An encryption method, a decryption method, an edge node and a management node

Abstract

The application provides an encryption method, a decryption method, an edge node and a management node. The method comprises the following steps: obtaining a first key of the management node; at least transmitting a second key of the edge node and a first running environment parameter to the management node, so that the management node determines a first encryption factor based on the first running environment parameter and a second running environment parameter of the management node; obtaining the first encryption factor, determining an encryption key based on the first encryption factor, the first key and a fourth key corresponding to the second key, the encryption key being used for encrypting data of the edge node to obtain encrypted data; performing privacy processing on the first encryption factor to obtain a first privacy value; and transmitting information associated with the first privacy value to the management node, so that the management node stores information associated with the first running environment parameter and the first privacy value.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to an encryption method, a decryption method, an edge node, and a management node. Background Technology

[0002] Currently, edge computing networks suffer from low security protection for edge nodes, leading to a significant risk of data leakage and low data security at edge nodes. Summary of the Invention

[0003] This application provides the following technical solution:

[0004] This application provides an encryption method for use in edge nodes, the method comprising:

[0005] Obtain the first key of the management node;

[0006] At least the second key and the first operating environment parameters of the edge node are passed to the management node, so that the management node can determine the first encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node;

[0007] The first encryption factor is obtained, and an encryption key is determined based on the first encryption factor, the first key, and the fourth key corresponding to the second key. The encryption key is used to encrypt the data of the edge node to obtain encrypted data.

[0008] The first encryption factor is processed for privacy to obtain a first privacy value;

[0009] The information associated with the first privacy value is transmitted to the management node, so that the management node can store the first operating environment parameters and the information associated with the first privacy value together.

[0010] The method further includes:

[0011] Obtain the first security factor and the second security factor of the management node;

[0012] At least the second key and first runtime environment parameters of the edge node are transmitted to the management node, so that the management node determines the first encryption factor based on the first runtime environment parameters and the management node's second runtime environment parameters, including:

[0013] Based on the second security factor, the first key and the first security factor are determined to be complete. The second key, the first security factor, and the first operating environment parameters are then subjected to security processing to obtain the third security factor. Based on the first key, the second key, the first security factor, the first operating environment parameters, and the third security factor are then encrypted to obtain the first encrypted information.

[0014] The first encrypted information is transmitted to the management node, so that the management node decrypts the first encrypted information based on the third key corresponding to the first key, obtaining the second key, the first security factor, the first operating environment parameters, and the third security factor; and,

[0015] Based on the third security factor, it is determined that the second key, the first security factor, and the first operating environment parameters are complete, and based on the first security factor, it is determined that the second key and the first operating environment parameters have not been tampered with. Based on the first operating environment parameters and the second operating environment parameters of the management node, the first encryption factor is determined.

[0016] Obtaining the first encryption factor includes:

[0017] Obtain second encrypted information, which is obtained by the management node encrypting the first encryption factor and the fourth security factor based on the second key;

[0018] The second encrypted information is decrypted based on the fourth key corresponding to the second key to obtain the first encryption factor and the fourth security factor.

[0019] The information associated with the first privacy value is transmitted to the management node, so that the management node can associate and store the first operating environment parameters and the information associated with the first privacy value, including:

[0020] The information and the fourth security factor are encrypted using the first key to obtain third encrypted information. This third encrypted information is then transmitted to the management node, enabling the management node to decrypt the third encrypted information using the third key corresponding to the first key, thereby obtaining the information and the fourth security factor.

[0021] Based on the fourth security factor, it is determined that the information has not been tampered with, and the information associated with the first operating environment parameter and the first privacy value is stored together.

[0022] The first security factor includes: a first random number;

[0023] The second security factor includes: first signature data obtained by signing the first random number and the first key based on the third key corresponding to the first key;

[0024] The third security factor includes: second signature data obtained by signing the second key, the first security factor, and the first operating environment parameters based on the fourth key corresponding to the second key.

[0025] The fourth security factor includes: a second random number.

[0026] The first operating environment parameters include: the first identifier of the security chip of the edge node and the physical address of the edge node;

[0027] The second operating environment parameter includes: the second identifier of the security chip of the management node;

[0028] The information associated with the first privacy value includes: first information representing the identity of the register where the first privacy value is located and the privacy processing algorithm used to perform privacy processing on the first encryption factor.

[0029] This application also provides a decryption algorithm applied to edge nodes, the method comprising:

[0030] Obtain the first key of the management node;

[0031] At least the second key and the first operating environment parameters of the edge node are passed to the management node so that the management node can obtain information associated with the first privacy value based on the first operating environment parameters. The information associated with the first privacy value is determined based on the encryption method of any one of claims 1-6.

[0032] Obtain the information associated with the first privacy value, and obtain the first privacy value based on the information associated with the first privacy value;

[0033] The first privacy value is sent to the management node so that the management node determines the second encryption factor based on the first operating environment parameter and the second operating environment parameter of the management node, performs privacy processing on the second encryption factor to obtain the second privacy value, and if the first privacy value and the second privacy value are consistent, the second encryption factor is sent to the edge node.

[0034] The decryption key is determined based on the second encryption factor, the first key, and the fourth key corresponding to the second key, and the encrypted data is decrypted based on the decryption key.

[0035] The method further includes:

[0036] Obtain the fifth and sixth security factors of the management node;

[0037] At least the second key and the first operating environment parameters of the edge node are passed to the management node so that the first operating environment parameters obtain information associated with the first privacy value, and the information associated with the first privacy value is sent to the edge node, including:

[0038] Based on the sixth security factor, the first key and the fifth security factor are determined to be complete. The first operating environment parameters, the fifth security factor, and the second key are then subjected to security processing to obtain the seventh security factor.

[0039] The first operating environment parameters, the fifth security factor, the second key, and the seventh security factor are encrypted based on the first key to obtain the fourth encrypted information;

[0040] The fourth encrypted information is transmitted to the management node, so that the management node can decrypt the fourth encrypted information to obtain the first operating environment parameters, the fifth security factor, the second key, and the seventh security factor; and,

[0041] Based on the seventh security factor, it is determined that the first operating environment parameters, the fifth security factor, and the second key are complete. Furthermore, based on the fifth security factor, it is determined that the first operating environment parameters and the second key have not been tampered with. Based on the first operating environment parameters, information associated with the first privacy value is obtained, and the information associated with the first privacy value is sent to the edge node.

[0042] Obtaining information associated with the first privacy value, and obtaining the first privacy value based on the information associated with the first privacy value, includes:

[0043] The fifth encrypted information is obtained by the management node encrypting the information associated with the first privacy value, the eighth security factor, and the ninth security factor based on the second key. The ninth security factor is obtained by performing security processing on the information associated with the first privacy value and the eighth security factor based on the third key.

[0044] Based on the fourth key, the fifth encrypted information is decrypted to obtain the information associated with the first privacy value, the eighth security factor, and the ninth security factor;

[0045] Based on the ninth security factor, the information associated with the first privacy value is determined to be complete with the eighth security factor, and the first privacy value is obtained based on the information associated with the first privacy value.

[0046] Sending the first privacy value to the management node, so that the management node determines the second encryption factor based on the first operating environment parameters and the management node's second operating environment parameters, including:

[0047] The first privacy value, the first operating environment parameter, and the eighth security factor are subjected to security processing to obtain the tenth security factor. The first privacy value, the first operating environment parameter, the eighth security factor, and the tenth security factor are encrypted based on the first key to obtain the sixth encrypted information.

[0048] The sixth encrypted information is transmitted to the management node, so that the management node can decrypt the sixth encrypted information to obtain the first privacy value, the first operating environment parameters, the eighth security factor, and the tenth security factor; and,

[0049] Based on the tenth security factor, the first privacy value, the first operating environment parameter, and the eighth security factor are determined to be complete. Furthermore, based on the eighth security factor, the first privacy value and the first operating environment parameter are determined to be unaltered. Based on the first operating environment parameter and the second operating environment parameter of the management node, the second encryption factor is determined.

