A trusted data space application data disk-falling encryption storage method and system

Abstract

The application discloses a kind of trusted data space application program data disk landing encryption storage method and system.The method is based on each application program of each security virtual machine derived by Haiguang CSV technology seal key;Current plaintext data is encrypted by the current data encryption key generated randomly in the current application program to obtain current ciphertext data, and the current ciphertext data is stored in the first storage unit;And the current data encryption key generated randomly is sealed by the seal key of current application, and the current data encryption key after sealing is stored in the second storage unit;The method can prevent data leakage when storage medium is lost, stolen or subjected to hacker attack, prevent illegal use or malicious disclosure of data by users with host and virtual machine permissions, prevent illegal use or tampering of other application programs in the same host and virtual machine system environment, and ensure that data can only be accessed by the application program that creates the data.

Description

Technical Field

[0001] The present invention relates to the field of encryption processing technology, and in particular to a method and system for encrypting and storing application data in a trusted data space. Background Art

[0002] Data encryption is commonly used to protect sensitive information, such as personal data, financial records, and confidential business data, from being leaked if the storage media is lost, stolen, or hacked. It is a crucial component of data security measures and can enhance the overall security of information systems.

[0003] A dataspace is a virtual data space that leverages existing standards and technologies, along with widely accepted governance models within the data economy, to facilitate secure and standardized data exchange and data linkage within a trusted business ecosystem. It thus provides a foundation for creating intelligent service scenarios and fostering innovative cross-company business processes while guaranteeing data sovereignty for data owners. Data sovereignty is a core aspect of a dataspace and can be defined as the ability of a natural person or legal entity to make fully autonomous decisions regarding their data.

[0004] Data security is particularly important in the data space. In addition to the conventional prevention of data leakage when the storage media is lost, stolen or attacked by hackers, it is also necessary to prevent users with host and virtual machine permissions from illegally using or maliciously leaking data, and prevent other applications in the same host and virtual machine system environment from illegally using or tampering with data, ensuring that data can only be accessed by the application that created it.

[0005] Currently, no effective solution has been proposed to address the problem that data encryption in existing technologies can only prevent data leakage when the storage medium is lost, stolen, or attacked by hackers. It cannot prevent users with host and virtual machine permissions from illegally using or maliciously leaking data, nor can it prevent other applications in the same host and virtual machine system environment from illegally using or tampering with data. Summary of the Invention

[0006] In an embodiment of the present invention, a method and system for encrypting and storing application data in a trusted data space is provided to solve the problem in the prior art that data encryption can only prevent data leakage when the storage medium is lost, stolen or attacked by hackers, but cannot prevent users with host and virtual machine permissions from illegally using or maliciously leaking the data, and cannot prevent other applications in the same host and virtual machine system environment from illegally using or tampering with the data.

[0007] To achieve the above-mentioned purpose, on the one hand, the present invention provides a method for encrypted storage of application data in a trusted data space, the method comprising: S1, deriving a seal key for each application in each secure virtual machine based on Haiguang CSV technology; S2, obtaining current plaintext data, encrypting the current plaintext data in the current application using a randomly generated current data encryption key to obtain current ciphertext data, and storing the current ciphertext data in a first storage unit; and sealing the randomly generated current data encryption key using the seal key of the current application, and storing the sealed current data encryption key in a second storage unit; S3, when the current application is restarted, obtaining the current ciphertext data in the first storage unit and the sealed current data encryption key in the second storage unit; decrypting the sealed current data encryption key using the seal key of the current application to obtain the current data encryption key; and decrypting the current ciphertext data using the current data encryption key to obtain the current plaintext data.

[0008] Optionally, the sealing key of each secure virtual machine is derived through the root key of the Haiguang security chip; based on the sealing key of the current secure virtual machine, the identity ID of the current application in the current secure virtual machine and other characteristic information, the CMAC algorithm is used to derive the sealing key of the current application in the current secure virtual machine.

