A secure kv bucket system based on trusted cryptographic module protection

Abstract

The application discloses a secure KV storage bucket system based on trusted cryptographic module protection and relates to the technical field of information security of cryptographic application and equipment, which comprises an application, a medium Ukey and equipment, the equipment is loaded with a connected KV storage bucket and a trusted cryptographic module, the medium Ukey is inserted into the equipment, and the application is connected with the equipment through an interface; the medium Ukey is used for initializing the KV storage bucket and performing application authorization on the application; the trusted cryptographic module is used for performing reading authentication and storage authentication on the communication between the application and the KV storage bucket; and the trusted cryptographic module is used for performing data renewal on the KV storage bucket. The application can solve the security problem of sensitive data ciphertext storage, the problem that the sensitive data depend on the trusted cryptographic module protection process and have high complexity, and the problem that the sensitive data are maliciously decrypted and tampered with by other malicious programs.

Description

Technical Field

[0001] This invention relates to the field of information security technology for cryptographic applications and devices, and more specifically to a secure key-value storage bucket system based on trusted cryptographic modules. Background Technology

[0002] With the rapid development of the information age, information security and privacy protection are receiving increasing attention. Cryptography plays a crucial role in fields such as the internet and government networks. Cryptography is particularly important for data layer protection. However, introducing cryptography for data layer protection adds many processing details and necessary steps to upper-layer application integration. Even slight negligence can lead to irrecoverable data loss. In some security application specifications, data encryption and storage require changing the encryption key, and the ciphertext is exposed on storage media such as databases and configuration files. Once the encryption key needs to be changed, these ciphertexts need to undergo data restoration (decryption and re-encryption with the new key). When the amount of data reaches a certain level, this process is often missed, leading to irreversible results.

[0003] The general solution in existing technologies is to identify the fields and values ​​that need to be encrypted during system integration, decrypt the ciphertext when the encryption key is changed, wait for the new key to be generated, re-encrypt it with the new key, and then store it in the respective files. However, this approach has the following drawbacks:

[0004] (1) For each new piece of data that needs to be encrypted, its preset data needs to be updated.

[0005] (2) The system requires frequent code modifications;

[0006] (3) If data that needs to be decrypted is missed during development, it will result in irreversible consequences;

[0007] (4) The ciphertext is exposed and is easily tampered with.

[0008] Therefore, improving the security and reliability of encrypted data storage is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0009] In view of this, the present invention provides a secure key-value storage bucket system based on trusted cryptographic modules, which solves the security problems of encrypted storage of sensitive data, the high complexity of the process of sensitive data relying on trusted cryptographic modules for protection, and the problem of sensitive data being maliciously decrypted and tampered with by other malicious programs.

[0010] To achieve the above objectives, the present invention adopts the following technical solution:

[0011] A secure key-value (KV) bucket system based on a trusted cryptographic module includes an application, a medium Ukey, and a device. The device is loaded with a connected KV bucket and a trusted cryptographic module. The medium Ukey is inserted into the device, and the application connects to the device through an interface. The system uses the medium Ukey to initialize the KV bucket and authorize the application. The trusted cryptographic module performs read and storage authentication for communication between the application and the KV bucket. The trusted cryptographic module also performs data renewal on the KV bucket.

[0012] Preferably, the KV bucket is securely initialized to enable access control of the application KV bucket using the media Ukey. The media Ukey stores a private key and a public key, and the private key cannot be exported. The public key is imported into the self-use area of ​​the KV bucket, and the private key is signed by inserting it into the device, ensuring the security of the private key. The public key is used for signature verification to achieve access control, so that only users with the media Ukey can access the KV bucket.

[0013] Preferably, the application authorized by the KV storage bucket will transmit the key-value pair consisting of the obtained key and value plaintext to the KV storage bucket. The KV storage bucket will use the key in the trusted cryptographic module to encrypt the value plaintext to obtain the value ciphertext, and store the value ciphertext and key in pairs.

