A key security management system based on confidential computing

Abstract

The present invention discloses a key security management system based on confidential computing. Based on a confidential computing environment, the system transforms the key from the original "storage state" to the "computation state", and transforms the original "one-time one-password" into the existing "one-time one-computation", thereby optimizing the existing key management system. The system includes a user request module, a key generation module, an information processing module and a key destruction module. The user request module includes a user information receiving unit and an identity authentication unit. The key generation module includes a user information acquisition unit and a key calculation unit. The information processing module includes a data encryption unit and a data decryption unit. The key destruction module includes a user information destruction unit and a key destruction unit. The present invention combines confidential computing technology with key management, transforms the key from the original "storage state" to the "computation state", enhances the security of the key, and reduces the cost of key management.

Description

Technical Field

[0001] The present invention relates to the field of confidential computing, and specifically designs a key security management system based on confidential computing. Background Art

[0002] With the development of the internet, vast amounts of information are transmitted and exchanged over networks, much of which involves user privacy and interests. Therefore, it's crucial to consider the potential for fraud and other insecurity risks. Therefore, security becomes crucial. Currently, cryptographic technologies, such as digital signatures and encryption / decryption, are commonly used to protect information. Because cryptographic systems are public, the core of information protection lies in the protection of encryption keys. If a key is lost or corrupted, attackers could potentially compromise or steal critical information, threatening system security.

[0003] Key management systems have emerged to prevent key loss or errors, which could compromise user information. A key management system is a crucial component of information security. It's an integrated information security solution encompassing key generation, loading, distribution, storage, updates, backup, recovery, and destruction. Its core goal is to ensure the security and availability of keys to support various security applications and protocols, such as data encryption and decryption, identity authentication, and digital signatures.

[0004] However, existing key management systems have the following problems: there is no way to guarantee the security of random numbers used to generate keys in memory and computing environments; the management costs of key import and protection are high; it takes too long to import a complete key; key backups are vulnerable to internal privileged attacks and can be easily cracked by external brute force guessing; and when the number of users is huge, the time cost of key queries is enormous.

[0005] To address the above-mentioned problems with the existing key management system, we proposed a key security management solution based on confidential computing. With the help of confidential computing technology, we transformed the key from the original "storage state" to the "computation state", and transformed the original "one-time one-key" into the current "one-time one-computation", solving the security and performance problems of the above-mentioned existing key management system. Summary of the Invention

[0006] In order to solve the above problems, the present invention provides a key security management system based on confidential computing, including a user request module, a key generation module, an information processing module, and a key destruction module;

[0007] The user request module includes: a user information receiving unit, an identity authentication unit;

[0008] The key generation module includes: a user information acquisition unit and a key calculation unit;

[0009] In the above-mentioned key generation module, after the user identity authentication is passed, the secure zone of the confidential computing environment obtains the user's relevant information and combines it with the master key stored in the secure zone to perform a series of calculations to obtain the key. The user information acquisition unit is responsible for obtaining the relevant information of the user participating in subsequent calculations, and the key calculation unit is responsible for calculating and generating the key. The specific process is as follows:

[0010] S21: The system sends the user ID and password PW to the confidential computing environment security zone;

[0011] S22: The confidential computing environment security zone sends the received user ID and password PW to the key generation module;

[0012] S23: The user information acquisition unit of the key generation module in the confidential computing environment security zone receives the user ID and password PW and sends the acquired information to the key calculation unit;

[0013] S24: The key calculation unit calculates the XOR value of the user ID and the password PW

[0014] S25: The key calculation unit calculates the hash value of the XOR value m to obtain the user's pseudonym

[0015] S26: The key calculation unit calculates the user's pseudonym PID and the security zone master key KEY enclave XOR value of

[0016] S27: The key calculation unit calculates the hash value of the XOR value Y and intercepts the first 16 bits of the hash value to obtain the data storage key

[0017] S28: The key generation module stores the data key KEY data Send to the information processing module;

[0018] The above-mentioned information processing module includes: a data encryption unit and a data decryption unit;

[0019] The key destruction module includes: a user information destruction unit and a key destruction unit.

[0020] Furthermore, as a preferred key management system, the user request module, upon receiving a user request, receives the user's identity information and uses the received identity information to authenticate the user and determine whether the user is a legitimate user of the key management system. The module includes a user information receiving unit and an identity authentication unit. The user information receiving unit is responsible for receiving the user's identity information for identity authentication, and the identity authentication unit is responsible for authenticating the user's identity using the received information. The specific process is as follows:

[0021] S11: The user initiates an identity authentication request to the system;

[0022] S12: The user transmits identity information to the system;

[0023] S13: The system receives user identity information;

[0024] S14: The system uses the user identity information to authenticate the user and determine whether the user is a legitimate user.