[0050] The decryption key is determined based on the second encryption factor, the first key, and the fourth key corresponding to the second key, including:

[0051] Obtain the seventh encrypted information, which is obtained by the management node encrypting the second encryption factor and the eleventh security factor based on the second key, and the eleventh security factor is obtained by security processing the second encryption factor based on the third key;

[0052] The second encryption factor is determined to be complete based on the eleventh security factor, and the decryption key is determined based on the second encryption factor, the first key, and the fourth key corresponding to the second key.

[0053] A third aspect of this application provides an encryption method applied to a management node, the method comprising:

[0054] In response to an encryption request from an edge node, the first key from the security chip of the management node is sent to the edge node;

[0055] Obtain the second key and first operating environment parameters of the edge node, and determine the first encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node;

[0056] The first encryption factor is sent to the edge node so that the edge node determines the encryption key based on the first encryption factor, the first key and the fourth key corresponding to the second key. The first encryption factor is then processed for privacy to obtain a first privacy value. The information associated with the first privacy value is then transmitted to the management node. The encryption key is used to encrypt the data of the edge node to obtain encrypted data.

[0057] The information associated with the first operating environment parameters and the first privacy value is stored together.

[0058] A fourth aspect of this application provides a decryption method applied to a management node, the method comprising:

[0059] In response to a decryption request from an edge node, the first key from the security chip of the management node is sent to the edge node;

[0060] Obtain the second key and the first operating environment parameters of the edge node, and obtain information associated with the first privacy value based on the first operating environment parameters;

[0061] The information associated with the first privacy value is sent to the edge node, so that the edge node obtains the first privacy value based on the information associated with the first privacy value, and sends the first privacy value to the management node;

[0062] A second encryption factor is determined based on the first operating environment parameters and the second operating environment parameters of the management node. The second encryption factor is then subjected to privacy processing to obtain a second privacy value. If the first privacy value and the second privacy value are consistent, the second encryption factor is sent to the edge node so that the edge node can determine a decryption key based on the second encryption factor, the first key, and the fourth key corresponding to the second key. The encrypted data is then decrypted based on the decryption key.

[0063] A fifth aspect of this application provides an edge node, comprising: a first memory, a first processor, and a first security chip;

[0064] The first security chip includes a second key and first operating environment parameters;

[0065] The first memory is used to store at least one set of instructions;

[0066] The first processor is configured to call and execute the instruction set in the first memory, and to perform the encryption method or the decryption method as described above by executing the instruction set.

[0067] A sixth aspect of this application provides a management node, including: a second memory, a second processor, and a second security chip;

[0068] The second security chip includes a first key and second operating environment parameters;

[0069] The second memory is used to store at least one set of instructions;

[0070] The second processor is configured to call and execute the instruction set in the second memory, and to perform the encryption method or the decryption method as described above by executing the instruction set.

[0071] In this application, the edge node interacts with the management node and uses the first and second operating environment parameters as one of the necessary information to determine the encryption key. Once the operating environment changes, the edge node will not obtain a key consistent with the encryption key determined by the edge node, which increases the difficulty of cracking the encryption key and reduces the risk of data leakage.

[0072] Furthermore, by not sharing their respective critical information, edge nodes and management nodes increase the difficulty of cracking encryption keys, further reducing the risk of data leakage and ensuring data security. Attached Figure Description

[0073] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0074] Figure 1 This is a flowchart illustrating an encryption method provided in Embodiment 1 of this application;

[0075] Figure 2 This is a flowchart illustrating an encryption method provided in Embodiment 2 of this application;

[0076] Figure 3 This is a flowchart illustrating an encryption method provided in Embodiment 3 of this application;

[0077] Figure 4 This is a schematic diagram of the interaction between an edge node and a management node provided in Embodiment 3 of this application;

[0078] Figure 5 This is a flowchart illustrating a decryption method provided in Embodiment 4 of this application;

[0079] Figure 6 This is a flowchart illustrating a decryption method provided in Embodiment 5 of this application;

[0080] Figure 7 This is a schematic diagram of the interaction between an edge node and a management node provided in Embodiment 5 of this application;

[0081] Figure 8 This is a flowchart illustrating an encryption method provided in Embodiment 6 of this application;

[0082] Figure 9 This is a flowchart illustrating a decryption method provided in Embodiment 7 of this application;

[0083] Figure 10 This is a schematic diagram of the structure of an edge node provided in this application;

[0084] Figure 11 This is a schematic diagram of the structure of a management node provided in this application. Detailed Implementation

[0085] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0086] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0087] Reference Figure 1 This is a flowchart illustrating an encryption method provided in Embodiment 1 of this application. This method can be applied to edge nodes, such as... Figure 1 As shown, the method may include, but is not limited to, the following steps:

[0088] Step S101: Obtain the first key of the management node.

[0089] In this embodiment, the edge node can obtain the partition information and partition status of each partition on its disk. Based on the partition status, if the partition is determined to be unencrypted, it can send an encryption request to the management node. The management node then responds to the encryption request by retrieving a first key from the security chip and sending the first key to the edge node. Correspondingly, the edge node receives the first key from the management node.

[0090] The first key can be, but is not limited to, the public key in the key pair generated by the management node.

[0091] A management node can be used to manage at least one edge node.

[0092] Step S102: At least the second key and the first operating environment parameters of the edge node are passed to the management node, so that the management node can determine the first encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node.

[0093] In this embodiment, the first operating environment parameter changes with the operating environment of the edge node. If the operating environment of the edge node changes, it indicates a risk of data leakage.

[0094] The second operating environment parameters will change as the operating environment of the management node changes.

[0095] The first operating environment parameters may include: the first identifier of the security chip of the edge node and / or the physical address of the edge node. If the security chip of the edge node is tampered with or damaged, the first identifier of the security chip of the edge node will change; if the physical location of the edge node changes, the physical address of the edge node will change.

[0096] After obtaining the first key from the management node, the edge node can transmit a message containing the edge node's second key, the first identifier of the edge node's security chip, and the edge node's physical address to the management node, thereby completing the transmission of the second key, the first identifier of the security chip, and the physical address of the edge node to the management node.

[0097] Of course, the edge node can also send its physical address along with the encryption request to the management node. The management node can then obtain the edge node's physical address from the encryption request. After obtaining the management node's first key, the management node will transmit a message containing the edge node's second key and the first identifier of the edge node's security chip to the management node.

[0098] The second operating environment parameter may include, but is not limited to, the second identifier of the security chip of the management node.

[0099] The second key can be, but is not limited to, the public key in the key pair generated by the edge node.

[0100] Step S103: Obtain the first encryption factor, and determine the encryption key based on the fourth key corresponding to the first encryption factor, the first key, and the second key. The encryption key is used to encrypt the data of the edge node to obtain encrypted data.

[0101] The encryption key is determined based on the fourth key corresponding to the first encryption factor, the first key, and the second key, and may include, but is not limited to:

[0102] The first encryption factor is replaced with the random number in the key negotiation algorithm. Based on the key negotiation algorithm, the fourth key corresponding to the first encryption factor, the first key, and the second key is negotiated to obtain the encryption key.

[0103] Key exchange algorithms may include, but are not limited to, the ECDH (Elliptic Curve Diffie–Hellman keyExchange) algorithm.

[0104] If the act of illegally obtaining data from the edge node causes changes to the operating environment of the edge node and / or the operating environment of the management node, a changed first encryption factor will be determined based on the changed first operating environment parameters and the changed second operating environment parameters. The key determined based on the changed first encryption factor is inconsistent with the previously determined encryption key, ensuring that the data cannot be decrypted.

