A symmetric key distribution method

Abstract

The application discloses a symmetric key distribution method, in the symmetric key distribution process, the first distribution adopts the form of key component plus security medium protection to send to the opposite node offline, which enhances the security of the key distribution; when there are common pairs of symmetric keys between nodes, the second distribution of the key can be protected by selecting any key according to the business scene, which improves the flexibility of the key protection relationship; and the whole distribution process effectively protects the confidentiality and integrity of the key, and has strong applicability.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, in particular to a symmetric key distribution method. BACKGROUND

[0002] In the communication process, in order to achieve a specific cryptographic function, the sender generally uses an encryption key to encrypt data, and the receiver uses a decryption key to decrypt data. The key can be divided into two categories: symmetric key and asymmetric key. In asymmetric key, "asymmetric" means that the encryption key and the decryption key are different, and the encryption key and the decryption key usually have a specific mathematical relationship; in symmetric key, the word "symmetric" means that the encryption key and the decryption key are the same.

[0003] The core of the symmetric encryption system is the management and protection of the key, which must ensure the synchronization of the key between the communication nodes and the security of the key in the generation, storage and use process. The existing symmetric encryption application has various types of business, and each type of business has different security requirements. Different key management, use strategies and methods are adopted, and the network node security island type key management is adopted.

[0004] Based on the symmetric algorithm, in the absence of a secure channel, the traditional way of symmetric key distribution generally has two kinds. One is to use pre-set keys or agreed keys for distribution. This method cannot guarantee the randomness of the key. The other is to use a medium for offline transmission. If the password is leaked, it will cause security risks to the key. If it is found that the key has security risks, it must be replaced in time. In addition, the above two traditional key distribution methods cannot achieve the requirement of unified distribution and replacement management. SUMMARY

[0005] The technical problem to be solved by the present application is to provide a symmetric key distribution method to realize unified distribution and replacement management of symmetric keys and improve the security of symmetric key distribution.

[0006] To solve the above technical problems, the technical solutions adopted by the present application are as follows.

[0007] A symmetric key distribution method, specifically comprising the following steps:

[0008] S1. Generating a key encryption key KEK for m business nodes respectively at a password management node am , wherein the key encryption key is generated according to a key component threshold to determine the number of key components n (n≥2) before the key encryption key is generated; and each key component is stored in a corresponding secure medium T mn ;

[0009] S2. Offline delivering the secure medium T mn of each business node to the corresponding business node respectively;

[0010] S3. The service node receiving the security medium further XORs the key components in each security medium to obtain the key encryption key KEK generated by the password management node am ;

[0011] S4. The password management node generates the communication key KT ai for the i-th (i∈m) service node, encapsulates the communication key KT ai into a distribution key data packet to be distributed to the i-th service node, and exports the distribution key data packet to the security medium T ssi ;

[0012] S5. The security medium T ssi is delivered offline to the i-th service node, which obtains the encryption key information from the distribution key data packet, reads the encryption key, decrypts the data through the encryption key, verifies the integrity of the key data, and obtains the communication key KT ai ;

[0013] S6. The password management node generates the communication key KT ij between the i-th (i∈m) service node and the j-th (j∈m) service node ij ;

[0014] S7. The encryption key is selected to encapsulate the communication key KT si into distribution key data packets for the i-th service node and the j-th service node, respectively, and the corresponding distribution key data packets are exported to the security medium T sj and the security medium T am , respectively. The encryption key information used in encapsulation can be selected from the key encryption key KEK ai or the communication key KT si ;

[0015] S8. The security medium T sj and the security medium T ij are delivered offline to the i-th service node and the j-th service node, respectively, and the i-th service node and the j-th service node obtain the encryption key information from the distribution key data packet to obtain the encryption key; decrypt the data through the encryption key, verify the integrity of the key data, and obtain the communication key KT am .

[0016] The above-mentioned symmetric key distribution method, step S1 specifically includes the following steps:

[0017] S11. The password management node generates the key encryption key KEK i1 for the i-th (i∈m) service node, respectively, and the key component F i1 is encapsulated into a key component data packet and exported to the security medium Ti1 ;

[0018] S12. The password management node generates a key encryption key KEK of the i (i∈m) service node respectively am key component F i2 , encapsulates the key component F i2 into a key component data packet, and exports to a secure medium T i2 ;

[0019] S13. According to the key component threshold, it is determined that the condition of synthesizing the key is reached, and the key encryption key KEK is synthesized by exclusive OR. am The local key is used to encrypt and store in the local database of the password management node, and the key confidentiality and integrity are ensured during storage. The key HASH is calculated first, and then the key plaintext and the HASH are spliced to calculate the ciphertext for storage.

