A method, apparatus, device, and storage medium for protecting private keys.

Abstract

This application discloses a private key protection method, apparatus, device, and storage medium, relating to the field of information security technology. The method includes: generating a pair of asymmetric keys in a trusted execution environment (TEX) of a privacy computing platform to obtain a first private key and a first public key; generating a symmetric key in the TEX; obtaining a second public key sent by a USBKey, and encrypting the first private key using the second public key to obtain an encrypted private key; encrypting the symmetric key using the first public key to obtain an encrypted symmetric key; when target data sent by a user terminal is received, sending the encrypted private key and the encrypted symmetric key to the user, decrypting the encrypted private key using the second private key embedded in the USBKey to obtain the first private key, decrypting the encrypted symmetric key using the first private key to obtain the symmetric key, and then encrypting the target data using the symmetric key. This application protects the security of the private key during transmission through the public key generated by the USBKey, making private key transmission more secure.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method, apparatus, device and storage medium for protecting private keys. Background Technology

[0002] With the rapid development of privacy computing, this technology has been widely applied across various industries. A key technology in privacy computing is cryptography. The security of the private key determines the data security in all environments during privacy computing, particularly during data transmission, data storage, and data operation verification. The carrying of the private key has become a new challenge in privacy computing. Therefore, how to solve the security issues of private key carrying, private key transmission, and private key verification has become a prominent problem that urgently needs to be addressed.

[0003] However, current methods for carrying, transmitting, and verifying private keys have the following drawbacks: private keys are easily copied and deleted; private keys are easily stolen during transmission due to the lack of protection; and private key verification is too complex and requires manual script execution. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a private key protection method, apparatus, device, and storage medium that can protect the security of private keys during transmission, enabling data providers to protect their private keys and avoiding the risk of leakage and copying during transmission, thus making private key transmission more secure. The specific solution is as follows:

[0005] Firstly, this application discloses a private key protection method applied to a privacy computing platform, comprising:

[0006] A pair of asymmetric keys is generated in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key;

[0007] Generate a symmetric key in the trusted execution environment;

[0008] Obtain the second public key embedded in the USBKey sent by the USBKey, and use the second public key to encrypt the first private key to obtain the encrypted private key;

[0009] The symmetric key is encrypted using the first public key to obtain the encrypted symmetric key;

[0010] When the target data sent by the user terminal is obtained, the encrypted private key and the encrypted symmetric key are sent to the user terminal. The encrypted private key is decrypted using the second private key built into the USBKey to obtain the first private key. The encrypted symmetric key is then decrypted using the first private key to obtain the symmetric key. Finally, the target data is encrypted using the symmetric key to obtain the target ciphertext.

[0011] Optionally, generating a pair of asymmetric keys in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key includes:

[0012] In the trusted execution environment of the privacy computing platform, a pair of asymmetric keys is generated through the key management service system to obtain a first private key and a first public key.

[0013] Optionally, obtaining the second public key embedded in the USBKey sent by the USBKey includes:

[0014] Obtain the second public key embedded in the USBKey, which is sent via user registration.

[0015] Optionally, after encrypting the target data using the symmetric key to obtain the target ciphertext, the method further includes:

[0016] The target ciphertext is sent to the privacy computing platform via the user terminal, so that the target ciphertext can be stored by the privacy computing platform.

[0017] Optionally, before generating a pair of asymmetric keys in the trusted execution environment of the privacy computing platform, the method further includes:

[0018] A public-private key pair is randomly generated using the USBKey to obtain the second public key and the second private key, and the second public key and the second private key are embedded in the USBKey.

[0019] Optionally, after encrypting the target data using the symmetric key to obtain the target ciphertext, the method further includes:

[0020] The target ciphertext is decrypted using the symmetric key to obtain the target data.

[0021] Optionally, before sending the encrypted private key and the encrypted symmetric key to the user terminal, the method further includes:

[0022] The user's identity is authenticated using the public key algorithm built into the USBKey. If the authentication is successful, the step of sending the encrypted private key and the encrypted symmetric key to the user is executed.

[0023] Secondly, this application discloses a private key protection device for use in a privacy computing platform, comprising:

[0024] An asymmetric key generation module is used to generate a pair of asymmetric keys in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key;

[0025] A symmetric key generation module is used to generate a symmetric key in the trusted execution environment.

