Key service method and device, and storage medium

Abstract

The embodiment of the invention provides a key service method and device and a storage medium, and belongs to the technical field of information security. The method is applied to a key core server, the key core server runs in a secure enclave, and the method comprises the following steps: establishing a secure communication channel with a client, and receiving a user password service request sent by the client through the secure communication channel; in response to the user password service request, generating an effective secondary key according to an effective root key pre-stored in the secure enclave, and executing an encryption service and a decryption service on the user password according to the effective secondary key; and returning the receipt information of the encryption service and the receipt information of the decryption service to the client through a secure communication channel. According to the embodiment of the invention, the security of the root key can be ensured, so that the leakage of user information protected by the root key is avoided.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a key service method, device and storage medium. Background Art

[0002] In modern public key infrastructure (PKI) systems, a multi-level key mechanism is often used. In this mechanism, the lower-level keys are protected by the upper-level keys, and the root key is the source of the multi-level key system. As the top-level key, any lower-level key must be directly or indirectly protected by the root key. Therefore, the security of the root key is the basis and guarantee of the security of the key system. However, since the root key is not protected by the upper-level key, the security protection is weak. If the root key is illegally obtained, the user information protected by the root key will be leaked, causing losses to the user.

[0003] Therefore, how to ensure the security of the root key to avoid leakage of user information protected by the root key has become a problem that needs to be solved urgently. Summary of the invention

[0004] The main purpose of the embodiments of the present invention is to provide a key service method, a key service device and a storage medium, aiming to solve the technical problem of how to ensure the security of the root key to avoid leakage of user information protected by the root key.

[0005] In a first aspect, an embodiment of the present invention provides a key service method, the method being applied to a key core server, the key core server running in a secure enclave, comprising:

[0006] Establishing a secure communication channel with a client, and receiving a user password service request sent by the client through the secure communication channel;

[0007] In response to the user password service request, generating a valid secondary key according to a valid root key pre-stored in the secure enclave, and performing encryption service and decryption service for the user password according to the valid secondary key;

[0008] The receipt information of the encryption service and the receipt information of the decryption service are returned to the client through the secure communication channel.

[0009] In a second aspect, an embodiment of the present invention further provides a key service device, comprising a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the steps of any one of the key service methods provided in the specification of the present invention are implemented.

[0010] In the third aspect, an embodiment of the present invention further provides a storage medium for computer-readable storage, characterized in that the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any key service method provided in the specification of the present invention.

[0011] The embodiment of the present invention provides a key service method, device and storage medium. The key service method is applied to a key core server. The key core server runs in a secure enclave. The key core server establishes a secure communication channel with a client and receives a user password service request sent by the client through the secure communication channel. In response to the user password service request, a valid secondary key is generated according to a valid root key pre-stored in the secure enclave, and encryption and decryption services for the user password are performed according to the valid secondary key. The receipt information of the encryption service and the receipt information of the decryption service are returned to the client through the secure communication channel. The key core server of the embodiment of the present invention runs in a secure enclave, and the valid root key is also pre-stored in the secure enclave. Only when the key core server establishes a secure communication channel with the client, the key core server will provide the client with encryption and decryption services of the user password based on the valid secondary key generated by the valid root key. Due to the reliable security of the secure enclave, the key core server and its interaction with the client, the security of the valid root key and the valid secondary key are all extremely reliably guaranteed, thereby ensuring the security of the user password. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0013] Figure 1 A schematic diagram of a key service method provided by an embodiment of the present invention;

[0014] Figure 2 A schematic diagram of the architecture of a root key security protection system involved in a key service method provided in an embodiment of the present invention;

[0015] Figure 3 An example diagram of a root key calculation process involved in a key service method provided in an embodiment of the present invention;

[0016] Figure 4 An example diagram of the encryption service process of a user password involved in the key service method provided in an embodiment of the present invention;

[0017] Figure 5An example diagram of a decryption service process for a user password involved in a key service method provided in an embodiment of the present invention;

[0018] Figure 6 A schematic block diagram of the structure of a key service device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0021] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0022] In the related art, a hardware security module (HSM) is used to securely manage the root key. A hardware security module is a computer hardware device used to protect and manage the root key used by a strong authentication system and provide related cryptographic operations. The hardware security module is generally directly connected to a computer device or a network server in the form of an expansion card or an external device. It divides the root key into three segments, which are injected into the hardware security module by three roles respectively, thereby ensuring the security of the root key. However, this method only relies on a dedicated hardware security module, which is costly, and the security maintenance of the hardware security module is also difficult, and the security of the hardware security module is difficult to guarantee.

