A key management method and system

Abstract

The present invention relates to a key management method and system, and belongs to the technical field of computer software. The method of the present invention is applied in resource-constrained devices such as smart cards, security elements, and security MCUs. Keys are managed and used through key identifiers. The key identifier is a positive integer that can uniquely identify the key. The key identifier is specified in advance by a programmer or generated when a key management module creates a key. When the key identifier is specified in advance by a programmer, the application does not need to save the key identifier; a key manager class is created to uniformly manage related keys, including operations such as creation, initialization, clearing key data, and deleting keys of various types of keys; related keys can be uniformly stored and accessed, which can save persistent storage space and improve the access speed of keys.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer software, and in particular relates to a key management method and system. Background Art

[0002] Traditional platforms that support writing applications in object-oriented programming languages ​​provide an application programming interface API for key operations. Applications can call the key API to perform key-related operations, define the key super interface Key and various sub-interfaces to represent the management operations of different keys. Keys are divided into symmetric keys and asymmetric keys. Symmetric keys can have different key lengths. Asymmetric keys are composed of public and private key pairs. Different types of asymmetric keys are composed of multiple so-called key components. Each key is implemented by a corresponding key class. The key class should implement the corresponding key interface defined by the API; the key factory method class can create the corresponding key and return the corresponding key super interface reference, hereinafter referred to as the key reference. The application needs to convert the key super interface to the interface of the corresponding key type and call the key-specific interface method to perform key operations.

[0003] This implementation method has the following disadvantages: defining an interface for each key makes the implementation and use of the key API complex; the application needs to save the key reference of each key; the interface method call is slow to execute; each key needs an object (also called an instance) of the key class to save, and each object needs to have an object header, which increases the storage space required to save the key data. Therefore, the existing technical method has the problems of complex implementation and use, low execution efficiency, and large storage space occupation when performing key security management in resource-constrained devices. Summary of the invention

[0004] In view of the defects existing in the prior art, the purpose of the present invention is to provide a key management method and system, which can greatly save the storage space of the key, reduce the bytecode size of the application, and improve the access speed of the key.

[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is:

[0006] A key management method is applied in a resource-constrained device, wherein the software system of the resource-constrained device includes an application layer, an operating environment layer, and a cryptographic computing application programming interface module therebetween, and the method includes the following steps:

[0007] Formulate key identifiers for various types of keys;

[0008] Creating a key management module and a cryptographic calculation module in the operating environment layer, assigning key identifiers to various keys, and managing related keys in a unified manner through the key identifiers;

[0009] When the cryptographic calculation module accesses the key in the key management module, the cryptographic calculation module uses the specified key in the cryptographic calculation module to perform a cryptographic operation on the key in the key management module, and the type of the specified key matches the cryptographic algorithm operation in progress;

[0010] The application in the application layer accesses the key in the operating environment layer through the cryptographic computing application programming interface module.

[0011] Furthermore, in the key management method as described above, the key identifier of each key is a unique positive integer.

[0012] Furthermore, in the key management method described above, the key identifiers of various types of keys are pre-specified by the user; or the key identifiers of various types of keys are specified by the key management module, and the key management module returns the corresponding key identifier when creating a key.

[0013] Furthermore, the key management method as described above manages related keys in a unified manner by creating a key manager class and a key manager object in the key management module, and the management operations include creating keys, initializing keys, setting the default key of a specified algorithm, clearing key data, deleting keys, returning symmetric key data, setting symmetric key data, returning key component data of an asymmetric key, setting key component data of an asymmetric key, generating key pairs and setting the current operation key.

[0014] Furthermore, in the key management method as described above, the key management module uses a specific derivation algorithm to derive keys and uniformly stores and accesses the derived related keys.

[0015] Furthermore, in the key management method as described above, when the cryptographic calculation module accesses the key in the key management module, the cryptographic calculation module first selects the specified key in the key manager module, and uses the specified key to perform cryptographic operations on the keys in the key management module; or specifies a default key for a certain type of algorithm, and the cryptographic calculation module uses the default key to perform cryptographic operations of that type.

