Service key protection method and device, equipment, storage medium and product

Abstract

The invention discloses a service key protection method and device, equipment, a storage medium and a product, and relates to the technical field of data encryption. The method comprises the following steps: encrypting a service private key in a service public and private key pair to obtain a password verification ciphertext; acquiring a key ciphertext generated after the cryptographic device encrypts the service key by using a service public key in the service public and private key pair, and acquiring service data sent by the first application program; performing decryption operation on the password verification ciphertext to obtain a service private key corresponding to the key ciphertext; performing decryption operation on the key ciphertext through the service private key to obtain a service key; and performing cryptographic operation on the service data through the service key to obtain a cryptographic operation result corresponding to the service data. On the premise that the software password module and the password device are combined, the password verification text generated after the service private key is encrypted is additionally arranged in the software password module, the situation that the key is leaked in the transmission process is avoided, and the security of key protection is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data encryption technology, and in particular to a method, device, equipment, storage medium and product for protecting a business key. Background Art

[0002] With the continuous development of network technology, data security has gradually become the focus of attention in various industries. In the process of data transmission, the transmission data is usually encrypted by setting a key and then sent to the receiver. After receiving the encrypted data, the receiver decodes it to obtain the transmission data. Therefore, it is also particularly important to ensure the secure transmission of keys.

[0003] In related technologies, the method to ensure the security of keys is usually to use a cryptographic device to manage the keys, and a software cryptographic module (an application with cryptographic computing capabilities) to perform cryptographic operations. The first application obtains the key through the cryptographic device, sends the key and transmission data to the software cryptographic module for cryptographic operations, and obtains the cryptographic operation results for data transmission.

[0004] However, in the related art, since the cryptographic device manages the key in a black box environment, the key needs to be decrypted and sent to the first application, and then sent to the software cryptographic module by the first application. In this process, the key content may be intercepted or leaked, which makes the security strength of key management weaker, and thus the security of key transmission is also low. Summary of the invention

[0005] The embodiments of the present application provide a method, device, equipment, storage medium and product for protecting a business key, which can ensure the security of data transmission under encryption by improving the security strength of key management. The technical solution is as follows.

[0006] In one aspect, a method for protecting a business key is provided, the method comprising:

[0007] The password verification ciphertext is obtained by encrypting the business private key in the business public-private key pair, wherein the password verification ciphertext refers to a cipher text parameter generated after the business private key in the business public-private key pair is encrypted, and is a cipher text parameter used to encrypt and protect the business private key;

[0008] Obtaining a receiving key ciphertext generated by encrypting a business key by a cryptographic device using a business public key in the business public-private key pair, and obtaining business data sent by the first application, wherein the key ciphertext refers to a ciphertext parameter obtained by encrypting a business key by a cryptographic device using a business public key in the business public-private key pair, and the business key refers to a ciphertext parameter used to perform cryptographic operations on the business data;

[0009] Performing a decryption operation on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext;

[0010] Decrypting the key ciphertext using the business private key to obtain the business key;

[0011] The cryptographic operation is performed on the business data using the business key to obtain a cryptographic operation result corresponding to the business data.

[0012] On the other hand, a method for protecting a business key is also provided, the method comprising:

[0013] receiving a data encryption request sent by a first application, wherein the data encryption request is used to encrypt business data;

[0014] The password verification ciphertext is obtained by encrypting the business private key in the business public-private key pair, wherein the password verification ciphertext is a cipher text parameter used to encrypt and protect the business private key;

[0015] Obtaining a key ciphertext generated by encrypting a business key using a business public key in the business public-private key pair by a cryptographic device, and obtaining business data sent by the first application, wherein the business key refers to a ciphertext parameter used to perform encryption operations on the business data;

[0016] Performing a decryption operation on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext;

[0017] Decrypting the key ciphertext using the business private key to obtain the business key;

[0018] The business data is encrypted using the business key to obtain encrypted data corresponding to the business data, and the encrypted data is sent to a second application for data processing based on the data encryption request. The second application and the first application perform data transmission under encryption conditions.

[0019] On the other hand, a device for protecting a service key is provided, the device comprising:

[0020] A first acquisition module is used to obtain a password verification ciphertext by encrypting a business private key in a business public-private key pair, wherein the password verification ciphertext is a password text parameter used to encrypt and protect the business private key;

[0021] A first receiving module is used to obtain a key ciphertext generated by encrypting a business key by using a business public key in the business public-private key pair by a cryptographic device, and obtain business data sent by a first application, wherein the business key refers to a ciphertext parameter used to perform a cryptographic operation on the business data;

[0022] A first operation module, used for performing a decryption operation on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext;

[0023] The operation module is further used to perform a decryption operation on the key ciphertext using the business private key to obtain the business key;

[0024] The operation module is further used to perform the cryptographic operation on the business data using the business key to obtain a cryptographic operation result corresponding to the business data.

[0025] On the other hand, a device for protecting a service key is also provided, the device comprising:

[0026] A second receiving module, used to receive a data encryption request sent by the first application, where the data encryption request is used to encrypt the business data;

[0027] A second acquisition module is used to obtain a password verification ciphertext by encrypting the business private key in the business public-private key pair, wherein the password verification ciphertext is a password text parameter used to encrypt and protect the business private key;

[0028] The second acquisition module is further used to obtain a key ciphertext generated by encrypting a business key by using the business public key in the business public-private key pair by the cryptographic device, and to obtain business data sent by the first application, wherein the business key refers to a ciphertext parameter used to perform encryption operations on the business data;

[0029] A second operation module is used to perform a decryption operation on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext;

[0030] The second operation module is further used to perform a decryption operation on the key ciphertext using the business private key to obtain the business key;

[0031] The sending module is used to perform the encryption operation on the business data through the business key to obtain the encrypted data corresponding to the business data, and send the encrypted data to the second application for data processing based on the data encryption request. The second application and the first application perform data transmission under encryption conditions.

[0032] On the other hand, a computer device is provided, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement a method for protecting a business key as described in any of the above-mentioned embodiments of the present application.

[0033] On the other hand, a computer-readable storage medium is provided, in which at least one instruction, at least one program, a code set or an instruction set is stored, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement a method for protecting a business key as described in any of the above-mentioned embodiments of the present application.

[0034] On the other hand, a computer program product or a computer program is provided, the computer program product or the computer program includes a computer instruction, the computer instruction is stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method for protecting a business key described in any of the above embodiments.

[0035] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0036] First, the password verification ciphertext corresponding to the business private key in the business public-private key pair is obtained. After receiving the ciphertext content and business data encrypted by the business public key in the business public-private key pair through the cryptographic device, the password verification ciphertext is first decrypted to obtain the business private key corresponding to the key ciphertext, and then the key ciphertext is decrypted and operated according to the business private key to obtain the business key, and finally the business data is cryptographically operated with the business key to obtain the result of the cryptographic operation. That is, under the premise of combining the software cryptographic module and the cryptographic device, a password verification text generated after encrypting the business private key is added to the software cryptographic module, so that the key ciphertext is decrypted according to the business private key obtained after decrypting the password verification text, thereby enhancing the protection strength of the key security, avoiding the key from being leaked during the transmission process, improving the security of key protection, and thus improving the security of encrypted data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0038] Figure 1 It is a schematic diagram of a method for protecting a business key provided by an exemplary embodiment of the present application;

[0039] Figure 2 It is a schematic diagram of an implementation environment provided by an exemplary embodiment of the present application;

[0040] Figure 3is a flow chart of a method for protecting a business key provided by an exemplary embodiment of the present application;

[0041] Figure 4 is a flow chart of a method for protecting a business key provided by another exemplary embodiment of the present application;

[0042] Figure 5 is a flow chart of a training process of a business key protection method provided by another exemplary embodiment of the present application;

[0043] Figure 6 is a flow chart of a training process of a business key protection method provided by another exemplary embodiment of the present application;

[0044] Figure 7 is a schematic diagram of a method for protecting a business key provided by another exemplary embodiment of the present application;

[0045] Figure 8 is a schematic diagram of a method for protecting a business key provided by another exemplary embodiment of the present application;

[0046] Fig. 9 It is a structural block diagram of a protection device for a business key provided by an exemplary embodiment of the present application;

[0047] Fig.10 is a structural block diagram of a protection device for a business key provided by another exemplary embodiment of the present application;

[0048] Fig.11 is a structural block diagram of a protection device for a business key provided by another exemplary embodiment of the present application;

[0049] Fig.12 It is a schematic diagram of the structure of a server provided by an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0051] First, a brief introduction is given to the terms involved in the embodiments of the present application.

