Key encryption and decryption method, storage and application control system, and electronic device

Abstract

The application relates to the technical field of data security, and discloses a secret key encryption and decryption method, a storage, application control system and electronic equipment. The secret key encryption method comprises the following steps: setting a communication handshake secret key; generating secret key data stream according to the communication handshake secret key; creating secret key loading information; encrypting plaintext data according to the secret key data stream and the secret key loading information to obtain secret key ciphertext data; and storing the secret key ciphertext data in a secret key storage space. The secret key decryption method comprises the following steps: reading the secret key ciphertext data from the secret key storage space; obtaining the communication handshake secret key and the secret key loading information during encryption; and decrypting the secret key ciphertext data according to the communication handshake secret key and the secret key loading information to obtain secret key plaintext data. The communication handshake secret key of network communication is encrypted, and the encrypted secret key ciphertext data is stored, so that the risk of communication secret key being cracked by brute force can be reduced, and the security of network communication is improved.

Description

Technical Field

[0001] The embodiments of this application relate to the field of data security technology, and in particular to a key encryption and decryption method and storage, application control system, and electronic device. Background Technology

[0002] With the continuous advancement of network information security technology, IPSec VPN technology is increasingly widely used in network information security. IPSec VPN refers to a VPN technology that uses the IPSec protocol to achieve remote access. IPSec VPN technology provides security services at the IP layer of the Internet protocol stack. Operators can select the appropriate security protocol and determine the algorithm used by the service according to communication requirements. IPSec VPN can provide mutual authentication methods, protecting one or more paths between hosts, between security gateways, and between a security gateway and a host, as well as the data in transit, from theft and attack. Due to its high security, confidentiality, and reliability, IPSec VPN communication technology is also widely used in the field of robot control.

[0003] IPSec VPN technology offers high security in communication. Before communication, both parties need to exchange communication handshake keys to identify each other. These keys are often stored in hard drives as databases or files, or in external electrically erasable programmable read-only memory (EEPROM) or flash memory. Due to the high readability of hard drives and flash memory, this method of key storage poses a significant risk in situations with high security requirements. Summary of the Invention

[0004] This application provides a key encryption and decryption method and storage, application control system, and electronic device. By encrypting the communication handshake key of network communication and then storing the encrypted key ciphertext data, the risk of the communication handshake key being brute-forced can be reduced, thereby improving the security of network communication.

[0005] The embodiments of this application provide the following technical solutions:

[0006] In a first aspect, embodiments of this application provide a key encryption method, which includes:

[0007] Set the communication handshake key;

[0008] Generate a key data stream based on the communication handshake key;

[0009] Create key loading information;

[0010] Based on the key data stream and key loading information, the plaintext data is encrypted to obtain the key ciphertext data.

[0011] Store the ciphertext data of the key in the key's storage space.

[0012] In some embodiments, creating key loading information includes:

[0013] Initiate an authorization session to create access permissions;

[0014] Create a primary key object to generate a seed key based on the primary key object;

[0015] Based on the seed key, create an RSA key to generate a public and private key;

[0016] Based on the public key and the private key, key loading information is generated by fusing them together.

[0017] In some embodiments, storing the key ciphertext data in the key's storage space includes:

[0018] Access permissions to create storage space;

[0019] Set the address and storage space for key storage, and authorize the storage space;

[0020] Write the key ciphertext data to the storage space to store the key ciphertext data.

[0021] In some embodiments, the storage space for the key includes non-volatile storage space.

[0022] Secondly, embodiments of this application provide a key decryption method, which includes:

[0023] Read the key ciphertext data from the key's storage space;

[0024] Retrieve the key loading information during encryption;

[0025] Based on the communication handshake key and key loading information, the ciphertext data of the key is decrypted to obtain the plaintext data of the key.

[0026] In some embodiments, before reading the key ciphertext data from the key's storage space, the method further includes:

[0027] Verify the legitimacy of the key decryption identity;

[0028] If the identity verification key is valid, then obtain the key loading information during encryption.

[0029] If the key verification fails to decrypt the identity, the key ciphertext data will not be decrypted.