[0014] Preferably, after the user inserts the media Ukey into the device, the KV storage bucket is initialized. The initialization process is as follows:

[0015] Step 11: The media Ukey initiates initialization to the KV storage bucket;

[0016] Step 12: The KV storage bucket sends a Ukey authentication prompt to the media Ukey;

[0017] Step 13: Enter the Ukey password into the KV storage bucket using the media Ukey;

[0018] Step 14: The device enumerates and authenticates the Ukey based on the Ukey password. If the authentication is successful, the public key in the Ukey on the medium is exported, and the process proceeds to Step 15; otherwise, the initialization ends.

[0019] Step 15: The KV bucket calls the trusted cryptographic module, uses the secure random numbers stored in the trusted cryptographic module to randomly generate a file key and a protection key, and stores them in the trusted cryptographic module. If the trusted cryptographic module verifies that the key generation is successful, it imports the public key into the KV bucket, and the initialization is complete; otherwise, the initialization ends.

[0020] The technical effects of the above solution are as follows: After initialization, the public key is imported into the KV storage bucket. The medium Ukey in the user's hands then becomes the key for authorization. Only applications signed with the private key in the medium Ukey have the authority to call the KV storage bucket, thereby realizing access control. Another purpose of initialization is to generate a key. After importing the public key and generating a key (random value), the KV storage bucket can provide services to the outside world normally. In addition, private key signing requires verification with the public key. Once the private key in the medium Ukey is properly stored, the signature cannot be forged, which makes the KV storage bucket secure for interface calls.

[0021] Preferably, the device runs a KV storage bucket and provides a physical USB interface. The device can be a host computer such as a PC or server that can provide a physical USB port.

[0022] Preferably, application authorization can prevent malicious access and invocation. The application authorization process is as follows:

[0023] Step 21: The user sends the selected application to the KV storage bucket via the media Ukey;

[0024] Step 22: The KV storage bucket calculates the fingerprint based on the unique identifier information of the selected application;

[0025] Step 23: The KV storage bucket sends a Ukey authentication prompt to the media Ukey;

[0026] Step 24: Enter the Ukey password into the KV storage bucket using the media Ukey;

[0027] Step 25: The device enumerates and authenticates the Ukey based on the Ukey password. If the authentication is successful, the medium Ukey uses the private key to sign the fingerprint, obtains the fingerprint signature, and proceeds to step 26; otherwise, no authorization is granted.

[0028] Step 26: The KV storage bucket uses the public key to verify the fingerprint signature. If the verification is successful, the fingerprint is stored, an authorization list is generated, and a storage space is allocated to each selected application; otherwise, no authorization is granted.

[0029] Preferably, the unique identification information used in step 22 includes the application path, application name, and application summary, and the formula for calculating the fingerprint is:

[0030] Fingerprint = hmac(application path + application name)^hmac(application digest);

[0031] The HMAC algorithm uses a protected key from a trusted cryptographic module; the SM3 algorithm is used to calculate the application digest.

[0032] Preferably, the storage authentication process is as follows:

[0033] Step 31: The application calls the data storage interface of the KV storage bucket;

[0034] Step 32: The KV storage bucket calculates the application fingerprint and checks if it exists in the authorization list. If it exists, it calculates the digest of the plaintext value transmitted by the application and stores it in the corresponding storage space, then proceeds to step 33; otherwise, the service is denied.

[0035] Step 33: The KV storage bucket calls the protection key of the trusted cryptographic module to encrypt the plaintext value transmitted by the application, obtains the ciphertext value, and stores it in the corresponding storage space in pairs with the corresponding key.

[0036] Step 34: The KV storage bucket uses the file key from the trusted cryptographic module to encrypt and map the storage space into a ciphertext file.

[0037] Preferably, the expression for calculating the digest of the plaintext value is:

[0038] Summary = SM3(value);

[0039] SM3 indicates the SM3 encryption algorithm.

[0040] Preferably, the authentication process is as follows:

[0041] Step 41: The application calls the data retrieval interface of the KV storage bucket;

[0042] Step 42: The KV storage bucket calculates the application fingerprint and checks if it exists in the authorized list. If it exists, it searches for the key in the corresponding storage space and proceeds to step 43; otherwise, it denies the service.