[0105] It should be noted that after encrypting the data of the edge node based on the encryption key, the edge node does not save the encryption key.

[0106] In the implementation where the second key is the public key in the key pair generated by the edge node, the fourth key is the private key in the key pair generated by the edge node.

[0107] Encrypting edge node data based on encryption keys can include, but is not limited to, encrypting edge node data based on the LUKS (Linux Unified Key Setup) specification and encryption keys.

[0108] Step S104: Perform privacy processing on the first encryption factor to obtain the first privacy value.

[0109] In this embodiment, the first encryption factor can be processed using a privacy processing algorithm to obtain a first privacy value. The first privacy value can be stored in the register of the edge node.

[0110] This application does not limit the privacy processing algorithm. Specifically, the privacy processing algorithm may include, but is not limited to, a hash algorithm, and correspondingly, the first privacy value may include, a first hash value.

[0111] Step S105: Pass the information associated with the first privacy value to the management node so that the management node can store the information associated with the first operating environment parameters and the first privacy value.

[0112] In this embodiment, the information associated with the first privacy value may include, but is not limited to: first information representing the identity of the register where the first privacy value is located and the privacy processing algorithm used to perform privacy processing on the first encryption factor.

[0113] Understandably, the edge node did not pass the encryption key to the management node, and the management node did not save the encryption key.

[0114] The management node associates and stores information related to the first operating environment parameters and the first privacy value, so that the edge node can determine the decryption key based on the information associated and stored by the management node, and decrypt the encrypted data based on the decryption key.

[0115] In this embodiment, the edge node interacts with the management node to use the first and second operating environment parameters as one of the necessary information for determining the encryption key. Once the operating environment changes, the edge node will not obtain a key consistent with the encryption key determined by the edge node, which increases the difficulty of cracking the encryption key and reduces the risk of data leakage.

[0116] Furthermore, by not sharing their respective critical information, edge nodes and management nodes increase the difficulty of cracking encryption keys, further reducing the risk of data leakage and ensuring data security.

[0117] As another optional embodiment of this application, refer to Figure 2 This is a flowchart illustrating an encryption method provided in Embodiment 2 of this application. This embodiment is mainly an extension of the encryption method described in Embodiment 1 above. The method may include, but is not limited to, the following steps:

[0118] Step S201: Obtain the first key of the management node.

[0119] Step S202: Obtain the first security factor and the second security factor of the management node.

[0120] The first security factor can be used to determine whether the data it protects (e.g., the first key and the second security factor) has been tampered with.

[0121] In this embodiment, the first security factor can be, but is not limited to, the first random number generated by the management node.

[0122] In this embodiment, the management node can perform security processing on the first key and the first security factor to obtain a second security factor. The second security factor can be used to determine whether the data it protects (e.g., the first key and the first security factor) is intact.

[0123] The second security factor can be, but is not limited to, the first signature data obtained by the security chip of the management node signing the first security factor and the first key based on the third key corresponding to the first key.

[0124] In an implementation where the first key is the public key in the key pair generated by the management node, the third key can be the private key in the key pair generated by the management node.

[0125] Step S203: Based on the second security factor, the first key and the first security factor are determined to be complete. The second key, the first security factor and the first operating environment parameters are subjected to security processing to obtain the third security factor. Based on the first key, the second key, the first security factor, the first operating environment parameters and the third security factor are encrypted to obtain the first encrypted information.

[0126] The first key and the first security factor are determined based on the second security factor, and may include, but are not limited to:

[0127] S2031. Perform security processing on the first key and the first security factor to obtain the second security factor to be used.

[0128] The edge nodes employ the same security processing methods as the management nodes to securely process the first key and the first security factor.

[0129] S2032. Compare whether the second safety factor to be used and the second safety factor are consistent.

[0130] If they match, proceed to step S2033.

[0131] S2033, The first key and the first security factor are confirmed to be complete.

[0132] In this embodiment, the second key, the first security factor, and the first operating environment parameters are subjected to security processing to obtain the third security factor, which may include, but is not limited to:

[0133] S2034. Based on the fourth key corresponding to the second key, the second key, the first security factor, and the first operating environment parameters are signed to obtain the second signature data.

[0134] Step S204: The first encrypted information is transmitted to the management node, so that the management node decrypts the first encrypted information based on the third key corresponding to the first key to obtain the second key, the first security factor, the first operating environment parameter, and the third security factor; and, based on the third security factor, it is determined that the second key, the first security factor, and the first operating environment parameter are complete, and based on the first security factor, it is determined that the second key and the first operating environment parameter have not been tampered with, and the first encryption factor is determined based on the first operating environment parameter and the second operating environment parameter of the management node.

[0135] Based on the third security factor, the second key, the first security factor, and the first operating environment parameters are determined to be complete, which may include, but is not limited to:

[0136] S2041. Perform security processing on the second key, the first security factor, and the first operating environment parameters to obtain the third security factor to be used.

[0137] The edge nodes employ the same security processing methods as the management nodes to securely process the second key, the first security factor, and the first operating environment parameters.

[0138] S2042. Compare whether the third safety factor to be used and the third safety factor are consistent.

[0139] If they match, proceed to step S2043.

[0140] S2043. The second key, the first security factor, and the first operating environment parameters are confirmed to be complete.

[0141] Based on the first security factor, it is determined that the second key and the first operating environment parameters have not been tampered with, which may include, but is not limited to:

[0142] S2044. Compare whether the first security factor passed from the edge node is consistent with the first security factor generated by the management node.

[0143] If they match, proceed to step S2045.

[0144] S2045. It was determined that the second key and the first runtime environment parameters had not been tampered with.

[0145] The first encryption factor is determined based on the first operating environment parameters and the second operating environment parameters of the management node, and may include, but is not limited to:

[0146] S2046. Combine the first operating environment parameters and the second operating environment parameters to obtain the combined operating environment parameters.

[0147] Combining the first operating environment parameters and the second operating environment parameters may include, but is not limited to, splicing the first operating environment parameters and the second operating environment parameters.

[0148] S2046. Perform hash calculation on the combined runtime environment parameters to obtain the hash value.

[0149] Steps S203-S204 are a specific implementation of step S102 in Example 1.

[0150] Step S205: Obtain the first encryption factor, and determine the encryption key based on the fourth key corresponding to the first encryption factor, the first key, and the second key. The encryption key is used to encrypt the data of the edge node to obtain encrypted data.

[0151] Step S206: Perform privacy processing on the first encryption factor to obtain the first privacy value.

[0152] Step S207: Pass the information associated with the first privacy value to the management node so that the management node can associate and store the information associated with the first operating environment parameters and the first privacy value.

[0153] For a detailed description of steps S205-S207, please refer to the relevant description of steps S102-S104 in Example 1, which will not be repeated here.

[0154] In this embodiment, the edge node and the management node ensure the integrity and security of the information exchanged between the edge node and the management node based on the first security factor, the second security factor and the third security factor. On this basis, the first operating environment parameter and the second operating environment parameter are used as one of the necessary information to determine the encryption key. Once the operating environment changes, the key will not be consistent with the encryption key determined by the edge node, which increases the difficulty of cracking the encryption key and reduces the risk of data leakage.

[0155] Furthermore, by not sharing their respective critical information, edge nodes and management nodes increase the difficulty of cracking encryption keys, further reducing the risk of data leakage and ensuring data security.

[0156] As another optional embodiment of this application, refer to Figure 3 This is a flowchart illustrating an encryption method provided in Embodiment 3 of this application. This embodiment is mainly a refinement of the encryption method described in Embodiment 2 above. The method may include, but is not limited to, the following steps:

[0157] Step S301: Obtain the first key of the management node.