[0009] Optionally, the application and the plaintext data have a one-to-many correspondence; the plaintext data and the data encryption key have a one-to-one correspondence.

[0010] Optionally, in the current application, a symmetric encryption key with a specified key bit number is randomly generated as the current data encryption key.

[0011] Optionally, the other feature information includes: version number, version name, feature value; the first storage unit includes: disk or external database; the second storage unit includes: secure hardware, disk or external database.

[0012] On the other hand, the present invention provides a trusted data space application data disk encryption storage system, the system including: a derivation unit, used to derive a seal key for each application in each secure virtual machine based on Haiguang CSV technology; an encryption storage unit, used to obtain current plaintext data, encrypt the current plaintext data in the current application using a randomly generated current data encryption key to obtain current ciphertext data, and store the current ciphertext data in a first storage unit; and seal the randomly generated current data encryption key using the seal key of the current application, and store the sealed current data encryption key in a second storage unit; a decryption unit, used to obtain the current ciphertext data in the first storage unit and the sealed current data encryption key in the second storage unit when the current application is restarted; decrypt the sealed current data encryption key using the seal key of the current application to obtain the current data encryption key; and decrypt the current ciphertext data using the current data encryption key to obtain the current plaintext data.

[0013] Optionally, the derivation unit includes: a first derivation sub-unit, used to derive the sealing key of each secure virtual machine through the root key of the Haiguang security chip; a second derivation sub-unit, used to derive the sealing key of the current application in the current secure virtual machine using the CMAC algorithm based on the sealing key of the current secure virtual machine, the identity ID of the current application in the current secure virtual machine, and other characteristic information.

[0014] Optionally, the application and the plaintext data have a one-to-many correspondence; the plaintext data and the data encryption key have a one-to-one correspondence.

[0015] Optionally, in the current application, a symmetric encryption key with a specified key bit number is randomly generated as the current data encryption key.

[0016] Optionally, the other feature information includes: version number, version name, feature value; the first storage unit includes: disk or external database; the second storage unit includes: secure hardware, disk or external database.

[0017] Beneficial effects of the present invention:

[0018] The present invention provides a method and system for encrypted storage of application data in a trusted data space. The method derives a seal key for each application within each secure virtual machine based on Haiguang CSV technology; encrypts the current plaintext data in the current application using a randomly generated current data encryption key to obtain current ciphertext data, which is then stored in a first storage unit; and seals the randomly generated current data encryption key using the current application's seal key, storing the sealed current data encryption key in a second storage unit. This method can prevent data leakage when the storage medium is lost, stolen, or attacked by hackers. It can also prevent illegal use or malicious leakage of data by users with host and virtual machine permissions, as well as illegal use or tampering by other applications in the same host and virtual machine system environment, ensuring that data can only be accessed by the application that created the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a flow chart of a method for encrypted storage of application data in a trusted data space provided by an embodiment of the present invention;

[0020] Figure 2 is a flow chart of a method for deriving a sealing key for each application in each secure virtual machine provided by an embodiment of the present invention;

[0021] Figure 3 This is a schematic diagram of the structure of a trusted data space application data disk encryption storage system provided by an embodiment of the present invention;

[0022] Figure 4 It is a structural diagram of a derivation unit provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] To make the objectives, technical solutions, and advantages of the present invention more apparent, the present invention will be further described in detail below with reference to the accompanying drawings. It is apparent that the embodiments described are only some, not all, of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are intended to fall within the scope of protection of the present invention.

[0024] Data encryption is commonly used to protect sensitive information, such as personal data, financial records, and confidential business data, from being leaked if the storage media is lost, stolen, or hacked. It is a crucial component of data security measures and can enhance the overall security of information systems.