[0043] Step 43: The KV storage bucket calls the protection key of the trusted cryptographic module to decrypt the vlaue ciphertext corresponding to the searched key, and obtains the vlaue plaintext;

[0044] Step 44: The KV storage bucket calculates the digest of the vlaue plaintext and compares it with the digest stored in step 32. If the verification is correct (the comparison is consistent), the vlaue plaintext is retrieved and transmitted to the application; otherwise, the service is rejected.

[0045] The preferred data refresh process is as follows:

[0046] Step 51: Upon detecting that the key of the trusted cryptographic module is about to be updated, the KV storage bucket pre-processing method is triggered;

[0047] Step 52: The KV storage bucket uses the file key in the trusted cryptography module to decrypt the ciphertext file and obtain the plaintext file;

[0048] Step 53: The KV storage bucket traverses all the ciphertext values ​​in the plaintext file and decrypts them using the protection key of the trusted cryptographic module to obtain the plaintext values.

[0049] Step 54: Update the key in the trusted cryptography module and trigger the KV bucket post-processing method; the trusted cryptography module randomly generates the updated key based on the stored secure random number;

[0050] Step 55: The KV storage bucket repeatedly calls the new protection key to encrypt the plaintext value, obtains the new ciphertext value, iterates through and stores the new ciphertext value, and calls the new file key in the trusted cryptographic module to encrypt the storage space, obtains the new ciphertext file and stores it.

[0051] Preferably, the pre-processing refers to monitoring actions related to the trusted cryptographic module, such as key updates. The execution scope of the pre-processing method extends from the triggering of the pre-processing to the key update. The post-processing refers to monitoring whether the trusted cryptographic module's actions have been completed. The execution scope of the post-processing method extends from the triggering of the post-processing to the generation of the ciphertext file.

[0052] As can be seen from the above technical solution, compared with the prior art, this invention discloses a secure key-value (KV) bucket system based on trusted cryptographic modules, providing secure data storage capabilities for cryptographic devices and applications. The modification process is simple, and using KV buckets for data security protection allows for the storage of database passwords, service passwords, and other data requiring reversible encryption, achieving configuration file integrity protection, application integrity protection, etc. The system of this invention has application isolation capabilities, uses trusted cryptographic modules to protect keys for data protection, ensuring data security; uses physical media (Ukey) for authorization management, ensuring secure data access; and trigger-based data renewal ensures that data is not lost or altered. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0054] Figure 1 A schematic diagram of a secure KV storage bucket system protected by a trusted cryptographic module is provided for this invention.

[0055] Figure 2 This is a timing diagram of the initialization process provided by the present invention;

[0056] Figure 3This is a timing diagram of the application licensing process provided by the present invention;

[0057] Figure 4 This is a timing diagram of the storage authentication process provided by the present invention;

[0058] Figure 5 This is a timing diagram of the reading authentication process provided by the present invention;

[0059] Figure 6 This is a schematic diagram of the data renewal process provided by the present invention. Detailed Implementation

[0060] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0061] This invention discloses a secure key-value storage bucket system based on a trusted cryptographic module, such as... Figure 1 As shown, it includes an application, a media Ukey, and a device. The device is loaded with a connected KV storage bucket and a trusted cryptographic module. The media Ukey is inserted into the device, and the application connects to the device through an interface. The media Ukey is used to initialize the KV storage bucket and authorize the application. The trusted cryptographic module is used to perform read authentication and storage authentication for the communication between the application and the KV storage bucket. The trusted cryptographic module is used to refresh the data in the KV storage bucket.

[0062] The KV bucket uses a key-value format to store data, and applications access values ​​using a unique key. Key-value pairs are stored in the application data area within the storage space allocated to each authorized application. The public key imported into the KV bucket, along with the mapping between the storage space and the key of the trusted cryptographic module, is stored in the self-use area. This invention uses a trusted cryptographic module to protect files within the KV bucket using a separate key. The application's storage space is protected using a file key, and the application level can be configured to use a unique key for protection. The self-use area of ​​the KV bucket stores application configuration items, public keys, authorizations, etc., while the application data area stores the key.

[0063] Furthermore, the KV bucket undergoes secure initialization to enable access control of the application KV bucket using the media Ukey. The media Ukey stores a private key and a public key; the private key cannot be exported. The public key is imported into the self-use area of ​​the KV bucket, and the private key is signed by inserting it into the device, ensuring its security. The public key is then used for signature verification, enabling access control. Only users with the media Ukey can access the KV bucket.

