Hardware cryptographic module based on domestic commercial cryptographic algorithm and implementation method thereof

Abstract

The invention discloses a hardware cryptographic module based on a domestic commercial cryptographic algorithm and an implementation method of the hardware cryptographic module. The hardware cryptographic module comprises a security chip, a central control unit, a memory unit, a key management module, an encryption and decryption module, a multi-interface support unit, a bus interface unit and an indicator light module, the implementation method comprises the following steps: activating multi-layer encryption when a module is started, verifying the integrity of a master key through an SM3 algorithm, and ensuring the secure storage and management of the key; generating a session key by using an SM2 algorithm, and distributing the session key through a secure channel; performing multi-level encryption and decryption operation on the data, and introducing multiple authentication in key access; according to the invention, through multilayer encryption and multi-factor authentication, the security of key management is significantly enhanced, and through optimizing encryption and decryption processes and hardware configuration, the problem of performance bottleneck in a high-load environment is effectively solved, and efficient and safe operation of the system in a complex application scene is ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security cryptographic technology, and in particular to a hardware cryptographic module based on a domestic commercial cryptographic algorithm and an implementation method thereof. Background Art

[0002] The two basic requirements for computer network information security are confidentiality and integrity. Cryptography technology is the basis of network security communication. By encrypting the communication content, unauthorized persons cannot understand its true meaning, so as to prevent passive attacks such as eavesdropping and ensure the confidentiality of information. The authentication of the application of cryptographic system can prevent active attacks on the transmitted information such as tampering and accidental destruction, so as to maintain the integrity of data.

[0003] The Chinese patent publication (publication number CN116015646A) discloses a hardware cryptographic module based on a domestic commercial cryptographic algorithm and its implementation method, which includes a hardware part and a software part; the hardware part includes a security chip, a central control unit, a flash, a BOOT flash, a USB interface, a DDRAM, a power supply, an RJ45 interface, a bus interface unit and a cryptographic module operation indicator light; the software part includes an interface processing module, a key management module and a driver module;

[0004] Although the above patent has mentioned that the key is permanently stored in the security chip and the private key is encrypted based on the SM2 algorithm, in actual operation, there are still potential security risks. For example, if there are defects in the physical security or internal security of the security chip, the key information may be leaked, resulting in a reduction in the overall security of the system;

[0005] In addition, regarding performance bottlenecks and processing efficiency issues, although the above-mentioned patent uses a symmetric encryption algorithm to reduce data processing latency, in high-load or complex network environments, the existing hardware configuration may become a bottleneck for the system. For example, under high-frequency encryption and decryption operations, the processing power of the central control unit and storage unit may not be sufficient to maintain efficient operation, resulting in decreased system performance.

[0006] Based on this, a hardware cryptographic module based on a domestic commercial cryptographic algorithm and its implementation method are needed. Summary of the invention

[0007] To achieve the above-mentioned purpose, the present invention provides the following solution: a hardware cryptographic module based on a domestic commercial cryptographic algorithm and an implementation method thereof, the hardware cryptographic module comprising:

[0008] Security chip: configured with side-channel attack resistance and built-in multi-layer encryption for key encryption. The security chip is used to store the master key, which is used to encrypt and manage the subordinate working keys;

[0009] Central control unit: equipped with a high-performance processor for handling encryption and decryption operations, and supporting dynamic resource allocation and high-load management;

[0010] Memory unit: including high-speed dynamic random access memory (DDR) and solid-state drive (SSD), used to cache frequently accessed data to increase processing speed;

[0011] Key management module: implements regular updates of working keys and key lifecycle management. The module supports multi-factor authentication strategies, combining user-set passwords, biometric features, and physical tokens to access and operate keys.

[0012] Encryption and decryption module: It uses domestic commercial encryption algorithms SM2, SM3 and SM4 to implement data encryption and decryption operations. The SM4 algorithm is used to negotiate and generate session keys for communication data encryption, the SM2 algorithm is used to generate encryption and decryption session keys, and the SM3 algorithm is used to ensure the integrity of the module software program and security policy files;

[0013] Multi-interface support unit: including USB interface, RJ45 network interface, bus interface, to achieve the connection between the module and external devices and networks;

[0014] Bus interface unit: realizes data exchange between the security chip and the central control unit and memory unit;

[0015] Indicator module: including the password module operation indicator light, used to display the module status and operation feedback;

[0016] The implementation steps include:

[0017] S1. When the hardware cryptographic module is started, the multi-layer encryption in the security chip is activated, including hardware-level encryption of the master key and hierarchical encryption protection of the working key. The integrity of the master key is verified by the SM3 algorithm to ensure that it has not been tampered with, and a secure and trusted basic environment is established to prepare for subsequent key management and data encryption and decryption operations;

[0018] S2. After the security chip is successfully initialized, the central control unit generates encryption and decryption session keys based on the SM2 algorithm. The master key is used to generate the session key. The generated session key is distributed to each key storage unit through an encrypted secure channel. The key management module also regularly updates the working key according to the preset update cycle of the security policy file.