[0025] A Trusted Execution Environment (TEE) is an independent, secure computing environment designed to protect sensitive data and code. Typically residing within a device's main processor, the TEE is isolated from the operating system and other applications, ensuring protection from malware and other attacks when processing sensitive operations. This technology is widely used in scenarios requiring high security, such as data storage, mobile payments, digital rights management, authentication, and password storage. By providing an isolated, secure execution space, TEE technology enhances overall device security and data privacy.

[0026] A dataspace is a virtual data space that leverages existing standards and technologies, along with widely accepted governance models within the data economy, to facilitate secure and standardized data exchange and data linkage within a trusted business ecosystem. It thus provides a foundation for creating intelligent service scenarios and fostering innovative cross-company business processes while guaranteeing data sovereignty for data owners. Data sovereignty is a core aspect of a dataspace and can be defined as the ability of a natural person or legal entity to make fully autonomous decisions regarding their data.

[0027] Data Spaces is designed to meet the following strategic requirements:

[0028] Trust: Trust is the foundation of the data space. Every participant is evaluated and authenticated before being granted access to the trusted business ecosystem.

[0029] Security and Data Sovereignty: All components of the data space rely on state-of-the-art security measures. In addition to architectural specifications, security is primarily ensured through the evaluation and certification of each technical component used in the data space. As a core aspect of ensuring data sovereignty, data owners in the data space attach usage restrictions to their data before transmitting it to data consumers. To use the data, data consumers must fully accept the data owner's usage policy.

[0030] Data Ecosystem: The architecture of the data space does not require a central data storage function. Instead, it pursues the concept of decentralized data storage, meaning that data physically remains with its respective owner until it is transferred to a trusted party. This approach requires a comprehensive description of each data source, as well as its value and usability to other companies, combined with the ability to integrate domain-specific data vocabularies. Furthermore, metadata brokers within the ecosystem provide real-time data search services.

[0031] Standardized interoperability: DataSpace connectors are core components of the architecture and are implemented in different variants and available from different vendors. However, each connector is able to communicate with any other connector (or other technology component) in the DataSpace ecosystem.

[0032] Value-added applications: Data Spaces allow applications to be injected into Data Space connectors to provide services on top of the data exchange process. For example, this includes services for data processing, data format alignment, and data exchange protocols. In addition, data analysis services can be provided through remote execution of algorithms.

[0033] Data Marketplace: Dataspaces enable the creation of novel data-driven services that leverage data applications. They foster new business models for these services by providing clearing mechanisms and billing capabilities, as well as creating domain-specific metadata brokering solutions and marketplaces. Furthermore, Dataspaces provide templates and other methodologies for participants to specify usage restrictions and request legal information.

[0034] Data security is particularly important in the data space. In addition to the conventional prevention of data leakage when the storage media is lost, stolen or attacked by hackers, it is also necessary to prevent users with host and virtual machine permissions from illegally using or maliciously leaking data, and prevent other applications in the same host and virtual machine system environment from illegally using or tampering with data, ensuring that data can only be accessed by the application that created it.

[0035] Therefore, the present invention provides a method for encrypting and storing application data in a trusted data space. Figure 1 This is a flow chart of a method for storing encrypted data in a trusted data space application program according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0036] S1. Derive the sealing key of each application in each secure virtual machine based on Haiguang CSV technology;

[0037] Figure 2 Flowchart of the method for deriving the sealing key of each application in each secure virtual machine provided by an embodiment of the present invention, such as Figure 2 As shown, the method includes:

[0038] S11. Derive the sealing key of each secure virtual machine through the root key of the Haiguang security chip;

[0039] Hygon CSV technology ensures that the secure virtual machine has a unique sealing key, that is, the sealing keys of each secure virtual machine are different. They are derived from the root key of the Hygon security chip and cannot be deduced or cracked.

[0040] S12. Based on the sealing key of the current secure virtual machine, the identity ID of the current application in the current secure virtual machine, and other characteristic information, a CMAC algorithm is used to derive the sealing key of the current application in the current secure virtual machine.

