a software cryptographic module provided in an embodiment of the present application.

[0048] Specific steps may include:

[0049] S101: Receive the user password and determine whether the user password is correct; if so, proceed to S102; if not, end the process;

[0050] The present embodiment can be applied to a software password module. Before this step, the user may enter a user password on the software password module, and the user password is compared with a pre-stored standard password. If they are consistent, the user password is determined to be correct, and if they are inconsistent, the user password is determined to be incorrect.

[0051] S102: Collecting biometric features of the user and obtaining local hardware features of the device where the software password module is located;

[0052] Among them, the device where the software password module is located is equipped with a variety of biometric collection devices, such as infrared cameras, temperature sensors, microphones, fingerprint collection devices, etc. On the basis of the correct user password, this embodiment can start the above-mentioned biometric collection devices to collect the user's biometrics. Furthermore, this embodiment can also obtain the local hardware characteristics of the device where the software password module is located, such as IP address, MAC address, device serial number, etc.

[0053] S103: Perform key derivation calculation using the user password, biometrics and local hardware features to obtain a root key;

[0054] Among them, this embodiment can perform key derivation calculation based on the user password, biometrics and local hardware features to generate a root key. Specifically, this embodiment can perform a digest calculation on the user password, the biometrics and the local hardware features to obtain a 256-bit hash value, and use the hash value to perform key derivation calculation to obtain the root key.

[0055] S104: Using the root key to protect the protection key; wherein the protection key is used to protect target data.

[0056] The software password module is provided with a protection key, and the protection key is used to protect the target data. In this embodiment, the protection key can be encrypted with a root key to protect the protection key.

[0057] As a feasible implementation method, the above-mentioned target data includes user key sensitive parameters and public sensitive parameters, the protection keys include user protection keys for protecting user key sensitive parameters and public protection keys for protecting public sensitive parameters, and the root key can protect the above-mentioned user protection keys and public protection keys respectively.

[0058] Furthermore, after the protection key is protected by the root key, the root key may be deleted to improve the security of the software cryptographic module.

[0059] After verifying that the user password is correct, this embodiment collects the user's biometrics and local hardware features, uses the user password, biometrics and local hardware features to perform password-derived calculations to obtain a root key, and accesses the protection key using the above-mentioned root key. Biometrics are not easy to counterfeit, and combined with cryptographic technology, they are easy to use and highly secure. This embodiment uses three factors, user password, biometrics and local hardware features, to jointly generate a root key, which can avoid security risks caused by the loss of user passwords and reduce key attacks caused by information leakage. This embodiment can improve the security of the software password module and avoid information leakage.

[0060] As for Figure 1 Further introduction to the corresponding embodiment, the user's biometric features can be collected in the following manner: collect the user's facial image, fingerprint image, sound information and posture information; extract features from the facial image, the fingerprint image, the sound information and the posture information to obtain the biometric features. By extracting features from the facial image, facial features and iris features can be obtained, by extracting features from the fingerprint image, fingerprint features and blood vessel (finger vein) features can be obtained, by extracting features from the sound information, voiceprint features can be obtained, and by extracting features from the posture information, hand posture features can be obtained.

[0061] As for Figure 1Further introduction to the corresponding embodiment, after the protection key is protected by the root key, the root key can be deleted. After deleting the key generation factor and the root key, if a data decryption request is received, the user password is received, and it is determined whether the user password is correct; if so, the user's biometrics are collected, and the user password, the biometrics and the local hardware features are used to perform key derivation calculations to obtain the root key; the root key is used to decrypt the protection key, and the decrypted protection key is used to decrypt the target data.

[0062] An embodiment of the present application also provides a data decryption method for a software password module, comprising: if a data decryption request is received, receiving the user password and determining whether the user password is correct; if so, collecting the user's biometric features and obtaining the local hardware features of the device where the software password module is located; performing key derivation calculations using the user password, the biometric features and the local hardware features to obtain the root key; decrypting the protection key using the root key, and decrypting the target data using the decrypted protection key.

