A data encryption storage method based on national secret algorithm

Abstract

The present invention provides a data encryption storage method based on the national secret algorithm, which belongs to the field of data security. The present invention includes four parts: the issuance of the agreed key, the generation of the master key, the generation of the data key, and the data encryption; the key management service is the key life cycle management center, which is responsible for the centralized management of the key. The key cannot be obtained from the outside, and the data key can be derived from the master key for use; the encryption and decryption of the data is realized locally by securely transmitting the data key. The risk of data storage is reduced and the security of the encryption key is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a data encryption storage method based on a national secret algorithm. Background Art

[0002] Strictly speaking, data security technologies can be divided into three categories: hiding, access control, and cryptography. Data transmission security, data storage security, data access security control, etc. are all within the scope of data security. In order to solve these data security issues, the national secret encryption algorithm has been implemented, of which the commercial version includes SM1, SM2, SM3, SM4, SM7 and SM9 algorithms.

[0003] In the process of encrypting and storing large files, the traditional method is to transfer the large files to a physical encryption machine for encryption and then return them for storage. Although this can ensure the security of the data, it cannot guarantee the security during the transmission process and is inefficient (it depends on various factors such as bandwidth). Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides a data encryption storage method based on the national secret algorithm. It can reduce the risk of data storage and improve the security of encryption keys without using ssl_vpn to ensure the security of transmission. The present invention can be extended to other business application scenarios, and is not limited to the use of docking with key management services. Through the invention, the secure encrypted storage of data can be guaranteed.

[0005] The technical solution of the present invention is:

[0006] A data encryption storage method based on the national secret algorithm, including four parts: the issuance of agreed keys, master key generation (CMK), data key generation (DEK), and data encryption; the key management service is the key lifecycle management center, responsible for the centralized management of keys. The keys cannot be obtained from the outside, and the data keys can be derived from the master key for use. By connecting to the key management service, data encryption and decryption are realized locally in the form of secure transmission of data keys.

[0007] Furthermore,

[0008] Here are the steps:

[0009] Step 1): Issue the agreed key

[0010] Generate an SM4 symmetric key value through online or offline operations as the key for HMACSM3 calculation, and send it to the user (one key for each user). After the user gets the key value, put it in the configuration file of the calling SDK to facilitate subsequent code calls.

[0011] Step 2): Master key generation

[0012] Generate the master key by calling the key management service;

[0013] Step 3): Data key generation

[0014] 3.1) Initialization and calculation of client information;

[0015] 3.2) After receiving the request, the server performs verification and other logical processing.

[0016] Step 4): Data encryption

[0017] After the user obtains the data key, he or she performs encryption operations on the local plaintext data.

[0018] Going further,

[0019] In step 2), the key is a master key encrypted based on the password card. The keys stored in the key management service are all encrypted based on the hardware device. The key itself cannot be obtained directly and can only be obtained after decryption by the hardware device.

[0020] The master key only supports SM4 and SM2. SM4 is a symmetric key that generates a key value and encrypts and stores it in the key management service. SM2 generates a key pair, and the user can obtain the public key value to facilitate subsequent encryption and decryption operations.

[0021] Going further,

[0022] Step 3.1) further comprises:

[0023] 3.11) The local cryptographic module generates a key pair based on the SM2 algorithm and then generates seed information;

[0024] 3.12) Calculate a sign value for the input parameter based on the rules using the HMACSM3 algorithm (the encryption key of HMACSM3 is the key value issued in the first step);

[0025] 3.13) Use the client SDK to call the data key generation interface with the generated public key, seed information and sign value.

[0026] Step 3.2) further comprises:

[0027] 3.21) Verify the signature based on the information transmitted to the server; also based on the HMACSM3 algorithm, using the key sent in step 1 for calculation;

[0028] 3.22) After the signature verification is completed, a data key a is generated based on the SM4 algorithm (the data key is in plain text at this time);

[0029] 3.23) Call the server encryption machine to encrypt the data key with the master key to generate ciphertext b. The ciphertext b generated in this step is mainly reserved for later decryption;

[0030] 3.24) According to the incoming public key and seed information, the data key a is encrypted through the SM2 algorithm and the ciphertext key c is obtained. After the value is sent back to the user end for decryption, the plaintext data key can be obtained.

[0031] 3.25) Finally, b and c are sent back to the calling user (the data sent back at this time are all encrypted data).

[0032] When decrypting data, it is also necessary to call the key management service based on the stored data key b to obtain the plaintext data key, and then decrypt the data ciphertext. It is also necessary to perform signature verification and transmit public key information.