[0025] Furthermore, as a preferred key management system, the above-mentioned information processing module uses the calculated data storage key to encrypt or decrypt data transmitted into the secure zone of the confidential computing environment. It includes a data encryption unit and a data decryption unit. The data encryption unit is responsible for encrypting the plaintext data in the secure zone, and the data decryption unit is responsible for decrypting the ciphertext data in the secure zone. The specific process is as follows:

[0026] S31: The information processing module receives the data storage key KEY sent by the key generation module data ;

[0027] S32: The external space transmits the data to be processed m to the information processing module in the secure zone of the confidential computing environment;

[0028] S33: The information processing module stores the data key KEY data The national secret algorithm SM4 function is passed as a parameter to encrypt or decrypt the data to be processed m to obtain the processed data m';

[0029] S34: The information processing module returns the processed data m' to the user.

[0030] Furthermore, as a preferred key management system, the key destruction module mentioned above destroys the user information generated by key calculation in the confidential computing security environment security zone after the data storage key is no longer used, and destroys the data storage key that has been used. It includes a user information destruction unit and a key destruction unit. The user information destruction unit is responsible for destroying the user information involved in key calculation, and the key destruction unit is responsible for destroying the encryption key that has been used. The specific process is as follows:

[0031] S41: The confidential computing environment security zone destroys the received user ID and password PW;

[0032] S42: Destroy the encryption key KEY in the confidential computing environment security zone data .

[0033] The above work implements a key security management system based on confidential computing, which ultimately reduces the security risks of key attacks and the performance overhead caused by key import and query. It can be used as an implementation example of a key management system in cryptographic technology application scenarios.

[0034] The present invention has at least the following technical effects or advantages:

[0035] 1. The present invention reduces the security risk of key attacks by converting the "storage state" of the key to the "computation state", so that the key is calculated and generated in the security zone of the confidential computing environment, avoiding the leakage of the random number used to generate the key, and preventing the key from being attacked by internal privileges and cracked by external brute force guessing.

[0036] 2. The present invention avoids the overhead of key import, protection and query by converting the overhead of key import, protection and query into a smaller key calculation overhead. It reduces the overall overhead while ensuring the security of the key and improves the practicality of the system.

[0037] In summary, the present invention can effectively reduce the security risks of key management and the performance overhead caused by key import, management and query, and realize a new key security management solution that improves key security while reducing overall overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 The overall architecture diagram of the system of the present invention

[0039] Figure 2 Key generation module flow chart Specific implementation methods

[0040] In order to make the purpose, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0041] Please refer to Figure 1 The present invention provides a key security management system based on confidential computing, including a user request module, a key generation module, an information processing module, and a key destruction module.

[0042] The user request module includes: a user information receiving unit and an identity authentication unit.

[0043] The key generation module includes: a user information acquisition unit and a key calculation unit.

[0044] The key generation module, after the user identity authentication is passed, the security zone of the confidential computing environment obtains the user's relevant information and combines it with the master key stored in the security zone to perform a series of calculations to obtain the key. The user information acquisition unit is responsible for obtaining the relevant information of the user participating in subsequent calculations, and the key calculation unit is responsible for calculating and generating the key. Please refer to Figure 2 The specific process is as follows:

[0045] S21: The system sends the user ID and password PW to the confidential computing environment security zone;

[0046] S22: The confidential computing environment security zone sends the received user ID and password PW to the key generation module;

[0047] S23: The user information acquisition unit of the key generation module in the confidential computing environment security zone receives the user ID and password PW and sends the acquired information to the key calculation unit;

[0048] S24: The key calculation unit calculates the XOR value of the user ID and the password PW

[0049] S25: The key calculation unit calculates the hash value of the XOR value X to obtain the user's pseudonym

[0050] S26: The key calculation unit calculates the user's pseudonym PID and the security zone master key KEY enclave XOR value of

[0051] S27: The key calculation unit calculates the hash value of the XOR value Y and intercepts the first 16 bits of the hash value to obtain the data storage key

[0052] S28: The key generation module stores the data key KEY data Send to the information processing module;

[0053] The information processing module includes: a data encryption unit and a data decryption unit.

[0054] The key destruction module includes: a user information destruction unit and a key destruction unit.

[0055] Furthermore, as a preferred key management system, the user request module, upon receiving a user request, receives the user's identity information and uses the received identity information to authenticate the user and determine whether the user is a legitimate user of the key management system. The module includes a user information receiving unit and an identity authentication unit. The user information receiving unit is responsible for receiving the user's identity information for identity authentication, and the identity authentication unit is responsible for authenticating the user's identity using the received information. The specific process is as follows:

[0056] S11: The user initiates an identity authentication request to the system;

[0057] S12: The user transmits identity information to the system;

[0058] S13: The system receives user identity information;

[0059] S14: The system uses the user identity information to authenticate the user and determine whether the user is a legitimate user.