[0023] To this end, an embodiment of the present invention provides a key service method, device and storage medium. The key service method is applied to a key core server, which runs in a secure enclave, and a valid root key is also pre-stored in the secure enclave. Only when the key core server establishes a secure communication channel with the client, the key core server will provide the client with encryption and decryption services of the user password based on the valid secondary key generated by the valid root key. Due to the reliable security of the secure enclave, the key core server and its interaction with the client, the security of the valid root key and the valid secondary key are all extremely reliably guaranteed, thereby ensuring the security of the user password.

[0024] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0025] Please refer to Figure 1 , Figure 1 A flowchart of a key service method provided by an embodiment of the present invention.

[0026] like Figure 1 As shown, the key service method includes steps S101 to S103.

[0027] Step S101: Establish a secure communication channel with a client, and receive a user password service request sent by the client through the secure communication channel.

[0028] The key service method can be implemented by a key service device, which can be a terminal device with data processing function such as a server. A root key security protection system is deployed on the key service device.

[0029] See also Figure 2 , Figure 2 This is a schematic diagram of the architecture of the root key security protection system, which mainly includes a key core server, a system parameter proxy server and a client.

[0030] Among them, the key core server runs in the secure enclave. For ease of understanding, the secure enclave is explained first: Intel proposed the SGX (Software Guard Extensions) security protection mechanism in 2013. It is a set of hardware-based extended instructions and security protection mechanisms that allow applications to separate trusted and untrusted parts during design, and create a trusted encrypted memory area for the code and data of the trusted part, thereby ensuring the integrity of the code and the consistency of the data during operation. This encrypted memory area is called a secure enclave. The data in the secure enclave can only be accessed by the code in the secure enclave, and any malware, privileged software or even the operating system itself on the same platform cannot access the secure enclave, thereby ensuring that the data in the secure enclave will not be leaked or maliciously tampered with.

[0031] In some embodiments, the key core server can be implemented to run in a secure enclave based on Intel SGX technology. Specifically, a secure enclave is created first, which requires the key service device to have specific infrastructure software and hardware version requirements in addition to general hardware requirements. Exemplarily, the key service device is required to have a CPU that can support the Intel SGX function, such as Intel CPUs of the XEON series; the key service device is required to have a BIOS system that can support the Intel SGX function, which is used to implement EPC (Encalve Page Cache, an encrypted physical memory area in the operating system reserved memory, used to store secure enclave pages and SGX data structures) and EPCM (Encalve PageCache Map, used by hardware to track EPC content) planning and creation on the physical memory on the BIOS; the key service device is required to have a linux x86 64 operating system and driver for supporting the Intel SGX function. Based on the above requirements, the key service device completes the configuration of the operating system. The root key security protection system needs to configure the Gramine LibOS module (LibOS, library operating system, exokernel architecture can provide customized and efficient resource management for different applications. According to the requirements of different application fields, the abstraction of hardware resources is modularized into a series of libraries), so as to create a secure enclave based on the Gramine LibOS module. The root key security protection system also needs to configure the Gramine SGX module, and finally load the key core server into the secure enclave based on the Gramine SGX module.

[0032] The key core server running in the secure enclave is used to generate root keys and store them in the secure enclave, as well as regularly maintain and update the root keys to obtain valid root keys, thereby generating valid secondary keys based on the valid root keys. The valid secondary keys are symmetric encryption keys, and then provide encryption and decryption services for user passwords based on the valid secondary keys.

[0033] Specifically, the key core server includes a communication unit, a calculation encryption and decryption unit, a verification and update unit, and a data read and write unit. The communication unit is used to communicate securely with the client and system parameter proxy server outside the secure enclave; the calculation encryption and decryption unit is mainly used to calculate the root key, effective root key and effective secondary key, and perform encryption and decryption calculations on user passwords; the verification and update unit is used to update and maintain the root key material and root key; the data read and write unit is used to realize the reading and writing of related basic data.