[0158] Step S302: Obtain the first security factor and the second security factor of the management node.

[0159] Step S303: Based on the second security factor, the first key and the first security factor are determined to be complete. The second key, the first security factor and the first operating environment parameters are subjected to security processing to obtain the third security factor. Based on the first key, the second key, the first security factor, the first operating environment parameters and the third security factor are encrypted to obtain the first encrypted information.

[0160] Step S304: The first encrypted information is transmitted to the management node, so that the management node decrypts the first encrypted information based on the third key corresponding to the first key to obtain the second key, the first security factor, the first operating environment parameter, and the third security factor; and, based on the third security factor, it is determined that the second key, the first security factor, and the first operating environment parameter are complete, and based on the first security factor, it is determined that the second key and the first operating environment parameter have not been tampered with, and the first encryption factor is determined based on the first operating environment parameter and the second operating environment parameter of the management node.

[0161] For a detailed description of steps S301-S304, please refer to the relevant description of steps S201-S204 in Example 2, which will not be repeated here.

[0162] Step S305: Obtain the second encrypted information, which is obtained by the management node encrypting the first encryption factor and the fourth security factor based on the second key.

[0163] The fourth security factor can be used to determine whether the data it protects (e.g., the first encryption factor) has been tampered with.

[0164] In this embodiment, the fourth security factor can be, but is not limited to, a second random number generated by the management node, which is different from the first random number.

[0165] Step S306: Decrypt the second encrypted information based on the fourth key corresponding to the second key to obtain the first encryption factor and the fourth security factor.

[0166] Steps S305-S306 are a specific implementation of obtaining the first encryption factor in step S205 of Example 2 or step S103 of Example 1.

[0167] Step S307: Based on the first encryption factor, the first key, and the fourth key corresponding to the second key, an encryption key is determined. The encryption key is used to encrypt the data of the edge node to obtain encrypted data.

[0168] For a detailed description of step S307, please refer to the relevant description of step S205 in Example 2, which will not be repeated here.

[0169] Step S308: Perform privacy processing on the first encryption factor to obtain the first privacy value.

[0170] For a detailed description of step S308, please refer to the relevant description of step S206 in Example 2, which will not be repeated here.

[0171] Step S309: Encrypt the information and the fourth security factor based on the first key to obtain the third encrypted information, and transmit the third encrypted information to the management node so that the management node can decrypt the third encrypted information based on the third key corresponding to the first key to obtain the information and the fourth security factor; and, based on the fourth security factor, determine that the information has not been tampered with, and store the information associated with the first operating environment parameter and the first privacy value.

[0172] Determining that information has not been tampered with based on the fourth security factor can include, but is not limited to:

[0173] S3091. Compare whether the fourth security factor passed from the edge node is consistent with the fourth security factor generated by the management node.

[0174] If they match, proceed to step S3092.

[0175] S3092. It is determined that the information associated with the first privacy value has not been tampered with.

[0176] Step S309 is a specific implementation of step S207 in Example 2 or step S105 in Example 1.

[0177] In this embodiment, a specific implementation of steps S301-S309 above is described using the interaction process between edge nodes and management nodes as an example. Figure 4 As shown, it can specifically include:

[0178] 1. The edge node sends an encryption request to the management node.

[0179] 2. In response to the encryption request, the management node obtains the public key Pkc (i.e., one implementation of the first key) from the security chip TPM2 of the management node, and generates a first random number NONCE1 (i.e., one implementation of the first security factor). Based on the private key SKc corresponding to Pkc, the management node performs signature processing on NONCE1 and Pkc to obtain the first signature data SIGN1 (i.e., one implementation of the second security factor).

[0180] 3. The management node passes NONCE1, Pkc, and SIGN1 to the edge nodes.

[0181] 4. The edge node obtains the public key PKn (i.e., an implementation of the second key) from its security chip TPM1.

[0182] 5. The edge node obtains the chip EID(n) (i.e., the first identifier) ​​from its security chip TPM1. The security chip TPM1 verifies the signature of SIGN1 based on PKc. If the signature verification is successful, it uses the private key SKn to sign the message after combining EID(n), NONCE1, and PKn to obtain the second signature data SIGN2 (i.e., an implementation of the third security factor). The security chip TPM1 uses PKc to encrypt EID(n), NONCE1, PKn, and SIGN2 to obtain the first encrypted information, and sends the first encrypted information to the management node.

[0183] 6. The management node uses SKc to decrypt the first encrypted information to obtain EID(n), NONCE1, PKn, and SIGN2 transmitted from the edge node. It verifies the signature of SIGN2 based on PKn and compares whether the NONCE1 transmitted from the edge node is consistent with the NONCE1 generated by the management node. If the signature of SIGN2 is verified and the NONCE1 transmitted from the edge node is consistent with the NONCE1 generated by the management node, the management center obtains EID(c) (i.e., the second identifier) ​​from its security chip TPM2 and obtains IP(n) (i.e., the physical address of the edge node) from the encryption request. It uses EID(n), EID(c), and IP(n) to calculate SALT (i.e., one implementation of the first encryption factor).

[0184] 7. The management node generates a second random number NONCE2 (i.e., an implementation of the fourth security factor). The security chip TPM2 uses PKn to encrypt SALT and NONCE2 to obtain the second encrypted information, and sends the second encrypted information to the edge node.

[0185] 8. The edge node uses SKn to decrypt the second encrypted information and obtain SALT and NONCE2. The security chip TPM1 uses SKn, PKc, and SALT to calculate the encryption key ENK.

[0186] 9. Edge nodes use the ENK and LUKS specifications to encrypt the data of edge nodes.

[0187] 10. The security chip TPM1 of the edge node calculates the HASH value of SALT based on the hash algorithm, obtains SALT.HASH, and writes the SALT.HASH value into the register PCR.

[0188] 11. The edge node uses PKc to encrypt the PCR number PCR.NO (i.e., one implementation of the first information), hash algorithm (i.e., one implementation of the privacy processing algorithm), and NONCE2 to obtain the third encrypted information, and sends the third encrypted information to the management node.

[0189] 12. The security chip TPM2 of the management node uses SKc to decrypt the third encrypted information and obtain the PCR.NO, hash algorithm and NONCE2 transmitted from the edge node. If the NONCE2 transmitted from the edge node is consistent with the NONCE2 generated by the management node, the EID(n) and the PCR number and hash algorithm are associated and stored.

[0190] In this embodiment, the edge node and the management node ensure the integrity and security of the key, first operating environment parameter, and second operating environment parameter used for interaction between the edge node and the management node based on the first security factor, the second security factor, and the third security factor. On this basis, the first operating environment parameter and the second operating environment parameter are used as one of the necessary information to determine the encryption key. Once the operating environment changes, the key will not be consistent with the encryption key determined by the edge node, which increases the difficulty of cracking the encryption key and reduces the risk of data leakage.

[0191] Furthermore, by not sharing their respective critical information, edge nodes and management nodes increase the difficulty of cracking encryption keys, further reducing the risk of data leakage and ensuring data security.

[0192] Furthermore, the edge node and the management node are based on a fourth security factor to ensure the security of the information associated with the first privacy value. On this basis, the management node stores the information associated with the first operating environment parameters and the first privacy value in association, ensuring the security and validity of the stored information associated with the first operating environment parameters and the first privacy value.

[0193] Reference Figure 5 This is a flowchart illustrating a decryption method provided in Embodiment 4 of this application. This method can be applied to edge nodes, such as... Figure 5 As shown, the method may include, but is not limited to, the following steps:

[0194] Step S401: Obtain the first key of the management node.

[0195] In this embodiment, the edge node can obtain the partition information and partition status of each partition on its disk. Based on the partition status, if a partition is determined to be in an encrypted state, it can send a decryption request to the management node. The management node then responds to the decryption request by retrieving a first key from the security chip and sending the first key to the edge node. Correspondingly, the edge node receives the first key from the management node.