[0033] The asymmetric key pair generated based on SM2 is a session-level key, which is one-time. During the entire interaction process, the SM2, HMACSM3, and SM4 national encryption algorithms are used.

[0034] The present invention adopts a key transmission method to perform encryption operations, thereby improving the encryption efficiency of large files while ensuring security;

[0035] The national secret signature algorithm based on the agreed key ensures the security of the data key and will not be tampered with;

[0036] Data storage is secure and without plain text, preventing data leakage from dragging databases;

[0037] The master key is protected by a hardware encryption card with a high security level and cannot be copied.

[0038] The beneficial effects of the present invention are

[0039] (1) The present invention provides a new implementation method for large file encryption storage, which greatly improves the encryption efficiency while ensuring security.

[0040] (2) The present invention is applicable to encryption services in other business scenarios. The present invention can reduce the performance overhead of physical encryption machines.

[0041] (3) The present invention can improve the security of inter-business communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a schematic diagram of the workflow of the present invention;

[0043] Figure 2It is the master key generation flow chart;

[0044] Figure 3 This is a flowchart for obtaining a data key. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0046] The present invention is mainly designed for how to ensure the security of data storage of large files in the process of using key management services, and realizes the secure storage of data while ensuring efficiency.

[0047] The present invention includes three relatively mature and commonly used algorithms: SM2, SM3 and SM4. By combining different algorithms and adjusting the algorithm mode and complement method, the confidentiality and integrity of data transmission, the security of data storage, and the data leakage caused by artificial dragging of the database are guaranteed.

[0048] The present invention mainly includes four parts: the issuance of agreed keys, master key generation (CMK), data key generation (DEK), and data encryption. As the key lifecycle management center, the key management service is responsible for the centralized management of the key. The key cannot be obtained from the outside, and the data key can be derived from the master key for use. In the process of encrypting and storing large files, the present invention adopts the docking key management service, and realizes data encryption and decryption locally by securely transmitting data keys, thereby greatly improving the encryption efficiency and reducing bandwidth dependence.

[0049] The technical solution implementation steps are as follows:

[0050] Step 1: Issue the agreed key

[0051] This step mainly generates an SM4 symmetric key value as the key for HMACSM3 calculation through online or offline operations, and sends it to the user (one key for each user). After the user obtains the key value, it is placed in the configuration file of the calling SDK to facilitate subsequent code calls.

[0052] Step 2: Generate master key

[0053] This step is to generate the master key by calling the key management service (supporting symmetric SM4 and asymmetric SM2). The key is generally based on the master key encrypted by the password card. The keys stored in the key management service are based on the content encrypted by the hardware device. The key itself cannot get the key directly and can only be obtained after decryption by the hardware device. The master key currently only supports SM4 and SM2. SM4 is a symmetric key, which will generate a key value and encrypt and store it in the key management service; SM2 will generate a key pair, and the user can obtain the public key value to facilitate subsequent encryption and decryption operations. For details, please refer to Figure 2 Explanation instructions.

[0054] Step 3: Generate data key

[0055] This step is the core link of the present invention, which not only involves the generation of data keys, but also involves the return and authentication process of data keys.

[0056] 1) Client information is initially generated and calculated.

[0057] The local cryptographic module is required to generate a key pair based on the SM2 algorithm, and then generate seed information, etc.

[0058] A sign value is calculated based on certain rules using the HMACSM3 algorithm for the input parameter (the encryption key of HMACSM3 is the key value issued in the first step).

[0059] The generated public key, seed information and sign value are called through the client SDK to generate the data key interface.

[0060] 2) After receiving the request, the server performs verification and other logical processing.

[0061] Verify the signature based on the information transmitted to the server. Also based on the HMACSM3 algorithm, use the key sent in step 1 for calculation.

[0062] After the signature verification is completed, a data key a is generated based on the SM4 algorithm (the data key is in plain text at this time).

[0063] The server encryption machine is called to encrypt the data key with the master key to generate ciphertext b. The ciphertext b generated in this step is mainly reserved for later decryption.

[0064] According to the incoming public key and seed information, the data key a is encrypted with the SM2 algorithm to obtain the ciphertext key c. After this value is sent back to the user end for decryption, the plaintext data key can be obtained.

[0065] Finally, b and c are sent back to the calling user (the data sent back at this time are all encrypted data).

[0066] The above is the entire execution process. For specific procedures, please refer to Figure 3 Explanation instructions.