[0063] After verifying that the user password is correct, this embodiment collects the user's biometrics and local hardware features, uses the user password, biometrics and local hardware features to perform password-derived calculations to obtain a root key, and accesses the protection key using the above-mentioned root key to decrypt the target data using the decrypted protection key. Biometrics are not easy to counterfeit, and combined with cryptographic technology, they are easy to use and highly secure. This embodiment uses three factors, user password, biometrics and local hardware features, to jointly generate a root key, which can avoid security risks caused by the loss of user passwords and reduce key attacks caused by information leakage. This embodiment can improve the security of the software cryptographic module, and can also improve the security of the data decryption process and avoid information leakage.

[0064] The above embodiment provides a data decryption process of a software password module. Before this process, the following key encryption process may also exist: receiving a user password and determining whether the user password is correct; if so, collecting the user's biometric features and obtaining the local hardware features of the device where the software password module is located; performing key derivation calculations using the user password, the biometric features and the local hardware features to obtain a root key; encrypting the target data using a protection key, and encrypting the protection key using the root key.

[0065] The process described in the above embodiment is explained below through an embodiment in actual application.

[0066] Maintaining the safe development of cyberspace will help alleviate the frequent penetration attacks in cyberspace and help cope with the security risks brought by new business forms under the background of digital development. Existing mainstream software cryptographic module products lack hardware protection, run in an untrusted semi-honest computing environment, and lack a reasonable and reliable security protection model design, which causes their root keys to be in a weak security protection state, which in turn causes other working keys and sensitive parameters in the software cryptographic module to be leaked and tampered with. Therefore, how to design a convenient and secure key protection model and protection method to solve the security risks of the root key of the software cryptographic module and meet the strong market demand for commercial secret computing security has become the main problem restricting the development of software cryptographic modules today.

[0067] At present, common methods to solve the root key security of software cryptographic modules mainly include:

[0068] Method 1: Hide the root key of the software cryptographic module;

[0069] The disadvantage of the above method is that the security of simply hiding locally is almost zero, and attackers can easily find the hidden root key and recover the encrypted data, thereby causing data leakage or tampering.

[0070] Method 2: Use passwords to confuse and mask the root key to achieve protection;

[0071] The disadvantage of the above method is that its security is actually based on the confidentiality of the password and the confidentiality of the obfuscation algorithm. Since the password is easy to attack, the security of this method is relatively low.

[0072] Method 3: A protection mechanism that uses the secure storage capabilities provided by the host processor;

[0073] The disadvantages of the above method are: it has high requirements on the host machine's CPU or GPU hardware, high requirements on the hardware environment for operation, it is expensive, and its security and reliability depend on the security of the hardware itself.

[0074] Method 4: Mechanism based on key threshold technology;

[0075] The disadvantages of the above method are: the normal operation of the software cryptographic module depends on the background. When the network environment is unstable or the background is attacked, the normal operation of the software cryptographic module cannot be effectively guaranteed. At the same time, because of the need for collaborative work, it generates necessary network overhead and is relatively inefficient.

[0076] It can be seen that the existing related technologies are either too weak in security and cannot ensure their own security when providing cryptographic computing services to the outside world, resulting in risk spillover; or the hardware requirements are too high, which is expensive to counterfeit, and the use scenarios are limited, which raises questions and challenges to the security of the hardware itself; or the principle mechanism is too complicated, which makes it difficult to implement and inefficient, and all of them are unsatisfactory. The current security status of software cryptographic modules has resulted in most of these products on the market being unable to obtain higher security certification qualifications, and because of the large security risks, it is difficult to meet the requirements of security protection and confidentiality evaluation, and cannot be truly applied on a large scale.

[0077] At present, common methods for solving the root key security problem of software cryptographic modules include hiding, obfuscation, split storage, joint calculation and use, etc. The above protection mechanisms are either too weak in security, too high in hardware requirements, or too complex and inefficient, and all have various shortcomings. This embodiment summarizes and analyzes the advantages and disadvantages of the prior art, combines biometrics with cryptographic technology, and proposes a security enhancement technology for software cryptographic modules.

[0078] Unlike hardware cryptographic modules such as cryptographic machines, cryptographic cards, and cryptographic chips, which have a natural hardware security storage environment, software cryptographic modules lack the security protection of hardware devices, and their sensitive parameters, especially their root keys, are stored in an untrusted, vulnerable, dishonest environment. In modern cryptographic theory, the security of an information system lies mainly in the protection of keys, not in algorithm confidentiality or other aspects. Therefore, to solve the security of software cryptographic modules, we must first solve the security problem of the software cryptographic module's own keys. Only after ensuring the security of the software cryptographic module itself can we use it to ensure the security of other applications that use the cryptographic services it provides.