[0020] The above-mentioned symmetric key distribution method, step S3 specifically comprises the following steps: obtaining two key encryption key components through the secure medium T i1 and the secure medium T i2 , unpackaging the key component data packet to obtain the key component data, and determining that the key component threshold is reached, and the key encryption key KEK is synthesized by exclusive OR. ai .

[0021] The above-mentioned symmetric key distribution method, wherein the key component data packet comprises key generation node, destination node and component threshold information; and the secure medium type is an intelligent password key or a TF password card.

[0022] The above-mentioned symmetric key distribution method, wherein the distribution key data packet comprises encrypted key information, used encryption algorithm and integrity algorithm, and ciphertext data of the key+key MAC.

[0023] Thanks to the above technical solutions, the technical progress achieved by the present application is as follows.

[0024] In the symmetric key distribution process, the present application firstly distributes the key components in the form of security medium protection offline to the opposite node, thereby enhancing the security of key distribution; when there are multiple pairs of symmetric keys shared between nodes, the key is distributed according to the business scene selection of any key protection during the second distribution of the key, thereby improving the flexibility of key protection relationship; and the confidentiality and integrity of the key are effectively protected during the entire distribution process, thereby being highly applicable. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 The flowchart of the embodiment 1 of the present application is shown in the figure.

[0026] Figure 2 The schematic diagram of the optional key protection component in the embodiment 1 of the present application is shown in the figure. Detailed Implementation

[0027] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0028] A symmetric key distribution method is proposed. The initial distribution uses key components with secure media protection and is sent offline to the business node. When multiple pairs of symmetric keys exist among the nodes, the key can be distributed again by selecting any key protection according to the business scenario. This improves the flexibility of key protection relationships while enhancing security.

[0029] This embodiment uses three nodes as an example to explain the specific steps in detail, such as... Figure 1 As shown, this embodiment includes node A, node 1 and node 2; where node A represents the password management node, and node 1 and node 2 represent two business nodes, i.e. m=2.

[0030] A symmetric key distribution method specifically includes the following steps.

[0031] S1. Generate encryption keys KEK for m business nodes at the password management node. am Before generating the encryption key, the number of key components n (n≥2) is determined based on a key component threshold; and each key component is stored in its corresponding secure medium T. mn In this step, the key component data packet includes the key generation node, destination node, and component threshold information; the security medium type is a smart cryptographic key or a TF cryptographic card.

[0032] S11. Generate the key encryption key KEK for the i-th (i∈m) business node at the password management node. am key component F i1 , the key component F i1 Encapsulated into key component data packets, exported to secure medium T i1 .

[0033] S12. Generate the key encryption key KEK for the i-th (i∈m) business node at the password management node. am key component F i2 , the key component F i2 Encapsulated into key component data packets, exported to secure medium T i2 .

[0034] S13. Determine if the conditions for synthesizing the key are met based on the key component threshold, and XOR the synthesized key to encrypt the key KEK. am, encrypts and stores to the local database of the password management node, guarantees the key confidentiality and integrity during storage, calculates the key HASH first, concatenates the key plaintext and the HASH to calculate the ciphertext for storage.

[0035] In this embodiment, the number of key components n is set to two, i.e. the password management node A generates a key encryption key KEK am for each service node.

[0036] Specifically: 1) the password management node generates a key component F a1 of the key encryption key KEK 11 from node A to service node 1, encapsulates the key component F 11 into a key component data packet, and exports it to the secure medium T 11 ; the password management node generates a key component F a1 of the key encryption key KEK 12 from node A to service node 2, encapsulates the key component F 12 into a key component data packet, and exports it to the secure medium T 12 ; according to the key component threshold, it is determined that the condition for synthesizing the key is reached, and the key encryption key KEK a1 from node A to service node 1 is synthesized by XOR, which is encrypted and stored to the local database of the password management node, guarantees the key confidentiality and integrity during storage, calculates the key HASH first, concatenates the key plaintext and the HASH to calculate the ciphertext for storage.

[0037] 2) the password management node generates a key component F a2 of the key encryption key KEK 21 from node A to service node 2, encapsulates the key component F 21 into a key component data packet, and exports it to the secure medium T 21 ; the password management node generates a key component F a2 of the key encryption key KEK 22 from node A to service node 2, encapsulates the key component F 22 into a key component data packet, and exports it to the secure medium T 22 ; according to the key component threshold, it is determined that the condition for synthesizing the key is reached, and the key encryption key KEK a2 from node A to service node 2 is synthesized by XOR, which is encrypted and stored to the local database of the password management node, guarantees the key confidentiality and integrity during storage, calculates the key HASH first, concatenates the key plaintext and the HASH to calculate the ciphertext for storage.