[0026] The public key acquisition module is used to acquire the second public key embedded in the USBKey, which is sent by the USBKey;

[0027] A public key encryption module is used to encrypt the first private key using the second public key to obtain an encrypted private key;

[0028] A symmetric key encryption module is used to encrypt the symmetric key using the first public key to obtain an encrypted symmetric key;

[0029] The key distribution module is used to distribute the encrypted private key and the encrypted symmetric key to the user terminal when the target data sent by the user terminal is obtained;

[0030] The decryption module is used to decrypt the encrypted private key using the second private key built into the USBKey to obtain the first private key, and to decrypt the encrypted symmetric key using the first private key to obtain the symmetric key.

[0031] The data encryption module is used to encrypt the target data using the symmetric key to obtain the target ciphertext.

[0032] Thirdly, this application discloses an electronic device, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the aforementioned private key protection method.

[0033] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned private key protection method.

[0034] As can be seen, this application first generates an asymmetric key pair in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key. Then, it generates a symmetric key in the trusted execution environment. Next, it obtains a second public key embedded in the USBKey sent by the USBKey, and uses the second public key to encrypt the first private key to obtain an encrypted private key. Then, it uses the first public key to encrypt the symmetric key to obtain an encrypted symmetric key. When target data sent by the user terminal is obtained, the encrypted private key and the encrypted symmetric key are sent to the user terminal. The second private key embedded in the USBKey is used to decrypt the encrypted private key to obtain the first private key, and the first private key is used to decrypt the encrypted symmetric key to obtain the symmetric key. Finally, the symmetric key is used to encrypt the target data to obtain the target ciphertext. This application protects the security of the private key during transmission by using the public key generated at any time by the USBKey, enabling the data provider to protect their private key and avoiding the risk of leakage and copying of the private key during transmission, thus making private key transmission more secure. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0036] Figure 1 This is a flowchart of a private key protection method disclosed in this application;

[0037] Figure 2 This is a flowchart of a specific private key protection method disclosed in this application;

[0038] Figure 3 This is a flowchart of a specific private key protection method disclosed in this application;

[0039] Figure 4 This application discloses a specific private key signature verification flowchart;

[0040] Figure 5 This is a schematic diagram of a private key protection device disclosed in this application;

[0041] Figure 6 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0042] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0043] This application discloses a private key protection method applied to a privacy computing platform. See [link to relevant documentation]. Figure 1 As shown, the method includes:

[0044] Step S11: Generate a pair of asymmetric keys in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key.

[0045] In this embodiment, an asymmetric key pair is first generated at any time within the Trusted Execution Environment (TEE) of the privacy computing platform, resulting in a first private key and a first public key. The TEE enables trust based on the underlying architecture of the Intel hardware vendor, and its trustworthiness is guaranteed by the CPU (Central Processing Unit) architecture. Simultaneously, Intel's TEE service center remotely verifies the trusted identity of users accessing the TEE. For example, when a data participant needs to verify the trustworthiness of the TEE, a random number *r* is generated locally on the participant's end. The TEE then performs trusted authentication on the random number *r* and returns a trusted authentication report. When the data participant receives the trusted authentication report, it is automatically forwarded to Intel's TEE service center. The TEE service center then verifies whether the parameters of the TEE in the trusted authentication report have been modified. If modified, the TEE is considered untrustworthy; otherwise, it is considered trustworthy.

[0046] It should be noted that before generating a pair of asymmetric keys in the trusted execution environment of the privacy computing platform, the process specifically includes: randomly generating a pair of public and private keys using the USBKey to obtain the second public key and the second private key, and embedding the second public key and the second private key into the USBKey. That is, a pair of public and private keys is generated randomly using the USBKey beforehand, and then saved into the USBKey.

[0047] Specifically, generating a pair of asymmetric keys in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key may include: generating a pair of asymmetric keys in the trusted execution environment of the privacy computing platform through a key management service system to obtain a first private key and a first public key. That is, a pair of asymmetric keys can be generated based on the trusted execution environment of the privacy computing platform through a key management service (KMS) system.

[0048] Step S12: Generate a symmetric key in the trusted execution environment.

[0049] In this embodiment, after generating a pair of asymmetric keys to obtain a first private key and a first public key in the trusted execution environment of the privacy computing platform, a symmetric key is further generated in the trusted execution environment of the aforementioned privacy computing platform.