[0079] This embodiment combines biometrics and cryptographic technology to propose a security enhancement technology for software cryptographic modules to solve the following problems: 1) the security storage problem of the software cryptographic module root key due to the lack of a hardware protection environment; 2) the security attack problem that the software cryptographic module may face due to loss or theft; 3) meeting the convenience and security requirements.

[0080] This embodiment provides a biometric-based software cryptographic module security enhancement technology in a semi-honest environment that is easy to attack. This technology mainly integrates biometric features such as human fingerprints, faces, voiceprints, irises, and blood vessels with cryptographic technology, and proposes a technical idea for protecting the root key and other sensitive parameters of the software cryptographic module. The specific solution is as follows:

[0081] See also Figure 2 , Figure 2A structural diagram of a software password module key protection model based on biometrics provided in an embodiment of the present application is provided, and the key protection model includes a sensitive parameter layer, a protection key layer, a root key layer, and an acquisition calculation layer. In the acquisition calculation layer, a capacitive or photoelectric fingerprint acquisition device can be used to collect user fingerprints, a facial recognition device (such as a camera) can be used to collect user facial images, a sound acquisition device (such as a microphone) can be used to collect user voices, and other acquisition devices can be used to collect other features (such as iris features, posture features, etc.). In the acquisition calculation layer, feature extraction and information encoding can be implemented through feature extraction algorithms to obtain biometric features. User passwords (i.e., user passwords) and local hardware information (i.e., local hardware features) can also be obtained in the acquisition calculation layer. A root key can be derived from the root key layer, and the protection key layer can store user protection keys and public protection keys protected by the root key. The sensitive parameter layer is used to store user key sensitive parameters protected by user protection keys, and public sensitive parameters protected by public protection keys.

[0082] In the collection and calculation layer, the software password module collects the user's biometrics, such as iris, voiceprint, fingerprint, facial features, etc. through various biometric collection devices, and gives the feature extraction algorithm to calculate the user's biometric information, and then forms a key generation factor through coding conversion. At the same time, in order to enhance the randomness and security of the software password module, the user's local password and the user's local hardware information can be used as other additional key generation factors. With the key factor as input, the software password module root key is calculated by the key derivation function that meets the national secret standard. In the protection key layer, there are various protection keys used separately for different purposes. These protection keys are used to protect various sensitive parameters of different categories at the bottom layer, such as user sensitive parameters, public sensitive parameters, etc. Finally, the software password module encrypts and protects the protection key through the root key, and the protection key protects the sensitive parameters, thereby forming a complete protection chain to ensure the inherent security of the software password module.

[0083] When in use, the software cryptographic module can recover the master key and decrypt related sensitive parameters according to the following process:

[0084] Step 1: The user enters the correct user password, and the software password module compares the user password and obtains the first password generation factor if successful;

[0085] Step 2: After the password comparison is successful, the software password module collects the user's facial, fingerprint, voice, posture and other biometric features, extracts the feature value, and calculates the second password generation factor.

[0086] Step 3: The software password module collects the local hardware factor and obtains the third password generation factor.

[0087] Step 4: The software cryptographic module temporarily calculates the root key using the first cryptographic generation factor, the second cryptographic generation factor, and the third cryptographic generation factor as input.

[0088] Step 5: Decrypt the protection key with the root key and destroy the calculated root key.

[0089] Step 6: Use the protection key to decrypt the sensitive parameters needed.

[0090] The principle of generating the root key based on personalized feature information such as biometrics, user passwords, and local hardware as input and combined with cryptographic technology is as follows:

[0091] (a) Biometric feature extraction information is encoded to obtain bio-s, user password P, and local hardware feature L;

[0092] (b) Digest the biometric features, user password, and local hardware features to generate a 256-bit hash value H, H = HASH (bio-s||P||L);

[0093] (c) Key derivation: Key = KDF(H, L, C, Dlen); generate a derived key, where KDF is the key derivation function, C is the number of iterations greater than 1024, and Dlen is the length of the derived key.

[0094] (d) Encrypt the protected data using the derived key E_M=SM4 ECB (Key, M); where E_M is the encrypted message, key is the derived key, and M is the plaintext message.