[0030] Thirdly, embodiments of this application provide a key storage system, which includes a data reading module, an encryption module, a decryption module, and a storage module;

[0031] The encryption module is used to set the communication handshake key; generate a key data stream based on the communication handshake key; create key loading information; and encrypt plaintext data based on the key data stream and key loading information to obtain key ciphertext data.

[0032] The data reading module is used to read the ciphertext data of the key from the key storage space; and to obtain the key loading information during encryption.

[0033] The decryption module is used to decrypt the key ciphertext data based on the communication handshake key and key loading information to obtain the key plaintext data;

[0034] The storage module is used to store the key ciphertext data in the key's storage space.

[0035] In some embodiments, the data reading module is also used to verify the legitimacy of the key decryption identity; if the verification of the legitimacy of the key decryption identity is successful, the key loading information at the time of encryption can be obtained; if the verification of the legitimacy of the key decryption identity fails, the key ciphertext data cannot be decrypted.

[0036] Fourthly, embodiments of this application provide an application control system applied to a chip, the system comprising:

[0037] The hardware encryption layer includes an authentication module and a cryptographic algorithm module. The authentication module is used to authenticate the basic input / output system and the startup of the operating system, and the cryptographic algorithm module is used to encrypt the data. The authentication module and the cryptographic algorithm module are used together for mandatory authentication and recognition when the operating system starts up.

[0038] The system layer includes device drivers, which are used to drive the chips.

[0039] The application layer includes, for example, a key storage system, as described in the third aspect.

[0040] Fifthly, embodiments of this application provide an electronic device, including:

[0041] At least one processor; and

[0042] A memory that is communicatively connected to at least one processor; wherein,

[0043] The memory stores instructions that can be executed by at least one processor, such that the at least one processor can perform a key encryption method as described in the first aspect and a key decryption method as described in the second aspect.

[0044] In a sixth aspect, embodiments of this application provide a non-volatile computer-readable storage medium storing computer-executable instructions for causing an electronic device to perform a key encryption method as described in the first aspect and a key decryption method as described in the second aspect.

[0045] The beneficial effects of the embodiments of this application are as follows: Unlike existing technologies, the embodiments of this application provide a key encryption method applied to a key storage system. This key encryption method includes: setting a communication handshake key; generating a key data stream based on the communication handshake key; creating key loading information; encrypting plaintext data based on the key data stream and the key loading information to obtain ciphertext key data; and storing the ciphertext key data in the key storage space. By encrypting the communication handshake key for network communication and then storing the encrypted ciphertext key data, this application can reduce the risk of brute-force attacks on the communication key, thereby improving the security of network communication. Attached Figure Description

[0046] One or more embodiments are illustrated by way of example with reference to the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements having the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0047] Figure 1 This is a schematic diagram of the structure of an application control system provided in an embodiment of this application;

[0048] Figure 2 This is a flowchart illustrating a key encryption method provided in an embodiment of this application;

[0049] Figure 3 yes Figure 2 A detailed flowchart of step S203 in the process;

[0050] Figure 4 yes Figure 2 A detailed flowchart of step S205 in the process;

[0051] Figure 5 This is a flowchart illustrating a key decryption method provided in an embodiment of this application;

[0052] Figure 6 This is a schematic diagram illustrating the verification of the legitimacy of a key decryption identity provided in an embodiment of this application;

[0053] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0054] Explanation of icon numbers:

[0055]

[0056] Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0058] Furthermore, the technical features involved in the various embodiments of this application described below can be combined with each other as long as they do not conflict with each other.

[0059] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The term "and / or" as used in this specification includes any and all combinations of one or more of the associated listed items.

[0060] The technical solution of this application will be described in detail below with reference to the accompanying drawings:

[0061] Please see Figure 1 , Figure 1 This is a schematic diagram of the structure of an application control system provided in an embodiment of this application;

[0062] like Figure 1As shown, the application control system 100 is applied to an electronic device (TCM device). The electronic device (TCM device) includes a domestically produced trusted computing platform module chip (TCM chip). The full English name of the domestically produced trusted computing platform module (TCM) is "Trusted Cryptography Module," which provides cryptographic operation functions for the trusted computing platform and has protected storage space. The concept of a trusted computing platform was proposed by the State Cryptography Administration. A trusted computing platform is built on a computing system and serves as a support system for implementing trusted computing functions. The cryptographic support platform for trusted computing is an important component of the trusted computing platform, including cryptographic algorithms, key management, certificate management, cryptographic protocols, and cryptographic services, providing cryptographic support for the integrity, identity trustworthiness, and data security of the trusted computing platform itself.