[0064] Furthermore, the application authorized by the KV storage bucket will transmit the key-value pair consisting of the obtained key and value plaintext to the KV storage bucket. The KV storage bucket will use the key in the trusted cryptographic module to encrypt the value plaintext to obtain the value ciphertext, and store the value ciphertext in pairs with the key.

[0065] Furthermore, the device runs a KV storage bucket and provides a physical USB interface. The device can be a host computer such as a PC or server that can provide a physical USB port.

[0066] On the other hand, in one specific embodiment, after the user inserts the media Ukey into the device, the KV storage bucket is initialized, such as... Figure 2 The initialization process shown is as follows:

[0067] S11: The media Ukey initiates initialization to the KV storage bucket;

[0068] S12: The KV storage bucket sends a Ukey authentication prompt to the media Ukey;

[0069] S13: Input the Ukey password to the KV storage bucket using the media Ukey;

[0070] S14: The device enumerates and authenticates the Ukey based on the Ukey password. If the authentication is successful, the public key in the Ukey medium is exported and the process proceeds to S15; otherwise, the initialization ends.

[0071] S15: The KV storage bucket calls the trusted cryptographic module, uses the random number generation unit in the trusted cryptographic module to generate the file key and protection key, and stores them in the trusted cryptographic module. If the trusted cryptographic module verifies that the key generation is successful, it imports the public key into the KV storage bucket and the initialization is complete; otherwise, the initialization ends.

[0072] The technical effects of the above solution are as follows: After initialization, the public key is imported into the KV storage bucket. The medium Ukey in the user's hands then becomes the key for authorization. Only applications signed with the private key in the medium Ukey have the authority to call the KV storage bucket, thereby realizing access control. Another purpose of initialization is to generate a key. After importing the public key and generating a key (random value), the KV storage bucket can provide services to the outside world normally. In addition, private key signing requires verification with the public key. Once the private key in the medium Ukey is properly stored, the signature cannot be forged, which makes the KV storage bucket secure for interface calls.

[0073] On the other hand, in one specific embodiment, application authorization can prevent malicious access and invocation, such as Figure 3 As shown, the application authorization process is as follows:

[0074] S21: The user sends the selected application to the KV storage bucket via the medium Ukey;

[0075] S22: The KV storage bucket calculates a fingerprint based on the unique identifier of the selected application;

[0076] S23: The KV storage bucket sends a Ukey authentication prompt to the media Ukey;

[0077] S24: Input the Ukey password to the KV storage bucket using the media Ukey;

[0078] S25: The device enumerates and authenticates the Ukey based on the Ukey password. If the authentication is successful, the medium Ukey calls the private key to sign the fingerprint and obtain the fingerprint signature.

[0079] S26: The KV storage bucket uses the public key to verify the fingerprint signature. If the verification is successful, the fingerprint is stored, an authorization list is generated, and a storage space is allocated to each selected application; otherwise, no authorization is granted.

[0080] Furthermore, the unique identification information of the application in S22 includes the application path, application name, and application digest. The formula for calculating the fingerprint is:

[0081] Fingerprint = hmac(application path + application name)^hmac(application digest);

[0082] The HMAC algorithm uses a protected key from a trusted cryptographic module; the SM3 algorithm is used to calculate the application digest.

[0083] On the other hand, in one specific embodiment, the storage authentication is as follows: Figure 4 As shown, the specific process is as follows:

[0084] S31: The application calls the data storage interface of the KV storage bucket;

[0085] S32: The KV storage bucket calculates the application fingerprint and checks if it exists in the authorization list. If it exists, it calculates the digest of the plaintext value transmitted by the application and stores it in the corresponding storage space, then proceeds to S33; otherwise, it denies service.

[0086] S33: The KV storage bucket calls the protection key of the trusted cryptographic module to encrypt the plaintext value transmitted by the application, obtains the ciphertext value, and stores it in the corresponding storage space in pairs with the corresponding key;

[0087] S34: The KV storage bucket calls the file key of the trusted cryptographic module to encrypt and map the storage space into a ciphertext file.