[0038] S2. The secure medium T mn of each service node is delivered offline to the corresponding service node respectively.

[0039] In this embodiment, the security media T 11 and the security media T 12 are delivered offline to the first service node 1; the security media T 21 and the security media T 22 are delivered offline to the second service node 2.

[0040] S3. After the service node receiving the security media unpacks the key component in each security media, the further XOR operation obtains the key encryption key KEK am generated by the password management node. In this step, two key encryption key components are obtained through the security media T i1 and the security media T i2 , the key component data packet is unpacked to obtain the key component data, and it is determined that the key component threshold is reached, and the key encryption key KEK ai is synthesized through the XOR operation.

[0041] In this embodiment, the security media T i1 and the security media T i2 can be imported in any order.

[0042] In this embodiment, 1) the security media T 11 is imported into the service node 1, the key component data packet is unpacked to obtain the key component data; the security media T 12 is imported into the service node 1, the key component data packet is unpacked to obtain the key component data; and it is determined that the key component threshold is reached, and the key encryption key KEK a1 is synthesized through the XOR operation. 2) the security media T 21 is imported into the service node 2, the key component data packet is unpacked to obtain the key component data; the security media T 22 is imported into the service node 2, the key component data packet is unpacked to obtain the key component data; and it is determined that the key component threshold is reached, and the key encryption key KEK a2 is synthesized through the XOR operation.

[0043] Through steps S1 to S3, the symmetric key distribution of the password management node to the service node 1 and the service node 2 is realized, the key component is used in the form of security media protection offline to the opposite end node, and the security of the key distribution is enhanced.

[0044] S4. The password management node generates the communication key KT ai for the i (i∈m) service node, encapsulates the communication key KT ai into a distribution key data packet distributed to the i service node, and exports the distribution key data packet to the security media T ssiThe distribution key data packet includes encryption key information, encryption algorithm and integrity algorithm used, and ciphertext data of key+key MAC.

[0045] In this embodiment, the password management node generates the communication key KT a1 between the node A and the first service node 1. a1 encapsulates it into a distribution key data packet distributed to the first service node 1, and exports the distribution key data packet to the secure medium T ss1 .

[0046] In this embodiment, the password management node also generates the communication key KT a2 between the node A and the second service node 2. a2 encapsulates it into a distribution key data packet distributed to the second service node 2, and exports the distribution key data packet to the secure medium T ss2 .

[0047] S5. The secure medium T ssi is delivered offline to the ith service node, which acquires the encryption key information of this time according to the distribution key data packet, reads the encryption key, decrypts the data by the encryption key, verifies the integrity of the key data, and obtains the communication key KT ai .

[0048] In this embodiment, the secure medium T ss1 is delivered offline to the first service node 1, which receives the distribution key data packet, acquires the encryption key information of this time according to the distribution key data packet, reads the encryption key at the service node 1, decrypts the data by the encryption key, verifies the integrity of the key data, and obtains the communication key KT a1 .

[0049] Alternatively, the secure medium T ss2 is delivered offline to the second service node 2, which receives the distribution key data packet, acquires the encryption key information of this time according to the distribution key data packet, reads the encryption key at the service node 2, decrypts the data by the encryption key, verifies the integrity of the key data, and obtains the communication key KT a2 .

[0050] S6. The password management node generates the communication key KT ij between the ith (i∈m) service node and the jth (j∈m) service node. 12 .

[0051] In this embodiment, the password management node A generates the communication key KT 12 between the first service node 1 and the second service node 2. 12 .

[0052] S7. Selecting an encryption key to encapsulate the communication key KT ij The distribution key data packet is encapsulated into the i-th service node and the j-th service node respectively, and the corresponding distribution key data packet is exported to the secure medium T si and the secure medium T sj The encryption key information used in the encapsulation can be the key encryption key KEK am or the communication key KT ai .

[0053] In this embodiment, the communication key KT 12 is encapsulated into the first service node 1 and the second service node 2 respectively, and the corresponding distribution key data packet is exported to the secure medium T s1 and the secure medium T s2 The distribution key data packet includes encryption key information, encryption algorithm used, and integrity algorithm.

[0054] The encryption key information used in the encapsulation can be the key encryption key KEK a1 or the communication key KT a1 .