[0019] S3. Once the data is received in the key management module, the encryption and decryption process is started immediately. The key management module calls the SM4 algorithm, uses the session key to encrypt the data, converts it into ciphertext, and transmits it to the external device through the bus interface. After receiving the encrypted data, the key management module uses the same session key and the SM4 algorithm to decrypt, restore the ciphertext to plaintext, and transmits it to the target device through the RJ45 network interface;

[0020] S4. When performing operations involving key access and management, the user needs to pass multiple authentications, including password input, biometric information, and hardware tokens, to verify the legitimacy of the identity. The central control unit verifies the authentication information after receiving it. Only when all the information is verified can the user access and operate the key;

[0021] S5. After the hardware cryptographic module is started, the central control unit reads and imports the security policy by reading the security policy file from the key storage unit, which includes the session key update period and authentication method, and regularly triggers key update and performs identity authentication according to the imported policy.

[0022] Furthermore, when the security chip is started, the master key is encrypted at the hardware level, including encrypting the master key using a dedicated encryption hardware module inside the chip and storing it in a protected area of ​​the chip. The protected area is tamper-proof, and any unauthorized access attempt will trigger the chip to self-destruct;

[0023] On the basis of secure storage of the master key, the working key is encrypted using the master key to form an initially encrypted working key. The encrypted working key is then re-encrypted using a different encryption algorithm and cannot be used directly without the corresponding decryption steps.

[0024] Furthermore, after the security chip is initialized, the SM3 algorithm is automatically called to perform integrity verification on the master key stored in the chip. By calculating and comparing the hash value of the master key, it is detected whether the master key has been tampered with or damaged during storage and use. To ensure the long-term security of the master key, the SM3 algorithm is repeatedly called for integrity verification each time the hardware cryptographic module is started.

[0025] Furthermore, a dedicated hardware isolation unit is set inside the hardware cryptographic module, which physically isolates the generation and distribution process of the session key from other system operations to prevent unauthorized access or interference; in the process of transmitting the session key from the generation unit to each key storage unit, an end-to-end encryption algorithm is used to encrypt the transmission data, which enables the session key to remain encrypted throughout the entire transmission path. Even if the communication channel is attacked, the attacker cannot directly obtain or decrypt the session key.

[0026] Furthermore, in the data encryption and decryption in step S3, the SM4 algorithm is used to perform the initial encryption on the encrypted data to convert the original data into ciphertext. After the initial encryption is completed, the generated session key is further used to perform secondary encryption on the encrypted data. The main purpose of the secondary encryption is to provide an additional layer of protection during data transmission. Even if an attacker can intercept the encrypted data in transmission, due to the complexity of multiple layers of encryption, the attacker cannot directly restore the original data through a single decryption.

[0027] Furthermore, the secondary encryption operation of the SM4 algorithm is further defined as, before the data packet is transmitted to the external device, the data packet is encrypted multiple times using a session key, and each encryption operation uses a different session key or encryption parameter to form a multi-level encryption structure. When decrypting on the receiving device, it is decrypted layer by layer in reverse order according to the encryption order, so that the information will not be leaked during the transmission process due to the cracking of a certain layer of encryption.

[0028] Furthermore, in the multi-factor authentication process of S4, a one-time password (OTP) generated by a hardware token is used as an additional means of authentication. The OTP is dynamically generated by the hardware token and generates a unique password for each authentication. After entering the password and providing biometric information, the user must enter the OTP to complete the authentication.

[0029] Furthermore, the reading and importing of the security policy file in S5 is further limited to not only reading the existing security policy file in the storage unit each time the system is started, but also being able to obtain and import the latest security policy through online updating or automatic updating of preset policy files.