[0016] A key management system is applied in a resource-constrained device, the system comprises an application layer, an operating environment layer and a cryptographic computing application programming interface module, and the application in the application layer accesses the device-level function provided by the operating environment layer through the cryptographic computing application programming interface module;

[0017] The operating environment layer includes a key management module and a cryptographic calculation module. The key management module is used to uniformly manage related keys through key identifiers; the cryptographic calculation module is used to use the specified key in the cryptographic calculation module to perform cryptographic operations on the keys in the key management module, and the type of the specified key matches the ongoing cryptographic algorithm operation.

[0018] Furthermore, in the key management system as described above, the key identifier of each key is a unique positive integer.

[0019] Furthermore, in the key management system as described above, the key identifiers of various types of keys are pre-specified by the user; or the key identifiers of various types of keys are specified by the key management module, and the key management module returns the corresponding key identifier when creating a key.

[0020] Furthermore, in the key management system as described above, the key management module uniformly manages the relevant keys by creating a key manager class and a key manager object, and the management operations include creating keys, initializing keys, setting the default key of a specified algorithm, clearing key data, deleting keys, returning symmetric key data, setting symmetric key data, returning key component data of an asymmetric key, setting key component data of an asymmetric key, generating key pairs and setting the current operation key.

[0021] Furthermore, in the key management system as described above, the key management module includes a key derivation module and a key storage module, the key derivation module is used to derive keys using a specific derivation algorithm and transmit the derived keys to the key storage module; the key storage module uniformly stores and accesses the derived keys.

[0022] Furthermore, in the key management system as described above, when the cryptographic calculation module accesses the key in the key management module, the cryptographic calculation module selects the specified key in the key manager module, and uses the specified key to perform cryptographic operations on the keys in the key management module; or specifies a default key for a certain type of algorithm, and the cryptographic calculation module uses the default key to perform cryptographic operations of that type.

[0023] The beneficial effects of the present invention are: using the method and system described in the present invention, keys are managed and used through key identifiers, and the key identifiers are specified in advance by programmers or generated when the key management module creates the key. If the key identifier is specified by the programmer, the application does not need to save the key reference; a key manager class is created to uniformly manage related keys, including operations such as creation, initialization, clearing key data, and deletion of various types of keys; related keys can be uniformly stored and accessed, which can save persistent storage space and improve the access speed of the keys; before using the key, it is necessary to first select the specified key in the key manager, and the type of the key needs to match the ongoing cryptographic algorithm operation; if there are multiple keys of the same type, the user can specify a key as the default key, and the default key can be used without explicit selection. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 is a flow chart of the method of the present invention;

[0025] Figure 2 It is a schematic diagram of the structure of the system of the present invention;

[0026] Figure 3 It is another structural schematic diagram of the system of the present invention. DETAILED DESCRIPTION

[0027] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments.

[0028] The present invention describes a key management method and system, which are applied to resource-constrained devices. The key management method is executed by a key management system installed in resource-constrained devices such as smart cards, security elements and security MCUs. Some key technologies involved in the embodiments of the present application are explained below.

[0029] like Figure 2 and Figure 3 As shown, the key management system can be configured in a resource-constrained device, which includes an application layer 110, an operating environment layer 120 and a cryptographic computing application programming interface module 111. The applications in the application layer 110 access the device-level functions provided by the operating environment layer 120 through the cryptographic computing application programming interface module 111.

[0030] The operating environment layer 120 includes a key management module 121 and a cryptographic calculation module 122, wherein:

[0031] The key management module 121 is used to uniformly manage related keys through key identifiers. The key identifier of each key is a unique positive integer. For example, the key identifier may include two parts: the key algorithm type and the key index. The specific format is as follows:

[0032] short KeyID=(byte)keyType<<8|(byte)keyIndex

[0033] Among them, keyType indicates the key algorithm type, which is 1 byte long. Other attributes of the key, such as key length, storage memory type, and whether to encrypt, need to be set separately. keyIndex indicates the key index, which is 1 byte long. Each type of key is numbered separately starting from 0. The public key and private key of the key pair use the same index.

[0034] In a specific embodiment, the key identifiers of various keys are pre-specified by programmers and only need to conform to the above-mentioned key identifier format, without defining variables to store the key identifier of each key.