[0050] Step S13: Obtain the second public key embedded in the USBKey sent by the USBKey, and use the second public key to encrypt the first private key to obtain the encrypted private key.

[0051] In this embodiment, after generating a symmetric key in the trusted execution environment, the second public key sent by the USBKey and embedded in the USBKey is first obtained, and then the first private key is encrypted using the second public key to obtain the encrypted private key.

[0052] Step S14: Encrypt the symmetric key using the first public key to obtain the encrypted symmetric key.

[0053] In this embodiment, after encrypting the first private key with the second public key to obtain the encrypted private key, the first public key is then used to encrypt the symmetric key to obtain the corresponding encrypted symmetric key.

[0054] Step S15: When the target data sent by the user terminal is obtained, the encrypted private key and the encrypted symmetric key are sent to the user terminal. The encrypted private key is decrypted using the second private key built into the USBKey to obtain the first private key. The encrypted symmetric key is then decrypted using the first private key to obtain the symmetric key. Finally, the target data is encrypted using the symmetric key to obtain the target ciphertext.

[0055] In this embodiment, after encrypting the symmetric key with the first public key to obtain the encrypted symmetric key, when the target data sent by the user terminal is obtained, the encrypted private key and the encrypted symmetric key are first sent to the user terminal. Then, the script in the USBKey is automatically executed on the user terminal side, and the encrypted private key is decrypted with the second private key built into the USBKey to obtain the first private key. Then, the encrypted symmetric key is decrypted with the first private key to obtain the symmetric key. Further, the target data is encrypted with the symmetric key to obtain the corresponding target ciphertext.

[0056] In addition, before sending the encrypted private key and the encrypted symmetric key to the user terminal, the method further includes: authenticating the user terminal's identity using the public key algorithm built into the USBKey; if the authentication is successful, then the step of sending the encrypted private key and the encrypted symmetric key to the user terminal is executed. It should be noted that the USBKey is a hardware device with a USB interface, containing a microcontroller or smart card chip, and has a certain amount of storage space to store the user's private key and digital certificate information. The public key algorithm built into the USBKey can be used to authenticate the user's identity. Since the user's private key is stored in a password lock, it is theoretically impossible to read using any method; therefore, using a USBKey can ensure the security of user authentication. In this embodiment, when sending key information to the user terminal, to ensure the security of information transmission, the user terminal's identity can first be authenticated using the public key algorithm built into the USBKey; if the authentication is successful, then the corresponding information transmission operation is performed.

[0057] It should be noted that after encrypting the target data using the symmetric key to obtain the target ciphertext, the process may further include: sending the target ciphertext to the privacy computing platform via the user terminal, so that the privacy computing platform can store the target ciphertext. In this embodiment, to improve the security of target ciphertext storage, after the target ciphertext is generated on the user terminal, it can be sent to the privacy computing platform for storage.

[0058] Furthermore, after encrypting the target data using the symmetric key to obtain the target ciphertext, the process may further include: decrypting the target ciphertext using the symmetric key to obtain the target data. In this embodiment, to verify the signature of the private key, the second private key built into the USBKey can be used to decrypt the encrypted private key to obtain the first private key. Then, the first private key can be used to decrypt the encrypted symmetric key to obtain the symmetric key. Finally, the symmetric key can be used to decrypt the target ciphertext data to obtain the plaintext information, i.e., the target data. This completes the verification of the private key.

[0059] As can be seen, this embodiment first generates an asymmetric key pair in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key. Then, a symmetric key is generated in the trusted execution environment. Next, a second public key embedded in the USBKey is obtained and used to encrypt the first private key to obtain an encrypted private key. Then, the first public key is used to encrypt the symmetric key to obtain an encrypted symmetric key. When target data sent by the user terminal is received, the encrypted private key and the encrypted symmetric key are sent to the user terminal. The second private key embedded in the USBKey is used to decrypt the encrypted private key to obtain the first private key, and the first private key is used to decrypt the encrypted symmetric key to obtain the symmetric key. Finally, the symmetric key is used to encrypt the target data to obtain the target ciphertext. This embodiment protects the security of the private key during transmission by using the public key generated at any time by the USBKey, enabling the data provider to protect its own private key and avoiding the risk of leakage and copying of the private key during transmission, making private key transmission more secure.