[0088] Furthermore, the expression for calculating the digest of the plaintext value is:

[0089] Summary = SM3(value).

[0090] On the other hand, in one specific embodiment, reading authentication is as follows: Figure 5 As shown, the specific process is as follows:

[0091] S41: The application calls the data retrieval interface of the KV storage bucket;

[0092] S42: Calculate the application fingerprint in the KV storage bucket and check if it exists in the authorized list. If it exists, find the key in the corresponding storage space and proceed to S43; otherwise, deny service.

[0093] S43: The KV storage bucket calls the protection key of the trusted cryptographic module to decrypt the vlaue ciphertext corresponding to the searched key and obtain the vlaue plaintext;

[0094] S44: The KV storage bucket performs a digest calculation on the vlaue plaintext and compares it with the digest stored in S32. If the verification is correct (the comparison is consistent), the vlaue plaintext is retrieved and transmitted to the application; otherwise, the service is denied.

[0095] On the other hand, in one specific embodiment, data refurbishment is as follows: Figure 6 As shown, the specific process is as follows:

[0096] S51: If the key of the trusted cryptographic module is about to be updated, the KV bucket pre-processing method is triggered.

[0097] S52: The KV storage bucket uses the file key in the trusted cryptographic module to decrypt the ciphertext file and obtain the plaintext file;

[0098] S53: The KV storage bucket traverses all the ciphertext values ​​in the plaintext file and decrypts them using the protection key of the trusted cryptographic module to obtain the plaintext value.

[0099] S54: Update the key in the trusted cryptographic module and trigger the KV bucket post-processing method; the trusted cryptographic module randomly generates the updated key based on the stored secure random number;

[0100] S55: The KV storage bucket repeatedly calls the new protection key to encrypt the plaintext value, obtains the new ciphertext value, iterates through and stores the new ciphertext value, and calls the new file key in the trusted cryptographic module to encrypt the storage space, obtains the new ciphertext file and stores it.

[0101] Furthermore, "pre-processing" refers to monitoring actions related to the trusted cryptographic module, such as key updates. The execution scope of the pre-processing method extends from the triggering of the pre-processing to the key update. "Post-processing" refers to monitoring whether the trusted cryptographic module's actions have been completed. The execution scope of the post-processing method extends from the triggering of the post-processing to the generation of the ciphertext file.

[0102] Furthermore, the trusted cryptographic modules in the system include, but are not limited to, cryptographic machines, encryption machines, SSL VPN gateways, IPSec VPN gateways, KMS, signature verification servers, and financial data cryptographic machines.

[0103] A KV secure storage bucket system based on trusted cryptographic modules has the following characteristics:

[0104] (1) Easy to use; application integration only requires integrating two access interfaces.

[0105] (2) Data isolation: Data stored in different applications will be isolated;

[0106] (3) Application authorization: In order to prevent malicious programs from obtaining sensitive values ​​through open interface calls, application authorization is added to restrict application access permissions;

[0107] (4) The encrypted data is automatically refreshed. When the key is changed, the data is automatically refreshed internally, and the external interface does not affect the normal storage of the data.

[0108] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0109] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A secure KV bucket system based on trusted cryptomodule protection, characterized in that, The application, the medium Ukey and the device are included, the connected KV bucket and the trusted cryptographic module are loaded on the device, the medium Ukey is inserted into the device, and the application is connected to the device through the interface; the KV bucket is initialized by the medium Ukey, and the application is authorized; the communication between the application and the KV bucket is read authenticated and stored authenticated by the trusted cryptographic module; the data of the KV bucket is renewed by the trusted cryptographic module; The process of storage authentication is as follows: Step 31: the application calls the data storage interface of the KV bucket; Step 32: the KV bucket calculates the application fingerprint, and checks whether it exists in the authorized list, if it exists, the digest of the value plaintext transmitted by the application is calculated and stored in the corresponding storage space, and step 33 is entered; otherwise, the service is refused; Step 33: the KV bucket calls the protection key of the trusted cryptographic module to encrypt the value plaintext transmitted by the application, obtains the value ciphertext, and stores it in the corresponding storage space in pairs with the corresponding key; Step 34: the KV bucket calls the file key of the trusted cryptographic module to encrypt the storage space into a ciphertext file; The process of read authentication is as follows: Step 41: the application calls the data retrieval interface of the KV bucket; Step 42: the KV bucket calculates the application fingerprint, and checks whether it exists in the authorized list, if it exists, the key in the corresponding storage space is found, and step 43 is entered; otherwise, the service is refused; Step 43: the KV bucket calls the protection key of the trusted cryptographic module to decrypt the value ciphertext corresponding to the found key, and obtains the value plaintext; Step 44: the KV bucket calculates the digest of the value plaintext, and compares it with the digest stored in step 32; if the verification is correct, the value plaintext is transmitted to the application; otherwise, the service is refused.