[0034] The system parameter proxy server runs outside the secure enclave as a function expansion module. Under the premise of secure communication, it is used to provide the key core server with relevant key hardware information as the source of material for generating the root key. Based on the expansion capability of the system parameter proxy server, it is also convenient to expand and support other related key hardware information as the source of material for generating the root key.

[0035] Specifically, the system parameter proxy server includes a communication unit and a query unit. The communication unit is used to communicate securely with the key core server; the query unit is mainly used to process the root key material reading request of the key core server, thereby providing the key core server with relevant key hardware information as the root key material, and can also realize functional interaction with other related key hardware, thereby providing the key core server with other key hardware information as the root key material.

[0036] Through the root key system agent, it is possible to replace the key core server isolated in the secure enclave to interact with other hardware and improve the related processing speed.

[0037] The client also runs outside the secure enclave. Under the premise of secure communication, it is used to forward the user password service request to the key core server and receive the receipt information after the key core server responds to the user password service request. The client can be compiled into a dynamic library file for easy integration in the root key security protection system.

[0038] Specifically, the client includes a communication unit and a receiving unit. The communication unit is used to communicate securely with the key core server; the receiving unit is used to receive user password encryption and decryption service requests, thereby forwarding the user password encryption and decryption service requests to the key core server, and receiving the encryption and decryption service receipt information returned by the key core server and forwarding it to the user.

[0039] Through the client, the response speed to user password service requests can be improved, and the key core server can be helped to improve its processing capabilities for user password service requests.

[0040] The following describes in detail the specific process of the key core server of the root key security protection system, collaborating with the system parameter proxy server and the client to implement the technical solution provided by the embodiment of the present invention.

[0041] In some embodiments, the key core server pre-generates a root key and stores it in the secure enclave, that is, before step S101, it can include: obtaining salt value material and root key material; generating a root key according to the salt value material and the root key material, and storing the root key in the secure enclave.

[0042] Specifically, see Figure 3 , Figure 3 This is an example diagram of the root key calculation process. First, the root key security protection system completes the configuration of startup parameters such as salt value string and SSL (Secure Sockets Layer, network communication encryption protocol). For example, the root key security protection system can be manually configured by an operator, or the root key security protection system can automatically configure the salt value string by generating a random number based on the default communication certificate configuration SSL. The salt value string constitutes the salt value material.

[0043] Then, the root key security protection system starts the system parameter proxy server and confirms that the Socket is established and listened normally.

[0044] Next, the root key security protection system encapsulates the key core server through the Gramine SGX module, sets the key core server as the program entry, completes the key core server's operating environment parameter settings in the secure enclave, including the memory size, stack size, temporary directory, file directory mapping relationship, etc. occupied by the secure enclave, sets the key files as trusted files, and sets the hash value parameters of the gramine tool including gramine-manifest, gramine-sgx-sign, gramine-get-token, and solidified files as the basis for whether the operating environment has been tampered with. Set the relevant files as exception files. These exception files are also allowed to be loaded into the secure enclave and allowed to be modified at runtime. These files are mainly disk files or related temporary files involved in the read-write unit.

[0045] After that, the root key security protection system starts the key core server through the Gramine SGX module. Gramine completes the setting of the operating environment, loads the relevant environment files and library files, and verifies the token of the trust files to confirm whether the relevant files of the operating environment are damaged. If the token verification passes, it means that the relevant files of the operating environment are not damaged, and the operating environment is confirmed to be trustworthy. Gramine automatically loads the key core server into the secure enclave, starts running according to the set startup parameters, and establishes a Socket connection.

[0046] Furthermore, the key core server attempts to read the relevant salt value material. When the reading fails, the key core server attempts to read the backup file and restore the salt value material based on the backup file. If the key core server fails to read the backup file (indicating that the backup file does not exist), the key core server defaults to the initial startup state and automatically generates a string of salt value strings of fixed length as salt value materials by random numbers.

[0047] After obtaining the salt value material, the key core server sends a request to obtain the root key material to the system parameter proxy server. The system parameter proxy server responds to the request to obtain the root key material and allows the key core server to read the root key material. The root key material includes but is not limited to the UUID (Universally Unique Identifier) ​​corresponding to the root key security protection system, the UUID of the root (ROOT) partition, and the ciphertext field configured by the operator.

[0048] In some embodiments, if there is authenticated key hardware, the system parameter proxy server may provide the key core server with signature information corresponding to the key hardware as root key material.