[0063] The application control system 100 includes a hardware encryption layer 110, a system layer 120, and an application layer 130.

[0064] The hardware encryption layer 110 is a TCM chip, including an authentication module 111 and a cryptographic algorithm module 112. The authentication module 111 is used for the legitimacy authentication management of BIOS / UEFI boot. UEFI stands for Unified Extensible Firmware Interface, a standard that describes a new type of interface and is a standard firmware interface for computers. UEFI aims to improve software interoperability and overcome the limitations of BIOS. This legitimacy authentication management includes, during the system boot phase, verifying the trusted operating system based on BIOS. Specifically, the verification program reads the operating system flag at a specific location in the hard disk sector to determine if it is a trusted operating system. If authentication passes, the operating system boots; if authentication fails, the BIOS stops booting the operating system. The authentication module 111 is also used for the basic input output system (BIOS) boot authentication management. The cryptographic algorithm module 112 is located within the onboard TCM chip and is used to encrypt data. The authentication module and the cryptographic algorithm module work together to enforce authentication and recognition during operating system boot.

[0065] In this embodiment, the specific working method of the identity authentication module and the cryptographic algorithm module is as follows: After the operating system starts, the BIOS completes system self-test and initialization after power-on. The onboard TCM chip and the secure hard disk are connected to the BIOS respectively. The identity authentication module performs mandatory identity authentication on the operator. At the same time, the basic input / output devices (i.e., keyboard and mouse) authenticate the operator's identity. After the basic input / output devices verify the operator's identity, the operator completes data input by using the basic input / output devices. The identity authentication module performs mandatory verification on the data input by the operator using the key data stored in the BIOS flash memory chip, thereby verifying the operator's identity. Author identification; After the BIOS verifies the operator's identity, the SM3 algorithm engine in the cryptographic algorithm module calculates the BIOS hash value and stores it in the data security storage module in the onboard TCM chip. The integrity measurement module in the onboard TCM chip calls the SM1 algorithm in the cryptographic algorithm module to use the first 128 bits of the BIOS hash value as a backup key for SM1 algorithm encryption backup. The encrypted backup data is stored in the onboard TCM chip. The key data stored on the secure hard drive is used to identify and verify the operator's identity again. After the operator's identity is verified, the secure hard drive is initialized and verified.

[0066] In addition, the hardware encryption layer also includes a secure authentication serial terminal based on Chinese national cryptographic algorithms. The CPU of the secure authentication serial terminal includes SM1, SM2, and SM3 algorithm engines to provide algorithm support to the chip and operating system. The secure authentication serial terminal's confidential memory is used to store identity authentication information and private keys, and also provides confidential storage for information exchanged with the identity authentication module. The chip operating system of the secure authentication serial terminal is used to complete the digital signature function of outgoing data and the private key decryption function of received data by calling the CPU's Chinese national cryptographic algorithm engine. At the same time, biometric technology, including but not limited to fingerprint modules and facial recognition modules, can be accessed on the serial terminal.

[0067] System layer 120 includes device driver 121, which is the TCM device driver used to drive the TCM chip. System layer 120 also includes a protocol stack layer. In the domestically produced Trusted Computing Platform Module (TCM), the operator cannot directly manipulate the chip's internal registers, but interacts with the TCM through software such as the protocol stack. The TCM's protocol stack layer (IPSEC protocol processing layer) is a secure transmission protocol to ensure the security of network transmission, but its actual security comes from the fact that the transmitted data is encrypted by the TCM. This protocol stack layer includes Tpm2_TSS, Tpm2_Tool, and Tpm2_Abrmd. TSS (TCG Software Stack), also known as the Trusted Software Stack, is the supporting software for TPM on the Trusted Computing Platform. The main function of TSS is to provide an interface for the operating system and application software to use TPM. The structure of TSS can be divided into a kernel layer, a system service layer, and an operator program layer. Tpm_tool is the application tool for TCM, used to access the TPM2.0 non-volatile (NV) space (index values) on compatible systems. It provides functions for enumerating, creating, deleting, querying, and locking NV indexes, as well as reading and writing data stored within them. Tpm2_Abrmd is the TCM2 access agent and resource manager, a system daemon used to implement the TCG's TPM2 access agent (TAB) and resource manager (RM) specifications. Tpm2_TSS, Tpm2_Tool, and Tpm2_Abrmd provide the interface for applications to access TCM and manage it.