[0035] In a specific embodiment, the key identifier is specified by the key management module 121 in the operating environment layer 120. The key management module 121 returns the key identifier when creating a key. The programmer does not need to specify the key identifier, but the application in the application layer 110 needs to save the key identifier of each key.

[0036] In a specific embodiment, the key management module 121 manages the related keys in a unified manner by creating a key manager class and a key manager object. The key management module 121 includes the following key management operations: create a key; delete a key; clear key data; query whether the key is initialized; set the default key of the specified algorithm; return symmetric key data; set symmetric key data; return key component data of an asymmetric key; set key component data of an asymmetric key; generate a key pair; set the current operation key, etc.

[0037] For example, you can create three key manager classes to manage related keys in a unified manner, namely:

[0038] An abstract base class for key managers that implement symmetric and non-object key sharing operations;

[0039] Symmetric key manager class, which inherits the abstract base class of key manager and is used to implement management operations specific to symmetric keys;

[0040] The asymmetric key manager class inherits the abstract base class of the key manager and is used to implement management operations specific to asymmetric keys.

[0041] For example, one or more key manager objects can be created to manage related keys as needed. For example, two key manager objects can be created for signature and encryption / decryption, which are used to manage signature keys and encryption / decryption keys respectively. Alternatively, keys involved in a business can be managed by one or more key manager objects as needed by the business process.

[0042] The key management module 121 further includes a key derivation module 1211 and a key storage module 1212, wherein: the key derivation module 1211 is used to derive keys using a specific derivation algorithm and transmit the derived keys to the key storage module 1212; the key storage module 1212 uniformly stores and accesses the derived keys.

[0043] In a specific embodiment, objects and arrays are used to implement functions similar to ISO7816-4 record files, which are used to store key data and access keys through record numbers. Objects need to have object headers for management, and access to objects requires attachment checks such as firewall checks. Compared with the method that each key requires an object to implement, storing and accessing related keys in a unified manner can save persistent storage space for key data and increase the speed of accessing keys.

[0044] The cryptographic calculation module 122 is used to use the specified key in the cryptographic calculation module to perform cryptographic operations on the keys in the key management module. The type of the specified key needs to match the cryptographic algorithm operation in progress. Before using the key, the cryptographic calculation module 122 generally needs to select the specified key in the key management module 121 and use the specified key to perform cryptographic operations on the keys in the key management module; if there are multiple keys of the same type, the user can specify a key as the default key, and the cryptographic calculation module uses the default key to perform cryptographic operations of this type.

[0045] The present invention provides a key management method, such as Figure 1 As shown, the key management method of the present invention comprises the following steps:

[0046] S1. Establish key identifiers for various types of keys.

[0047] Specifically, the key identifier of each key is a unique positive integer. For example, the key identifier may include the key algorithm type and the key index, and the specific format is as follows:

[0048] short KeyID=(byte)keyType<<8|(byte)keyIndex

[0049] Among them, keyType indicates the key algorithm type, which is 1 byte long. Other attributes of the key, such as key length, storage memory type, and whether to encrypt, need to be set separately. keyIndex indicates the key index, which is 1 byte long. Each type of key is numbered separately starting from 0. The public key and private key of the key pair use the same index.

[0050] The key types of commonly used key algorithms are as follows:

[0051] Symmetric key type

[0052] ALG_TYPE_DES

[0053] ALG_TYPE_AES

[0054] ALG_TYPE_SM4

[0055] ALG_TYPE_HMAC

[0056] ALG_TYPE_KOREAN_SEED

[0057] Asymmetric key types

[0058] DSA key pair

[0059] ALG_TYPE_DSA_PRIVATE

[0060] ALG_TYPE_DSA_PUBLIC

[0061] Elliptic curve algorithm key pair

[0062] ALG_TYPE_EC_F2M_PRIVATE

[0063] ALG_TYPE_EC_F2M_PUBLIC

[0064] ALG_TYPE_EC_FP_PRIVATE

[0065] ALG_TYPE_EC_FP_PUBLIC

[0066] ALG_TYPE_SM2_PRIVATE

[0067] ALG_TYPE_SM2_PUBLIC

[0068] RSA key pair

[0069] ALG_TYPE_RSA_CRT_PRIVATE

[0070] ALG_TYPE_RSA_PRIVATE

[0071] ALG_TYPE_RSA_PUBLIC

[0072] S2. Create a key management module and a cryptographic calculation module in the operating environment layer, assign key identifiers to various types of keys, and manage related keys in a unified manner through the key identifiers.

