A system, method and storage medium for implementing secret key storage using software

Abstract

The present invention discloses a system, method and storage medium for realizing key storage by software, the system includes an operating system, a key storage program, a key user application, a remote server and a local storage; the key storage program runs on the operating system; the key user application is used to submit its hardware serial number to the remote server and obtain a digital signature; the key storage program includes an application interface, an algorithm module, a signature verification module, a remote key request module and a local key request module; the signature verification module is used to verify the legitimacy; the algorithm module is used to calculate the key; the remote key request module is used to obtain the hardware password; the local key request module is used to obtain the encrypted data block. The present invention can effectively verify the legitimacy of the identity of the key user, so that the key can be obtained only after the verification is passed, thereby further improving the information security performance.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a system, method and storage medium for implementing key storage via software. Background Art

[0002] With the networking of automobile functions, the security of communication data is becoming more and more important. Core data needs to be protected to avoid losses caused by data leakage. In this context, vehicle information security technology was born. In the implementation of vehicle information security, after determining the key storage medium, the key access logic responsible for the software part is an indispensable link. The determined key storage medium must be combined with the appropriate software access logic to play the role of protecting communication data.

[0003] Currently, cars can establish communication connections with remote servers and internal car controllers. Between ends, data needs to be encrypted before it is sent to prevent people from intercepting the data on the link and obtaining important information. Before receiving data, because the data is encrypted, it must be decrypted before it can be used. If a key leak occurs, the core data can be intercepted and obtained after decryption. Therefore, after we design a secure key storage medium and method, we solve the security of the key storage location, but the legitimacy of the key user's identity cannot be verified.

[0004] Generally speaking, the secret key is used directly, that is, the secret key is stored in a certain file directory in the form of a file. As long as you have the access rights to the directory, you can use it directly. For example, if you obtain the root account permissions in an attack, you can directly use the secret key in the directory. Therefore, in general information security design plans, there is no legitimacy verification of the identity of the key user, which greatly reduces the security performance of the information. Summary of the invention

[0005] In view of the above-mentioned deficiencies in the prior art, the technical problem to be solved by the present invention is: how to provide a system and method for software-implemented key storage that can effectively verify the legitimacy of the identity of the key user so that the key can be obtained only after the verification is passed, thereby further improving the information security performance.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0007] A system for implementing key storage by software, comprising an operating system, a key storage program, a key user application, a remote server and a local memory; the key storage program runs on the operating system;

[0008] The key user application is in a two-way communication connection with the remote server, for submitting its hardware serial number to the remote server and obtaining a digital signature from the remote server;

[0009] The key user application is also connected to the key storage program in a two-way communication manner, for sending a digital signature to the key storage program and obtaining a decrypted key from the key storage program;

[0010] The key storage program includes an application interface, an algorithm module, a signature verification module, a remote key request module and a local key request module;

[0011] The application interface is bidirectionally connected to the key user application for obtaining a digital signature from the key user application and sending a decrypted key to the key user application;

[0012] The signature verification module is used to verify the legitimacy of the key user application;

[0013] The algorithm module is used to calculate the secret key and send the calculated secret key to the key user application through the application interface;

[0014] The remote key request module is used to obtain the hardware password from the remote server;

[0015] The local key request module is used to obtain the encrypted data block from the local memory.

[0016] Preferably, the signature verification module is communicatively connected with the application interface, the remote key request module and the local key request module respectively, and the signature verification module is used to obtain the digital signature from the application interface, to obtain the hardware password from the remote key request module, and to obtain the encrypted data block from the local key request module, so as to calculate the digital signature and the encrypted data block respectively through the hardware password to verify the legitimacy of the key user application.

[0017] Preferably, the algorithm module is respectively communicated with the application interface, the remote key request module and the local key request module, and the algorithm module is used to obtain the hardware password from the remote key request module, and to obtain the encrypted data block from the local key request module, so as to decrypt the encrypted data block through the hardware password to obtain the key, and send the key to the key user application through the application interface.

[0018] A method for implementing key storage by software, using the above software to implement a key storage system, comprising the following steps:

[0019] Step 1) starting the operating system and initializing the key storage program;

[0020] Step 2) the key user application is connected to the remote server for communication, the key user application submits its hardware serial number to the remote server and obtains a digital signature from the remote server;

[0021] Step 3) The key user application transmits the digital signature to the key storage program through the application interface;

[0022] Step 4) The signature verification module verifies the legitimacy of the key user application. If the verification passes, execute step 5). If the verification fails, execute step 6);

[0023] Step 5) The algorithm module calculates the secret key and sends the calculated secret key to the key user application through the application interface;

[0024] Step 6) End.

[0025] Preferably, in step 1), the initialization of the key storage program includes: the local key request module obtains and saves the encrypted data block from the local memory, and the remote key request module obtains and saves the hardware password from the remote server through its hardware serial number.