2. The secure KV bucket system based on trusted cryptomodule protection of claim 1, wherein, The private key and the public key are stored in the medium Ukey, and the private key cannot be derived, and the private key is signed by being inserted into the device.

3. The secure KV bucket system based on trusted cryptomodule protection of claim 2, wherein, The application authorized by the KV bucket transmits the key-value pair composed of the obtained key and value plaintext to the KV bucket, and the KV bucket encrypts the value plaintext by using the key in the trusted cryptographic module to obtain the value ciphertext, and stores the value ciphertext in pairs with the key.

4. The secure KV bucket system based on trusted cryptomodule protection of claim 3, wherein, After the medium Ukey is inserted into the device, the KV bucket is initialized, and the process of initialization is as follows: Step 11: the medium Ukey initiates the initialization to the KV bucket; Step 12: the KV bucket sends a Ukey authentication prompt to the medium Ukey; Step 13: the medium Ukey inputs a Ukey password to the KV bucket; Step 14: the device enumerates and authenticates the Ukey according to the Ukey password, if the authentication is passed, the public key in the medium Ukey is derived, and step 15 is entered; otherwise, the initialization is ended; Step 15: the KV bucket calls the trusted cryptographic module, the file key and the protection key are generated in the trusted cryptographic module, and the public key is imported into the KV bucket after the trusted cryptographic module verifies that the key generation is successful, and the initialization is completed; otherwise, the initialization is ended.

5. The secure KV bucket system based on trusted cryptomodule protection of claim 4, wherein, The process of application authorization is as follows: Step 21: send the selected application to the KV bucket through the medium Ukey; Step 22: the KV bucket calculates the fingerprint according to the unique identification information of the selected application; Step 23: the KV bucket sends a Ukey authentication prompt to the medium Ukey; Step 24: the medium Ukey inputs the Ukey password to the KV bucket; Step 25: the device enumerates and authenticates the Ukey according to the Ukey password, if the authentication is passed, the medium Ukey calls the private key to sign the fingerprint, obtains the fingerprint signature, and enters step 26; otherwise, it is not authorized; Step 26: the KV bucket verifies the fingerprint signature with the public key, if the verification is passed, it stores the fingerprint, generates an authorization list, and allocates a storage space for each selected application; otherwise, it is not authorized.

6. The secure KV bucket system based on trusted cryptomodule protection of claim 5, wherein, The unique identification information of the application in step 22 includes the application path, the application name and the application digest, and the formula for calculating the fingerprint is: Fingerprint = hmac (application path + application name) ^ hmac (application digest); The key of the hmac algorithm uses the protection key of the trusted password module; the SM3 algorithm is used to calculate the application to obtain the application digest.

7. The secure KV bucket system based on trusted cryptomodule protection of claim 5, wherein, The expression for calculating the digest of the value plaintext is: Digest = SM3 (value).

8. The secure KV bucket system based on trusted cryptomodule protection of claim 5, wherein, The process of data renewal is: Step 51: listen to the key of the trusted password module about to be updated; Step 52: the KV bucket calls the file key in the trusted password module to decrypt the ciphertext file and obtains the plaintext file; Step 53: the KV bucket traverses all the value ciphertexts in the plaintext file and decrypts them using the protection key of the trusted password module to obtain the value plaintext; Step 54: update the key in the trusted password module; Step 55: the KV bucket calls the new protection key to encrypt the value plaintext to obtain the new value ciphertext, traverses the storage of the new value ciphertext, and calls the new file key in the trusted password module to encrypt the storage space to obtain the new ciphertext file and store it.

Images