[0095] This embodiment provides a root key derivation calculation method based on biometrics and other local personalized data, and provides a key security protection level for protecting user sensitive information through root keys and protection keys. This embodiment provides a method for recovering root keys and encrypted data by extracting biometrics and combining other personalized data. Compared with the traditional attachment processing method, this embodiment has the following advantages: 1) When the user logs in, the root key is temporarily calculated based on the identity characteristics, and is destroyed immediately after logging in. There is no need to store the root key in an insecure environment, avoiding the risk of key leakage due to storage environment problems; 2) The user logs in with a password and identity characteristics each time, avoiding the security risks caused by password loss; 3) A secure key protection hierarchy is formed through a scientific and reasonable key protection model; 4) In addition to biometrics, a variety of personalized data such as passwords and local environment feature information are introduced to reduce possible key attacks due to key material leakage; 5) There is no need to store keys in the background, avoiding key leakage during background upload and background storage; 6) There is no need for background joint calculation, avoiding the bottleneck of centralized services, and the efficiency is relatively high; 7) The natural characteristics of biometrics that are not easy to counterfeit are utilized, combined with cryptographic technology, and have the characteristics of easy use and high security.

[0096] See also Figure 3 , Figure 3 A schematic diagram of the structure of a key protection system for a software cryptographic module provided in an embodiment of the present application;

[0097] The system may include:

[0098] The password receiving module 301 is used to receive the user password and determine whether the user password is correct;

[0099] The feature collection module 302 is used to collect the user's biometric features if the user password is correct, and obtain the local hardware features of the device where the software password module is located;

[0100] A derivation calculation module 303, configured to perform a key derivation calculation using the user password, the biometric feature and the local hardware feature to obtain a root key;

[0101] The key protection module 304 is used to protect the protection key using the root key; wherein the protection key is used to protect the target data.

[0102] After the user password is correct, this embodiment collects the user's biometrics and local hardware features, uses the user password, biometrics and local hardware features to perform password-derived calculations to obtain a root key, and accesses the protection key using the above-mentioned root key. Biometrics are not easy to counterfeit, and combined with cryptographic technology, they are easy to use and highly secure. This embodiment uses three factors, user password, biometrics and local hardware features, to jointly generate a root key, which can avoid security risks caused by the loss of user passwords and reduce key attacks caused by information leakage. This embodiment can improve the security of the software password module and avoid information leakage.

[0103] Furthermore, the process of the feature collection module 302 collecting the user's biometric features includes: collecting the user's facial image, fingerprint image, voice information and posture information; performing feature extraction on the facial image, the fingerprint image, the voice information and the posture information to obtain the biometric features.

[0104] Furthermore, it also includes:

[0105] The root key destruction module is used to delete the root key after the protection key is protected by the root key.

[0106] Furthermore, it also includes:

[0107] A decryption module is used to receive the user password and determine whether the user password is correct if a data decryption request is received after deleting the key generation factor and the root key; if so, collect the user's biometric features, and use the user password, the biometric features and the local hardware features to perform key derivation calculations to obtain the root key; and is also used to decrypt the protection key using the root key, and use the decrypted protection key to decrypt the target data.

[0108] Furthermore, the process in which the derivation calculation module 303 uses the user password, the biometric feature and the local hardware feature to perform a key derivation calculation to obtain the root key includes: performing a digest calculation on the user password, the biometric feature and the local hardware feature to obtain a 256-bit hash value, and using the hash value to perform a key derivation calculation to obtain the root key.

[0109] A data decryption system of a software cryptographic module provided in an embodiment of the present application includes:

[0110] A password verification module, for receiving the user password and determining whether the user password is correct if a data decryption request is received;

[0111] A feature acquisition module, used to collect the user's biometric features if the user password is correct, and to acquire the local hardware features of the device where the software password module is located;

[0112] A root key calculation module, used to perform key derivation calculation using the user password, the biometric feature and the local hardware feature to obtain the root key;

[0113] The decryption module is used to decrypt the protection key using the root key, and decrypt the target data using the decrypted protection key.