[0030] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0031] First, the present invention performs hardware-level encryption protection on the master key by activating multi-layer encryption when the hardware password module is started, ensuring both physical and logical protection of the key; in addition, the security of key management is further enhanced by using a multi-factor authentication strategy, including password input, biometric information, and a one-time password (OTP) generated by a hardware token; only fully verified users can access and operate the key, effectively preventing unauthorized access or key leakage;

[0032] 2. The present invention optimizes the encryption and decryption process by adopting a layered encryption strategy and combining the configuration of a high-performance processor and a high-speed memory unit. When encrypting data, the SM4 algorithm is first used for initial encryption, and then the session key is used for secondary encryption. The multi-level encryption structure not only improves the security of the data, but also reduces the performance bottleneck caused by a single encryption algorithm. In addition, hardware isolation technology is combined with end-to-end encryption to ensure that the generation and distribution of session keys are carried out in an isolated secure environment to prevent unauthorized interference or data leakage, further improving the processing efficiency and security of the system in complex environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 It is a flow chart of the steps of the present invention. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0037] Example

[0038] like Figure 1 As shown, in this embodiment, a hardware cryptographic module based on a domestic commercial cryptographic algorithm and its implementation method, the hardware cryptographic module includes:

[0039] Security chip: It is equipped with the ability to resist side-channel attacks and has built-in multi-layer encryption for key encryption. The security chip is used to store the master key, which is used to encrypt and manage the subordinate working keys;

[0040] Central control unit: equipped with a high-performance processor for handling encryption and decryption operations, and supporting dynamic resource allocation and high-load management;

[0041] Memory unit: including high-speed dynamic random access memory (DDR) and solid-state drive (SSD), used to cache frequently accessed data to increase processing speed;

[0042] Key management module: implements regular updates of working keys and key lifecycle management. The module supports multi-factor authentication strategies, combining user-set passwords, biometric features, and physical tokens to access and operate keys.

[0043] Encryption and decryption module: It uses domestic commercial encryption algorithms SM2, SM3 and SM4 to implement data encryption and decryption operations. The SM4 algorithm is used to negotiate and generate session keys for communication data encryption, the SM2 algorithm is used to generate encryption and decryption session keys, and the SM3 algorithm is used to ensure the integrity of the module software program and security policy files;

[0044] Multi-interface support unit: including USB interface, RJ45 network interface, bus interface, to achieve the connection between the module and external devices and networks;

[0045] Bus interface unit: realizes data exchange between the security chip and the central control unit and memory unit;

[0046] Indicator module: including the password module operation indicator light, used to display the module status and operation feedback;

[0047] The implementation steps include:

[0048] S1. When the hardware password module is started, the multi-layer encryption in the security chip is activated; specifically, the master key is encrypted at the hardware level, and the master key is encrypted by the dedicated encryption hardware module inside the chip, and stored in the protected area of ​​the chip. The area adopts a tamper-proof design, and any unauthorized access attempt will trigger the chip to self-destruct; on the basis of the secure storage of the master key, the working key is encrypted for the first time using the master key, and then the encrypted working key is encrypted again using different encryption algorithms, and it cannot be used directly without the corresponding decryption steps; the integrity of the master key is verified by the SM3 algorithm, and the hash value of the master key is calculated and compared to ensure that the key has not been tampered with or damaged, and this verification is repeated at each startup to continuously verify the security of the key;

[0049] By activating the multi-layer encryption in the security chip when the hardware password module is started, the system ensures the dual physical and logical protection of the master key; the master key storage security is guaranteed through hardware-level encryption and tamper-proof design; then, the master key is used for the initial and secondary encryption of the working key to further improve the security of the key; the integrity check using the SM3 algorithm continuously monitors the integrity of the key to prevent tampering or damage; this whole set ensures the high security and reliability of key management;

[0050] S2. After the security chip is successfully initialized, the central control unit generates encryption and decryption session keys based on the SM2 algorithm. The master key is used to generate these session keys. The generated session keys are distributed to each key storage unit through an encrypted secure channel. The implementation of the secure channel includes a hardware isolation unit to physically isolate the generation and distribution process of the session keys from other system operations to prevent unauthorized access or interference. At the same time, an end-to-end encryption algorithm is used to encrypt the transmission data so that the session key remains encrypted throughout the transmission path. Even if the communication channel is attacked, the attacker cannot directly obtain or decrypt the session key. In addition, the key management module regularly updates the working key according to the preset update cycle of the security policy file.