[0073] In a specific embodiment, the key identifiers of various keys are pre-specified by programmers and only need to conform to the above-mentioned key identifier format, without defining variables to store the key identifier of each key.

[0074] In a specific embodiment, the key identifier is specified by the key management module 121 in the operating environment layer 120. The key management module 121 returns the key identifier when creating a key. The programmer does not need to specify the key identifier, but the application in the application layer 110 needs to save the key identifier of each key.

[0075] In a specific embodiment, various keys are uniformly managed by creating a key manager class and a key manager object in the key management module 121. Specifically, the key management operations include: creating a key; deleting a key; clearing key data; querying whether a key is initialized; setting a default key for a specified algorithm; returning symmetric key data; setting symmetric key data; returning key component data of an asymmetric key; setting key component data of an asymmetric key; generating a key pair; setting the current operation key, etc.

[0076] For example, the key management module 121 manages related keys in a unified manner by creating three key manager classes, and the three key manager classes are:

[0077] An abstract base class for key managers that implement symmetric and non-object key sharing operations;

[0078] Symmetric key manager class, which inherits the abstract base class of key manager and is used to implement management operations specific to symmetric keys;

[0079] The asymmetric key manager class inherits the abstract base class of the key manager and is used to implement management operations specific to asymmetric keys.

[0080] For example, the key management module 121 creates one or more key manager objects as needed to manage relevant keys. For example, two key manager objects are created according to signature and encryption and decryption, which are used to manage signature keys and encryption and decryption keys respectively; or according to business process needs, the keys involved in a certain business can be managed by one or more key manager objects.

[0081] The following points need to be explained:

[0082] Each operation requires specifying the key identifier to be operated on;

[0083] First create the key and set the key attributes before setting the key value;

[0084] The specified key identifier can be used to repeatedly set the key attribute. If the key value has been set, it needs to be cleared.

[0085] The key can be used only after it has been initialized.

[0086] The key management module 121 uses a specific derivation algorithm to derive keys and uniformly stores and accesses the derived key data.

[0087] In a specific embodiment, objects and arrays are used to implement functions similar to ISO7816-4 record files, which are used to store key data and access keys through record numbers. Objects need to have object headers for management, and access to objects requires attachment checks such as firewall checks. Compared with the method that each key requires an object to implement, storing and accessing related keys in a unified manner can save persistent storage space for key data and increase the speed of accessing keys.

[0088] S3. When the cryptographic calculation module accesses the key in the key management module, it uses the specified key in the cryptographic calculation module to perform cryptographic operations on the key in the key management module, and the type of the specified key matches the ongoing cryptographic algorithm operation.

[0089] Specifically, in the operating environment layer 120, the key manager object is passed to the object of the cryptographic calculation module 122 class, and the association between the key manager object and the object of the cryptographic calculation module class is realized, and the object of the cryptographic calculation module 122 class can access the key in the key management module. When the cryptographic calculation module accesses the key in the key management module, the cryptographic calculation module first needs to select the specified key in the key manager module, and use the specified key to perform cryptographic operations on the key in the key management module; or specify a default key for a certain type of algorithm, and the cryptographic calculation module uses the default key to perform cryptographic operations of this type.

[0090] S4. The application in the application layer accesses the key in the operating environment layer through the cryptographic computing application programming interface module.