[0049] Finally, the root key material is combined with the salt value material, and the root key is calculated using the preset PBKDF2 algorithm (Password-Based Key Derivation Function 2, which repeatedly calculates the salted hash multiple times and applies a pseudo-random function to derive the key) and stored in the secure enclave.

[0050] In some embodiments, in order to improve the security of the root key, the root key material and salt value material can be backed up as a temporary file, so that when the root key security protection system is interrupted, the root key material and salt value material are automatically destroyed to prevent them from being tampered with without monitoring.

[0051] After that, the root key security protection system can start the client, and the key core server can establish a secure communication channel with the client through the SSL socket. The client can confirm the working status of the key core server through a message handshake, and then wait for the user to call the relevant key service.

[0052] In some embodiments, in order to improve the security protection of user passwords, the root key is given timeliness, and ultimately user password services are provided to users based on the valid root key.

[0053] Specifically, after the root key is stored in the secure enclave, the root key can be updated according to a preset period, a valid root key is obtained and stored in the secure enclave, and the root key is destroyed.

[0054] In some embodiments, the root key is updated according to a preset period, and a periodic polling task can be created to check whether the salt value material and the root key are invalid according to the preset period; if the salt value material and the root key are invalid, the updated salt value material is obtained, and the root key is updated according to the updated salt value material and the root key material.

[0055] Please continue reading Figure 3 The key core server creates a corresponding periodic polling task to check whether the salt value material and the root key are expired according to the preset period. If the salt value material and the root key are expired, the salt value material is updated through automatic configuration, and the root key is updated based on the updated salt value material and the root key material to obtain a valid root key.

[0056] The user can send a user password service request to the client through the SSL socket, and the client forwards the user password service request to the key core server through the secure communication channel. The key core server receives the user password service request forwarded by the client through the secure communication channel.

[0057] Step S102: In response to the user password service request, generate a valid secondary key according to the valid root key pre-stored in the secure enclave, and perform encryption and decryption services for the user password according to the valid secondary key.

[0058] The key core server responds to the user password service request, generates a valid secondary key according to the valid root key pre-stored in the secure enclave, and performs encryption and decryption services for the user password according to the valid secondary key.

[0059] In some embodiments, the user password service request includes a user password encryption service request and a user password decryption service request. Step S102 may be to respond to the user password encryption service request, if the root key pre-stored in the secure enclave is not updated, generate a secondary key according to the root key, and use the secondary key to perform encryption service on the user password; in the case of updating the root key, use the updated root key as the effective root key, and generate a new secondary key based on the effective root key as the effective secondary key; perform encryption service on the user password using the effective secondary key; and respond to the user password decryption service request, perform decryption service on the user password using the effective secondary key.

[0060] The key core server responds to the user password encryption service request. If the root key is not invalid, it first generates a secondary key based on the root key and performs encryption service on the user password based on the secondary key.

[0061] In some embodiments, the salt value material may be decoded using a preset Base64 algorithm, thereby generating an Advanced Encryption Standard (AES) symmetric encryption key as a secondary key based on the root key and the decoded salt value material.

[0062] Afterwards, if the root key is invalidated and updated, the key core server will use the updated root key as the valid root key, and generate a new secondary key based on the valid root key as the valid secondary key to perform encryption services for user passwords.

[0063] Then, in response to the user password decryption service request, the effective secondary key is used to perform the decryption service of the user password.

[0064] In some embodiments, the encryption service of the user password is performed using the secondary key, which may be to encrypt the plain text of the user password using the secondary key to obtain the cipher text of the user password, and then delete the plain text of the user password.

[0065] The secondary key can be used to symmetrically encrypt the plain text of the user password to obtain the cipher text of the user password.

[0066] Using the valid secondary key to perform encryption services on the user password, the secondary key may be used to decrypt the ciphertext of the user password to obtain the plaintext of the user password, and the valid secondary key may be used to encrypt the plaintext of the user password to obtain a new ciphertext of the user password;

[0067] Since the secondary key is a symmetric encryption key, if the root key is invalidated and updated, the secondary key is first used to decrypt the ciphertext of the user password to obtain the plaintext of the user password, and then the valid secondary key generated based on the updated valid root key is used to symmetric encrypt the plaintext of the user password to obtain the new ciphertext of the user password.

[0068] The decryption service of the user password is performed by using the valid secondary key, and the new ciphertext of the user password is decrypted by using the valid secondary key to obtain the plaintext of the user password.