[0041] Specifically, when the current application is constructed in the current secure virtual machine, an identity ID and an interference factor are randomly generated, and are shuffled and dispersed before being hard-coded in the current application (i.e., the identity ID data and the interference factor data are sliced ​​and shuffled and dispersed in the current application). Among them, the identity ID is a key parameter for deriving the sealing key of the current application. The characteristic is that the current application will be different each time it is built, and each application is also different. After being interfered and shuffled and dispersed, it is difficult to crack and extract.

[0042] After the current application in the current secure virtual machine is started, the CMAC encryption algorithm is adopted, and the sealing key of the current secure virtual machine derived based on the Haiguang CSV technology is used. The identity ID of the current application in the current secure virtual machine is used (that is, the original identity ID reconstructed by the current application using the scrambled and scattered identity ID data slices. It should be noted that the current application can reconstruct the original identity ID from the scrambled and scattered identity ID data slices, but other applications cannot crack and reconstruct it) and other characteristic information (the other characteristic information includes version number, version name, characteristic value, additional information, etc.) to derive a sealing key unique to the current application in the current secure virtual machine.

[0043] This method ensures that each application running in each secure virtual machine has its own unique sealing key, and cannot be detected or cracked by other applications even if they are running in the same secure virtual machine environment.

[0044] Furthermore, CMAC stands for Cipher-based Message Authentication Code. CMAC is a message authentication code based on a symmetric key block encryption algorithm and can be considered an operating mode of the symmetric algorithm. It uses key derivation techniques to generate multiple subkeys from a single master key to implement various security functions, such as secure communication protocols, storage encryption and decryption, and password management. CMAC has a wide range of applications, including but not limited to improving data security and reducing the burden on users' memory. The security of key-derived CMAC depends on the size of the generated subkey space, the derivation algorithm used, and the key protection measures.

[0045] S2. Obtain current plaintext data, encrypt the current plaintext data using a randomly generated current data encryption key in the current application to obtain current ciphertext data, and store the current ciphertext data in a first storage unit; and seal the randomly generated current data encryption key using a sealing key of the current application, and store the sealed current data encryption key in a second storage unit;

[0046] Specifically, the application and the plaintext data have a one-to-many correspondence relationship; the plaintext data and the data encryption key have a one-to-one correspondence relationship.

[0047] In the current application, multiple plaintext data can be obtained, and each plaintext data has a one-to-one corresponding data encryption key.

[0048] Take one of the plaintext data as an example:

[0049] Before the current plaintext data is written to disk, a current data encryption key corresponding to the current plaintext data is randomly generated based on the current plaintext data security policy level. The current plaintext data is encrypted in the current application using the randomly generated current data encryption key to obtain the current ciphertext data, effectively preventing data leakage. It is important to note that in the current application, a randomly generated symmetric encryption key with a specified number of key bits is used as the current data encryption key. The symmetric encryption key refers to the use of the same key for both encryption and decryption. For example, a randomly generated 256-bit symmetric encryption key can be used. Different plaintext data has different data encryption keys, which can further ensure data security.

[0050] The current ciphertext data is stored in a first storage unit; the first storage unit includes: a disk or an external database; specifically, the current ciphertext data is persistently stored in the disk or the external database.

[0051] Use the current application's seal key to encrypt and seal the randomly generated current data encryption key, effectively preventing the current data encryption key from being leaked.

[0052] The current data encryption key after the encryption seal is stored in a second storage unit; the second storage unit includes: secure hardware, a disk, or an external database. Specifically, the current data encryption key after the encryption seal is persistently stored in the secure hardware, the disk, or the external database.

[0053] It should be noted that if the current data encryption key is directly placed in the memory of the current application, the current data encryption key will disappear when the current application is restarted. Therefore, the current data encryption key needs to be encrypted and stored in the second storage unit.