[0114] After verifying that the user password is correct, this embodiment collects the user's biometrics and local hardware features, uses the user password, biometrics and local hardware features to perform password-derived calculations to obtain a root key, and accesses the protection key using the above-mentioned root key to decrypt the target data using the decrypted protection key. Biometrics are not easy to counterfeit, and combined with cryptographic technology, they are easy to use and highly secure. This embodiment uses three factors, user password, biometrics and local hardware features, to jointly generate a root key, which can avoid security risks caused by the loss of user passwords and reduce key attacks caused by information leakage. This embodiment can improve the security of the software cryptographic module, and can also improve the security of the data decryption process and avoid information leakage.

[0115] Since the embodiments of the system part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the system part, which will not be repeated here.

[0116] The present application also provides a storage medium on which a computer program is stored, and when the computer program is executed, the steps provided in the above embodiment can be implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0117] The present application also provides an electronic device, which may include a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps provided in the above embodiment may be implemented. Of course, the electronic device may also include various network interfaces, power supplies and other components.

[0118] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of this application.

[0119] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A key protection method for a software cryptographic module, It is characterized in that include: Receive a user password and determine whether the user password is correct; If so, collecting the user's biometric features and obtaining the local hardware features of the device where the software password module is located; Performing a key derivation calculation using the user password, the biometric feature, and the local hardware feature to obtain a root key; The root key is used to protect the protection key, wherein the protection key is used to protect the target data.

2. The key protection method of the software cryptographic module according to claim 1, It is characterized in that The collecting of the user's biometric features includes: Collecting facial images, fingerprint images, voice information and posture information of the user; Feature extraction is performed on the facial image, the fingerprint image, the sound information and the posture information to obtain the biological feature.

3. The key protection method of the software cryptographic module according to claim 1, It is characterized in that Also includes: After the protection key is protected by using the root key, the root key is deleted.

4. The key protection method of the software cryptographic module according to claim 3, It is characterized in that After deleting the key generation factor and the root key, the method further includes: If a data decryption request is received, the user password is received and it is determined whether the user password is correct; If yes, collect the user's biometric features, and use the user password, the biometric features and the local hardware features to perform key derivation calculation to obtain the root key; The protection key is decrypted using the root key, and the target data is decrypted using the decrypted protection key.

5. The key protection method of the software cryptographic module according to claim 1, It is characterized in that The key derivation calculation is performed using the user password, the biometric feature and the local hardware feature to obtain a root key, including: A digest calculation is performed on the user password, the biometric feature and the local hardware feature to obtain a 256-bit hash value, and a key derivation calculation is performed using the hash value to obtain the root key.

6. A method for decrypting data in a software cryptographic module, It is characterized in that include: If a data decryption request is received, the user password is received and it is determined whether the user password is correct; If so, collecting the user's biometric features and obtaining the local hardware features of the device where the software password module is located; Performing a key derivation calculation using the user password, the biometric feature, and the local hardware feature to obtain the root key; The protection key is decrypted using the root key, and the target data is decrypted using the decrypted protection key.

7. A key protection system for a software cryptographic module, It is characterized in that include: A password receiving module is used to receive a user password and determine whether the user password is correct; A feature collection module, used to collect the user's biometric features if the user password is correct, and obtain the local hardware features of the device where the software password module is located; A derivation calculation module, used to perform key derivation calculation using the user password, the biometric feature and the local hardware feature to obtain a root key; A key protection module is used to protect a protection key using the root key; wherein the protection key is used to protect target data.

8. A data decryption system for a software cryptographic module, It is characterized in that include: A password verification module, for receiving the user password and determining whether the user password is correct if a data decryption request is received; A feature acquisition module, used to collect the user's biometric features if the user password is correct, and to acquire the local hardware features of the device where the software password module is located; A root key calculation module, used to perform key derivation calculation using the user password, the biometric feature and the local hardware feature to obtain the root key; The decryption module is used to decrypt the protection key using the root key, and decrypt the target data using the decrypted protection key.

9. An electronic device, It is characterized in that It comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps of the key protection method of the software cryptographic module according to any one of claims 1 to 5 or the data decryption method of the software cryptographic module according to claim 6 are implemented.

10. A storage medium, It is characterized in that The storage medium stores computer executable instructions, which, when loaded and executed by the processor, implement the steps of the key protection method for the software cryptographic module according to any one of claims 1 to 5 or the data decryption method for the software cryptographic module according to claim 6.

Images