Secret key security management scheme based on confidential calculation

Abstract

The invention discloses a secret key security management scheme based on confidential calculation. According to the scheme, on the basis of a secret computing environment, a secret key is converted into a computing state from an original storage state, an original one-time-one-key state is converted into an existing one-time-one-computing state, and an existing secret key management system is optimized. The scheme comprises a user request module, a key generation module, an information processing module and a key destruction module. Wherein the user request module comprises a user information receiving unit and an identity authentication unit. Wherein the key generation module comprises a user information acquisition unit and a key calculation unit. Wherein the information processing module comprises a data encryption unit and a data decryption unit. Wherein the key destroying module comprises a user information destroying unit and a key destroying unit. According to the invention, the secret computing technology is combined with the key management, and the key is converted from the original'storage state 'into the'computing state', so that the security of the key is enhanced, and the key management cost is reduced.

Description

Technical Field

[0001] The present invention relates to the field of confidential computing, and specifically designs a key security management solution based on confidential computing. Background Art

[0002] With the development of the Internet, a large amount of information will be transmitted and exchanged through the network, and much of the data will involve the privacy and interests of users. At this time, it is necessary to consider whether there is fraud and other unsafe factors in the process, so security becomes particularly important. Nowadays, people generally use cryptographic technologies such as digital signatures, encryption and decryption technologies to protect the security of information. When using cryptographic technology to protect information, since the cryptographic system is public, its core is the protection of the key. Once the key is lost or wrong, the attacker may destroy or steal key information, posing a threat to system security.

[0003] In order to prevent the loss or error of keys from threatening user information, key management systems came into being. Key management system is an important part of information security. The system is an integrated information security solution, including key generation, loading, distribution, storage, update, backup, recovery and destruction. Its core goal is to ensure the security and availability of keys to support various security applications and protocols, such as data encryption and decryption, identity authentication, digital signature, etc.

[0004] However, the existing key management system has the following problems: there is no way to ensure the security of random numbers used to generate keys in memory and computing environment; the management costs of key import and protection are high; it takes too long to import a complete key; keys are vulnerable to internal privilege attacks during key backup and can be cracked by external brute force guessing; and when the number of users is huge, the time cost of key query is huge.

[0005] In order to solve the above problems existing in the existing key management system, we proposed a key security management solution based on confidential computing. With the help of confidential computing technology, the key is transformed from the original "storage state" to the "computing state", and the original "one-time one-key" is transformed into the current "one-time one-computation", which solves the security and performance problems existing in the above existing key management system. Summary of the invention

[0006] In order to solve the above problems, the present invention provides a key security management solution based on confidential computing, including a user request module, a key generation module, an information processing module, and a key destruction module;

[0007] The user request module includes: a user information receiving unit, an identity authentication unit;

[0008] The key generation module includes: a user information acquisition unit and a key calculation unit;

[0009] The above-mentioned information processing module includes: a data encryption unit and a data decryption unit;

[0010] The key destruction module comprises: a user information destruction unit and a key destruction unit.

[0011] Further, as a preferred implementation scheme, the user request module receives the user's identity information after receiving the user's request, and uses the received identity information to authenticate the user, and determines whether the user is a legitimate user of the key management system, including a user information receiving unit and an identity authentication unit, wherein the user information receiving unit is responsible for receiving the user's identification information for identity authentication, and the identity authentication unit is responsible for authenticating the user's identity using the received information. The specific process is as follows:

[0012] S11: The user initiates an identity authentication request to the system;

[0013] S12: The user transmits identity information to the system;

[0014] S13: The system receives user identity information;

[0015] S14: The system uses the user identity information to authenticate the user and determine whether the user is a legitimate user.

[0016] Further, as a preferred implementation scheme, the above-mentioned key generation module, after the user identity authentication is passed, the security zone of the confidential computing environment obtains the user's relevant information and performs a series of calculations in combination with the master key stored in the security zone to obtain the key, including a user information acquisition unit and a key calculation unit, wherein the user information acquisition unit is responsible for obtaining the relevant information of the user participating in subsequent calculations, and the key calculation unit is responsible for calculating and generating the key. The specific process is as follows:

[0017] S21: The system sends the user ID and password PW to the confidential computing environment security zone;

[0018] S22: The confidential computing environment security zone sends the received user ID and password PW to the key generation module;

[0019] S23: The user information acquisition unit of the key generation module in the confidential computing environment security zone receives the user ID and password PW, and sends the acquired information to the key calculation unit;

[0020] S24: The key calculation unit calculates the XOR value of the user ID and the password PW

[0021] S25: The key calculation unit calculates the hash value of the XOR value X to obtain the user's pseudonym

[0022] S26: The key calculation unit calculates the user's pseudonym PID and the security zone master key KET enclave XOR value of

[0023] S27: The key calculation unit calculates the hash value of the XOR value Y, and intercepts the first 16 bits of the hash value to obtain the data storage key

[0024] S28: The key generation module stores the data key KEY data Sent to the information processing module.