[0196] For details on the specific implementation of the first key, please refer to the first key described in any of the embodiments in Examples 1-3, which will not be repeated here.

[0197] Step S402: At least the second key and the first operating environment parameters of the edge node are passed to the management node so that the management node can obtain the information associated with the first privacy value based on the first operating environment parameters. The information associated with the first privacy value is determined based on the encryption method described in any one of the embodiments 1-3.

[0198] The specific implementation of the second key and the first operating environment parameters of the edge node can be found in any of the embodiments described in Examples 1-3, and will not be repeated here.

[0199] The management node can send the information associated with the first privacy value to the edge node.

[0200] Step S403: Obtain the information associated with the first privacy value, and obtain the first privacy value based on the information associated with the first privacy value.

[0201] Edge nodes can receive information associated with a first privacy value sent by the management node. The information associated with the first privacy value includes: first information representing the identity of the register where the first privacy value is located, and the implementation method of the privacy processing algorithm used to perform privacy processing on the first encryption factor. The first privacy value can be obtained from the corresponding register based on the first information.

[0202] Step S404: Send the first privacy value to the management node so that the management node can determine the second encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node. Perform privacy processing on the second encryption factor to obtain the second privacy value. If the first privacy value and the second privacy value are consistent, send the second encryption factor to the edge node.

[0203] The detailed process of the management node determining the second encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node can be found in any of the embodiments 1-3, which describes how the management node determines the first encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node. It will not be repeated here.

[0204] Step S405: Determine the decryption key based on the second encryption factor, the first key, and the fourth key corresponding to the second key, and decrypt the encrypted data based on the decryption key.

[0205] In this embodiment, the edge node transmits the first operating environment parameters to the management node, enabling the management node to determine the second encryption factor based on the first and second operating environment parameters. The management node then performs privacy processing on the second encryption factor to obtain a second privacy value. If the first and second privacy values ​​are consistent, it indicates that the edge node and the management node are in a trusted environment or have not been illegally modified. Based on ensuring that the edge node is in a trusted environment or has not been illegally modified, the management node sends the second encryption factor to the edge node. The edge node determines the decryption key based on the second encryption factor, the first key, and the fourth key, ensuring the consistency between the decryption key and the edge node's encryption key, thereby ensuring successful decryption.

[0206] As another optional embodiment of this application, refer to Figure 6This is a flowchart illustrating a decryption method provided in Embodiment 5 of this application. This embodiment is mainly an extension of the decryption method described in Embodiment 4 above. The method may include, but is not limited to, the following steps:

[0207] Step S501: Obtain the first key of the management node.

[0208] Step S502: Obtain the fifth and sixth security factors of the management node.

[0209] The fifth security factor can be used to determine whether the data it protects has been tampered with.

[0210] In this embodiment, the fifth security factor can be, but is not limited to, a third random number generated by the management node.

[0211] In this embodiment, the management node can perform security processing on the first key and the fifth security factor to obtain a sixth security factor. The sixth security factor can be used to determine whether the data it protects (e.g., the first key and the fifth security factor) is intact.

[0212] The sixth security factor can be, but is not limited to, the third signature data obtained by the security chip of the management node signing the fifth security factor and the first key based on the third key corresponding to the first key.

[0213] For details on the implementation of the third key, please refer to the relevant introduction of the third key in any one of the embodiments in Examples 1-3.

[0214] Step S503: Based on the sixth security factor, the first key and the fifth security factor are determined to be complete. The first operating environment parameters, the fifth security factor and the second key are then processed to obtain the seventh security factor.

[0215] The first key and the fifth security factor are determined based on the sixth security factor, which may include, but are not limited to:

[0216] S5031. Perform security processing on the first key and the fifth security factor to obtain the sixth security factor to be used.

[0217] The edge nodes employ the same security processing methods as the management nodes, performing security processing on the first key and the fifth security factor.

[0218] S5032. Compare whether the sixth safety factor to be used and the sixth safety factor are consistent.

[0219] If they match, proceed to step S5033.

[0220] S5033, The first key and the fifth security factor are confirmed to be complete.

[0221] The first operating environment parameters, the fifth security factor, and the second key are processed to obtain the seventh security factor, which may include, but is not limited to:

[0222] S5034. Based on the fourth key corresponding to the second key, the second key, the fifth security factor, and the first operating environment parameters are signed to obtain the fourth signature data.

[0223] Step S504: Encrypt the first operating environment parameters, the fifth security factor, the second key, and the seventh security factor based on the first key to obtain the fourth encrypted information.

[0224] Step S505: The fourth encrypted information is transmitted to the management node so that the management node can decrypt the fourth encrypted information to obtain the first operating environment parameters, the fifth security factor, the second key, and the seventh security factor; and, based on the seventh security factor, it is determined that the first operating environment parameters, the fifth security factor, and the second key are complete, and based on the fifth security factor, it is determined that the first operating environment parameters and the second key have not been tampered with, and based on the first operating environment parameters, the information associated with the first privacy value is obtained, and the information associated with the first privacy value is sent to the edge node.

[0225] In this embodiment, the determination of the first operating environment parameters, the fifth security factor, and the completeness of the second key based on the seventh security factor may include, but is not limited to:

[0226] S5051. Perform security processing on the second key, the fifth security factor, and the first operating environment parameters to obtain the seventh security factor to be used.

[0227] The management node employs the same security processing method as the edge node to securely process the second key, the fifth security factor, and the first operating environment parameters.

[0228] S5052. Compare whether the seventh safety factor to be used and the seventh safety factor are consistent.

[0229] If they match, proceed to step S5053.

[0230] S5053, The second key, fifth security factor and first operating environment parameters are confirmed to be complete.

[0231] In this embodiment, determining that the first operating environment parameters and the second key have not been tampered with based on the fifth security factor may include, but is not limited to:

[0232] S5054. Compare whether the fifth security factor passed from the edge node is consistent with the fifth security factor generated by the management node.

[0233] If they match, proceed to step S5055.

[0234] S5055. It was determined that the second key and the first runtime environment parameters had not been tampered with.

[0235] Steps S503-S505 are a specific implementation of step S402 in Example 4.

[0236] Step S506: Obtain the information associated with the first privacy value, and obtain the first privacy value based on the information associated with the first privacy value.

[0237] This step may include, but is not limited to:

[0238] S5061. Obtain the fifth encrypted information. The fifth encrypted information is obtained by the management node encrypting the information associated with the first privacy value, the eighth security factor, and the ninth security factor based on the second key. The ninth security factor is obtained by performing security processing on the information associated with the first privacy value and the eighth security factor based on the third key.

[0239] The eighth security factor can be, but is not limited to, the fourth random number generated by the management node.

[0240] The security processing of the information associated with the first privacy value and the eighth security factor based on the third key may include, but is not limited to: signing the information associated with the first privacy value and the eighth security factor based on the third key to obtain the fifth signature data.

[0241] S5062. Based on the fourth key, decrypt the fifth encrypted information to obtain the information associated with the first privacy value, the eighth security factor, and the ninth security factor.

[0242] S5063. Based on the ninth security factor, the information associated with the first privacy value is determined to be complete with the eighth security factor, and the first privacy value is obtained based on the information associated with the first privacy value.

[0243] Based on the ninth security factor, the information associated with the first privacy value is determined to be complete with the eighth security factor, which may include, but is not limited to:

[0244] S50631. Perform security processing on the information associated with the first privacy value and the eighth security factor to obtain the ninth security factor to be used.

[0245] Among them, the edge nodes adopt the same security processing method as the management nodes to perform security processing on the information associated with the first privacy value and the eighth security factor.