[0052] Software cryptographic module: An entity that performs cryptographic functions (such as encryption, decryption, signing, and signature verification) in the form of software, which can be in the form of a software development kit (SDK) or an application.

[0053] White-box encryption: White-box encryption, also known as white-box symmetric encryption, refers to a special encryption method that can resist external attacks in a white-box environment. White-box encryption does not require the presentation of its complete key during the encryption operation process, so even if the relevant data is stolen during the operation of the entire encryption process, the complete key cannot be obtained.

[0054] First, the implementation environment of this application is introduced. Figure 1 , which shows a schematic diagram of an implementation environment provided by an exemplary embodiment of the present application, such as Figure 1 As shown, the implementation environment includes a terminal 110 , a cryptographic device 120 and a server 130 , and the terminal 110 , the cryptographic device 120 and the server 130 are connected via a communication network 140 .

[0055] Illustratively, a first application is running in the terminal 110. The first application ensures that business data is transmitted under encrypted conditions by calling a software cryptographic module and a cryptographic device. For example, when the first application and the second application are transmitting data, the first application encrypts the business data by calling the software cryptographic module and the cryptographic device and then sends the data to the second application. When the second application receives the encrypted business data, it decrypts the encrypted business data by calling the software cryptographic module and the cryptographic device, thereby obtaining the business data.

[0056] In an optional embodiment, at least one software cryptographic module is integrated in the server 130, wherein the software cryptographic module is used to perform cryptographic operations on input business data using a key. Optionally, a single or multiple software cryptographic modules are integrated in the server 130, wherein when the server 130 is integrated with multiple software cryptographic modules, the multiple software cryptographic modules can be integrated into the same business service architecture, wherein the business service architecture refers to an architecture used to provide specified service types.

[0057] In another optional embodiment, the software cryptographic module may also be integrated into the terminal, that is, in the current case, the software cryptographic module and the first application are in the same terminal, or in different terminals, which is not limited.

[0058] In this embodiment, the software cryptographic module is integrated into the server 130 as an example. In the process of the terminal 110 running the first application, when the first application needs to perform cryptographic operations on the business data, taking the cryptographic operation as a data encryption operation as an example, the terminal 110 receives the key ciphertext sent by the cryptographic device 120, wherein the key ciphertext refers to the ciphertext parameter (for example, a string represented in binary form) obtained by the cryptographic device after encrypting the business key with the business public key in the business public-private key pair, and the business key is used to encrypt the business data generated in the first application.

[0059] After obtaining the key ciphertext, the terminal 110 sends the key ciphertext and the business data to the server 130 for data encryption.

[0060] The server 130 is integrated with a software cryptographic module, which stores a password verification ciphertext, which refers to a ciphertext parameter generated after the business private key in the business public-private key pair is encrypted. When the server 130 receives the key ciphertext and business data, it first performs a decryption operation on the password verification ciphertext through the software cryptographic module to obtain the business private key corresponding to the key ciphertext, and then performs a decryption operation on the key ciphertext according to the business private key to obtain the business key, and finally performs a data encryption operation on the business data according to the business key to obtain the encrypted data corresponding to the business data, and feeds the encrypted data back to the terminal 110.

[0061] Among them, the terminal 110 includes at least one of the terminals such as smart phones, tablet computers, portable laptops, desktop computers, smart speakers, smart wearable devices, smart voice interaction devices, smart home appliances, and vehicle-mounted terminals. The server 130 can be used in scenarios for implementing command operations in the fields of smart transportation, vehicle-mounted terminals, and the Internet of Things.

[0062] It is worth noting that the above-mentioned communication network 140 can be implemented as a wired network or a wireless network, and the communication network 140 can be implemented as any one of a local area network, a metropolitan area network or a wide area network, which is not limited in the embodiments of the present application.

[0063] It is worth noting that the above-mentioned server 130 can be implemented as a cloud server in the cloud, where cloud technology (Cloud Technology) refers to a hosting technology that unifies a series of resources such as hardware, software, and network in a wide area network or local area network to achieve data calculation, storage, processing, and sharing.

[0064] In some embodiments, the server 130 may also be implemented as a node in a blockchain system.

[0065] It is worth noting that the embodiment of the present application provides a method for protecting a business key, which can be implemented by the terminal 110 alone, by the server 130 alone, or by the terminal 110 and the server 130 in collaboration.

[0066] Among them, when the terminal 110 and the server 130 collaborate to implement the solution provided by the embodiment of the present application, the terminal 110 and the server 130 can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present application.

[0067] It should be noted that before collecting relevant data of users and during the process of collecting relevant data of users, this application can display a prompt interface, pop-up window or output voice prompt information, and the prompt interface, pop-up window or voice prompt information is used to prompt the user that its relevant data is currently being collected, so that this application only starts to execute the relevant steps of obtaining relevant data of users after obtaining the confirmation operation issued by the user to the prompt interface or pop-up window, otherwise (that is, when the confirmation operation issued by the user to the prompt interface or pop-up window is not obtained), the relevant steps of obtaining relevant data of users are terminated, that is, the relevant data of users are not obtained. In other words, all user data collected by this application are collected with the consent and authorization of the user, and the collection, use and processing of relevant user data need to comply with the relevant laws, regulations and standards of the relevant regions.

[0068] In combination with the above-mentioned noun introduction and implementation environment, the protection method of the business key provided in the embodiment of the present application is described, and the method is performed by the server as an example. For illustration, please refer to Figure 2 , which shows a flowchart of a method for protecting a business key provided by an exemplary embodiment of the present application, the method includes the following steps.

[0069] Step 210: encrypt the business private key in the business public-private key pair to obtain a password verification ciphertext.

[0070] The password verification ciphertext refers to the password text parameter used to encrypt and protect the business private key.

[0071] In some embodiments, at least one software cryptographic module is integrated in the server, and the protection method of the business key in the embodiments of the present application is described by taking the application in the software cryptographic module as an example. In another achievable case, the software cryptographic module can also be implemented as being integrated in the terminal, which is not limited to this.

[0072] In schematic form, a business public-private key pair refers to a shared key pair agreed upon between a cryptographic device and a software cryptographic module, wherein the business public-private key pair includes a business public key and a business secret key. The shared key pair is used to authenticate the identity between the cryptographic device and the software cryptographic module. For example, the cryptographic device encrypts part of the data using the business public key, and after the software cryptographic module obtains the data encrypted by the cryptographic device, it decrypts the encrypted data using the business private key, thereby restoring part of the data.

[0073] Therefore, the business public-private key pair is a shared key pair in asymmetric encryption technology, that is, both the public key and the private key are keys.

[0074] In some embodiments, both the business private key and the business public key are strings consisting of random numbers.

[0075] Indicatively, the business private key in the business public-private key pair is stored in the software cryptographic module in an encrypted manner. Therefore, the cipher text parameter generated after encrypting the business private key is the password verification ciphertext.