[0068] The application layer 130 includes a key storage system 131, wherein the key storage system 131 includes a data reading module 1311, an encryption module 1312, a storage module 1313, and a decryption module 1314.

[0069] The data reading module 1311 is communicatively connected to the storage module 1313 and the decryption module 1314 respectively. The data reading module 1311 is used to send a request to the storage module to read the key ciphertext data, read the key ciphertext data from the key storage space, and send the key ciphertext data to the decryption module; and obtain the key loading information during encryption.

[0070] The encryption module 1312 is communicatively connected to the storage module 1313. The encryption module 1312 is used to set the communication handshake key; generate a key data stream based on the communication handshake key; create key loading information; encrypt plaintext data based on the key data stream and key loading information to obtain key ciphertext data, and send the key ciphertext data to the storage module.

[0071] The storage module 1313 is communicatively connected to the encryption module 1312. The storage module 1313 is used to receive the key ciphertext data sent by the encryption module and store the key ciphertext data in the key storage space.

[0072] The decryption module 1314 is communicatively connected to the data reading module 1311 and is used to receive the key ciphertext data sent by the data reading module; obtain the communication handshake key and key loading information during encryption; and decrypt the key ciphertext data according to the communication handshake key and key loading information to obtain the key plaintext data.

[0073] In this embodiment of the application, the encryption module 1312 is specifically used for:

[0074] Initiate an authorization session to create access permissions;

[0075] Create a primary key object to generate a seed key based on the primary key object;

[0076] Based on the seed key, create an RSA key to generate a public and private key;

[0077] Based on the public and private keys, the key loading information is generated by fusing them together.

[0078] Access permissions to create storage space;

[0079] Set the address and storage space for key storage, and authorize the storage space;

[0080] Write the key ciphertext data to the storage space to store the key ciphertext data.

[0081] Please see Figure 2 , Figure 2 This is a flowchart illustrating a key encryption method provided in an embodiment of this application;

[0082] The key encryption method is applied to a key storage system. Specifically, the execution subject of the key encryption method is one or more processors of an electronic device.

[0083] like Figure 2 As shown, the key encryption method includes:

[0084] In this embodiment of the application, before encrypting the communication handshake key, the computer control system is powered on and started. After the operating system starts, it reads the session authorization digest through TCM and verifies the legitimacy of the basic input / output system (BIOS) and operating system (OS). If the check fails, the system will prompt an error and the communication handshake key cannot be encrypted. If the check passes and the authentication is successful, the normal system boot interface can be entered, and the system will be prompted that the system has started normally, and then the process can proceed to step S201.

[0085] Step S201: Set the communication handshake key;

[0086] Specifically, the operator sets the communication handshake key through the deployment tool. This communication handshake key is an IPSecVPN-based communication handshake key. The deployment tool has a default initial password for key setting. When setting the IPSecVPN handshake key for the first time, the default factory password needs to be changed. Before setting the key, the operator's legitimacy is verified. If the verification fails, the deployment tool will display an error message and will not allow login to set the key. If the user's identity is verified, the user will be taken to the key setting interface.

[0087] Step S202: Generate a key data stream based on the communication handshake key;

[0088] Specifically, the key data stream is a string of data streams used to encrypt and decrypt the plaintext data stream. The key data stream is generated based on the communication handshake key. The key data stream is generated by creating a string of key data streams through a random or pseudo-random process.

[0089] Step S203: Create key loading information;

[0090] In this application embodiment, TPM (Trusted Platform Module) refers to the TPM hardware security chip proposed by the Trusted Computing Group (TCG), and the trusted computing system standard built upon it, such as the TPM2.0 specification. Authorization is a core concept in the TPM2.0 specification. All TPM specifications ensure that access to various resources must be authorized. Authorization is used to control access to TPM entities and provide security for TPM. Sessions are the carrier and tool for TPM to complete authorization, and various authorizations are accomplished by setting various attributes and states of the session. The Trusted Platform Module (TPM) is a chip embedded inside a computer that provides a root of trust for the computer. The specifications of this chip are defined by the Trusted Computing Group. In China, the corresponding chip is the TCM (Trusted Cryptography Module), which is researched domestically.