[0069] Since the effective secondary key is a symmetric encryption key, the new ciphertext of the user password can be decrypted using the effective secondary key to obtain the plaintext of the user password.

[0070] In some embodiments, in order to improve the efficiency of the user password service, before generating the secondary key according to the root key pre-stored in the secure enclave, the user password encryption service request can be parsed to obtain the plain text of the user ID and the user password; determine whether the user ID is associated with a corresponding pre-stored secondary key; if the user ID is not associated with a pre-stored secondary key, perform the step of generating the secondary key according to the root key; if the user ID is associated with a pre-stored secondary key, generate the secondary key according to the root key, and compare the pre-stored secondary key with the secondary key. If the pre-stored secondary key is inconsistent with the secondary key, encrypt the plain text of the user password using the secondary key to obtain the ciphertext of the user password.

[0071] Specifically, in order to improve the convenience of user password services, the key core server will record the user IDs and corresponding secondary keys of historical users that have been served, and associate and save the user IDs of historical users and the corresponding secondary keys (defined as pre-stored secondary keys).

[0072] In this way, when the key core server responds to the user password encryption service request, it can first parse the plain text of the user ID and user password from the user password encryption service request, and then determine whether the user ID is associated with a pre-stored secondary key. If the user ID is not associated with a pre-stored secondary key, a secondary key is generated based on the root key.

[0073] If the user ID is associated with a pre-stored secondary key, a secondary key is generated based on the root key, and the pre-stored secondary key is compared with the generated secondary key. If the pre-stored secondary key is inconsistent with the generated secondary key, the user password is encrypted with the secondary key to obtain the ciphertext of the user password. The pre-stored secondary key can also be deleted, and the updated secondary key can be associated with the user ID to provide convenience for subsequent user password services.

[0074] Step S103: Return the receipt information of the encryption service and the receipt information of the decryption service to the client through the secure communication channel.

[0075] After the key core server performs encryption services for the user password according to the valid secondary key, it can also generate a key identification code (key UUID) corresponding to the valid secondary key and store it in association with the valid secondary key. The key UUID corresponding to the valid secondary key and the status code indicating that the user password is in an encrypted state are returned to the client through a secure communication channel as receipt information for the user to view.

[0076] In this way, when subsequent users need user password decryption services, they can submit a user password decryption service request carrying the user ID and key UUID through the client. After the key core server receives the user password decryption service request forwarded by the client through a secure communication channel, it parses the user password decryption service request to obtain the user ID and key UUID, and then performs security authentication on the user ID. If the user ID passes the authentication, the corresponding valid secondary key is queried through the key UUID, thereby using the valid secondary key to perform decryption services on the user password.

[0077] After the key core server performs the decryption service for the user password according to the valid secondary key, it returns the plain text of the user password and the status code indicating that the user password is in the decrypted state as receipt information to the client through the secure communication channel for the user to view.

[0078] In this way, based on the trusted security of the secure enclave, the key core server of the root key security protection system, together with the system parameter proxy server and client, collaborates to implement extremely reliable key security services by combining the valid root key pre-stored in the secure enclave, solving the problem of lack of protection of the root key, ensuring the working efficiency of the root key security protection system, improving security protection capabilities, and solving the problem of the trust chain of the root key lacking protection.

[0079] In some embodiments, see Figure 4 , Figure 4 This is an example diagram of the encryption service process of the user password. In order to better understand the technical solution provided by the embodiment of the present invention, the following is combined with Figure 4, explains the encryption service process of user passwords in more detail.

[0080] The user submits a user password encryption service request through the client, and the password encryption service request carries the plain text of the user ID and the user password; the key core server establishes a secure communication channel with the client through the SSL socket, and the client forwards the user password encryption service request to the key core server through the secure communication channel, and the key core server receives the user password encryption service request sent by the client. Then the key core server verifies the md5 value of the salt value material to confirm whether the salt value material is expired and invalid. If the salt value material is expired and invalid, try to restore it through the backup material; the key core server parses the plain text of the user ID and the user password, and performs security authentication on the user ID. If the user ID passes the authentication, check whether the plain text of the user password meets the specification; if the plain text of the user password meets the specification, determine whether the user ID is associated with the corresponding pre-stored secondary key. If the user ID is associated with a pre-stored secondary key, determine whether the pre-stored secondary key is expired; if the pre-stored secondary key is expired and invalid (indicating that it has not been updated), decode the salt value material through the preset Base64 algorithm, and then generate an AES symmetric encryption key based on the root key and the decoded salt value material as the secondary key. Furthermore, the key core server performs encryption services on the user password through the secondary key, obtains the ciphertext of the user password and saves it. It also generates a key UUID corresponding to the secondary key and saves it in association with the secondary key; the key UUID corresponding to the secondary key and the status code indicating that the user password is in an encrypted state are returned to the client through a secure communication channel as receipt information for the user to view.