[0076] Optionally, the method for encrypting the business private key includes at least one of the following methods:

[0077] 1. Perform white-box encryption on the business private key through white-box encryption technology. For example, after performing multiple data obfuscation on the business private key, a relatively complex matrix is ​​generated for storage. In this way, even if the software cryptographic module is attacked, only the matrix after data obfuscation is obtained, and the business private key cannot be directly obtained or restored;

[0078] 2. Perform black-box encryption on the business private key through black-box encryption technology. For example, after performing a specified type of encryption on the business private key, an encrypted data is obtained, wherein the specified type can be implemented by converting the business private key originally represented in binary form into a decimal representation, and marking the encryption type corresponding to the encrypted data.

[0079] It is worth noting that the above-mentioned encryption method for the business private key is only an illustrative example and is not limited to this in the embodiments of the present application.

[0080] Among them, white-box encryption technology refers to encrypting business data so that the encrypted business data can resist white-box attacks. Among them, white-box attacks (White-Box Attack) refer to the attacker's complete control over the operating environment and executable programs of the encryption system (such as software cryptographic modules), and can observe and modify any internal operations and data, including the device's central processing unit (CPU), registers, memory and other data.

[0081] Among them, black box encryption technology refers to the encryption of business data, and the encrypted business data can resist black box attacks. Among them, black box attacks refer to the attacker performing statistical analysis on plain text (business data) and cipher text (encrypted business data).

[0082] In some embodiments, the software cryptographic module obtains the password verification ciphertext from a pre-stored parameter file.

[0083] Optionally, one or more password verification ciphertexts are stored in the software cryptographic module, wherein, when multiple password verification ciphertexts are stored in the software cryptographic module, different password verification ciphertexts correspond to different first applications, for example: when the software cryptographic module receives a cryptographic operation request from the first application a, the password verification ciphertext 1 corresponding to the first application a is obtained from the parameter file; when the software cryptographic module receives a cryptographic operation request from the first application b, the password verification ciphertext 2 corresponding to the first application b is obtained from the parameter file.

[0084] Step 220, obtaining a key ciphertext generated by encrypting a business key using a business public key in a business public-private key pair by a cryptographic device, and obtaining business data sent by the first application.

[0085] The business key refers to the cipher text parameter used to perform cryptographic operations on business data.

[0086] In some embodiments, the business data is related data generated by the first application. For example, the first application is an application with a pathological data recording function. After the first application generates pathological data corresponding to the user, the pathological data needs to be encrypted and sent to the diagnosis platform for medical diagnosis. Therefore, the first application currently has encryption requirements. It is worth noting that at this time, the diagnosis platform is the second application, which is used to transmit data with the first application under encrypted conditions.

[0087] Illustratively, the role of the business key is to perform corresponding cryptographic operations on the business data generated by the first application according to the business requirements corresponding to the first application.

[0088] Optionally, the cryptographic operation includes at least one of encryption, decryption, signing, and signature verification.

[0089] Among them, encryption refers to encrypting business data to obtain encrypted data; decryption refers to performing relevant operations on the encrypted business data and then restoring it to business data; signature refers to identity authentication during data transmission under encrypted conditions, for example: when the sender sends encrypted data to the receiver, it also sends a data signature to verify the identity information of the current sender; signature verification refers to the receiver verifying the sender's identity information through the data signature.

[0090] In some embodiments, the cryptographic device refers to a hardware device for storing and managing business keys. Optionally, the cryptographic device includes at least one of the following device types: a hardware cryptographic machine, a managed cryptographic machine, a hardware cryptographic card, and the like.

[0091] Illustratively, when the cryptographic device receives a cryptographic operation request sent by the first application, the cryptographic device encrypts the business key according to the business public key in the business public-private key pair pre-agreed with the software cryptographic module, obtains the key ciphertext corresponding to the business key and sends it to the first application.

[0092] Optionally, after the cryptographic device generates the key ciphertext, it sends the key ciphertext to the first application, which then sends it to the software cryptographic module; or, after the cryptographic device generates the key ciphertext, it directly sends it to the software cryptographic module, which is not limited to this.

[0093] Optionally, the data file format corresponding to the key ciphertext includes at least one of a format with a “.cer” suffix, a format with a “.cer” suffix, a format with a “.crt” suffix, a format with a “.key” suffix, and the like.

[0094] Optionally, the key algorithm type of the business public and private key pair includes at least one of the following types: elliptic curve cryptography algorithm (SM2), special reversible modular exponentiation algorithm (RSA), block data algorithm (SM4), elliptic curve digital signature algorithm (ECDSA), Advanced Encryption Standard (AES), etc.

[0095] It is worth noting that the business public key and business secret key in the business public-private key pair correspond to the same key algorithm type. For example, the business public-private key pair a includes the SM2 public key and the SM2 private key.

[0096] Optionally, the business private key and business public key in the business public-private key pair are generated simultaneously; or, the business private key is generated first, and then a public key operation is performed based on the business private key to obtain the corresponding business public key; or, the business public key is generated first, and then a private key operation is performed based on the business public key to obtain the corresponding business public key.

[0097] Among them, whether it is public key operation or private key operation, a specified type of mathematical algorithm is used to perform mathematical calculations on the business private key / business public key to obtain the corresponding business public key / business private key.

[0098] In some embodiments, after receiving the key ciphertext sent by the cryptographic device, the first application sends the key ciphertext and business data to the software cryptographic module.

[0099] In other embodiments, the first application only sends the business data to the software cryptographic module, and the cryptographic device sends the key ciphertext to the software cryptographic module.

[0100] Step 230, decrypt the password verification ciphertext to obtain the business private key corresponding to the key ciphertext.

[0101] In an illustrative manner, after obtaining the key ciphertext and the business data, the password verification ciphertext is first decrypted based on the password verification ciphertext, thereby restoring the password verification ciphertext to the business private key in the business private key pair.

[0102] In some embodiments, in the process of white-box encryption of a business private key using white-box encryption technology, the password verification ciphertext is obtained by encrypting the business private key using a pre-generated white-box key. Therefore, the process of decrypting the verification password ciphertext is to use the pre-generated white-box key to perform a decryption operation on it, thereby restoring the business private key in the business public-private key pair.

[0103] Step 240: Decrypt the key ciphertext using the business private key to obtain the business key.

[0104] Indicatively, after the business private key is restored, the key ciphertext is decrypted using the business private key to restore the business key.

[0105] Optionally, when the types of the business private keys are different, the manners of performing decryption operations on the key ciphertext using the business private keys are also different.

[0106] Step 250: Perform cryptographic operations on the business data using the business key to obtain cryptographic operation results corresponding to the business data.

[0107] Illustratively, after the software cryptographic module obtains the business key through decryption operation, the software cryptographic module performs cryptographic operation on the business data using the business key, thereby obtaining a cryptographic operation result corresponding to the business data.

[0108] In a feasible case, when the cryptographic operation is encryption, an encryption operation is performed on the business data using a business key, thereby obtaining encrypted data corresponding to the business data.

[0109] In a feasible case, when the cryptographic operation is decryption, a decryption operation is performed on the business data (the business data is implemented as encrypted data at this time) using the business key, thereby restoring the decrypted data.

[0110] In a feasible case, when the cryptographic operation is a signature, a signature operation is performed on the business data using the business key to obtain a digital signature corresponding to the business data.

[0111] In a feasible case, when the cryptographic operation is signature verification, the business data is subjected to a signature verification operation using the business key, thereby obtaining a signature verification result corresponding to the business data, wherein the signature verification result includes two situations: verification passed and verification failed.

[0112] In some embodiments, the cryptographic operation results corresponding to the business data will be sent by the software cryptographic module to the first application to facilitate the subsequent data processing of the cryptographic operation results by the first application. For example, the first application transmits the cryptographic operation results to other applications, thereby ensuring that the data transmission process is implemented under encryption conditions.