[0091] Please refer to the following: Figure 3 , Figure 3 yes Figure 2 A detailed flowchart of step S203 in the process;

[0092] like Figure 3 As shown, step S203: Create key loading information, including:

[0093] Step S2031: Initiate an authorization session to create access permissions;

[0094] Specifically, the non-volatile storage space (NV space) access tool in the Trusted Platform Module (TPM) is used to generate commands for setting TCM access permission authentication to create access permissions. This NV space access tool is used to access the TPM2.0 non-volatile (NV) space (index value) on compatible systems with zero dependency on any TPM2.0 stack. The tool provides functions for enumerating, creating, deleting, querying, and locking NV indices, as well as reading and writing data stored therein. This tool includes the Tpm_tool, which is a tool applied to TCM devices. The command for setting TCM access permission authentication includes: tcm2_takeownership(O1,E1,L1), where ownership represents the owner of the TPM operation rights, parameter O1 represents Ownerpass, which is the password required for the operator to operate the TPM device (the TPM device can be any device with a TPM chip), parameter E1 represents endorsementpass, which is the password used for endorsement / signing with the TPM, and parameter L1 represents Lockpass, which is used to lock the TPM. Once TCM access authentication is successful, access permissions will be granted.

[0095] Step S2032: Create a primary key object to generate a seed key based on the primary key object;

[0096] Specifically, the non-volatile storage space (NV space) access tool in the Trusted Platform Module (TPM) generates the command `tpm2_createprimary` to create a primary key object. This primary key object is then used to generate a seed key, which is an RSA key with a SHA256 hash function. The seed key object is temporarily stored in a file cache file. For example, the command `tpm_tool` generates the seed key includes: `tcm2_createprimary(He, K11, G0b, Cpotx.ctx, L1)`. Here, parameter `He` represents the endorsement key (`TPM_RH_ENDORSEMENT`), parameter `K11` represents the authentication key, which is the password for operating the primary object, parameter `G0b` represents the algorithm type of the generated primary key (e.g., SHA256), parameter `Cpotx.ctx` represents the temporary file for storing the seed key object, and parameter `L1` represents the locking operation on the TPM.

[0097] Step S2033: Based on the seed key, create an RSA key to generate a public key and a private key;

[0098] Specifically, based on the generated seed key, an RSA key is created, that is, a public key and a private key are generated. For example, the command to create an RSA key using the Tpm_tool tool includes: tcm2_create(Cpotx.ctx,key.pub,key.priv). The created public key and private key are both stored in the key storage system. key.pub and key.priv are two text files. key.pub is used to store the public key, and key.priv is used to store the private key.

[0099] Step S2034: Generate key loading information by fusing the public and private keys;

[0100] Specifically, the tcm2_load command is used in conjunction with the public and private keys generated in step S2033 to generate key loading information. For example, the command to generate key loading information using the Tpm_tool tool is: tcm2_load(key.pub,key.priv,RsaObj.ctx), where key.pub represents the text file used to store the public key, key.priv represents the text file used to store the private key, and RsaObj.ctx represents the key loading information. The data after fusing the public and private keys is the data in the RsaObj.ctx structure.

[0101] Step S204: Encrypt the plaintext data according to the key data stream and key loading information to obtain the key ciphertext data;

[0102] Specifically, the `rsaencrypt` command is used to encrypt plaintext data based on the key data stream and key loading information. The plaintext data refers to the communication handshake key, resulting in ciphertext data. For example, the command to encrypt plaintext data is: `Encrydm1 = rsaencrypt(RsaObj.ctx, dm1)`, where `RsaObj.ctx` represents the key loading information and `dm1` represents the key data stream. This encryption command uses the RSA encryption algorithm.

[0103] The principle of RSA public-key cryptography is understandable: according to number theory, finding two large prime numbers is relatively simple, while factoring their product is more difficult. Therefore, the product can be made public as the encryption key. RSA encryption: Ciphertext = Plaintext E mod N. This encryption process involves dividing the plaintext by N and taking the remainder. Given the public key, the `rsaencrypt` command is generated using the `Tpm_tool` utility and used to encrypt the plaintext data.