[0246] S50632. Compare whether the ninth safety factor to be used and the ninth safety factor are consistent.

[0247] If they match, proceed to step S50633.

[0248] S50633, Determine the completeness of the information associated with the first privacy value and the eighth security factor.

[0249] Step S507: Send the first privacy value to the management node so that the management node can determine the second encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node. Perform privacy processing on the second encryption factor to obtain the second privacy value. If the first privacy value and the second privacy value are consistent, send the second encryption factor to the edge node.

[0250] In this embodiment, the first privacy value is sent to the management node so that the management node can determine the second encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node, including:

[0251] S5071. Perform security processing on the first privacy value, the first operating environment parameter, and the eighth security factor to obtain the tenth security factor. Encrypt the first privacy value, the first operating environment parameter, the eighth security factor, and the tenth security factor based on the first key to obtain the sixth encrypted information.

[0252] The first privacy value, the first runtime environment parameter, and the eighth security factor are processed to obtain the tenth security factor, which may include, but is not limited to:

[0253] The sixth signature data is obtained by signing the first privacy value, the first operating environment parameter, and the eighth security factor based on the fourth key.

[0254] S5072. The sixth encrypted information is transmitted to the management node so that the management node can decrypt the sixth encrypted information to obtain the first privacy value, the first operating environment parameter, the eighth security factor, and the tenth security factor; and, based on the tenth security factor, it is determined that the first privacy value, the first operating environment parameter, and the eighth security factor are complete, and based on the eighth security factor, it is determined that the first privacy value and the first operating environment parameter have not been tampered with, and based on the first operating environment parameter and the second operating environment parameter of the management node, the second encryption factor is determined.

[0255] Based on the tenth security factor, the first privacy value, the first operating environment parameters, and the complete eighth security factor are determined, which may include, but are not limited to:

[0256] S50721. Perform security processing on the first privacy value, the first operating environment parameters, and the eighth security factor to obtain the tenth security factor to be used.

[0257] The management node adopts the same security processing method as the edge node, and performs security processing on the first privacy value, the first operating environment parameters and the eighth security factor.

[0258] S50722. Compare whether the tenth safety factor to be used and the tenth safety factor are consistent.

[0259] If they match, proceed to step S50723.

[0260] S50723, Determine the first privacy value, the first operating environment parameters, and the eighth security factor are complete.

[0261] Based on the eighth security factor, it is determined that the first privacy value and the first operating environment parameters have not been tampered with, which may include, but is not limited to:

[0262] S50724. Compare whether the eighth security factor passed from the edge node is consistent with the eighth security factor generated by the management node.

[0263] If they match, proceed to step S50725.

[0264] S50725, It is determined that the first privacy value and the first operating environment parameters have not been tampered with.

[0265] In this embodiment, sending the second encryption factor to the edge node may include, but is not limited to:

[0266] S5073. The management node performs security processing on the second encryption factor based on the third key to obtain the eleventh security factor, and encrypts the second encryption factor and the eleventh security factor based on the second key to obtain the seventh encrypted information.

[0267] The eleventh security factor is obtained by performing security processing on the second encryption factor based on the third key, which may include, but is not limited to, performing signature processing on the second encryption factor based on the third key to obtain signature data.

[0268] S5074. The management node sends the seventh encrypted information to the edge node.

[0269] Step S508: Determine the decryption key based on the second encryption factor, the first key, and the fourth key corresponding to the second key, and decrypt the encrypted data based on the decryption key.

[0270] The decryption key is determined based on the second encryption factor, the first key, and the fourth key corresponding to the second key, and may include, but is not limited to:

[0271] S5081. Obtain the seventh encrypted information, decrypt the seventh encrypted information, and obtain the second encryption factor and the eleventh security factor.

[0272] S5082. The second encryption factor is determined to be complete based on the eleventh security factor, and the decryption key is determined based on the fourth key corresponding to the second encryption factor, the first key, and the second key.

[0273] The second encryption factor is determined based on the eleventh security factor and may include, but is not limited to:

[0274] S50821. Perform security processing on the second encryption factor to obtain the eleventh security factor to be used.

[0275] The edge nodes employ the same security processing method as the management nodes to securely process the second encryption factor.

[0276] S50822. Compare whether the eleventh safety factor to be used and the eleventh safety factor are consistent.

[0277] If they match, proceed to step S50823.

[0278] Step S50823: Determine that the second encryption factor is complete.

[0279] Of course, steps S5081-S5082 are not limited to the implementation of step S508, but can also be the specific implementation of step S405 in embodiment 4.

[0280] In this embodiment, a specific implementation of steps S501-S508 above is described using the interaction process between edge nodes and management nodes as an example. Figure 7 As shown, it can specifically include:

[0281] 1. The edge node sends a decryption request to the management node.

[0282] 2. In response to the decryption request, the management node obtains the public key Pkc (i.e., one implementation of the first key) from the security chip TPM2 of the management node, and generates a first random number NONCE3 (i.e., one implementation of the fifth security factor). Based on the private key SKc corresponding to Pkc, the management node signs NONCE3 and Pkc to obtain the third signature data SIGN3 (i.e., one implementation of the sixth security factor).

[0283] 3. The management node passes NONCE3, Pkc, and SIGN3 to the edge nodes.

[0284] 4. The edge node obtains the public key PKn (i.e., an implementation of the second key) from its security chip TPM1.

[0285] 5. The edge node obtains the chip EID(n) (i.e., the first identifier) ​​from its security chip TPM1. The security chip TPM1 verifies the signature of SIGN3 based on PKc. If the signature verification is successful, it uses the private key SKn to sign the message after combining EID(n), NONCE3, and PKn to obtain the fourth signature data SIGN4 (i.e., an implementation of the seventh security factor). The security chip TPM1 uses PKc to encrypt EID(n), NONCE3, PKn, and SIGN4 to obtain the fourth encrypted information, and sends the fourth encrypted information to the management node.

[0286] 6. The management node uses SKc to decrypt the fourth encrypted information to obtain EID(n), NONCE3, PKn, and SIGN4 transmitted from the edge node. It verifies the signature of SIGN4 based on PKn and compares whether the NONCE3 transmitted from the edge node is consistent with the NONCE3 generated by the management node. If the signature of SIGN4 is verified and the NONCE3 transmitted from the edge node is consistent with the NONCE3 generated by the management node, the management center queries the corresponding PCR number PCR.NO and hash algorithm based on EID(n).

[0287] 7. The management node generates a second random number NONCE4 (i.e., an implementation of the eighth security factor). The security chip TPM2 uses SKc to sign PCR.NO and NONCE4 to generate the fifth signature data SIGN5 (an implementation of the ninth security factor). The security chip TPM2 uses PKn to encrypt PCR.NO, NONCE4, and SIGN5 to obtain the fifth encrypted information, and sends the fifth encrypted information to the edge node.

[0288] 8. The edge node uses SKn to decrypt the fifth encrypted information to obtain PCR.NO, and uses PCR.NO to query the corresponding value SALT.HASH in the security chip TPM1.

[0289] 9. The edge node obtains EID(n) from the security chip TPM1. The security chip TPM1 signs the message containing SALT.HASH, EID(n), and NONCE4 based on the private key SKn to obtain the sixth signature data SIGN6 (i.e., an implementation of the tenth security factor). The security chip TPM1 uses PKc to encrypt SALT.HASH, EID(n), NONCE4, and SIGN6 to obtain the sixth encrypted information, and sends the sixth encrypted information to the management node.

[0290] 10. The security chip TPM2 of the management node uses SKc to decrypt the sixth encrypted information to obtain SALT.HASH, EID(n), NONCE4, and SIGN6. If the signature of SIGN6 is verified and the NONCE4 transmitted from the edge node is consistent with the NONCE4 generated by the management node, the management node obtains EID(c) from the security chip TPM2, obtains the IP(n) of the edge node from the decryption request, and calculates SALTc (i.e., one implementation of the second encryption factor) using EID(n), EID(c), and IP(n).