[0113] In summary, the method for protecting the business key provided in the embodiment of the present application first obtains the password verification ciphertext corresponding to the business private key in the business public-private key pair, and after receiving the ciphertext content and business data encrypted by the business public key in the business public-private key pair by the cryptographic device, first decrypts the password verification ciphertext to obtain the business private key corresponding to the key ciphertext, and then decrypts the key ciphertext according to the business private key to obtain the business key, and finally performs a cryptographic operation on the business data through the business key to obtain the cryptographic operation result. That is, under the premise of combining the software cryptographic module and the cryptographic device, a password verification text generated after encrypting the business private key is added to the software cryptographic module, so that the key ciphertext is decrypted according to the business private key obtained after decrypting the password verification text, thereby enhancing the protection strength of the key security, avoiding the key from being leaked during the transmission process, improving the security of the key protection, and then improving the security of the encrypted data transmission.

[0114] In some embodiments, the business private key is encrypted by white box encryption technology. For example, please refer to Figure 3 , which shows a flowchart of a method for protecting a business key provided by an exemplary embodiment of the present application, that is, step 210 includes step 211 and step 212, such as Figure 3 As shown, the method includes the following steps.

[0115] Step 211: randomly generate a business private key, and generate a business public key in the business private key pair based on the business private key.

[0116] In an illustrative manner, a business private key is randomly generated by a random number generator according to a specified key algorithm type.

[0117] Among them, the random number generator refers to a device used to generate a key. First, the specified key algorithm type is determined, for example: the SM2 algorithm is selected as the key generation condition, the key generation condition is input into the random number generator, and a string combination is output. The string combination is used as the business private key, that is, the SM2 private key, denoted as Pri_S.

[0118] After obtaining the business private key, a mathematical calculation is performed on the business private key using a mathematical algorithm, and the calculated result is used as the business public key in the business public-private key pair.

[0119] Step 212: Perform encryption operation on the business private key using the pre-acquired white box key to obtain the encryption operation result as the password verification ciphertext.

[0120] Schematically, the white box key refers to a key generated by white box encryption technology, and the white box key is used to encrypt the SM4 private key to obtain a password verification ciphertext.

[0121] In some embodiments, a first key is randomly generated; a white-box encryption operation is performed on the first key to obtain a white-box key corresponding to the first key, and the white-box encryption operation refers to an encryption operation performed on the first key in a white-box environment; an encryption operation is performed on the business private key using the white-box key to obtain the encryption operation result as a password verification ciphertext.

[0122] In this embodiment, a first key is first randomly generated by a random number generator using a specified key algorithm type, and then a white-box key is obtained by performing a white-box encryption operation on the first key.

[0123] First, determine the specified key algorithm type, for example: select the SM4 algorithm as the key generation condition, input the key generation condition into the random number generator, output a string combination, and use the string combination as the first key, that is, the SM4 key.

[0124] Optionally, the order of generating the business private key and generating the first key can be to generate the business private key first and then generate the first key, or to generate the first key first and then generate the business private key. That is, there is no limitation on the order of generating the business private key and the first key.

[0125] After obtaining the first key, data obfuscation is performed on the first key using white box encryption technology, and the obfuscated data is used as the white box key corresponding to the first key, which is recorded as Key_WB.

[0126] After obtaining the white box key and the business private key, the business private key is encrypted by the white box key, so that the encrypted data is obtained as the password verification ciphertext, which is recorded as the module fingerprint F.

[0127] Optionally, the password verification ciphertext is implemented to be represented in at least one of binary, octal, hexadecimal, and other bit formats.

[0128] It is worth noting that the above-mentioned password verification ciphertext generation process can be implemented in the design process of the software password module, that is, when the software password module is delivered for use, the password verification ciphertext has been packaged and stored in the software password module.

[0129] Step 230, decrypt the password verification ciphertext to obtain the business private key corresponding to the key ciphertext.

[0130] In some embodiments, a white-box decryption operation is performed on the password verification ciphertext to obtain a business private key corresponding to the key ciphertext. The white-box decryption operation refers to a decryption operation performed on the password verification ciphertext in a white-box environment.

[0131] In this embodiment, during the process of performing white-box decryption operation on the password verification ciphertext, the business private key is decrypted using the white-box key, thereby obtaining the business private key corresponding to the key ciphertext.

[0132] That is, the white box key can both encrypt and decrypt the business private key.

[0133] In summary, the method for protecting the business key provided in the embodiment of the present application first obtains the password verification ciphertext corresponding to the business private key in the business public-private key pair, and after receiving the ciphertext content and business data encrypted by the business public key in the business public-private key pair by the cryptographic device, first decrypts the password verification ciphertext to obtain the business private key corresponding to the key ciphertext, and then decrypts the key ciphertext according to the business private key to obtain the business key, and finally performs a cryptographic operation on the business data through the business key to obtain the cryptographic operation result. That is, under the premise of combining the software cryptographic module and the cryptographic device, a password verification text generated after encrypting the business private key is added to the software cryptographic module, so that the key ciphertext is decrypted according to the business private key obtained after decrypting the password verification text, thereby enhancing the protection strength of the key security, avoiding the key from being leaked during the transmission process, improving the security of the key protection, and then improving the security of the encrypted data transmission.

[0134] In this embodiment, the method of encrypting the randomly generated business private key with the white box key to obtain the password verification ciphertext can ensure that even if the password verification ciphertext is leaked, the business private key cannot be restored, thereby improving the security strength of the cryptographic operation.

[0135] In this embodiment, the security performance of the key can be guaranteed by performing a white-box encryption operation on the randomly generated first key to obtain a white-box key.

[0136] In some embodiments, there is also a certificate verification process in the business key protection process. For example, please refer to Figure 4 , which shows a flowchart of a method for protecting a business key provided by an exemplary embodiment of the present application, that is, step 220 also includes step 2201 and step 2202 before step 220, and step 220 also includes step 221,

[0137] Step 2201, obtaining a business certificate corresponding to the first application.

[0138] The business certificate is used to perform business authorization verification on the cryptographic operation requirements of the first application.

[0139] Illustratively, the service certificate is a digital certificate pre-issued between the first application and the software cryptographic module, which is used to indicate that the cryptographic operation service of the current first application is authorized to be implemented by the software cryptographic module, and it is a digitally signed statement.

[0140] Optionally, the business certificate includes at least one of the following contents: certificate validity period, certificate signature, certificate serial number, name of the issuing organization of the certificate, version information of the certificate, public key data corresponding to the certificate, etc.

[0141] Optionally, the business certificate is issued by a designated issuing agency to the first application and the software cryptographic module, or the business certificate is automatically generated during the design of the software cryptographic module.

[0142] In an optional case, a plurality of different first application programs share the same software cryptographic module, and therefore the service certificates corresponding to the different first application programs are also different.

[0143] In some embodiments, a public key operation is performed on the business private key to obtain the business public key in the business public-private key pair; the business public key is certificate compiled to obtain the certificate request content; the certificate request content is digitally signed by the verification private key in the verification public-private key pair to obtain the business certificate.

[0144] In this embodiment, the process of generating the business certificate is carried out synchronously during the design process of the software cryptographic module. Therefore, after obtaining the SM2 private key (i.e., the business private key) in the above embodiment, the public key is calculated based on the SM2 private key to obtain the business public key Pub_S in the business public-private key pair.

[0145] After obtaining the business public key Pub_S, the business public key and the various contents in the above business certificate are compiled, and the compiled result is used as the certificate request content, that is, the certificate request string.

[0146] In addition, during the design of the software cryptographic module, a verification public-private key pair is also pre-designed, and the verification public-private key pair is used to control the business authorization process of the software cryptographic module. The verification public-private key pair is packaged and stored in the parameter file corresponding to the software cryptographic module. Among them, the generation method of the verification public-private key pair can refer to the generation method of the business public-private key pair mentioned above, which will not be repeated here.