[0055] S8. The secure medium T si and the secure medium T sj are delivered offline to the i-th service node and the j-th service node respectively, and the i-th service node and the j-th service node obtain the encryption key information according to the distribution key data packet, obtain the encryption key; decrypt the data through the encryption key, verify the integrity of the key data, and obtain the communication key KT ij .

[0056] In this embodiment, the secure medium T s1 and the secure medium T s2 are delivered offline to the first service node 1 and the second service node 2 respectively, and the first service node 1 and the second service node 2 receive the distribution key data packet, obtain the encryption key information according to the distribution key data packet, obtain the encryption key; decrypt the data through the encryption key, verify the integrity of the key data, and obtain the communication key KT 12 .

[0057] Steps S4 to S8 realize the distribution of the symmetric key between the two service nodes ij; Since there are two pairs of symmetric keys between the two nodes, the key encryption key KEK am or the communication key KT ai can be selected to protect the distribution between the two service nodes, which improves the flexibility of the key protection relationship. When the key encryption key KEK amThe symmetric key is protected when being distributed, and the communication key KT ai The business data encryption can be used according to the business scene; when the communication key KT ai The symmetric key is protected when being distributed, and the communication key KT ai It is not used for other purposes.

[0058] The result of the symmetric key distribution and protection of the business nodes by the password management node provided in the embodiment is shown in Figure 2 .

Claims

1. A symmetric key distribution method, characterized by, Specifically comprising the following steps: S1. The password management node generates key encryption keys KEK for m service nodes respectively am Before the generation of the key encryption key, the number of key components n is determined according to the key component threshold. and store each key component into corresponding security medium T mn ; generate the key encryption key KEK am of the i-th service node at the password management node respectively according to the key components F i1 , and determine the condition of reaching the synthesized key according to the key component threshold value, and perform XOR to synthesize the key encryption key KEK am ; S2. The secure media T of each service node is delivered offline to the corresponding service node, respectively. mn offline to the corresponding service node. S3. After the key components in each security media are decrypted by the service node receiving the security media, the service node further exclusive-ORs to obtain the key encryption key KEK generated by the password management node am ; S4. Generating a communication key KT for the i-th service node at the password management node ai , encapsulating the communication key KT ai into a distribution key data packet distributed to the i-th service node, and exporting the distribution key data packet to the secure medium T ssi ; the distribution key data packet comprises encrypted key information, encryption algorithm and integrity algorithm used, ciphertext data of the key + key MAC S5. The secure media T ssi is delivered offline to the i-th service node, which obtains the current encryption key information according to the distribution key data packet, reads the encryption key, decrypts the data through the encryption key, verifies the integrity of the key data, and obtains the communication key KT ai ; S6. Generating a communication key KT between the i-th service node and the j-th service node at the password management node ij ; S7. Selecting an encryption key to communicate the key KT ij The distribution key packets are encapsulated to the i-th service node and the j-th service node, respectively, and the corresponding distribution key packets are exported to the secure medium T si and the secure medium T sj The encryption key information used in the encapsulation can be selected from the key encryption key KEK am or the communication key KT ai ; S8. The secure media T si and the secure media T sj are respectively delivered offline to the i-th service node and the j-th service node, the i-th service node and the j-th service node obtain the encryption key information according to the distribution key data packet, obtain the encryption key; decrypt the data through the encryption key, verify the key data integrity, and obtain the communication key KT ij .

2. The symmetric key distribution method of claim 1, wherein, The step S1 specifically comprises the following steps: S11. The password management node generates a key encryption key KEK of the i-th service node respectively am key component F i1 , encapsulates the key component F i1 into a key component data packet, and exports it to the secure medium T i1 ; S12. The password management node generates a key encryption key KEK of the i-th service node respectively am key component F i2 , encapsulates the key component F i2 into a key component data packet, and exports it to the secure medium T i2 ; S13. Determine the condition of reaching the synthetic key according to the key component threshold value, and perform XOR synthetic key encryption key KEK am , encrypt the storage to the local database of the password management node using the local key, ensure the confidentiality and integrity of the key during storage, calculate the key HASH first, concatenate the key plaintext and HASH to calculate the ciphertext for storage.

3. The symmetric key distribution method of claim 2, wherein, Step S3 comprises the following steps in detail: obtaining the two key encryption key components by the secure medium T i1 and the secure medium T i2 obtaining two key encryption key components, unpacking the key component data packet to obtain the key component data, determining whether the key component threshold is reached, and XOR synthesizing the key encryption key KEK ai .

4. The symmetric key distribution method of claim 3, wherein, The key component data packet comprises key generation node, destination node and component threshold information; the security medium type is intelligent password key or TF password card.

Images