[0081] Therefore, by storing the root key in the secure enclave protection area, all applications and users outside the non-root key security protection system cannot directly access the corresponding memory area, so that illegal operators cannot obtain or detect the root key, thereby achieving security protection for the root key, avoiding the illegal acquisition of the root key, resulting in the leakage of secondary keys and user passwords protected by the root key, and effectively improving the security of the root key security protection system.

[0082] It can be understood that when the root key is updated, the key core server will use the updated root key as the valid root key, and generate a new secondary key based on the valid root key as the valid secondary key, and then perform encryption services on the user password based on the valid secondary key, and also generate a key UUID corresponding to the valid secondary key, and associate the valid secondary key and its corresponding key UUID with the valid secondary key for storage; finally, the key UUID corresponding to the valid secondary key and the status code indicating that the user password is in an encrypted state are returned to the client through a secure communication channel as receipt information for the user to view.

[0083] In this way, based on the trusted security of the secure enclave, under the premise of secure communication, the key core server and the client collaborate to implement the user password encryption service by combining the valid root key pre-stored in the secure enclave, thereby ensuring the security of the user password.

[0084] In some embodiments, see Figure 5 , Figure 5 This is an example diagram of the decryption service process of the user password. In order to better understand the technical solution provided by the embodiment of the present invention, the following is combined with Figure 5 , explains the decryption service process of user passwords in more detail.

[0085] The key core server establishes a secure communication channel with the client through an SSL socket. The user submits a user password decryption service request through the client, and the password decryption service request carries the user ID and the key UUID. The client forwards the user password decryption service request to the key core server through the secure communication channel. The key core server receives the user password decryption service request forwarded by the client, parses the user ID and the key UUID, and then the key core server performs security authentication on the user ID. If the user ID passes the authentication, it determines whether the parsed key UUID exists. If the parsed key UUID exists, it queries the corresponding valid secondary key. If the key UUID does not exist, the key core server can confirm whether the salt value material is expired and invalid. If the salt value material is not expired and invalid, the salt value material is decoded by the preset Base64 algorithm, so as to generate an AES symmetric encryption key based on the updated root key and the decoded salt value material as a valid secondary key, and then use the valid secondary key to decrypt the ciphertext of the user password to obtain the plaintext of the user password. Finally, the plaintext of the user password and the status code that the user password is in the decrypted state are returned to the client through the secure communication channel as receipt information for the user to view.

[0086] In this way, based on the trusted security of the secure enclave, under the premise of secure communication, the key core server and the client collaborate to implement the user password decryption service by combining the valid root key pre-stored in the secure enclave, thereby ensuring the security of the user password.

[0087] In summary, the above-mentioned method for providing key services is applied to the key core server, the key core server runs in the secure enclave, the key core server establishes a secure communication channel with the client, and receives the user password service request sent by the client through the secure communication channel; in response to the user password service request, a valid secondary key is generated according to the valid root key pre-stored in the secure enclave, and the encryption service and decryption service of the user password are performed according to the valid secondary key; through the secure communication channel, the receipt information of the encryption service and the receipt information of the decryption service are returned to the client. The key core server of the embodiment of the present invention runs in the secure enclave, and the valid root key is also pre-stored in the secure enclave. Only when the key core server and the client establish a secure communication channel, the key core server will provide the client with encryption and decryption services of the user password based on the valid secondary key generated by the valid root key. Due to the trusted security of the secure enclave, the key core server and its interaction with the client, the security of the valid root key and the valid secondary key are all extremely reliably guaranteed, thereby ensuring the security of the user password.

[0088] See also Figure 6 , Figure 6 A schematic block diagram of the structure of a key service device provided in an embodiment of the present invention.