[0067] Step 4: Data encryption

[0068] This step is to encrypt the local plaintext data after the user obtains the data keys b and c. The main steps are as follows:

[0069] Get the plaintext data key.

[0070] The user decrypts the data key c using the private key in the key pair initially generated based on the SM2 algorithm to obtain the plaintext data key.

[0071] Encrypts plaintext data.

[0072] Based on the SM4 encryption algorithm, the plaintext is encrypted using the plaintext data key to obtain the data ciphertext.

[0073] Release the plaintext data key in memory.

[0074] The encrypted data key and data ciphertext are stored on disk.

[0075] The data key b and the data ciphertext are stored on the disk. At this time, all the stored data are encrypted, and the user side does not save the plaintext related data and keys.

[0076] When decrypting data, it is also necessary to call the key management service according to the stored data key b to obtain the plaintext data key, and then decrypt the data ciphertext. The process is similar to the encryption process, and signature verification and public key information transmission are also required. This ensures the data integrity and confidentiality of the entire encryption and decryption process, preventing data from being intercepted and tampered with.

[0077] Note: The asymmetric key pair generated based on SM2 is a session-level key, one-time one-key. During the entire interaction process, national encryption algorithms such as SM2, HMACSM3, and SM4 are used.

[0078] The present invention mainly solves the process security of obtaining keys from a key management service, the storage security of keys, and the storage security of data. The method can reduce the risk of data storage and improve the security of encryption keys without using ssl_vpn to ensure the security of transmission. The present invention can be extended to other business application scenarios, and is not limited to the use of docking with a key management service. The invention can ensure the secure encrypted storage of data.

[0079] The above description is only a preferred embodiment of the present invention, which is only used to illustrate the technical solution of the present invention, and is not used to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A data encryption storage method based on a national secret algorithm, characterized in that: It includes four parts: issuance of agreed keys, generation of master keys, generation of data keys, and data encryption. As the key lifecycle management center, the key management service is responsible for the centralized management of keys. Keys cannot be obtained externally, but data keys can be derived from master keys for use. Data encryption and decryption are achieved locally by securely transmitting data keys. Here are the steps: Step 1): Issue the agreed key Generate an SM4 symmetric key value through online or offline operations as the key for HMACSM3 calculation and send it to the user, one key for each user; after the user gets the key value, put it in the configuration file of the calling SDK to facilitate subsequent code calls; Step 2): Master key generation Generate the master key by calling the key management service; Step 3): Data key generation 3.1) Initialization and calculation of client information; 3.2) After receiving the request, the server performs verification and other logical processing; Step 4): Data encryption After the user obtains the data key, he / she performs encryption operations on the local plaintext data; In step 2), the key is the master key encrypted by the password card. The keys stored by the key management service are all encrypted by the hardware device. The key itself cannot be obtained directly and can only be obtained after being decrypted by the hardware device. The master key only supports SM4 and SM2. SM4 is a symmetric key, which generates a key value and encrypts and stores it in the key management service. SM2 generates a key pair, and the user obtains the public key value to facilitate subsequent encryption and decryption operations. Step 3.1) further includes: 3.11) The local cryptographic module generates a key pair based on the SM2 algorithm and then generates seed information; 3.12) Calculate a sign value for the input parameter based on the rules using the HMACSM3 algorithm. The encryption key of HMACSM3 is the key value issued in the first step. 3.13) Use the generated public key, seed information and sign value to call the data key generation interface through the client SDK; Step 3.2) further includes: 3.21) Verify the signature based on the information transmitted to the server; also based on the HMACSM3 algorithm, using the key sent in step 1 for calculation; 3.22) After the signature verification is completed, a data key a is generated based on the SM4 algorithm. At this time, the data key is in plain text; 3.23) Call the server encryption machine to encrypt the data key with the master key to generate ciphertext b; the ciphertext b generated in this step is reserved for later decryption; 3.24) According to the incoming public key and seed information, the data key a is encrypted with the SM2 algorithm to obtain the ciphertext key c. The ciphertext key c is sent back to the user end for decryption to obtain the plaintext data key; 25) Finally, b and c are sent back to the calling user. At this time, the data sent back are all encrypted data.

2. The method according to claim 1, characterized in that: When decrypting data, it is also necessary to call the key management service based on the stored data key b to obtain the plaintext data key, and then decrypt the data ciphertext. It is also necessary to perform signature verification and transmit public key information.

3. The method according to claim 2, characterized in that The asymmetric key pair generated based on SM2 is a session-level key, which is one-time. During the entire interaction process, the SM2, HMACSM3, and SM4 national encryption algorithms are used.

Images