[0104] Step S205: Store the ciphertext key data in the key's storage space;

[0105] Please refer to the following: Figure 4 , Figure 4 yes Figure 2 A detailed flowchart of step S205 in the process;

[0106] like Figure 4 As shown, step S205: storing the ciphertext key data in the key's storage space includes:

[0107] Step S2051: Create access permissions for the storage space;

[0108] Specifically, the `takeownership` command generated by the `Tcm_tool` tool is used to create access permissions for the storage space. For example, the command to create access permissions for the storage space is `tcm2_takeownership(Ownerpass,Ekpass,Lockpass)`, where `ownerpass` represents the password for the operator to operate the TPM device, `Ekpass` represents the password for endorsing / signing the TPM, and `lockpass` represents locking the TPM.

[0109] Step S2052: Set the address and storage space for key storage, and authorize the storage space;

[0110] Specifically, the address and space for key storage are set, and the allocated space is authorized so that the operator can operate on this area within the TCM chip. The operation rights of the TPM are obtained through the command tcm2_takeownership(Ownerpass,Ekpass,Lockpass), which authorizes the operator to read and write the internal storage space of the chip. Here, ownerpass is the password for the operator to operate the TPM device, Ekpass is the password for endorsing / signing the TPM, and lockpass is used to lock the TPM.

[0111] Step S2053: Write the key ciphertext data into the storage space to store the key ciphertext data;

[0112] Specifically, the system accesses the address where the preset key is stored and uses the `tcm2_nvwrite(Nv.data, ownerpass)` command to write the encrypted key data to the storage space corresponding to that address. This storage space refers to non-volatile storage space (NV space), which includes, but is not limited to, flash memory, solid-state drive (SSD), storage class memory (SCM), NOR flash memory, random access memory (RAM), and magnetic random access memory (MRAM). Here, `Nv.data` represents the data written to the NV space, and `ownerpass` represents the password used by the operator to operate the TPM device. In addition to writing the encrypted key data to the non-volatile storage space, the authorized session digest also needs to be stored in the chip's internal non-volatile storage space. This authorized session digest is equivalent to a signature verification, used to ensure the non-repudiation of information.

[0113] Please refer to the following: Figure 5 , Figure 5 This is a flowchart illustrating a key decryption method provided in an embodiment of this application;

[0114] like Figure 5 As shown, the key decryption method includes:

[0115] Step S501: Read the key ciphertext data from the key storage space;

[0116] Specifically, reading encrypted key data from the key storage space in the TCM chip is the reverse operation of writing encrypted key data. The `tcm2_nvdefine(addstart, Length, ownerpass)` command is used to obtain the address and space where the key is stored, and authorization is granted so that the operator can operate on the storage space within the TCM chip. Here, `addstart` represents the starting address for storing the encrypted key data, `Length` represents the length of the data to be read, and `ownerpass` represents the password used by the operator to operate the TPM device. The `tcm2_nvread(Nv.data, ownerpass)` command is used to read encrypted key data from the preset key storage address NV space. Here, `Nv.data` represents the data read from the NV space, and `ownerpass` represents the password used by the operator to operate the TPM device.

[0117] Step S502: Obtain the key loading information during encryption;

[0118] Specifically, the key loading information is created before the key data is encrypted. When decrypting the ciphertext key data, the key loading information at the time of encryption can be obtained by direct call.

[0119] Step S503: Decrypt the ciphertext data of the key according to the key loading information to obtain the plaintext data of the key;

[0120] Specifically, based on the key loading information, the tpm2_rsadecrypt command is used in conjunction with the key loading information to decrypt the ciphertext data stream file. For example, the command to decrypt the ciphertext data stream file is tpm2_rsadecrypt(RsaObj.ctx,Encrydm1,dm1), where RsaObj.ctx represents the key loading information, Encrydm1 represents the key ciphertext data, and dm1 represents the plaintext data stream. This command generates a plaintext data stream file data.decrypt and outputs the plaintext data stream dm1 to obtain the key plaintext data.