[0089] like Figure 6 As shown, the key service device 300 includes a processor 301 and a memory 302 , and the processor 301 and the memory 302 are connected via a bus 303 , such as an I2C (Inter-integrated Circuit) bus.

[0090] Specifically, the processor 301 is used to provide computing and control capabilities to support the operation of the entire key service device. The processor 301 can be a central processing unit (CPU), and the processor 301 can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0091] Specifically, the memory 302 may be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a mobile hard disk.

[0092] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a partial structure related to the embodiment of the present invention, and does not constitute a limitation on the key service device to which the embodiment of the present invention is applied. The specific server may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0093] The processor is used to run a computer program stored in the memory, and implement any one of the key service methods provided by the embodiments of the present invention when executing the computer program.

[0094] In one embodiment, the processor is used to run a computer program stored in the memory, and implements the following steps when executing the computer program:

[0095] Establishing a secure communication channel with a client, and receiving a user password service request sent by the client through the secure communication channel;

[0096] In response to the user password service request, generating a valid secondary key according to a valid root key pre-stored in the secure enclave, and performing encryption service and decryption service for the user password according to the valid secondary key;

[0097] The receipt information of the encryption service and the receipt information of the decryption service are returned to the client through the secure communication channel.

[0098] In one embodiment, the user password service request includes a user password encryption service request and a user password decryption service request, and when the processor generates a valid secondary key according to a valid root key pre-stored in the secure enclave in response to the user password service request, and performs encryption service and decryption service for the user password according to the valid secondary key, it is configured to implement:

[0099] In response to the user password encryption service request, if the root key pre-stored in the secure enclave is not updated, generating a secondary key according to the root key, and performing an encryption service for the user password using the secondary key;

[0100] In the case where the root key is updated, the updated root key is used as a valid root key, and a new secondary key is generated based on the valid root key as a valid secondary key;

[0101] Performing encryption service on the user password using the valid secondary key;

[0102] In response to the user password decryption service request, the decryption service of the user password is performed using the valid secondary key.

[0103] In one embodiment, when implementing the encryption service of the user password using the secondary key, the processor is used to implement:

[0104] Encrypting the plain text of the user password using the secondary key to obtain the cipher text of the user password, and deleting the plain text of the user password;

[0105] When implementing the encryption service of the user password using the valid secondary key, the processor is used to implement:

[0106] Decrypting the ciphertext of the user password using the secondary key to obtain the plaintext of the user password, and encrypting the plaintext of the user password using the valid secondary key to obtain a new ciphertext of the user password;

[0107] When implementing the service of performing a decryption of the user password using the valid secondary key, the processor is used to implement:

[0108] The new ciphertext of the user password is decrypted using the valid secondary key to obtain the plaintext of the user password.

[0109] In one embodiment, the processor, before implementing the generating of the secondary key according to the root key, is configured to implement:

[0110] Parsing the user password encryption service request to obtain the plain text of the user ID and user password;

[0111] Determine whether the user ID is associated with a corresponding pre-stored secondary key;

[0112] If the user ID is not associated with the pre-stored secondary key, executing the step of generating the secondary key according to the root key;

[0113] If the user ID is associated with the pre-stored secondary key, a secondary key is generated based on the root key, and the pre-stored secondary key is compared with the secondary key. If the pre-stored secondary key is inconsistent with the secondary key, the plain text of the user password is encrypted using the secondary key to obtain the ciphertext of the user password.

[0114] In one embodiment, after implementing the response to the user password decryption service request, the processor is further configured to implement:

[0115] Parsing the user password decryption service request to obtain a user ID and a key identification code;

[0116] The user ID is authenticated, and when the user ID passes the authentication, the valid secondary key is queried through the key identification code.

[0117] In one embodiment, before implementing the receiving, through the secure communication channel, the user password service request sent by the client, the processor is further configured to implement:

[0118] Obtain salt value materials and root key materials;

[0119] A root key is generated based on the salt material and the root key material, and the root key is stored in the secure enclave.

[0120] In one embodiment, after implementing the storing of the root key in the secure enclave, the processor is further configured to implement:

[0121] The root key is updated according to a preset period, a valid root key is obtained and stored in the secure enclave, and the root key is destroyed.