[0060] This application discloses a specific private key protection method applied to a privacy computing platform. See [link to relevant documentation]. Figure 2 and Figure 3 As shown, the method includes:

[0061] Step S21: Generate a pair of asymmetric keys through the key management service system in the trusted execution environment of the privacy computing platform to obtain the first private key and the first public key.

[0062] In one specific implementation, see Figure 3As shown, a public-private key pair is first generated at any time via USBKey, resulting in private key UK1 and public key UK2. Then, the key management service system generates an asymmetric key pair within the trusted execution environment of the privacy computing platform, resulting in private key K1 and public key K2. It should be noted that the trusted execution environment uses hardware-generated keys. The key management service system is used for full lifecycle encryption during data flow, providing independent and unified key management. It supports an independent key management system, including functions such as encryption key generation, distribution, backup, recovery, and key non-disconnection from the device. Encryption keys are uniformly protected by a master key, which is generated and managed by the key management service system through a hardware cryptographic device, ensuring the security of the master key.

[0063] Step S22: Generate a symmetric key in the trusted execution environment.

[0064] Furthermore, a symmetric key K is generated in the aforementioned trusted execution environment through the key management service system.

[0065] Step S23: Obtain the second public key embedded in the USBKey sent by the user during registration, and use the second public key to encrypt the first private key to obtain the encrypted private key.

[0066] For example, after generating a symmetric key K in the trusted execution environment, the public key UK2 in the USBKey is sent to the privacy computing platform through user registration. After receiving the public key UK2, the privacy computing platform uses the public key UK2 to encrypt the private key K1 in the asymmetric key to obtain the encrypted private key UK12.

[0067] Step S24: Encrypt the symmetric key using the first public key to obtain the encrypted symmetric key.

[0068] Furthermore, the symmetric key K is encrypted using the public key K2 in the asymmetric key to obtain the encrypted symmetric key KK2.

[0069] Step S25: When the target data sent by the user terminal is obtained, the encrypted private key and the encrypted symmetric key are sent to the user terminal. The encrypted private key is decrypted using the second private key built into the USBKey to obtain the first private key. The encrypted symmetric key is then decrypted using the first private key to obtain the symmetric key. Finally, the target data is encrypted using the symmetric key to obtain the target ciphertext.

[0070] In one specific embodiment, when target data sent by the user terminal is received, the privacy computing platform sends the encrypted private key UK12 and the encrypted symmetric key KK2 to the user terminal. Then, the script in the USBkey is automatically executed on the user terminal, and the encrypted private key UK12 is decrypted using the private key UK1 to obtain the private key K1. Next, the encrypted symmetric key KK2 is decrypted using the private key K1 to obtain the symmetric key K. Finally, the symmetric key K is used locally on the user terminal to encrypt the local file to be encrypted, resulting in ciphertext KM. The ciphertext KM can be further uploaded to the privacy computing platform for storage. It is understood that the built-in script in the USBKey can automate private key verification, making it more convenient and secure to authorize datasets.

[0071] Additionally, see Figure 4 As shown, Figure 4 A specific private key verification process is illustrated. First, the USBKey is inserted into the privacy computing platform. Then, the encrypted private key UK12 is decrypted using the private key UK1 to obtain the private key K1. Next, the encrypted symmetric key KK2 is decrypted using the private key K1 to obtain the symmetric key K. Then, the ciphertext KM is synchronously entered into the trusted execution environment of the privacy computing platform, and the symmetric key K is also synchronously entered into the trusted execution environment so that the ciphertext KM can be decrypted using the symmetric key K to obtain the plaintext M.

[0072] As can be seen, the private key protection scheme proposed in this application encrypts the private key allocated by the privacy computing platform using the public key from the public-private key generated by the USBKey at any time, and verifies the private key signature through the USBKey on the user's local end. This enables the data provider to protect its own private key, prevent data security risks due to private key leakage, simplify the private key verification process, improve the user experience, eliminate the need for manual script execution, and make private key signature verification more convenient and secure. While protecting the security of the private key during transmission, it can quickly verify the private key signature and provide secondary confirmation of the user's authenticity.