[0054] S3. When the current application is restarted, the current ciphertext data in the first storage unit and the current data encryption key after encryption and sealing in the second storage unit are obtained; the current data encryption key after encryption and sealing is decrypted by the sealing key of the current application to obtain the current data encryption key; and the current ciphertext data is decrypted by the current data encryption key to obtain the current plaintext data.

[0055] When the current application is restarted, the current data encryption key is loaded: that is, the sealed current data encryption key is read from the security hardware, disk or external database; the sealed current data encryption key is decrypted using the seal key of the current application to obtain the current data encryption key. It should be noted that the sealed current data encryption key can only be decrypted by the seal key of the current application in the current secure virtual machine, and cannot be decrypted by the seal keys of other applications in the current secure virtual machine, nor can it be decrypted by the seal keys of all applications in other secure virtual machines.

[0056] Load the current ciphertext data: that is, read the current ciphertext data from the disk or external database; use the current data encryption key corresponding to the current ciphertext data (that is, the current data encryption key obtained by decrypting the sealed current data encryption key using the sealing key of the current application in the above) to decrypt the current ciphertext data to obtain the current plaintext data.

[0057] The present invention can prevent data leakage by encrypting different plaintext data with different data encryption keys and storing them in the first storage unit; and deriving a seal key for each application in each secure virtual machine, with different applications having different seal keys; using the seal key of the current application to seal the current data encryption key in the current application and store it in the second storage unit, effectively preventing the data encryption key from being leaked; in addition to preventing data leakage when the storage medium is lost, stolen or attacked by hackers, this method can also prevent users with host and virtual machine permissions from illegally using or maliciously leaking data, and prevent other applications in the same host and virtual machine system environment from illegally using or tampering with data, ensuring that data can only be accessed by the application that created the data.

[0058] Figure 3 This is a schematic diagram of the structure of a trusted data space application data disk encryption storage system provided by an embodiment of the present invention. Figure 3 As shown, the system includes:

[0059] A derivation unit 201 is configured to derive a sealing key for each application in each secure virtual machine based on the Haiguang CSV technology;

[0060] Figure 4 is a structural diagram of a derivation unit provided in an embodiment of the present invention, such as Figure 4 As shown, the derivation unit 201 includes:

[0061] The first derivation sub-unit 2011 is used to derive the sealing key of each secure virtual machine from the root key of the Haiguang security chip;

[0062] The second derivation subunit 2012 is used to derive the sealing key of the current application in the current secure virtual machine using the CMAC algorithm according to the sealing key of the current secure virtual machine, the identity ID of the current application in the current secure virtual machine, and other characteristic information.

[0063] In an optional implementation, the other characteristic information includes but is not limited to: version number, version name, characteristic value, etc.

[0064] The encryption storage unit 202 is configured to obtain current plaintext data, encrypt the current plaintext data using a randomly generated current data encryption key in the current application to obtain current ciphertext data, and store the current ciphertext data in the first storage unit; and seal the randomly generated current data encryption key using a sealing key of the current application, and store the sealed current data encryption key in the second storage unit;

[0065] In an optional implementation, the application and the plaintext data have a one-to-many correspondence; the plaintext data and the data encryption key have a one-to-one correspondence.

[0066] In an optional implementation, in the current application, a symmetric encryption key with a specified key bit number is randomly generated as the current data encryption key.

[0067] The first storage unit includes: a disk or an external database;

[0068] The second storage unit includes: secure hardware, a disk or an external database.

[0069] The decryption unit 203 is used to obtain the current ciphertext data in the first storage unit and the current data encryption key after encryption and sealing in the second storage unit when the current application is restarted; decrypt the current data encryption key after encryption and sealing by the sealing key of the current application to obtain the current data encryption key; and decrypt the current ciphertext data by the current data encryption key to obtain the current plaintext data.