[0147] The certificate request string is digitally signed by the verification private key Pri corresponding to the verification public key, thereby generating the final business certificate, denoted as Cert. In the digital signature process, the electronic file corresponding to the certificate request string is first generated, a digital summary is generated by the hash algorithm, and the digital summary is encrypted according to the verification private key to obtain the signature result, which is used as the business certificate.

[0148] It is worth noting that before the software cryptographic module is delivered for use, the white box key, password verification ciphertext, business certificate, and business public key in the above embodiments are all pre-compiled parameters and can be used directly during the delivery of the software cryptographic module.

[0149] Therefore, in the process of performing cryptographic operations on business data, the first application program first inputs the business certificate to the software cryptographic module, so that the software cryptographic module performs certificate verification on the business certificate.

[0150] Step 2202, perform certificate verification on the business certificate to obtain a certificate verification result.

[0151] In some embodiments, during the process of verifying the business certificate, the validity of certificate parameters such as the certificate validity period, certificate signature, business public key, etc. in the business certificate are verified.

[0152] In some embodiments, the business certificate is verified by using a verification public key in a pre-acquired verification public-private key pair to obtain a first verification result; in response to the first verification result meeting a first verification condition, a certificate analysis is performed on the business certificate to obtain an analysis public key; a public key operation is performed on the business private key to obtain the business public key in the business public-private key pair; and the comparison result between the analysis public key and the business public key is used as the certificate verification result.

[0153] In this embodiment, after receiving the business certificate input by the first application, the software cryptographic module uses the verification public key Pub of the verification public-private key pair to decrypt and verify Cert to obtain a first verification result, wherein the first verification result is mainly used to verify information such as the certificate validity period and certificate signature. In this embodiment, the first verification result is a digital summary, and the software cryptographic module performs a hash algorithm on the pre-stored certificate request string to obtain a verification summary, and compares the digital summary and the verification summary. When the comparison result is consistent, it indicates that the first verification result meets the first verification condition. If the comparison result is inconsistent, it indicates that the first verification result does not meet the first verification condition.

[0154] When the first verification result meets the first verification condition, the business certificate is analyzed, and the analysis public key is obtained according to the analysis result, which is recorded as Pub_S'. The software cryptographic module decrypts the password verification ciphertext with the white box key to obtain the business private key, calculates the public key according to the business private key, obtains the business public key in the business public-private key pair, and uses the business public key and the analysis public key as the certificate verification result.

[0155] Step 221: In response to the certificate verification result meeting the verification pass condition, receiving the key ciphertext and business data sent by the first application.

[0156] In some embodiments, the analysis public key and the business public key are compared to obtain a public key comparison result; in response to the public key comparison result being that the analysis public key and the business public key are consistent, the certificate verification result meets the verification pass condition.

[0157] In this embodiment, after obtaining the certificate verification result, the analysis public key and the business public key are compared. If the analysis public key and the business public key are the same, it indicates that the certificate verification result meets the verification pass conditions. If the analysis public key and the business public key are different, it indicates that the certificate verification result does not meet the verification pass conditions.

[0158] In summary, the method for protecting the business key provided in the embodiment of the present application first obtains the password verification ciphertext corresponding to the business private key in the business public-private key pair, and after receiving the ciphertext content and business data encrypted by the business public key in the business public-private key pair by the cryptographic device, first decrypts the password verification ciphertext to obtain the business private key corresponding to the key ciphertext, and then decrypts the key ciphertext according to the business private key to obtain the business key, and finally performs a cryptographic operation on the business data through the business key to obtain the cryptographic operation result. That is, under the premise of combining the software cryptographic module and the cryptographic device, a password verification text generated after encrypting the business private key is added to the software cryptographic module, so that the key ciphertext is decrypted according to the business private key obtained after decrypting the password verification text, thereby enhancing the protection strength of the key security, avoiding the key from being leaked during the transmission process, improving the security of the key protection, and then improving the security of the encrypted data transmission.

[0159] In this embodiment, by obtaining the business certificate corresponding to the first application and then performing certificate verification on it, it can be ensured that the key ciphertext and business data are received only when the verification is passed, thereby improving the security strength of the cryptographic operation.

[0160] In this embodiment, the business certificate is first verified by verifying the public key, and then the analysis public key obtained by certificate analysis of the business certificate is compared with the business public key to finally determine whether the verification is passed, thereby improving the security of certificate verification.

[0161] In this embodiment, the certificate is compiled using the business public key of the business public-private key pair, and the verification private key is used for digital signature. Finally, the business certificate is generated, which can improve the accuracy of certificate generation and ensure its privacy and security.

[0162] In some embodiments, the first application and the second application need to perform data transmission under encryption as an example. For example, please refer to Figure 5 , which shows a flow chart of a method for protecting a business key provided by an exemplary embodiment of the present application, such as Figure 5 As shown, the method includes the following steps.

[0163] Step 510: Receive a data encryption request sent by a first application.

[0164] The data encryption request is used to encrypt business data.

[0165] Illustratively, when the software cryptographic module receives a data encryption request sent by the first application, the data encryption function is started.

[0166] In some embodiments, the data encryption request refers to requesting the software cryptographic module to encrypt the business data sent by the first application.

[0167] In one possible implementation, the data encryption request includes the business data corresponding to the first application and the encryption request indication information. In another possible implementation, the data encryption request only includes the encryption request indication information.

[0168] Step 520, encrypting the business private key in the business public-private key pair to obtain a password verification ciphertext.

[0169] The password verification ciphertext is a password text parameter used to encrypt and protect the business private key.

[0170] Illustratively, the method for obtaining the password verification ciphertext in step 520 has been described in detail in the above step 210 and will not be repeated here.

[0171] Optionally, step 520 may be performed before step 510 or after step 510 .

[0172] In some embodiments, the process of generating the password verification ciphertext is a parallel process of the software password module during the design process. That is, when the software password module is used, the password verification ciphertext is already stored in the software password module.

[0173] In an optional embodiment, when password verification ciphertexts corresponding to multiple applications are stored in the software cryptographic module, when the software cryptographic module receives a data encryption request, it selects a password verification ciphertext corresponding to the first application from the stored folder according to the data encryption request.

[0174] Step 530, obtaining a key ciphertext generated by encrypting a business key using a business public key in a business public-private key pair by a cryptographic device, and obtaining business data sent by the first application.

[0175] The business key refers to the ciphertext parameter used to encrypt business data.

[0176] In some embodiments, after the first application sends a data encryption request to the software cryptographic module, the first application also sends a data encryption request to the cryptographic device, whereby the cryptographic device encrypts the business key using the business public key in the business public-private key pair according to the data encryption request, thereby generating a key ciphertext, and the cryptographic device sends the key ciphertext to the first application, whereupon the first application sends the key ciphertext and the business data to the software cryptographic module, and the key ciphertext and the business data are received by the data receiving interface corresponding to the software cryptographic module.

[0177] Illustratively, the description of the key ciphertext and business data generation process in step 530 has been described in detail in the above step 220 and will not be repeated here.

[0178] Step 540, decrypt the password verification ciphertext to obtain the business private key corresponding to the key ciphertext.

[0179] Indicatively, after the software cryptographic module receives the business data and the key ciphertext, it performs a white-box decryption operation on the password verification ciphertext, thereby decrypting and obtaining the business private key corresponding to the password verification ciphertext.

[0180] Step 550: Decrypt the key ciphertext using the business private key to obtain the business key.

[0181] Illustratively, the software cryptographic module uses the SM2 private key to perform a decryption operation on the business private key to obtain the business key.

[0182] Step 560: Perform encryption operation on the business data using the business key to obtain encrypted data corresponding to the business data, and send the encrypted data to the second application for data processing based on the data encryption request.

[0183] The second application and the first application perform data transmission under encryption conditions.