[0073] Accordingly, this application also discloses a private key protection device applied to a privacy computing platform, see [link to relevant documentation]. Figure 5 As shown, the device includes:

[0074] The asymmetric key generation module 11 is used to generate a pair of asymmetric keys in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key;

[0075] Symmetric key generation module 12 is used to generate a symmetric key in the trusted execution environment;

[0076] Public key acquisition module 13 is used to acquire the second public key embedded in the USBKey sent by the USBKey;

[0077] The public key encryption module 14 is used to encrypt the first private key using the second public key to obtain the encrypted private key;

[0078] The symmetric key encryption module 15 is used to encrypt the symmetric key using the first public key to obtain the encrypted symmetric key;

[0079] The key distribution module 16 is used to distribute the encrypted private key and the encrypted symmetric key to the user terminal when the target data sent by the user terminal is obtained.

[0080] The decryption module 17 is used to decrypt the encrypted private key using the second private key built into the USBKey to obtain the first private key, and to decrypt the encrypted symmetric key using the first private key to obtain the symmetric key.

[0081] The data encryption module 18 is used to encrypt the target data using the symmetric key to obtain the target ciphertext.

[0082] The specific workflow of each of the above modules can be found in the relevant content disclosed in the foregoing embodiments, and will not be repeated here.

[0083] As can be seen, in this embodiment, an asymmetric key pair is first generated in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key. Then, a symmetric key is generated in the trusted execution environment. Next, a second public key embedded in the USBKey is obtained and used to encrypt the first private key to obtain an encrypted private key. Then, the first public key is used to encrypt the symmetric key to obtain an encrypted symmetric key. When target data sent by the user terminal is received, the encrypted private key and the encrypted symmetric key are sent to the user terminal. The second private key embedded in the USBKey is used to decrypt the encrypted private key to obtain the first private key, and the first private key is used to decrypt the encrypted symmetric key to obtain the symmetric key. Finally, the symmetric key is used to encrypt the target data to obtain the target ciphertext. This embodiment protects the security of the private key during transmission by using the public key generated at any time by the USBKey, enabling the data provider to protect its own private key and avoiding the risk of leakage and copying of the private key during transmission, making private key transmission more secure.

[0084] In some specific embodiments, the asymmetric key generation module 11 may specifically include:

[0085] The first asymmetric key generation unit is used to generate a pair of asymmetric keys through the key management service system in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key.

[0086] In some specific embodiments, the public key acquisition module 13 may specifically include:

[0087] The public key acquisition unit is used to acquire the second public key embedded in the USBKey, which is sent by the USBKey through user registration.

[0088] In some specific embodiments, after the data encryption module 18, it may further include:

[0089] The encrypted text sending unit is used to send the target encrypted text to the privacy computing platform through the user terminal;

[0090] A ciphertext storage unit is used to store the target ciphertext through the privacy computing platform.

[0091] In some specific embodiments, the asymmetric key generation module 11 may be preceded by:

[0092] The second asymmetric key generation unit is used to randomly generate a public-private key pair using the USBKey to obtain the second public key and the second private key;

[0093] A storage unit is used to embed the second public key and the second private key into the USBKey.

[0094] In some specific embodiments, after the data encryption module 18, it may further include:

[0095] The ciphertext decryption unit is used to decrypt the target ciphertext using the symmetric key to obtain the target data.

[0096] In some specific embodiments, before the key distribution module 16, there may be:

[0097] The identity authentication unit is used to authenticate the identity of the user terminal using the public key algorithm built into the USBKey. If the authentication is successful, the unit executes the step of sending the encrypted private key and the encrypted symmetric key to the user terminal.