[0091] The key management method and system of the present invention are applied to resource-constrained devices. The beneficial effects of the technical solution of the present invention are as follows: the key is managed and used through the key identifier, which is specified in advance by the programmer or generated by the key management module when creating the key, and the application does not need to save the key reference; a key manager class is created to uniformly manage the relevant keys, including the creation, initialization, clearing of key data, deletion of keys and other operations of various types of keys; the relevant keys can be uniformly stored and accessed, which can save persistent storage space and improve the access speed of the keys; before using the key, it is necessary to first select the specified key in the key manager, and the type of the key needs to match the ongoing cryptographic algorithm operation; if there are multiple keys of the same type, the user can specify a key as the default key, and the default key can be used without explicit selection. This method can greatly save the storage space of the key, reduce the bytecode size of the application, and improve the access speed of the key.

[0092] Those skilled in the art should understand that the method and system described in the present invention are not limited to the embodiments described in the specific implementation manner, and the above specific description is only for the purpose of explaining the present invention, and is not used to limit the present invention. Those skilled in the art can derive other implementation methods according to the technical solution of the present invention, which also belong to the technical innovation scope of the present invention, and the protection scope of the present invention is defined by the claims and their equivalents.

Claims

1. A key management method, applied in a resource-constrained device, characterized in that: The software system of the resource-limited device includes an application layer, an operating environment layer, and a cryptographic computing application programming interface module therebetween. The method includes the following steps: A key management module and a cryptographic calculation module are created in the operating environment layer. A user creates one or more key manager objects in the key management module through an application programming interface to uniformly manage related keys, and assigns key identifiers to various keys in the key manager object. The management operations include creating keys, initializing keys, setting default keys for a specified algorithm, clearing key data, deleting keys, returning symmetric key data, setting symmetric key data, returning key component data of an asymmetric key, setting key component data of an asymmetric key, generating key pairs, and setting current operation keys. When the cryptographic calculation module accesses the key in the key management module, the cryptographic calculation module uses the specified key in the cryptographic calculation module to perform cryptographic operations on the key in the key management module, and the type of the specified key matches the cryptographic algorithm operation in progress; or a default key is specified for a certain type of algorithm, and the cryptographic calculation module uses the default key to perform cryptographic operations of this type; The application in the application layer accesses the key in the operating environment layer through the cryptographic computing application programming interface module.

2. The key management method according to claim 1, characterized in that: The key identifier of each key in the key manager is a unique positive integer.

3. The key management method according to claim 2, characterized in that: The key identifiers of various keys in each key manager are pre-specified by the user; or the key identifiers of various keys are specified by the key management module, and the key management module returns the corresponding key identifier when creating a key in the key manager.

4. The key management method according to any one of claims 1 to 3, characterized in that: The key management module uses a specific derivation algorithm to derive keys and uniformly stores and accesses the derived related keys.

5. A key management system, applied in a resource-constrained device, characterized in that: The system includes an application layer, an operating environment layer and a cryptographic computing application programming interface module, and the application in the application layer accesses the device-level functions provided by the operating environment layer through the cryptographic computing application programming interface module; The operating environment layer includes a key management module and a cryptographic calculation module. The key management module is used to manage related keys in a unified manner by creating one or more key manager objects, assign key identifiers to various keys in the key manager objects, and the management operations include creating keys, initializing keys, setting default keys for specified algorithms, clearing key data, deleting keys, returning symmetric key data, setting symmetric key data, returning key component data of an asymmetric key, setting key component data of an asymmetric key, generating key pairs, and setting current operation keys. When the cryptographic calculation module accesses the key in the key management module, it uses the specified key in the cryptographic calculation module to perform cryptographic operations on the key in the key management module, and the type of the specified key matches the ongoing cryptographic algorithm operation; or a default key is specified for a certain type of algorithm, and the cryptographic calculation module uses the default key to perform cryptographic operations of this type.

6. The key management system according to claim 5, characterized in that: The key identifier of each key in the key manager object is a unique positive integer.

7. The key management system according to claim 6, characterized in that: The key identifiers of various keys of each key manager object are pre-specified by the user; or the key identifiers of various keys are specified by the key management module, and the key management module returns the corresponding key identifier when creating a key in the key manager object.

8. The key management system according to any one of claims 5 to 7, characterized in that: The key management module includes a key derivation module and a key storage module, wherein the key derivation module is used to derive a key using a specific derivation algorithm and transmit the derived key to the key storage module; The key storage module uniformly stores and accesses the derived keys.

Images