[0025] Further, as a preferred implementation scheme, the above-mentioned information processing module uses the calculated data storage key to encrypt or decrypt the data transmitted into the secure area of ​​the confidential computing environment, including a data encryption unit and a data decryption unit, wherein the data encryption unit is responsible for encrypting the plaintext data in the secure area, and the data decryption unit is responsible for decrypting the ciphertext data in the secure area. The specific process is as follows:

[0026] S31: The information processing module receives the data storage key KEY sent by the key generation module data ;

[0027] S32: The external space transmits the to-be-processed data m to the information processing module in the secure zone of the confidential computing environment;

[0028] S33: The information processing module stores the data key KEY data The national secret algorithm SM4 function is passed as a parameter to encrypt or decrypt the data m to obtain the processed data m';

[0029] S34: The information processing module returns the processed data m' to the user.

[0030] Further, as a preferred implementation, the above-mentioned key destruction module, after the data storage key is no longer used, the confidential computing security environment security zone destroys the user information involved in the key calculation and the data storage key that has been used up, including a user information destruction unit and a key destruction unit, wherein the user information destruction unit is responsible for destroying the information of the user participating in the key calculation, and the key destruction unit is responsible for destroying the encryption key that has been used up. The specific process is as follows:

[0031] S41: The confidential computing environment security zone destroys the received user ID and password PW;

[0032] S42: Destroy the encryption key KEY in the secure area of ​​the confidential computing environment data .

[0033] The above work implements a key security management scheme based on confidential computing, which ultimately reduces the security risk of key attacks and the performance overhead caused by key import and query, and can be used as a key management system implementation plan in cryptographic technology application scenarios.

[0034] The present invention has at least the following technical effects or advantages:

[0035] 1. The present invention reduces the security risk of key attacks by converting the "storage state" of the key into a "computation state", so that the key is calculated and generated in a secure area of ​​a confidential computing environment, thereby avoiding the leakage of random numbers used to generate the key and preventing the key from being attacked by internal privileges and cracked by external brute force guessing.

[0036] 2. The present invention avoids the overhead of key import, protection and query. By converting the overhead of key import, protection and query into a smaller key calculation overhead, it reduces the overall overhead while ensuring the security of the key, thereby improving the practicality of the system.

[0037] In summary, the present invention can effectively reduce the security risks of key management and the performance overhead caused by key import, management and query, and realize a new key security management solution that improves key security while reducing overall overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 The overall architecture diagram of the present invention is as follows

[0039] Figure 2 Key generation module flow chart Specific implementation methods

[0041] In order to make the purpose, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described below in conjunction with the accompanying drawings.

[0042] Please refer to Figure 1 The present invention provides a key security management solution based on confidential computing, including a user request module, a key generation module, an information processing module, and a key destruction module.

[0043] The user request module includes: a user information receiving unit and an identity authentication unit.

[0044] The key generation module includes: a user information acquisition unit and a key calculation unit.

[0045] The information processing module includes: a data encryption unit and a data decryption unit.

[0046] The key destruction module includes: a user information destruction unit and a key destruction unit.

[0047] Further, as a preferred implementation scheme, the user request module receives the user's identity information after receiving the user's request, and uses the received identity information to authenticate the user, and determines whether the user is a legitimate user of the key management system, including a user information receiving unit and an identity authentication unit, wherein the user information receiving unit is responsible for receiving the user's identification information for identity authentication, and the identity authentication unit is responsible for authenticating the user's identity using the received information. The specific process is as follows:

[0048] S11: The user initiates an identity authentication request to the system;

[0049] S12: The user transmits identity information to the system;

[0050] S13: The system receives user identity information;

[0051] S14: The system uses the user identity information to authenticate the user and determine whether the user is a legitimate user.

[0052] Further, as a preferred implementation, the above-mentioned key generation module, after the user identity authentication is passed, the security zone of the confidential computing environment obtains the user's relevant information and combines it with the master key stored in the security zone to perform a series of calculations to obtain the key, including a user information acquisition unit and a key calculation unit, wherein the user information acquisition unit is responsible for obtaining the relevant information of the user participating in subsequent calculations, and the key calculation unit is responsible for calculating and generating the key. Please refer to Figure 2 , the specific process is as follows:

[0053] S21: The system sends the user ID and password PW to the confidential computing environment security zone;

[0054] S22: The confidential computing environment security zone sends the received user ID and password PW to the key generation module;

[0055] S23: The user information acquisition unit of the key generation module in the confidential computing environment security zone receives the user ID and password PW, and sends the acquired information to the key calculation unit;

[0056] S24: The key calculation unit calculates the XOR value of the user ID and the password PW

[0057] S25: The key calculation unit calculates the hash value of the XOR value X to obtain the user's pseudonym

[0058] S26: The key calculation unit calculates the user's pseudonym PID and the security zone master key KEY enclave XOR value of

[0059] S27: The key calculation unit calculates the hash value of the XOR value Y, and intercepts the first 16 bits of the hash value to obtain the data storage key

[0060] S28: The key generation module stores the data key KEY data Sent to the information processing module.