[0122] In one embodiment, when the processor implements the updating of the root key according to the preset period, it is used to implement:

[0123] Creating a periodic polling task to check whether the salt value material and the root key are invalid according to a preset period;

[0124] If the salt value material and the root key are invalid, an updated salt value material is obtained, and the root key is updated according to the updated salt value material and the root key material.

[0125] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the key service device described above can refer to the corresponding process in the aforementioned key service method embodiment, and will not be repeated here.

[0126] An embodiment of the present invention also provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any key service method provided in the description of the embodiment of the present invention.

[0127] The storage medium may be an internal storage unit of the key service device described in the above embodiment, such as a hard disk or memory of the key service device. The storage medium may also be an external storage device of the key service device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the key service device.

[0128] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware embodiment, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0129] It should be understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system including the element.

[0130] The serial numbers of the embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments. The above description is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A key service method, characterized in that: The method is applied to a key core server, which runs in a secure enclave, and includes: Establishing a secure communication channel with a client, and receiving a user password service request sent by the client through the secure communication channel; In response to the user password service request, generating a valid secondary key according to a valid root key pre-stored in the secure enclave, and performing encryption service and decryption service for the user password according to the valid secondary key; The receipt information of the encryption service and the receipt information of the decryption service are returned to the client through the secure communication channel.

2. The key service method according to claim 1, characterized in that: The user password service request includes a user password encryption service request and a user password decryption service request; in response to the user password service request, generating a valid secondary key according to a valid root key pre-stored in the secure enclave, and performing encryption service and decryption service for the user password according to the valid secondary key, comprising: In response to the user password encryption service request, if the root key pre-stored in the secure enclave is not updated, generating a secondary key according to the root key, and performing an encryption service for the user password using the secondary key; In the case where the root key is updated, the updated root key is used as a valid root key, and a new secondary key is generated based on the valid root key as a valid secondary key; Performing encryption service on the user password using the valid secondary key; In response to the user password decryption service request, the decryption service of the user password is performed using the valid secondary key.

3. The key service method according to claim 2, characterized in that: The using the secondary key to perform the encryption service of the user password includes: Encrypting the plain text of the user password using the secondary key to obtain the cipher text of the user password, and deleting the plain text of the user password; The using the effective secondary key to perform the encryption service of the user password includes: Decrypting the ciphertext of the user password using the secondary key to obtain the plaintext of the user password, and encrypting the plaintext of the user password using the valid secondary key to obtain a new ciphertext of the user password; The using the effective secondary key to perform the decryption service of the user password includes: The new ciphertext of the user password is decrypted using the valid secondary key to obtain the plaintext of the user password.

4. The key service method according to claim 2, characterized in that: Before generating the secondary key according to the root key, the method includes: Parsing the user password encryption service request to obtain the plain text of the user ID and user password; Determine whether the user ID is associated with a corresponding pre-stored secondary key; If the user ID is not associated with the pre-stored secondary key, executing the step of generating the secondary key according to the root key; If the user ID is associated with the pre-stored secondary key, a secondary key is generated based on the root key, and the pre-stored secondary key is compared with the secondary key. If the pre-stored secondary key is inconsistent with the secondary key, the plain text of the user password is encrypted using the secondary key to obtain the ciphertext of the user password.

5. The key service method according to claim 2, characterized in that: After responding to the user password decryption service request, the method includes: Parsing the user password decryption service request to obtain a user ID and a key identification code; The user ID is authenticated, and when the user ID passes the authentication, the valid secondary key is queried through the key identification code.

6. The key service method according to claim 1, characterized in that: Before receiving the user password service request sent by the client through the secure communication channel, the method includes: Obtain salt value materials and root key materials; A root key is generated based on the salt material and the root key material, and the root key is stored in the secure enclave.

7. The key service method according to claim 6, characterized in that: After storing the root key in the secure enclave, the method further comprises: The root key is updated according to a preset period, a valid root key is obtained and stored in the secure enclave, and the root key is destroyed.

8. The key service method according to claim 7, characterized in that: The updating of the root key according to a preset period includes: Creating a periodic polling task to check whether the salt value material and the root key are invalid according to a preset period; If the salt value material and the root key are invalid, an updated salt value material is obtained, and the root key is updated according to the updated salt value material and the root key material.

9. A key service device, characterized in that: The key service device includes a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the steps of the key service method according to any one of claims 1 to 8 are implemented.

10. A storage medium for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the key service method according to any one of claims 1 to 8.

Images