[0070] Beneficial effects of the present invention:

[0071] The present invention provides a method and system for encrypted storage of application data in a trusted data space. The method derives a seal key for each application within each secure virtual machine based on Haiguang CSV technology; encrypts the current plaintext data in the current application using a randomly generated current data encryption key to obtain current ciphertext data, which is then stored in a first storage unit; and seals the randomly generated current data encryption key using the current application's seal key, storing the sealed current data encryption key in a second storage unit. This method can prevent data leakage when the storage medium is lost, stolen, or attacked by hackers. It can also prevent illegal use or malicious leakage of data by users with host and virtual machine permissions, as well as illegal use or tampering by other applications in the same host and virtual machine system environment, ensuring that data can only be accessed by the application that created the data.

[0072] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for encrypting and storing application data in a trusted data space, characterized in that: include: S1. Derive the sealing key of each application in each secure virtual machine based on Haiguang CSV technology; S2. Obtain current plaintext data, encrypt the current plaintext data using a randomly generated current data encryption key in the current application to obtain current ciphertext data, and store the current ciphertext data in a first storage unit; and sealing the randomly generated current data encryption key using the sealing key of the current application, and storing the sealed current data encryption key in the second storage unit; S3. When the current application is restarted, the current ciphertext data in the first storage unit and the current data encryption key after encryption and sealing in the second storage unit are obtained; Decrypting the sealed current data encryption key using the seal key of the current application to obtain the current data encryption key; and decrypting the current ciphertext data using the current data encryption key to obtain the current plaintext data; Said S1 comprises: The sealing key of each secure virtual machine is derived from the root key of the Hygon security chip; According to the sealing key of the current secure virtual machine, the identity ID of the current application in the current secure virtual machine and other characteristic information, the CMAC algorithm is used to derive the sealing key of the current application in the current secure virtual machine.

2. The method according to claim 1, wherein: The application and the plaintext data have a one-to-many correspondence; the plaintext data and the data encryption key have a one-to-one correspondence.

3. The method according to claim 2, wherein: In the current application, a symmetric encryption key with a specified key bit length is randomly generated as the current data encryption key.

4. The method according to claim 1, wherein: The other characteristic information includes: version number, version name, characteristic value; The first storage unit includes: a disk or an external database; The second storage unit includes: secure hardware, a disk or an external database.

5. A trusted data space application data disk encryption storage system, characterized by: include: A derivation unit, used to derive the sealing key of each application in each secure virtual machine based on the Haiguang CSV technology; an encryption storage unit, configured to obtain current plaintext data, encrypt the current plaintext data using a randomly generated current data encryption key in a current application to obtain current ciphertext data, and store the current ciphertext data in a first storage unit; and sealing the randomly generated current data encryption key using the sealing key of the current application, and storing the sealed current data encryption key in the second storage unit; A decryption unit, configured to obtain the current ciphertext data in the first storage unit and the current data encryption key after encryption and sealing in the second storage unit when the current application is restarted; Decrypting the sealed current data encryption key using the seal key of the current application to obtain the current data encryption key; and decrypting the current ciphertext data using the current data encryption key to obtain the current plaintext data; The derivation unit includes: A first derivation sub-unit is used to derive the sealing key of each secure virtual machine from the root key of the Haiguang security chip; The second derivation subunit is used to derive the sealing key of the current application in the current secure virtual machine using the CMAC algorithm according to the sealing key of the current secure virtual machine, the identity ID of the current application in the current secure virtual machine and other characteristic information.

6. The system according to claim 5, characterized in that: The application and the plaintext data have a one-to-many correspondence; the plaintext data and the data encryption key have a one-to-one correspondence.

7. The system according to claim 6, characterized in that: In the current application, a symmetric encryption key with a specified key bit length is randomly generated as the current data encryption key.

8. The system according to claim 5, characterized in that: The other characteristic information includes: version number, version name, characteristic value; The first storage unit includes: a disk or an external database; The second storage unit includes: secure hardware, a disk or an external database.

Images