[0121] Please refer to the following: Figure 6 , Figure 6 This is a schematic diagram illustrating the verification of the legitimacy of a key decryption identity provided in an embodiment of this application;

[0122] like Figure 6 As shown, verifying the legitimacy of the key decryption identity includes:

[0123] Step S601: Obtain the key to decrypt and identify;

[0124] Specifically, before decrypting the key ciphertext data, it is necessary to verify the legitimacy of the key decryption identity and obtain the key decryption identity, which includes the private key used for decryption and the public key used for encryption generated in step S2033.

[0125] Step S602: Determine whether the key decryption identity is legitimate;

[0126] Specifically, the process of determining whether the identity used for key decryption is legitimate involves checking whether the private key used for decryption and the public key used for encryption are paired. If the identity used for key decryption is legitimate, proceed to step S603; if the identity used for key decryption is illegitimate, proceed to step S604.

[0127] Step S603: Obtain the key loading information during encryption;

[0128] Specifically, if the identity verification for key decryption is valid, it means that the validity of the identity verification for key decryption is successful. Then, TCM reads the key loading information at the time of encryption, decrypts the key loading information, and then combines the key loading information to decrypt the key ciphertext data to generate the key plaintext data stream.

[0129] Step S604: Do not decrypt the key ciphertext data;

[0130] Specifically, if the key decryption identity is invalid, it means that the verification of the key decryption identity has failed, and the key ciphertext data will not be decrypted.

[0131] In this application embodiment, a key encryption method and a key decryption method are provided. The key encryption method includes: setting a communication handshake key; generating a key data stream based on the communication handshake key; creating key loading information; encrypting plaintext data based on the key data stream and the key loading information to obtain key ciphertext data; and storing the key ciphertext data in the key's storage space. The key decryption method includes: reading the key ciphertext data from the key's storage space; obtaining the communication handshake key and key loading information used during encryption; and decrypting the key ciphertext data based on the communication handshake key and the key loading information to obtain key plaintext data. This application, by encrypting the communication handshake key for network communication and then storing the encrypted key ciphertext data, can reduce the risk of brute-force attacks on the communication key, thereby improving the security of network communication.

[0132] Please refer to the following: Figure 7 , Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0133] like Figure 7 As shown, the electronic device 70 includes one or more processors 701 and a memory 702. Wherein, Figure 7 Taking a processor 701 as an example. Preferably, the electronic device is a Trusted Cryptographic Module (TCM) device.

[0134] The processor 701 and the memory 702 can be connected via a bus or other means. Figure 7 Taking the example of a connection between China and Israel via a bus.

[0135] The processor 701 provides computing and control capabilities to control the electronic device 70 to perform corresponding tasks, such as controlling the electronic device 70 to execute the key encryption method and key decryption method in any of the above method embodiments. The key encryption method includes: setting a communication handshake key; generating a key data stream based on the communication handshake key; creating key loading information; encrypting plaintext data based on the key data stream and the key loading information to obtain ciphertext key data; and storing the ciphertext key data in the key's storage space. The key decryption method includes: reading the ciphertext key data from the key's storage space; obtaining the communication handshake key and key loading information used for encryption; and decrypting the ciphertext key data based on the communication handshake key and the key loading information to obtain plaintext key data.

[0136] By encrypting the handshake key for network communication and then storing the encrypted key ciphertext data, the risk of the communication key being brute-forced can be reduced, thereby improving the security of network communication.

[0137] Processor 701 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), a hardware chip, or any combination thereof; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The aforementioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0138] Memory 702, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the key encryption method and key decryption method in the embodiments of this application. Processor 701 can implement the key encryption method and key decryption method in any of the following method embodiments by running the non-transitory software programs, instructions, and modules stored in memory 702. Specifically, memory 702 may include volatile memory (VM), such as random access memory (RAM); memory 702 may also include non-volatile memory (NVM), such as read-only memory (ROM), flash memory, hard disk drive (HDD), solid-state drive (SSD), or other non-transitory solid-state storage devices; memory 702 may also include combinations of the above types of memory.

[0139] Memory 702 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, memory 702 may optionally include memory remotely located relative to processor 701, and these remote memories may be connected to processor 701 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0140] One or more modules are stored in memory 702. When executed by one or more processors 701, they perform the key encryption and key decryption methods in any of the above method embodiments. For example, they perform the methods described above. Figure 2 The steps shown can also be implemented. Figure 1 The functions of each module or unit.