[0026] Preferably, in step 4), the method by which the signature verification module verifies the legitimacy of the key user application is: first, use the hardware password to decrypt the digital signature to obtain the hash function information of the digital signature; then use the hardware password to perform an information summary algorithm on the encrypted data block to obtain the hash function information of the encrypted data block; finally, compare the hash function information of the digital signature and the hash function information of the encrypted data block; if the two are the same, the verification passes and step 5 is executed; if the two are not the same, the verification fails and step 6 is executed.

[0027] Preferably, in step 5), the method for the algorithm module to calculate the secret key is: the algorithm module first obtains the hardware password from the remote secret key request module, and then obtains the encrypted data block from the local secret key request module; finally, the encrypted data block is decrypted and calculated using the hardware password to obtain the secret key.

[0028] A storage medium stores one or more programs, and when the one or more programs are run by a processor, the steps of the method for implementing key storage by software are executed.

[0029] Compared with the prior art, the key user of the present invention first obtains the digital signature corresponding to his hardware serial number from the remote server before obtaining the key, and then the key storage program uses the hardware password to decrypt the digital signature to obtain the hash function information (MD5) of the digital signature. At the same time, the hardware password is used to perform the information digest algorithm on the encrypted data block to obtain the hash function information (MD5) of the encrypted data block, and then the two MD5 information are compared. If they are the same, it means that the digital signature verification is passed. At this time, the key storage program can send the calculated key to the key user application. If the verification fails, it means that the province of the key user is illegal. At this time, even if the key user obtains the access right to the key storage directory, the key user application will not be able to obtain the key. Therefore, even if the target system of the present invention has been hacked, the system still has the ability to prevent key leakage, which greatly improves the security of information technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A system block diagram of a system for implementing key storage with software of the present invention;

[0031] Figure 2 A schematic diagram of initializing a key storage program in the method for implementing key storage by software of the present invention;

[0032] Figure 3 A schematic diagram of a process for verifying the legitimacy of a key user application by a signature verification module in the method for realizing key storage by software of the present invention;

[0033] Figure 4 A schematic diagram of the process of calculating the key by the algorithm module in the method for implementing key storage by software of the present invention. DETAILED DESCRIPTION

[0034] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0035] As attached Figure 1 As shown, a system for implementing key storage by software includes an operating system, a key storage program, a key user application, a remote server and a local storage; the key storage program runs on the operating system;

[0036] A two-way communication connection between the key user application and the remote server, used to submit its hardware serial number (hardware ID) to the remote server and obtain a digital signature from the remote server;

[0037] The key user application is also connected to the key storage program in a two-way communication manner for sending the digital signature to the key storage program and obtaining the decrypted key from the key storage program;

[0038] The key storage program includes an application interface, an algorithm module, a signature verification module, a remote key request module, and a local key request module;

[0039] The application interface is connected to the key user application for bidirectional communication, and is used to obtain the digital signature from the key user application and send the decrypted key to the key user application;

[0040] The signature verification module is used to verify the legitimacy of the key user's application;

[0041] The algorithm module is used to calculate the secret key and send the calculated secret key to the key user application through the application interface;

[0042] The remote key request module is used to obtain and save the hardware password from the remote server based on its hardware ID (such as MAC address);

[0043] The local key request module is used to obtain the encrypted data block from the local storage and save it.

[0044] In this embodiment, the signature verification module is communicated with the application interface, the remote key request module and the local key request module respectively. The signature verification module is used to obtain the digital signature from the application interface, to obtain the hardware password from the remote key request module, and to obtain the encrypted data block from the local key request module, so as to calculate the digital signature and the encrypted data block respectively through the hardware password to verify the legitimacy of the key user's application.

[0045] In this embodiment, the algorithm module is communicated with the application interface, the remote key request module and the local key request module respectively. The algorithm module is used to obtain the hardware password from the remote key request module, and to obtain the encrypted data block from the local key request module, so as to decrypt the encrypted data block through the hardware password to obtain the key, and send the key to the key user application through the application interface.

[0046] A method for implementing key storage by software, using the above software to implement a key storage system, comprising the following steps:

[0047] Step 1) Start the operating system and initialize the key storage program;

[0048] Step 2) The key user application communicates with the remote server, submits its hardware serial number (hardware ID) to the remote server and obtains a digital signature from the remote server;

[0049] Step 3) The key user application passes the digital signature to the key storage program through the application interface;

[0050] Step 4) The signature verification module verifies the legitimacy of the key user's application. If the verification passes, execute step 5). If the verification fails, execute step 6);

[0051] Step 5) The algorithm module calculates the secret key and sends the calculated secret key to the key user application through the application interface;

[0052] Step 6) End.

[0053] In this embodiment, in step 1), the initialization of the key storage program includes: the local key request module obtains and saves the encrypted data block from the local memory, and the remote key request module obtains and saves the hardware password from the remote server through its hardware serial number, as shown in the attached Figure 2 shown.

[0054] In this embodiment, in step 4), as shown in the attached Figure 3 As shown, the method by which the signature verification module verifies the legitimacy of the key user application is: first, use the hardware password to decrypt the digital signature to obtain the hash function information (MD5 information) of the digital signature; then use the hardware password to perform the information digest algorithm (MD5 algorithm) on the encrypted data block to obtain the hash function information (MD5 information) of the encrypted data block; finally, compare the hash function information of the digital signature with the hash function information of the encrypted data block; if the two are the same, the verification passes and step 5 is executed; if the two are different, the verification fails and step 6 is executed.