[0051] By generating session keys using the SM2 algorithm after the security chip is initialized and distributing them through a hardware-isolated and end-to-end encrypted secure channel, the system effectively prevents unauthorized access and potential attacks, ensuring the high confidentiality of session keys throughout the entire transmission process; in addition, the key management module regularly updates the working key according to the preset security policy, further enhancing the security and adaptability of the system in a dynamic environment; ensuring the high security and effectiveness of the key management process;

[0052] S3. In the key management module, once the data is received, the encryption and decryption process is immediately started; specifically, the process includes using the SM4 algorithm to perform the initial encryption on the encrypted data, converting the original data into ciphertext, and further using the generated session key to perform secondary encryption on the encrypted data after the initial encryption is completed; the main purpose of secondary encryption is to provide an additional layer of protection during data transmission. Even if an attacker can intercept the encrypted data in transmission, due to the complexity of multiple layers of encryption, the attacker cannot directly restore the original data through a single decryption; the secondary encryption operation is further defined as, before the data packet is transmitted to the external device, the data packet is encrypted multiple times using the session key, and each encryption operation uses a different session key or encryption parameter to form a multi-level encryption structure. When decrypting on the receiving device, the encryption is reversed layer by layer in the order of encryption to ensure that the information will not be leaked during the transmission process due to the cracking of a certain layer of encryption;

[0053] After receiving the data through the key management module, the encryption and decryption process is immediately started. First, the data is encrypted using the SM4 algorithm and converted into ciphertext. Then the encrypted data is re-encrypted using the session key. The secondary encryption uses a multi-level encryption structure to ensure that even if the data is intercepted during transmission, the attacker cannot directly restore the original data through a single decryption. Each encryption operation uses a different session key or encryption parameter, which further increases the difficulty of decryption. On the receiving device, the data is decrypted layer by layer in reverse order of encryption to ensure the integrity and security of the information, thereby providing high-intensity protection during transmission.

[0054] S4. When performing operations involving key access and management, users need to pass multiple authentications, including password input, biometric information, and hardware tokens, to verify the legitimacy of their identity. The central control unit will verify the authentication information after receiving it. Only when all the information is verified can the user access and operate the key;

[0055] S5. When performing operations involving key access and management, users are required to pass multiple authentications, including password input, biometric information, and a one-time password (OTP) generated by a hardware token as an additional means of identity verification to verify the legitimacy of their identity; the OTP is dynamically generated by the hardware token and generates a unique password for each authentication; the central control unit verifies the authentication information after receiving it, and only after all the information is verified can the user access and operate the key;

[0056] Security is greatly improved by introducing multiple authentications in operations involving key access and management. Users need to verify their identity by entering passwords, biometric information (such as fingerprints or irises), and one-time passwords (OTPs) generated by hardware tokens. After receiving these authentication information, the central control unit conducts a comprehensive verification. Only when all authentication information is verified can the user obtain access to and operate the key. This multi-level authentication measure effectively prevents unauthorized access and ensures the high security of key management.

[0057] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0058] The principles and implementation methods of the present invention are described in this article using specific examples. The description of the above embodiments is only used to help understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A hardware cryptographic module based on a domestic commercial cryptographic algorithm and an implementation method thereof, the hardware cryptographic module comprising: Security chip: configured with side-channel attack resistance and built-in multi-layer encryption for key encryption. The security chip is used to store the master key, which is used to encrypt and manage the subordinate working keys; Central control unit: equipped with a high-performance processor for handling encryption and decryption operations, and supporting dynamic resource allocation and high-load management; Memory unit: including high-speed dynamic random access memory (DDR) and solid-state drive (SSD), used to cache frequently accessed data to increase processing speed; Key management module: implements regular updates of working keys and key lifecycle management. The module supports multi-factor authentication strategies, combining user-set passwords, biometric features, and physical tokens to access and operate keys. Encryption and decryption module: It uses domestic commercial encryption algorithms SM2, SM3 and SM4 to implement data encryption and decryption operations. The SM4 algorithm is used to negotiate and generate session keys for communication data encryption, the SM2 algorithm is used to generate encryption and decryption session keys, and the SM3 algorithm is used to ensure the integrity of the module software program and security policy files; Multi-interface support unit: including USB interface, RJ45 network interface, bus interface, to achieve the connection between the module and external devices and networks; Bus interface unit: realizes data exchange between the security chip and the central control unit and memory unit; Indicator module: including the password module operation indicator light, used to display the module status and operation feedback; It is characterized by comprising the following implementation steps: S1. When the hardware cryptographic module is started, the multi-layer encryption in the security chip is activated, including hardware-level encryption of the master key and hierarchical encryption protection of the working key. The integrity of the master key is verified by the SM3 algorithm to ensure that it has not been tampered with, and a secure and trusted basic environment is established to prepare for subsequent key management and data encryption and decryption operations; S2. After the security chip is successfully initialized, the central control unit generates encryption and decryption session keys based on the SM2 algorithm. The master key is used to generate the session key. The generated session key is distributed to each key storage unit through an encrypted secure channel. The key management module also regularly updates the working key according to the preset update cycle of the security policy file. S3. Once the data is received in the key management module, the encryption and decryption process is started immediately. The key management module calls the SM4 algorithm, uses the session key to encrypt the data, converts it into ciphertext, and transmits it to the external device through the bus interface. After receiving the encrypted data, the key management module uses the same session key and the SM4 algorithm to decrypt, restore the ciphertext to plaintext, and transmits it to the target device through the RJ45 network interface; S4. When performing operations involving key access and management, the user needs to pass multiple authentications, including password input, biometric information, and hardware tokens, to verify the legitimacy of the identity. The central control unit verifies the authentication information after receiving it. Only when all the information is verified can the user access and operate the key; S5. After the hardware cryptographic module is started, the central control unit reads and imports the security policy by reading the security policy file from the key storage unit, which includes the session key update period and authentication method, and regularly triggers key update and performs identity authentication according to the imported policy.