[0184] Illustratively, after the software cryptographic module decrypts and obtains the business key, it performs encryption operation on the business data sent by the first application using the business key to obtain encrypted data corresponding to the business data, and sends the encrypted data to the second application according to the data encryption request.

[0185] The second application is an application that needs to perform data transmission with the first application under encryption conditions.

[0186] When the second application receives the encrypted data corresponding to the business data, the second application may also call the corresponding cryptographic device and / or software cryptographic module to decrypt the encrypted data, thereby reading the corresponding business data.

[0187] In summary, the method for protecting the business key provided in the embodiment of the present application first obtains the password verification ciphertext corresponding to the business private key in the business public-private key pair, and after receiving the ciphertext content and business data encrypted by the business public key in the business public-private key pair by the cryptographic device, first decrypts the password verification ciphertext to obtain the business private key corresponding to the key ciphertext, and then decrypts the key ciphertext according to the business private key to obtain the business key, and finally performs a cryptographic operation on the business data through the business key to obtain the cryptographic operation result. That is, under the premise of combining the software cryptographic module and the cryptographic device, a password verification text generated after encrypting the business private key is added to the software cryptographic module, so that the key ciphertext is decrypted according to the business private key obtained after decrypting the password verification text, thereby enhancing the protection strength of the key security, avoiding the key from being leaked during the transmission process, improving the security of the key protection, and then improving the security of the encrypted data transmission.

[0188] In some embodiments, the cryptographic operation type is encryption as an example for illustration. For illustration, please refer to Figures 6 to 8 , which shows a flowchart of a method for protecting a business key provided by an exemplary embodiment of the present application, which is composed of three parts: a generation process of a password verification ciphertext and a business certificate, an encryption process based on the password verification ciphertext, and a certificate verification process.

[0189] First, the generation process of password verification ciphertext and business certificate is explained, such as Figure 6 As shown, the method includes Follow the steps below.

[0190] Step 601: Generate a first key using a random number generator.

[0191] First, determine that the cryptographic operation type is SM4, take SM4 as the key generation condition, and randomly generate an SM4 key as the first key through a random number generator.

[0192] Step 602: Perform a white-box encryption operation on the first key to obtain a white-box key.

[0193] The white box key is generated by performing encryption operation on the SM4 key in a white box environment.

[0194] Step 603: Generate a business private key through a random number generator.

[0195] Determine the cryptographic operation type as SM2, take SM2 as the key generation condition, and use a random number generator to randomly generate an SM2 private key as the business private key.

[0196] Step 604: Perform white-box encryption operation on the business private key using the white-box key to obtain a password verification ciphertext.

[0197] The business private key is encrypted by the white box key, and the ciphertext result is used as the password verification ciphertext. The password verification ciphertext is a binary format file.

[0198] Step 605: Perform a public key operation on the business private key to obtain the business public key.

[0199] By performing a public key operation on the business private key, the business public key corresponding to the business private key is determined according to the public key operation result.

[0200] Step 606: Generate certificate request content according to the business public key.

[0201] The business public key is compiled into a certificate, and the compiled result is used as the certificate request content.

[0202] Step 607: According to the certificate request content, use the verification private key in the software cryptographic module to sign it and generate a business certificate.

[0203] After obtaining the certificate request content, it is signed by the verification private key of the verification public-private key pair used to manage business authorization in the software cryptographic module, thereby generating a business certificate.

[0204] Step 608: Pack the white box key and the password verification ciphertext into the software cryptographic module for compilation.

[0205] The white box key and password verification ciphertext are packaged into the software cryptographic module for combined compilation, so that the subsequent software cryptographic module can directly obtain the above parameters for cryptographic operations during the application process.

[0206] In addition, during the delivery and use of the first application and software cryptographic module, the certificate and business private key are both products of packaged delivery.

[0207] It is worth noting that the above-mentioned process of generating password verification ciphertext and certificate is completed before the software cryptographic module is delivered for use. Therefore, when the software cryptographic module performs cryptographic operations, the corresponding password verification ciphertext can be directly obtained from the stored folder.

[0208] Secondly, the encryption process based on password verification ciphertext is explained, such as Figure 7 As shown, the method comprises the following steps Steps.

[0209] Step 701: The first application program requests the cryptographic device to encrypt the business key using the business public key to obtain a key ciphertext corresponding to the business key.

[0210] When the first application needs to encrypt business data, it first sends an encryption request to the cryptographic device, so that the cryptographic device encrypts the business key with the business public key in the business public-private key pair, thereby obtaining the key ciphertext corresponding to the business key.

[0211] The cryptographic device sends the encrypted key ciphertext to the first application.

[0212] Step 702: The first application program inputs a service certificate to the software cryptographic module, and the software cryptographic module completes verification of the service certificate.

[0213] The first application program inputs a service certificate to the software password module, so that the software password module can verify its service authorization service, wherein the service certificate is a pre-generated digital certificate.

[0214] After the software password module verifies the business certificate, if the verification passes, it will proceed to the next step; if the verification fails, it will stop receiving data.

[0215] Step 703: The first application program inputs the key ciphertext and business data into the corresponding interface of the software cryptographic module.

[0216] After the software cryptographic module verifies the service certificate, the first application program inputs both the key ciphertext and the service data into the interface corresponding to the software cryptographic module, so that the software cryptographic module receives the key ciphertext and the service data.

[0217] Step 704: the software cryptographic module performs a white-box decryption operation on the password verification ciphertext to obtain a business private key corresponding to the key ciphertext.

[0218] After the software cryptographic module receives the key ciphertext and business data, it obtains the password verification ciphertext corresponding to the business private key in the business public-private key pair from the pre-stored parameter file, and then decrypts the password verification ciphertext using the white box key to obtain the business private key.

[0219] Step 705: The software cryptographic module performs a decryption operation on the key ciphertext using the business private key to obtain the business key.

[0220] The software cryptographic module decrypts the key ciphertext using the business private key obtained through decryption, thereby obtaining the business key.

[0221] Step 706: The software cryptographic module uses the business key to encrypt the business data and outputs the result.

[0222] After decrypting and obtaining the business key, the software cryptographic module performs encryption operation on the business data using the decrypted business key to generate encrypted data corresponding to the business data, and sends the encrypted data to the first application.

[0223] Finally, the certificate verification process is described in detail in the above encryption process. Figure 8 As shown, this method includes The following steps are included.

[0224] Step 801: A first application program inputs a service certificate into a software cryptographic module.

[0225] First, the first application sends a pre-issued service certificate to the software cryptographic module.

[0226] Step 802: The software cryptographic module uses the verification public key to perform certificate verification on the business certificate.

[0227] The software cryptographic module verifies the business certificate through the verification public key in the verification public-private key pair used to manage business authorization, and obtains a first verification result, which mainly verifies the certificate validity period, certificate signature, etc.

[0228] When the first verification result is legal, it means that the verification is passed and the next step is executed. When the first verification result is illegal, it means that the verification fails and the current process ends.

[0229] Step 803: The software cryptographic module parses the certificate to obtain the analysis public key.

[0230] When the first verification result is legal, the software cryptographic module performs certificate analysis on the business certificate to obtain an analysis public key.

[0231] Step 804: The software cryptographic module uses the white box key to decrypt the password verification ciphertext to obtain the business private key.

[0232] The software cryptographic module obtains the business private key by performing white-box decryption operation on the password verification password.

[0233] Step 805: Perform a public key operation on the business private key to obtain the business public key.

[0234] After the software cryptographic module performs a public key operation on the business private key, it obtains the business public key in the business public-private key pair.

[0235] Step 806, comparing the consistency of the business public key and the business private key.

[0236] The analysis public key and the business public key are compared. If the analysis public key and the business public key are the same, it means that the business public key and the business private key are consistent, and the certificate verification passes. If the business public key and the business private key are different, it means that the certificate verification fails.