[0291] 11. Security chip TPM2 uses the same hash algorithm as security chip TPM1 to calculate the hash value of SALTc, obtaining SALTc.HASH. It then compares SALT.HASH with SALTc.HASH. If they do not match, it indicates that the edge node is located in an untrusted environment or has been illegally modified, terminating the decryption process and resulting in decryption failure. If they match, proceed to step S12.

[0292] 12. The security chip TPM2 of the management node uses SKc to sign SALTc, obtaining the seventh signature data SIGN7 (i.e., an implementation of the eleventh security factor). The security chip TPM2 uses PKn to encrypt SALTc and SIGN7, obtaining the seventh encrypted information, and sends the seventh encrypted information to the edge node.

[0293] 13. The security chip TPM1 at the edge node uses PKc to decrypt the seventh encrypted message, obtaining SALTc and SIGN7. After verifying SIGN7, the security chip TPM1 uses SKn, PKc, and SALTc to calculate the decryption key ENK.

[0294] 14. Use the decryption key ENK to decrypt the encrypted data of the edge node.

[0295] In this embodiment, the edge node and the management node ensure the integrity and security of the information exchanged between them based on the fifth, sixth, and seventh security factors. Furthermore, the management node determines a second encryption factor based on the first and second operating environment parameters, performs privacy processing on the second encryption factor to obtain a second privacy value. If the first and second privacy values ​​are consistent, it indicates that the edge node and the management node are in a trusted environment or have not undergone unauthorized modification. While ensuring the edge node is in a trusted environment or has not undergone unauthorized modification, the management node sends the second encryption factor to the edge node. The edge node determines a decryption key based on the second encryption factor, the first key, and the fourth key, ensuring the consistency between the decryption key and the edge node's encryption key, thereby guaranteeing successful decryption.

[0296] Reference Figure 8 This is a flowchart illustrating an encryption method provided in Embodiment 6 of this application. This method can be applied to management nodes, such as... Figure 8 As shown, the method may include, but is not limited to, the following steps:

[0297] Step S601: In response to the encryption request from the edge node, the first key in the security chip of the management node is sent to the edge node.

[0298] Step S602: Obtain the second key and first operating environment parameters of the edge node, and determine the first encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node.

[0299] Step S603: Send the first encryption factor to the edge node so that the edge node can determine the encryption key based on the first encryption factor, the first key, and the fourth key corresponding to the second key. Perform privacy processing on the first encryption factor to obtain the first privacy value. Transmit the information associated with the first privacy value to the management node. The encryption key is used to encrypt the data of the edge node to obtain encrypted data.

[0300] Step S604: Storing the information associated with the first operating environment parameters and the first privacy value.

[0301] For detailed procedures of steps S601-S604, please refer to the relevant descriptions in any of the embodiments in Examples 1-3, and they will not be repeated here.

[0302] Reference Figure 9 This is a flowchart illustrating a decryption method provided in Embodiment 7 of this application. This method can be applied to management nodes, such as... Figure 9 As shown, the method may include, but is not limited to, the following steps:

[0303] Step S701: In response to the decryption request from the edge node, the first key in the security chip of the management node is sent to the edge node.

[0304] Step S702: Obtain the second key and the first operating environment parameters of the edge node, and obtain the information associated with the first privacy value based on the first operating environment parameters.

[0305] Step S703: Send the information associated with the first privacy value to the edge node so that the edge node can obtain the first privacy value based on the information associated with the first privacy value and send the first privacy value to the management node.

[0306] Step S704: Determine the second encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node. Perform privacy processing on the second encryption factor to obtain the second privacy value. If the first privacy value and the second privacy value are consistent, send the second encryption factor to the edge node so that the edge node can determine the decryption key based on the second encryption factor, the first key, and the fourth key corresponding to the second key. Decrypt the encrypted data based on the decryption key.

[0307] For detailed procedures of steps S701-S704, please refer to the relevant description of any one of the embodiments in Example 4 or 5, and will not be repeated here.

[0308] The following section introduces an edge node provided in this application. The edge node described below can be referred to in correspondence with the encryption and decryption methods described above.

[0309] Please see Figure 10 The edge node includes: a first memory 100, a first processor 200, and a first security chip 300;

[0310] The first security chip 300 includes a second key and first operating environment parameters;

[0311] The first memory 100 is used to store at least one set of instructions;

[0312] The first processor 200 is configured to call and execute the instruction set in the first memory 100, and to perform the encryption method as described in any one of the embodiments 1-3 or the decryption method as described in embodiment 4 or 5 by executing the instruction set.

[0313] The following section introduces a management node provided in this application. The management node described below can be referred to in correspondence with the encryption and decryption methods described above.

[0314] Please see Figure 11 The management node includes: a second memory 400, a second processor 500, and a second security chip 600;

[0315] The second security chip 600 includes a first key and second operating environment parameters;

[0316] The second memory 400 is used to store at least one set of instructions;

[0317] The second processor 500 is configured to call and execute the instruction set in the second memory 400, and to perform the encryption method as described in Embodiment 6 or the decryption method as described in Embodiment 7 by executing the instruction set.

[0318] It should be noted that each embodiment focuses on describing the differences from other embodiments, and the same or similar parts between the embodiments can be referred to accordingly. For the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments.

[0319] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0320] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.

[0321] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0322] The above provides a detailed description of the encryption method, decryption method, edge node, and management node provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An encryption method applied to edge nodes, the method comprising: Obtain the first key of the management node; At least the second key and the first operating environment parameters of the edge node are passed to the management node, so that the management node can determine the first encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node; The first operating environment parameters include: the first identifier of the security chip of the edge node and the physical address of the edge node. The first operating environment parameters will change with the operating environment of the edge node, and the second operating environment parameters will change with the operating environment of the management node. The first encryption factor is obtained, and an encryption key is determined based on the fourth key corresponding to the second key, the first encryption factor, and the first key. The encryption key is used to encrypt the data of the edge node to obtain encrypted data. The first encryption factor is processed using a privacy processing algorithm to obtain a first privacy value. The information associated with the first privacy value is transmitted to the management node, so that the management node can store the first operating environment parameters and the information associated with the first privacy value together.

2. The method according to claim 1, further comprising: Obtain the first security factor and the second security factor of the management node; At least the second key and first runtime environment parameters of the edge node are transmitted to the management node, so that the management node determines the first encryption factor based on the first runtime environment parameters and the management node's second runtime environment parameters, including: Based on the second security factor, the first key and the first security factor are determined to be complete. The second key, the first security factor, and the first operating environment parameters are then subjected to security processing to obtain the third security factor. Based on the first key, the second key, the first security factor, the first operating environment parameters, and the third security factor are then encrypted to obtain the first encrypted information. The first encrypted information is transmitted to the management node, so that the management node decrypts the first encrypted information based on the third key corresponding to the first key, obtaining the second key, the first security factor, the first operating environment parameters, and the third security factor; and, Based on the third security factor, it is determined that the second key, the first security factor, and the first operating environment parameters are complete, and based on the first security factor, it is determined that the second key and the first operating environment parameters have not been tampered with. Based on the first operating environment parameters and the second operating environment parameters of the management node, the first encryption factor is determined.