[0061] Further, as a preferred implementation scheme, the above-mentioned information processing module uses the calculated data storage key to encrypt or decrypt the data transmitted into the secure area of ​​the confidential computing environment, including a data encryption unit and a data decryption unit, wherein the data encryption unit is responsible for encrypting the plaintext data in the secure area, and the data decryption unit is responsible for decrypting the ciphertext data in the secure area. The specific process is as follows:

[0062] S31: The information processing module receives the data storage key KEY sent by the key generation module data ;

[0063] S32: The external space transmits the to-be-processed data m to the information processing module in the secure zone of the confidential computing environment;

[0064] S33: The information processing module stores the data key KEY data The national secret algorithm SM4 function is passed as a parameter to encrypt or decrypt the data m to obtain the processed data m';

[0065] S34: The information processing module returns the processed data m' to the user.

[0066] Further, as a preferred implementation, the above-mentioned key destruction module, after the data storage key is no longer used, the confidential computing security environment security zone destroys the user information involved in the key calculation and the data storage key that has been used up, including a user information destruction unit and a key destruction unit, wherein the user information destruction unit is responsible for destroying the information of the user participating in the key calculation, and the key destruction unit is responsible for destroying the encryption key that has been used up. The specific process is as follows:

[0067] S41: The confidential computing environment security zone destroys the received user ID and password PW;

[0068] S42: Destroy the encryption key KEY in the secure area of ​​the confidential computing environment data .

[0069] In summary, a key security management scheme based on confidential computing described in the present invention is completed. The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. However, once a person skilled in the art knows the basic creative concept, he or she may make additional changes and modifications to these operational embodiments. Therefore, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A key security management scheme based on confidential computing, characterized by: It includes a user request module, a key generation module, an information processing module, and a key destruction module; The user request module includes: a user information receiving unit, an identity authentication unit; The key generation module includes: a user information acquisition unit and a key calculation unit; The information processing module includes: a data encryption unit and a data decryption unit; The key destruction module includes: a user information destruction unit and a key destruction unit.

2. A key security management scheme based on confidential computing according to claim 1, characterized in that: The user request module receives the user's identity information after receiving the user's request, and uses the received identity information to authenticate the user, and determines whether the user is a legitimate user of the key management system. It includes a user information receiving unit and an identity authentication unit, wherein the user information receiving unit is responsible for receiving the user's identification information for identity authentication, and the identity authentication unit is responsible for authenticating the user's identity using the received information. The specific process is as follows: S11: The user initiates an identity authentication request to the system; S12: The user transmits identity information to the system; S13: The system receives user identity information; S14: The system uses the user identity information to authenticate the user and determine whether the user is a legitimate user.

3. A key security management scheme based on confidential computing according to claim 1, characterized in that: The key generation module, after the user identity authentication is passed, the security zone of the confidential computing environment obtains the user's relevant information and combines it with the master key stored in the security zone to perform a series of calculations to obtain the key, including a user information acquisition unit and a key calculation unit, wherein the user information acquisition unit is responsible for obtaining the relevant information of the user participating in the subsequent calculation, and the key calculation unit is responsible for calculating and generating the key. The specific process is as follows: S21: The system sends the user ID and password PW to the confidential computing environment security zone; S22: The confidential computing environment security zone sends the received user ID and password PW to the key generation module; S23: The user information acquisition unit of the key generation module in the confidential computing environment security zone receives the user ID and password PW, and sends the acquired information to the key calculation unit; S24: The key calculation unit calculates the XOR value of the user ID and the password PW S25: The key calculation unit calculates the hash value of the XOR value X to obtain the user's pseudonym S26: The key calculation unit calculates the user's pseudonym PID and the security zone master key KEY enclav XOR value of e S27: The key calculation unit calculates the hash value of the XOR value Y, and intercepts the first 16 bits of the hash value to obtain the data storage key S28: The key generation module stores the data key KEY data Sent to the information processing module.

4. A key security management scheme based on confidential computing according to claim 1, characterized in that: The information processing module uses the calculated data storage key to encrypt or decrypt the data transmitted into the secure area of ​​the confidential computing environment, including a data encryption unit and a data decryption unit, wherein the data encryption unit is responsible for encrypting the plaintext data in the secure area, and the data decryption unit is responsible for decrypting the ciphertext data in the secure area. The specific process is as follows: S31: The information processing module receives the data storage key KEY sent by the key generation module data ; S32: The external space transmits the to-be-processed data m to the information processing module in the secure zone of the confidential computing environment; S33: The information processing module stores the data key KEY data The national secret algorithm SM4 function is passed as a parameter to encrypt or decrypt the data m to obtain the processed data m′; S34: The information processing module returns the processed data m′ to the user.

5. A key security management scheme based on confidential computing according to claim 1, characterized in that: The key destruction module, after the data storage key is no longer used, destroys the user information involved in the key calculation and the data storage key that has been used up in the confidential computing security environment security zone, and includes a user information destruction unit and a key destruction unit, wherein the user information destruction unit is responsible for destroying the information of the user involved in the key calculation, and the key destruction unit is responsible for destroying the encryption key that has been used up. The specific process is as follows: S41: The confidential computing environment security zone destroys the received user ID and password PW; S42: Destroy the encryption key KEY in the secure area of ​​the confidential computing environment data .

Images