[0098] Furthermore, embodiments of this application also disclose an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0099] Figure 6This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the private key protection method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0100] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0101] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0102] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the private key protection method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0103] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed private key protection method. The specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0104] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0105] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0106] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0107] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0108] The above provides a detailed description of a private key protection method, apparatus, device, and storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A private key protection method characterized by, The application is applied to a privacy computing platform, and comprises the following steps: generating a pair of asymmetric keys in a trusted execution environment of the privacy computing platform to obtain a first private key and a first public key; generating a symmetric key in the trusted execution environment; obtaining a second public key sent by a USBKey and built in the USBKey, and encrypting the first private key by using the second public key to obtain an encrypted private key; encrypting the symmetric key by using the first public key to obtain an encrypted symmetric key; when target data sent by a user end is obtained, the encrypted private key and the encrypted symmetric key are issued to the user end, so that the first private key is decrypted by using a second private key built in the USBKey, the symmetric key is decrypted by using the first private key, the target data is encrypted by using the symmetric key to obtain target ciphertext, and the target ciphertext is sent to the privacy computing platform by the user end, so that the target ciphertext is stored by the privacy computing platform. The method further comprises the following steps: obtaining a random number generated locally by a data participant, then performing trusted authentication on the random number by a trusted execution environment, and returning a trusted authentication report; verifying, by a trusted execution environment service center, whether the parameters of the trusted execution environment of the trusted authentication report are changed, if the parameters are changed, it is indicated that the trusted execution environment is untrusted, and if the parameters are not changed, it is indicated that the trusted execution environment is trusted. Before the step of issuing the encrypted private key and the encrypted symmetric key to the user end, the following step is further included: authenticating the identity of the user end by using a public key algorithm built in the USBKey, and if the authentication is passed, the step of issuing the encrypted private key and the encrypted symmetric key to the user end is performed.

2. The private key protection method of claim 1, wherein, The step of generating a pair of asymmetric keys in a trusted execution environment of the privacy computing platform to obtain a first private key and a first public key comprises the following steps: generating a pair of asymmetric keys in a trusted execution environment of the privacy computing platform by a key management service system to obtain a first private key and a first public key.

3. The private key protection method of claim 1, wherein, The step of obtaining a second public key sent by a USBKey and built in the USBKey comprises the following steps: obtaining a second public key sent by a USBKey and built in the USBKey by a user registration mode.

4. The private key protection method of claim 1, wherein, After the step of encrypting the target data by using the symmetric key to obtain target ciphertext, the following steps are further included: sending the target ciphertext to the privacy computing platform by the user end, so that the target ciphertext is stored by the privacy computing platform.

5. The private key protection method of claim 1, wherein, Before the step of generating a pair of asymmetric keys in a trusted execution environment of the privacy computing platform, the following steps are further included: randomly generating a pair of public and private keys by the USBKey to obtain the second public key and the second private key, and building the second public key and the second private key in the USBKey.

6. The private key protection method of claim 1, wherein, After the step of encrypting the target data by using the symmetric key to obtain target ciphertext, the following steps are further included: decrypting the target ciphertext by using the symmetric key to obtain the target data.

7. A private key protection apparatus, characterized by comprising: The application is applied to a privacy computing platform, and comprises the following steps: an asymmetric key generation module configured to generate a pair of asymmetric keys in a trusted execution environment of the privacy computing platform, to obtain a first private key and a first public key; a symmetric key generation module configured to generate a symmetric key in the trusted execution environment; a public key acquisition module configured to acquire a second public key sent by the USBKey and built in the USBKey; a public key encryption module configured to encrypt the first private key by using the second public key, to obtain an encrypted private key; a symmetric key encryption module configured to encrypt the symmetric key by using the first public key, to obtain an encrypted symmetric key; a key distribution module configured to distribute the encrypted private key and the encrypted symmetric key to a user terminal when target data sent by the user terminal is acquired; a decryption module configured to decrypt the encrypted private key by using a second private key built in the USBKey to obtain the first private key, and decrypt the encrypted symmetric key by using the first private key to obtain the symmetric key; a data encryption module configured to encrypt the target data by using the symmetric key to obtain target ciphertext; the apparatus is further configured to acquire a random number generated locally by a data participant, then perform trusted authentication on the random number by a trusted execution environment, and return a trusted authentication report; verify, by a trusted execution environment service center, whether parameters of the trusted execution environment of the trusted authentication report are changed, if the parameters are changed, it indicates that the trusted execution environment is not trusted, if the parameters are not changed, it indicates that the trusted execution environment is trusted; and authenticate the identity of the user terminal by using a public key algorithm built in the USBKey, if the authentication is passed, the step of distributing the encrypted private key and the encrypted symmetric key to the user terminal is executed.

8. An electronic device, comprising: a processor and a memory; wherein the processor implements the private key protection method in any one of claims 1 to 6 when executing a computer program saved in the memory.

9. A computer-readable storage medium, characterized in that, a computer program; wherein the computer program is executed by a processor to implement the private key protection method in any one of claims 1 to 6.

Images