[0237] In summary, the method for protecting the business key provided in the embodiment of the present application first obtains the password verification ciphertext corresponding to the business private key in the business public-private key pair, and after receiving the ciphertext content and business data encrypted by the business public key in the business public-private key pair by the cryptographic device, first decrypts the password verification ciphertext to obtain the business private key corresponding to the key ciphertext, and then decrypts the key ciphertext according to the business private key to obtain the business key, and finally performs a cryptographic operation on the business data through the business key to obtain the cryptographic operation result. That is, under the premise of combining the software cryptographic module and the cryptographic device, a password verification text generated after encrypting the business private key is added to the software cryptographic module, so that the key ciphertext is decrypted according to the business private key obtained after decrypting the password verification text, thereby enhancing the protection strength of the key security, avoiding the key from being leaked during the transmission process, improving the security of the key protection, and then improving the security of the encrypted data transmission.

[0238] The overall solution can be applied to the cryptographic application mode that combines software and hardware to solve the security problem of keys outside the boundaries of the software cryptographic module. At the same time, the introduction of fingerprint technology based on white-box encryption and initialization authentication methods can enhance the security strength of the software cryptographic module itself and resist security issues such as decompilation and unauthorized use of modules.

[0239] Fig. 9 FIG. 1 is a structural block diagram of a protection device for a service key provided by an exemplary embodiment of the present application. Fig. 9 As shown, the device comprises:

[0240] The first acquisition module 910 is used to obtain a password verification ciphertext, where the password verification ciphertext refers to a ciphertext parameter generated by encrypting a business private key in a business public-private key pair;

[0241] A first receiving module 920 is used to receive a key ciphertext and business data, wherein the key ciphertext refers to a ciphertext parameter obtained by encrypting a business key using a business public key in the business public-private key pair through a cryptographic device, and the business key refers to a ciphertext parameter used for cryptographic operations on the business data;

[0242] A first operation module 930 is used to perform a decryption operation on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext;

[0243] The first operation module 930 is further configured to perform a decryption operation on the key ciphertext using the business private key to obtain the business key;

[0244] The first operation module 930 is further used to perform the cryptographic operation on the business data using the business key to obtain a cryptographic operation result corresponding to the business data, and the cryptographic operation result is used to perform data transmission under encrypted conditions.

[0245] In some embodiments, Fig.10 As shown, the first acquisition module 910 includes:

[0246] A generating unit 911, configured to randomly generate the business private key, and generate a business public key in the business public-private key pair based on the business private key;

[0247] The operation unit 912 is used to perform encryption operation on the business private key by using the pre-acquired white box key to obtain the encryption operation result as the password verification ciphertext.

[0248] In some embodiments, the operation unit 912 is used to randomly generate a first key; perform a white-box encryption operation on the first key to obtain the white-box key corresponding to the first key, and the white-box encryption operation refers to performing an encryption operation on the first key in a white-box environment; perform the encryption operation on the business private key through the white-box key, and obtain the encryption operation result as the password verification ciphertext.

[0249] In some embodiments, the apparatus further comprises:

[0250] The first acquisition module 910 is used to acquire a business certificate corresponding to a first application, the first application is used to send the business data, and the business certificate is used to perform authorization verification on the cryptographic operation requirements of the first application;

[0251] The verification module 940 is used to perform certificate verification on the business certificate to obtain the certificate verification result;

[0252] The first receiving module 920 is configured to receive the key ciphertext and the business data sent by the first application in response to the certificate verification result meeting a verification pass condition.

[0253] In some embodiments, the verification module 940 is used to perform the certificate verification on the business certificate using the verification public key in a pre-acquired verification public-private key pair to obtain a first verification result; in response to the first verification result meeting a first verification condition, perform certificate analysis on the business certificate to obtain an analysis public key; perform public key operation on the business private key to obtain the business public key in the business public-private key pair; and use the comparison result between the analysis public key and the business public key as the certificate verification result.

[0254] In some embodiments, the apparatus further comprises:

[0255] The comparison module 950 is used to compare the analysis public key with the business public key to obtain a public key comparison result; in response to the public key comparison result being that the analysis public key is consistent with the business public key, the certificate verification result meets the verification pass condition.

[0256] In some embodiments, the first operation module 930 is also used to perform public key operation on the business private key to obtain the business public key in the business public-private key pair; perform certificate compilation on the business public key to obtain certificate request content; digitally sign the certificate request content by the verification private key in the verification public-private key pair to obtain the business certificate.

[0257] In some embodiments, the first operation module 930 is also used to perform a white-box decryption operation on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext, and the white-box decryption operation refers to performing the decryption operation on the password verification ciphertext in the white-box environment.

[0258] Fig.11 FIG. 1 is a structural block diagram of a protection device for a service key provided by an exemplary embodiment of the present application. Fig.11 As shown, the device comprises:

[0259] The second receiving module 1110 is used to receive a data encryption request sent by the first application, where the data encryption request is used to encrypt the business data;

[0260] The second acquisition module 1120 is used to obtain a password verification ciphertext by encrypting the business private key in the business public-private key pair, where the password verification ciphertext is a password text parameter used to encrypt and protect the business private key;

[0261] The second acquisition module 1120 is further used to obtain a key ciphertext generated by encrypting a business key using a business public key in the business public-private key pair by a cryptographic device, and to obtain business data sent by the first application, wherein the business key refers to a ciphertext parameter used to perform encryption operations on the business data;

[0262] The second operation module 1130 is used to perform a decryption operation on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext;

[0263] The second operation module 1130 is further configured to perform a decryption operation on the key ciphertext using the business private key to obtain the business key;

[0264] The sending module 1140 is used to perform the encryption operation on the business data using the business key to obtain encrypted data corresponding to the business data, and send the encrypted data to the second application for data processing based on the data encryption request. The second application and the first application perform data transmission under encryption conditions.

[0265] In summary, the business key protection device provided in the embodiment of the present application first obtains the password verification ciphertext corresponding to the business private key in the business public-private key pair, and after receiving the ciphertext content and business data encrypted by the business public key in the business public-private key pair by the cryptographic device, first decrypts the password verification ciphertext to obtain the business private key corresponding to the key ciphertext, and then decrypts the key ciphertext according to the business private key to obtain the business key, and finally performs a cryptographic operation on the business data through the business key to obtain the cryptographic operation result. That is, under the premise of combining the software cryptographic module and the cryptographic device, a password verification text generated after encrypting the business private key is added to the software cryptographic module, so that the key ciphertext is decrypted according to the business private key obtained after decrypting the password verification text, thereby enhancing the protection strength of the key security, avoiding the key from being leaked during the transmission process, improving the security of key protection, and thus improving the security of encrypted data transmission.

[0266] It should be noted that the business key protection device provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the business key protection device provided in the above embodiment and the business key protection method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0267] Fig.12 The following is a schematic diagram showing the structure of a server provided by an exemplary embodiment of the present application. Specifically:

[0268] The server 1200 includes a central processing unit (CPU) 1201, a system memory 1204 including a random access memory (RAM) 1202 and a read-only memory (ROM) 1203, and a system bus 1205 connecting the system memory 1204 and the central processing unit 1201. The server 1200 also includes a mass storage device 1206 for storing an operating system 1213, application programs 1214, and other program modules 1215.

[0269] The mass storage device 1206 is connected to the central processing unit 1201 through a mass storage controller (not shown) connected to the system bus 1205. The mass storage device 1206 and its associated computer-readable media provide non-volatile storage for the server 1200. That is, the mass storage device 1206 may include a computer-readable medium (not shown) such as a hard disk or a compact disc read-only memory (CD-ROM) drive.