3. The method according to claim 1 or 2, wherein obtaining the first encryption factor comprises: Obtain second encrypted information, which is obtained by the management node encrypting the first encryption factor and the fourth security factor based on the second key; The second encrypted information is decrypted based on the fourth key corresponding to the second key to obtain the first encryption factor and the fourth security factor. The information associated with the first privacy value is transmitted to the management node, so that the management node can associate and store the first operating environment parameters and the information associated with the first privacy value, including: The information and the fourth security factor are encrypted based on the first key to obtain third encrypted information. The third encrypted information is then transmitted to the management node so that the management node can decrypt the third encrypted information based on the third key corresponding to the first key to obtain the information and the fourth security factor. as well as, Based on the fourth security factor, it is determined that the information has not been tampered with, and the information associated with the first operating environment parameter and the first privacy value is stored together.

4. The method according to claim 2, wherein the first security factor comprises: First random number; The second security factor includes: first signature data obtained by signing the first random number and the first key based on the third key corresponding to the first key; The third security factor includes: second signature data obtained by signing the second key, the first security factor, and the first operating environment parameters based on the fourth key corresponding to the second key.

5. The method according to claim 3, wherein the fourth security factor comprises: Second random number.

6. The method according to claim 1, The second operating environment parameters include: The second identifier of the security chip of the management node; The information associated with the first privacy value includes: first information representing the identity of the register where the first privacy value is located, and the privacy processing algorithm used to perform privacy processing on the first encryption factor.

7. A decryption method applied to edge nodes, the method comprising: Obtain the first key of the management node; At least the second key and the first operating environment parameters of the edge node are passed to the management node so that the management node can obtain information associated with the first privacy value based on the first operating environment parameters. The information associated with the first privacy value is determined based on the encryption method of any one of claims 1-6. Obtain the information associated with the first privacy value, and obtain the first privacy value based on the information associated with the first privacy value; The first privacy value is sent to the management node so that the management node determines the second encryption factor based on the first operating environment parameter and the second operating environment parameter of the management node. The second encryption factor is then processed based on a privacy processing algorithm to obtain the second privacy value. If the first privacy value and the second privacy value are consistent, the second encryption factor is sent to the edge node. The decryption key is determined based on the fourth key corresponding to the second key, the second encryption factor, and the first key, and the encrypted data is decrypted based on the decryption key.

8. The method according to claim 7, further comprising: Obtain the fifth and sixth security factors of the management node; At least the second key and the first operating environment parameters of the edge node are passed to the management node so that the first operating environment parameters obtain information associated with the first privacy value, and the information associated with the first privacy value is sent to the edge node, including: Based on the sixth security factor, the first key and the fifth security factor are determined to be complete. The first operating environment parameters, the fifth security factor, and the second key are then subjected to security processing to obtain the seventh security factor. The first operating environment parameters, the fifth security factor, the second key, and the seventh security factor are encrypted based on the first key to obtain the fourth encrypted information; The fourth encrypted information is transmitted to the management node, so that the management node can decrypt the fourth encrypted information to obtain the first operating environment parameters, the fifth security factor, the second key, and the seventh security factor; and, Based on the seventh security factor, it is determined that the first operating environment parameters, the fifth security factor, and the second key are complete. Furthermore, based on the fifth security factor, it is determined that the first operating environment parameters and the second key have not been tampered with. Based on the first operating environment parameters, information associated with the first privacy value is obtained, and the information associated with the first privacy value is sent to the edge node.

9. The method according to claim 7 or 8, wherein obtaining information associated with the first privacy value and obtaining the first privacy value based on the information associated with the first privacy value, includes: The fifth encrypted information is obtained by the management node encrypting the information associated with the first privacy value, the eighth security factor, and the ninth security factor based on the second key. The ninth security factor is obtained by performing security processing on the information associated with the first privacy value and the eighth security factor based on the third key. Based on the fourth key, the fifth encrypted information is decrypted to obtain the information associated with the first privacy value, the eighth security factor, and the ninth security factor; Based on the ninth security factor, the information associated with the first privacy value is determined to be complete with the eighth security factor, and the first privacy value is obtained based on the information associated with the first privacy value.

10. The method according to claim 9, wherein the first privacy value is sent to the management node so that the management node determines a second encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node, comprising: The first privacy value, the first operating environment parameter, and the eighth security factor are subjected to security processing to obtain the tenth security factor. The first privacy value, the first operating environment parameter, the eighth security factor, and the tenth security factor are encrypted based on the first key to obtain the sixth encrypted information. The sixth encrypted information is transmitted to the management node so that the management node can decrypt the sixth encrypted information to obtain the first privacy value, the first operating environment parameter, the eighth security factor, and the tenth security factor; as well as, Based on the tenth security factor, the first privacy value, the first operating environment parameter, and the eighth security factor are determined to be complete. Furthermore, based on the eighth security factor, the first privacy value and the first operating environment parameter are determined to be unaltered. Based on the first operating environment parameter and the second operating environment parameter of the management node, the second encryption factor is determined.

11. The method according to claim 7, wherein determining the decryption key based on the second encryption factor, the first key, and the fourth key corresponding to the second key includes: Obtain the seventh encrypted information, which is obtained by the management node encrypting the second encryption factor and the eleventh security factor based on the second key, and the eleventh security factor is obtained by security processing the second encryption factor based on the third key; The second encryption factor is determined to be complete based on the eleventh security factor, and the decryption key is determined based on the second encryption factor, the first key, and the fourth key corresponding to the second key.

12. An encryption method applied to a management node, the method comprising: In response to an encryption request from an edge node, the first key from the security chip of the management node is sent to the edge node; Obtain the second key and first operating environment parameters of the edge node, and determine the first encryption factor based on the first operating environment parameters and the second operating environment parameters of the management node; The first operating environment parameters include: the first identifier of the security chip of the edge node and the physical address of the edge node. The first operating environment parameters will change with the operating environment of the edge node, and the second operating environment parameters will change with the operating environment of the management node. The first encryption factor is sent to the edge node so that the edge node determines the encryption key based on the fourth key corresponding to the second key, the first encryption factor, and the first key. The first encryption factor is then processed for privacy using a privacy processing algorithm to obtain a first privacy value. The information associated with the first privacy value is then transmitted to the management node. The encryption key is used to encrypt the data of the edge node to obtain encrypted data. The information associated with the first operating environment parameters and the first privacy value is stored together.

13. A decryption method applied to a management node, the method comprising: In response to a decryption request from an edge node, the first key from the security chip of the management node is sent to the edge node; Obtain the second key and the first operating environment parameters of the edge node, and obtain information associated with the first privacy value based on the first operating environment parameters; The information associated with the first privacy value is sent to the edge node, so that the edge node obtains the first privacy value based on the information associated with the first privacy value, and sends the first privacy value to the management node; A second encryption factor is determined based on the first operating environment parameters and the second operating environment parameters of the management node. The second encryption factor is then processed using a privacy processing algorithm to obtain a second privacy value. If the first privacy value and the second privacy value are consistent, the second encryption factor is sent to the edge node so that the edge node can determine a decryption key based on the fourth key corresponding to the second key, the second encryption factor, and the first key. The encrypted data is then decrypted based on the decryption key. The first operating environment parameters include: the first identifier of the security chip of the edge node and the physical address of the edge node. The first operating environment parameters will change with the operating environment of the edge node, and the second operating environment parameters will change with the operating environment of the management node.

14. An edge node, comprising: A first memory, a first processor, and a first security chip; The first security chip includes a second key and first operating environment parameters; The first memory is used to store at least one set of instructions; The first processor is configured to call and execute the instruction set in the first memory, and to perform the encryption method as described in any one of claims 1-6 or the decryption method as described in any one of claims 7-11 by executing the instruction set.

15. A management node, comprising: Second memory, second processor, and second security chip; The second security chip includes a first key and second operating environment parameters; The second memory is used to store at least one set of instructions; The second processor is configured to invoke and execute the instruction set in the second memory, and to perform the encryption method as described in claim 12 or the decryption method as described in claim 13 by executing the instruction set.

Images