[0055] In this embodiment, in step 5), as shown in the attached Figure 4 As shown, the method for the algorithm module to calculate the secret key is: the algorithm module first obtains the hardware password from the remote secret key request module, and then obtains the encrypted data block from the local secret key request module; finally, the hardware password is used to decrypt the encrypted data block to obtain the secret key.

[0056] A storage medium stores one or more programs. When the one or more programs are run by a processor, the steps of the method for implementing key storage by the software are executed.

[0057] Compared with the prior art, the key user of the present invention first obtains the digital signature corresponding to his hardware serial number from the remote server before obtaining the key, and then the key storage program uses the hardware password to decrypt the digital signature to obtain the hash function information (MD5) of the digital signature. At the same time, the hardware password is used to perform the information digest algorithm on the encrypted data block to obtain the hash function information (MD5) of the encrypted data block, and then the two MD5 information are compared. If they are the same, it means that the digital signature verification is passed. At this time, the key storage program can send the calculated key to the key user application. If the verification fails, it means that the province of the key user is illegal. At this time, even if the key user obtains the access right to the key storage directory, the key user application will not be able to obtain the key. Therefore, even if the target system of the present invention has been hacked, the system still has the ability to prevent key leakage, which greatly improves the security of information technology.

[0058] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit the technical solution. Those skilled in the art should understand that those modifications or equivalent substitutions of the technical solution of the present invention that do not depart from the purpose and scope of the technical solution should be included in the scope of the claims of the present invention.

Claims

1. A system for implementing key storage by software, characterized in that: It includes an operating system, a key storage program, a key user application, a remote server and a local storage; the key storage program runs on the operating system; The key user application is in a two-way communication connection with the remote server, for submitting its hardware serial number to the remote server and obtaining a digital signature from the remote server; The key user application is also connected to the key storage program in a two-way communication manner, for sending a digital signature to the key storage program and obtaining a decrypted key from the key storage program; The key storage program includes an application interface, an algorithm module, a signature verification module, a remote key request module and a local key request module; The application interface is bidirectionally connected to the key user application for obtaining a digital signature from the key user application and sending a decrypted key to the key user application; The signature verification module is used to verify the legitimacy of the key user application; first, the digital signature is decrypted using the hardware password to obtain the hash function information of the digital signature; then the information digest algorithm is performed on the encrypted data block using the hardware password to obtain the hash function information of the encrypted data block; finally, the hash function information of the digital signature is compared with the hash function information of the encrypted data block. If the two are the same, the verification is passed; if the two are different, the verification fails; The algorithm module is used to calculate the secret key and send the calculated secret key to the key user application through the application interface; The remote key request module is used to obtain the hardware password from the remote server; The local key request module is used to obtain the encrypted data block from the local memory.

2. The system for implementing key storage by software according to claim 1, characterized in that: The signature verification module is respectively communicated with the application interface, the remote key request module and the local key request module. The signature verification module is used to obtain the digital signature from the application interface, to obtain the hardware password from the remote key request module, and to obtain the encrypted data block from the local key request module, so as to calculate the digital signature and the encrypted data block respectively through the hardware password to verify the legitimacy of the key user application.

3. The system for implementing key storage by software according to claim 1, characterized in that: The algorithm module is respectively communicated with the application interface, the remote key request module and the local key request module. The algorithm module is used to obtain the hardware password from the remote key request module, and to obtain the encrypted data block from the local key request module, so as to decrypt the encrypted data block through the hardware password to obtain the key, and send the key to the key user application through the application interface.

4. A method for implementing key storage by software, characterized in that: A system for implementing key storage using the software as claimed in claim 1, comprising the following steps: Step 1) starting the operating system and initializing the key storage program; Step 2) the key user application is connected to the remote server for communication, the key user application submits its hardware serial number to the remote server and obtains a digital signature from the remote server; Step 3) The key user application transmits the digital signature to the key storage program through the application interface; Step 4) The signature verification module verifies the legitimacy of the key user application. If the verification passes, execute step 5). If the verification fails, execute step 6); Step 5) The algorithm module calculates the secret key and sends the calculated secret key to the key user application through the application interface; Step 6) End.

5. The method for implementing key storage by software according to claim 4, characterized in that: In step 1), the initialization of the key storage program includes: the local key request module obtains and stores the encrypted data block from the local memory, and the remote key request module obtains and stores the hardware password from the remote server through its hardware serial number.

6. The method for implementing key storage by software according to claim 5, characterized in that: In step 5), the algorithm module calculates the secret key in the following way: the algorithm module first obtains the hardware password from the remote secret key request module, and then obtains the encrypted data block from the local secret key request module; finally, the encrypted data block is decrypted using the hardware password to obtain the secret key.

7. A storage medium, characterized in that: The storage medium stores one or more programs, and when the one or more programs are executed by the processor, the steps of the method for implementing key storage by software as described in any one of claims 4 to 6 are executed.

Images