[0141] In this embodiment, the electronic device 70 may also have wired or wireless network interfaces, keyboards, and input / output interfaces for input and output. The electronic device 70 may also include other components for implementing device functions, which will not be described in detail here.

[0142] This application also provides a computer-readable storage medium, such as a memory including program code, which can be executed by a processor to perform the key encryption and key decryption methods in the above embodiments. For example, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CDROM), magnetic tape, floppy disk, and optical data storage device, etc.

[0143] This application also provides a computer program product comprising one or more lines of program code stored in a computer-readable storage medium. A processor of an electronic device reads the program code from the computer-readable storage medium and executes the program code to complete the method steps of the key encryption and key decryption methods provided in the above embodiments.

[0144] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware, or by a program or program code related to hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0145] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software and a general-purpose hardware platform, or of course, using hardware. Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0146] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and not to limit them; under the concept of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations as described above in different aspects of this application, which are not provided in detail for the sake of brevity; although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A secret key encryption method applied to a secret key storage system, characterized by, The method comprises: setting a communication handshake key; generating a key data stream according to the communication handshake key; creating key loading information; encrypting plaintext data according to the key data stream and the key loading information to obtain key ciphertext data; storing the key ciphertext data to a storage space of the key; the creating key loading information comprises: starting an authorized session to create access permission; creating a primary key object to generate a seed key according to the primary key object; creating an RSA key according to the seed key to generate a public key and a private key; fusing to generate key loading information according to the public key and the private key; the storing the key ciphertext data to the storage space of the key comprises: creating access permission of the storage space; setting an address and a storage space of key storage, and authorizing the storage space; writing the key ciphertext data to the storage space to store the key ciphertext data.

2. The method of claim 1, wherein, The storage space of the key comprises a non-volatile storage space.

3. A method of decrypting a secret key, applied to a secret key storage system, characterized by, The method comprises: reading key ciphertext data from a storage space of a key; obtaining key loading information at the time of encryption; decrypting the key ciphertext data according to the key loading information to obtain key plaintext data; before reading the key ciphertext data from the storage space of the key, the method further comprises: verifying the legality of a key decryption identity; if the key decryption identity is verified to be legal, obtaining the key loading information at the time of encryption; if the key decryption identity is verified to be illegal, not decrypting the key ciphertext data.

4. A key storage system, characterized by, The system comprises a data reading module, an encryption module, a decryption module, and a storage module; the encryption module is configured to set a communication handshake key, generate a key data stream according to the communication handshake key, and create key loading information; encrypt plaintext data according to the key data stream and the key loading information to obtain key ciphertext data; the data reading module is configured to read key ciphertext data from a storage space of a key and obtain key loading information at the time of encryption; the decryption module is configured to decrypt the key ciphertext data according to the key loading information to obtain key plaintext data; the storage module is configured to store the key ciphertext data to the storage space of the key; the encryption module is specifically configured to: start an authorized session to create access permission; create a primary key object to generate a seed key according to the primary key object; create an RSA key according to the seed key to generate a public key and a private key; fuse to generate key loading information according to the public key and the private key; the storage module is configured to: create access permission of the storage space; set an address and a storage space of key storage, and authorize the storage space; write the key ciphertext data to the storage space to store the key ciphertext data.

5. The system of claim 4, wherein, The data reading module is further configured to verify the legality of a key decryption identity; if the verification of the legality of the key decryption identity is successful, the key loading information at the time of encryption can be obtained; if the verification of the legality of the key decryption identity fails, the key ciphertext data cannot be decrypted.

6. An application control system characterized by comprising: The system is applied to a chip. The hardware encryption layer comprises an identity authentication module and a password algorithm module, the identity authentication module is used for authenticating the starting of a basic input / output system and an operating system, the password algorithm module is used for encrypting data, and the identity authentication module and the password algorithm module are used together for forced identity authentication and identification during booting of the operating system. The system layer comprises a device driver, and the device driver is used for driving the chip. The application layer comprises the secret key storage system according to claim 4 or 5.

7. An electronic device, comprising: comprise: at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the secret key encryption method according to any one of claims 1-2 or the secret key decryption method according to claim 3.

Images