[0270] Without loss of generality, computer readable media may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer readable instructions, data structures, program modules or other data. Computer storage media include RAM, ROM, Erasable Programmable Read Only Memory (EPROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other solid-state storage technology, CD-ROM, Digital Versatile Disc (DVD) or other optical storage, cassettes, tapes, disk storage or other magnetic storage devices. Of course, those skilled in the art will appreciate that computer storage media are not limited to the above. The above-mentioned system memory 1204 and mass storage device 1206 can be collectively referred to as memory.

[0271] According to various embodiments of the present application, the server 1200 can also be connected to a remote computer on the network through a network such as the Internet. That is, the server 1200 can be connected to the network 1212 through the network interface unit 1211 connected to the system bus 1205, or the network interface unit 1211 can be used to connect to other types of networks or remote computer systems (not shown).

[0272] The above-mentioned memory also includes one or more programs, and the one or more programs are stored in the memory and configured to be executed by the CPU.

[0273] An embodiment of the present application also provides a computer device, which includes a processor and a memory, in which at least one instruction, at least one program, code set or instruction set is stored, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the business key protection method provided by the above-mentioned method embodiments.

[0274] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the business key protection method provided by the above-mentioned method embodiments.

[0275] The embodiment of the present application also provides a computer program product, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the business key protection method described in any of the above embodiments.

[0276] Optionally, the computer readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a solid state drive (SSD), or an optical disk. Among them, the random access memory may include a resistance random access memory (ReRAM) and a dynamic random access memory (DRAM). The serial numbers of the above embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments.

[0277] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0278] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for protecting a business key, characterized in that: The method comprises: The password verification ciphertext is obtained by encrypting the business private key in the business public-private key pair, wherein the password verification ciphertext is a cipher text parameter used to encrypt and protect the business private key; Obtaining a key ciphertext generated by encrypting a business key using a business public key in the business public-private key pair by a cryptographic device, and obtaining business data sent by the first application, wherein the business key refers to a ciphertext parameter used to perform a cryptographic operation on the business data; Performing a decryption operation on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext; Decrypting the key ciphertext using the business private key to obtain the business key; The cryptographic operation is performed on the business data using the business key to obtain a cryptographic operation result corresponding to the business data.

2. The method according to claim 1, characterized in that The password verification ciphertext is obtained by encrypting the business private key in the business public-private key pair, including: Randomly generate the business private key, and generate the business public key in the business public-private key pair based on the business private key; The business private key is encrypted using the pre-acquired white box key to obtain an encryption result as the password verification ciphertext.

3. The method according to claim 2, characterized in that The process of performing encryption operation on the business private key by using the pre-acquired white box key to obtain the encryption operation result as the password verification ciphertext includes: randomly generating a first key; Performing a white-box encryption operation on the first key to obtain the white-box key corresponding to the first key, wherein the white-box encryption operation refers to performing an encryption operation on the first key in a white-box environment; The encryption operation is performed on the business private key using the white box key to obtain the encryption operation result as the password verification ciphertext.

4. The method according to any one of claims 1 to 3, characterized in that: Before receiving the key ciphertext and the service data, the method further includes: Obtaining a business certificate corresponding to the first application, where the business certificate is used to perform business authorization verification on the cryptographic operation requirements of the first application; Performing certificate verification on the business certificate to obtain the certificate verification result; The receiving key ciphertext and business data includes: In response to the certificate verification result meeting the verification pass condition, the key ciphertext and the business data sent by the first application are received.

5. The method according to claim 4, characterized in that The performing certificate verification on the business certificate to obtain the certificate verification result includes: Performing the certificate verification on the business certificate using the verification public key in the verification public-private key pair obtained in advance to obtain a first verification result; In response to the first verification result meeting the first verification condition, performing certificate analysis on the business certificate to obtain an analysis public key; Performing a public key operation on the business private key to obtain the business public key in the business public-private key pair; The comparison result between the analysis public key and the business public key is used as the certificate verification result.

6. The method according to claim 5, characterized in that Before receiving the key ciphertext and the service data sent by the first application, the method further includes: Perform a public key comparison between the analysis public key and the business public key to obtain a public key comparison result; In response to the public key comparison result being that the analysis public key is consistent with the business public key, the certificate verification result meets the verification pass condition.

7. The method according to claim 5, characterized in that Before obtaining the service certificate corresponding to the first application, the method further includes: Performing a public key operation on the business private key to obtain the business public key in the business public-private key pair; Compiling the business public key for a certificate to obtain certificate request content; The certificate request content is digitally signed using the verification private key in the verification public-private key pair to obtain the business certificate.

8. The method according to any one of claims 1 to 3, characterized in that: The decrypting operation is performed on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext, including: A white-box decryption operation is performed on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext, wherein the white-box decryption operation refers to performing the decryption operation on the password verification ciphertext in the white-box environment.

9. A method for protecting a business key, characterized in that: The method comprises: receiving a data encryption request sent by a first application, wherein the data encryption request is used to encrypt business data; The password verification ciphertext is obtained by encrypting the business private key in the business public-private key pair, wherein the password verification ciphertext is a cipher text parameter used to encrypt and protect the business private key; Obtaining a key ciphertext generated by encrypting a business key using a business public key in the business public-private key pair by a cryptographic device, and obtaining business data sent by the first application, wherein the business key refers to a ciphertext parameter used to perform encryption operations on the business data; Performing a decryption operation on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext; Decrypting the key ciphertext using the business private key to obtain the business key; The business data is encrypted using the business key to obtain encrypted data corresponding to the business data, and the encrypted data is sent to a second application for data processing based on the data encryption request. The second application and the first application perform data transmission under encryption conditions.

10. A device for protecting a business key, characterized in that: The device comprises: A first acquisition module is used to obtain a password verification ciphertext by encrypting a business private key in a business public-private key pair, wherein the password verification ciphertext is a password text parameter used to encrypt and protect the business private key; A first receiving module is used to obtain a key ciphertext generated by encrypting a business key by using a business public key in the business public-private key pair by a cryptographic device, and obtain business data sent by a first application, wherein the business key refers to a ciphertext parameter used to perform a cryptographic operation on the business data; A first operation module, used for performing a decryption operation on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext; The first operation module is further used to perform a decryption operation on the key ciphertext using the business private key to obtain the business key; The first operation module is further used to perform the cryptographic operation on the business data using the business key to obtain a cryptographic operation result corresponding to the business data.

11. A device for protecting a business key, characterized in that: The device comprises: A second receiving module, used to receive a data encryption request sent by the first application, where the data encryption request is used to encrypt the business data; A second acquisition module is used to obtain a password verification ciphertext by encrypting the business private key in the business public-private key pair, wherein the password verification ciphertext is a password text parameter used to encrypt and protect the business private key; The second acquisition module is further used to obtain a key ciphertext generated by encrypting a business key by using the business public key in the business public-private key pair by the cryptographic device, and to obtain business data sent by the first application, wherein the business key refers to a ciphertext parameter used to perform encryption operations on the business data; A second operation module is used to perform a decryption operation on the password verification ciphertext to obtain the business private key corresponding to the key ciphertext; The second operation module is further used to perform a decryption operation on the key ciphertext using the business private key to obtain the business key; A sending module is used to perform the encryption operation on the business data using the business key to obtain encrypted data corresponding to the business data, and send the encrypted data to the second application for data processing based on the data encryption request. The second application and the first application perform data transmission under encryption conditions.

12. A computer device, characterized in that: The computer device includes a processor and a memory, wherein the memory stores at least one program, and the at least one program is loaded and executed by the processor to implement the business key protection method according to any one of claims 1 to 9.

13. A computer-readable storage medium, characterized in that: The storage medium stores at least one program, and the at least one program is loaded and executed by a processor to implement the business key protection method according to any one of claims 1 to 9.

14. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the method for protecting a business key as claimed in any one of claims 1 to 9.

Images