[0060] Furthermore, as a preferred key management system, the above-mentioned information processing module uses the calculated data storage key to encrypt or decrypt data transmitted into the secure zone of the confidential computing environment. It includes a data encryption unit and a data decryption unit. The data encryption unit is responsible for encrypting the plaintext data in the secure zone, and the data decryption unit is responsible for decrypting the ciphertext data in the secure zone. The specific process is as follows:

[0061] S31: The information processing module receives the data storage key KEY sent by the key generation module data ;

[0062] S32: The external space transmits the data to be processed m to the information processing module in the secure zone of the confidential computing environment;

[0063] S33: The information processing module stores the data key KEY data The national secret algorithm SM4 function is passed as a parameter to encrypt or decrypt the data to be processed m to obtain the processed data m';

[0064] S34: The information processing module returns the processed data m' to the user.

[0065] Furthermore, as a preferred key management system, the key destruction module mentioned above destroys the user information generated by key calculation in the confidential computing security environment security zone after the data storage key is no longer used, and destroys the data storage key that has been used. It includes a user information destruction unit and a key destruction unit. The user information destruction unit is responsible for destroying the user information involved in key calculation, and the key destruction unit is responsible for destroying the encryption key that has been used. The specific process is as follows:

[0066] S41: The confidential computing environment security zone destroys the received user ID and password PW;

[0067] S42: Destroy the encryption key KEY in the confidential computing environment security zone data .

[0068] In summary, the present invention has completed the key security management system based on confidential computing. The above description is merely a preferred embodiment of the present invention and does not limit the present invention. However, once those skilled in the art understand the basic inventive concepts, they may make additional changes and modifications to these operational embodiments. Therefore, any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A key security management system based on confidential computing, characterized by: The system includes a user request module, a key generation module, an information processing module, and a key destruction module; The user request module includes: a user information receiving unit, an identity authentication unit; The key generation module includes: a user information acquisition unit and a key calculation unit; In the key generation module, after the user identity is authenticated, the secure zone of the confidential computing environment obtains the user's relevant information and performs a series of calculations based on the master key stored in the secure zone to obtain the key. The user information acquisition unit is responsible for obtaining the relevant information of the user participating in subsequent calculations, and the key calculation unit is responsible for calculating and generating the key. The specific process is as follows: S21: The system sends the user ID and password PW to the confidential computing environment security zone; S22: The confidential computing environment security zone sends the received user ID and password PW to the key generation module; S23: The user information acquisition unit of the key generation module in the confidential computing environment security zone receives the user ID and password PW and sends the acquired information to the key calculation unit; S24: The key calculation unit calculates the XOR value of the user ID and the password PW S25: The key calculation unit calculates the hash value of the XOR value X to obtain the user's pseudonym S26: The key calculation unit calculates the XOR value of the user's pseudonym PID and the security zone master key KEYenclave S27: The key calculation unit calculates the hash value of the XOR value Y and intercepts the first 16 bits of the hash value to obtain the data storage key S28: The key generation module stores the data key KEY data Send to the information processing module; The information processing module includes: a data encryption unit and a data decryption unit; The key destruction module includes: a user information destruction unit and a key destruction unit.

2. A key security management system based on confidential computing according to claim 1, characterized in that: The user request module receives the user's identity information after receiving the user's request, and uses the received identity information to authenticate the user and determine whether the user is a legitimate user of the key security management system. The user request module includes a user information receiving unit and an identity authentication unit. The user information receiving unit is responsible for receiving the user's identification information for identity authentication, and the identity authentication unit is responsible for authenticating the user's identity using the received information. The specific process is as follows: S11: The user initiates an identity authentication request to the system; S12: The user transmits identity information to the system; S13: The system receives user identity information; S14: The system uses the user identity information to authenticate the user and determine whether the user is a legitimate user.

3. A key security management system based on confidential computing according to claim 1, characterized in that: The information processing module uses the calculated data storage key to encrypt or decrypt data transmitted into the secure area of the confidential computing environment. It includes a data encryption unit and a data decryption unit. The data encryption unit is responsible for encrypting the plaintext data in the secure area, and the data decryption unit is responsible for decrypting the ciphertext data in the secure area. The specific process is as follows: S31: The information processing module receives the data storage key KEY sent by the key generation module data ; S32: The external space transmits the data to be processed m to the information processing module in the secure zone of the confidential computing environment; S33: The information processing module stores the data key KEY data The national secret algorithm SM4 function is passed as a parameter to encrypt or decrypt the data to be processed m to obtain the processed data m'; S34: The information processing module returns the processed data m' to the user.

4. A key security management system based on confidential computing according to claim 1, characterized in that: The key destruction module, after the data storage key is no longer used, destroys the user information generated by the key calculation in the confidential computing security environment security zone and destroys the data storage key that has been used. It includes a user information destruction unit and a key destruction unit, wherein the user information destruction unit is responsible for destroying the information of the user participating in the key calculation, and the key destruction unit is responsible for destroying the encryption key that has been used. The specific process is as follows: S41: The confidential computing environment security zone destroys the received user ID and password PW; S42: The confidential computing environment security zone destroys the encryption key KEYdata.

Images