2. According to claim 1, a hardware cryptographic module based on a domestic commercial cryptographic algorithm and its implementation method, characterized in that: When the security chip is started, the master key is encrypted at the hardware level, including using a dedicated encryption hardware module inside the chip to encrypt the master key and store it in a protected area of ​​the chip. The protected area is tamper-proof, and any unauthorized access attempt will trigger the chip to self-destruct; On the basis of secure storage of the master key, the working key is encrypted using the master key to form an initially encrypted working key. The encrypted working key is then re-encrypted using a different encryption algorithm and cannot be used directly without the corresponding decryption steps.

3. A hardware cryptographic module based on a domestic commercial cryptographic algorithm and its implementation method according to claim 2, characterized in that: After the security chip is initialized, the SM3 algorithm is automatically called to perform integrity check on the master key stored in the chip. By calculating and comparing the hash value of the master key, it is detected whether the master key has been tampered with or damaged during storage and use. To ensure the long-term security of the master key, the SM3 algorithm is repeatedly called for integrity check each time the hardware cryptographic module is started.

4. According to claim 1, a hardware cryptographic module based on a domestic commercial cryptographic algorithm and its implementation method, characterized in that: A dedicated hardware isolation unit is set inside the hardware cryptographic module, which physically isolates the generation and distribution process of the session key from other system operations to prevent unauthorized access or interference; in the process of transmitting the session key from the generation unit to each key storage unit, an end-to-end encryption algorithm is used to encrypt the transmission data. The encryption algorithm keeps the session key in an encrypted state throughout the entire transmission path. Even if the communication channel is attacked, the attacker cannot directly obtain or decrypt the session key.

5. According to claim 1, a hardware cryptographic module based on a domestic commercial cryptographic algorithm and its implementation method, characterized in that: In the data encryption and decryption in step S3, the SM4 algorithm is used to perform the initial encryption on the encrypted data to convert the original data into ciphertext. After the initial encryption is completed, the generated session key is further used to perform secondary encryption on the encrypted data. The main purpose of the secondary encryption is to provide an additional layer of protection during data transmission. Even if an attacker is able to intercept the encrypted data in transmission, due to the complexity of multiple layers of encryption, the attacker cannot directly restore the original data through a single decryption.

6. A hardware cryptographic module based on a domestically produced commercial cryptographic algorithm and its implementation method according to claim 5, characterized in that: The secondary encryption operation of the SM4 algorithm is further defined as, before the data packet is transmitted to the external device, the data packet is encrypted multiple times using a session key, and each encryption operation uses a different session key or encryption parameter to form a multi-level encryption structure. When decrypting on the receiving device, it is decrypted layer by layer in reverse order according to the encryption order, so that the information will not be leaked during the transmission process due to the cracking of a certain layer of encryption.

7. A hardware cryptographic module based on a domestic commercial cryptographic algorithm and its implementation method according to claim 1, characterized in that: In the multi-factor authentication process of S4, a one-time password (OTP) generated by a hardware token is used as an additional means of authentication. The OTP is dynamically generated by the hardware token and generates a unique password for each authentication. After entering the password and providing biometric information, the user must enter the OTP to complete the authentication.

8. A hardware cryptographic module based on a domestic commercial cryptographic algorithm and its implementation method according to claim 1, characterized in that: The reading and importing of the security policy file in S5 is further defined as not only reading the existing security policy file in the storage unit each time the system is started, but also being able to obtain and import the latest security policy through online updating or a preset policy file automatic update program.

Images