Disk encryption method, device, equipment and system based on threshold password

Abstract

The present application provides a disk encryption method, device, equipment and system based on threshold cryptography. In an example of the present application, the method includes: generating shared secrets corresponding to each other first encryption node according to the initial key parameters, and sending them to the corresponding first encryption nodes; adding the first encryption nodes corresponding to the verified shared secrets to the local second encryption node set; generating a third encryption node set through a consistency negotiation method, and generating secret sharing shares according to the third encryption node set and the super-reversible matrix; generating private key shares according to the secret sharing shares, and sending the private key shares to the client, so that the client generates an encryption key according to the received private key shares, and creates and encrypts the disk according to the generated encryption key. This method can avoid the problem of key loss and damage during single point failure.

Description

Technical Field

[0001] The present application relates to the field of information security and encryption technology, and in particular to a disk encryption method, device, equipment and system based on threshold password. Background Art

[0002] In the context of the Internet era, the public's awareness of cryptographic security has been continuously enhanced, and the importance of information security has become increasingly prominent. In order to meet the security needs of Internet users, cryptographers have invented various encryption algorithms and protocols, and a variety of encryption products and software have appeared on the market. At the same time, with the development of open distributed technologies such as blockchain and Web3, distributed system applications have become more popular, promoting the application and innovation of cryptographic technologies such as threshold cryptography, secret sharing, and multi-party secure computing.

[0003] In current disk encryption schemes, the management of disk encryption keys is mostly centralized or derived based on input passwords. These schemes have been well developed and applied in actual scenarios, but there is still a problem of over-centralization. Key management still relies on key management servers or users themselves remembering passwords.

[0004] Therefore, how to apply threshold cryptography to disk encryption, realize distributed management of disk encryption keys, and increase the difficulty for hackers to attack the system has become a technical problem that needs to be urgently solved in the current disk encryption system. Summary of the invention

[0005] In view of this, the present application provides a disk encryption method, apparatus, device and system based on threshold password.

[0006] Specifically, the present application is implemented through the following technical solutions:

[0007] According to a first aspect of an embodiment of the present application, a disk encryption method based on a threshold password is provided, which is applied to an encryption node and includes:

[0008] Receive an encryption disk creation application, key initial parameters, a super reversible matrix, and a first encryption node set sent by a system management server; wherein the encryption disk creation application is forwarded to the encryption node by the system management server when receiving the encryption disk creation application sent by the client; the key initial parameters are generated by the system management server when receiving the encryption disk creation application sent by the client; the first encryption node set includes the first encryption node determined by the system management server and participating in the distributed key generation; the super reversible matrix is ​​determined by the system management server according to the number of first encryption nodes in the first encryption node set and the maximum number of tolerable corrupt nodes;

[0009] Generating shared secrets corresponding to other first encryption nodes respectively according to the initial key parameters, and sending the generated shared secrets to the corresponding first encryption nodes;

[0010] When receiving a shared secret sent by other first encryption nodes, verify the received shared secret, and add the first encryption node corresponding to the verified shared secret to the local second encryption node set;

[0011] Determine the third encryption node set that ultimately participates in the distributed key generation through a consensus negotiation method based on the local second encryption node set and the second encryption node sets of other first encryption nodes;

[0012] Generating secret sharing shares corresponding to other first encryption nodes respectively according to the third encryption node set and the super reversible matrix, and sending the generated secret sharing shares to the corresponding first encryption nodes;

[0013] When receiving secret sharing shares sent by other first encryption nodes, generating a private key share of the node according to the received secret sharing shares sent by each other first encryption node;

[0014] The private key share of this node is sent to the client, so that the client generates an encryption key according to the received private key share, and creates and encrypts the disk according to the generated encryption key.

[0015] According to a second aspect of an embodiment of the present application, a disk encryption device based on a threshold password is provided, which is deployed at an encryption node, and the device includes:

[0016] A communication unit, used for receiving an encryption disk creation application, a key initial parameter, a super reversible matrix, and a first encryption node set sent by a system management server; wherein the encryption disk creation application is forwarded to the encryption node by the system management server when receiving the encryption disk creation application sent by a client; the key initial parameter is generated by the system management server when receiving the encryption disk creation application sent by the client; the first encryption node set includes the first encryption node determined by the system management server and participating in the distributed key generation; the super reversible matrix is ​​determined by the system management server according to the number of first encryption nodes in the first encryption node set and the maximum number of corruption nodes that can be tolerated;

[0017] A generating unit, configured to generate a shared secret corresponding to each other first encryption node according to the initial key parameter, and send the generated shared secret to the corresponding first encryption node;

[0018] The communication unit is further used to send the generated shared secret to the corresponding first encryption node;

[0019] A verification unit, configured to verify the received shared secret when receiving the shared secret sent by other first encryption nodes, and add the first encryption node corresponding to the verified shared secret to the local second encryption node set;

[0020] A negotiation unit, configured to determine a third encryption node set that ultimately participates in the distributed key generation through a consistency negotiation method based on the local second encryption node set and the second encryption node sets of each other first encryption node;

[0021] The generating unit is further used to generate secret sharing shares corresponding to other first encryption nodes respectively according to the third encryption node set and the super reversible matrix;

[0022] The communication unit is further used to send the generated secret sharing share to the corresponding first encryption node;

[0023] The communication unit is further used to receive secret sharing shares sent by other first encryption nodes;

[0024] The generating unit is further used to generate the private key share of the node according to the secret sharing shares received from the other first encryption nodes;

[0025] The communication unit is also used to send the private key share of the node to the client, so that the client generates an encryption key according to the received private key share, and creates and encrypts the disk according to the generated encryption key.

[0026] According to a third aspect of an embodiment of the present application, there is provided an electronic device, including a processor and a memory, wherein:

[0027] Memory, used to store computer programs;

[0028] The processor is used to implement the method provided in the first aspect when executing the program stored in the memory.

[0029] According to a fourth aspect of an embodiment of the present application, a disk encryption system based on threshold cryptography is provided, comprising: a system management server, an encryption node, and a client; wherein:

[0030] The system management server is used to receive the encrypted disk creation application sent by the client, determine the first encryption node set participating in the distributed key generation, generate a super reversible matrix according to the number of first encryption nodes in the first encryption node set and the maximum number of tolerable corrupt nodes, and send the key initial parameters, the encrypted disk creation application, the super reversible matrix, and the first encryption node set to each first encryption node in the first encryption node set;

[0031] The encryption node is used to generate a shared secret corresponding to each other first encryption node according to the key initial parameter, and send the generated shared secret to the corresponding first encryption node;

[0032] The encryption node is further used to verify the received shared secret when receiving the shared secret sent by other first encryption nodes, and add the first encryption node corresponding to the verified shared secret to the local second encryption node set;

[0033] The encryption node is further used to determine a third encryption node set that ultimately participates in the distributed key generation through a consistency negotiation method based on the local second encryption node set and the second encryption node sets of each other first encryption node;

[0034] The encryption node is further used to generate secret sharing shares corresponding to each other first encryption node according to the third encryption node set and the super reversible matrix, and send the generated secret sharing shares to the corresponding first encryption node;

[0035] The encryption node is further used to generate a private key share of the node according to the received secret sharing shares sent by each other first encryption node when receiving the secret sharing shares sent by other first encryption nodes;

[0036] The encryption node is also used to send the private key share of the node to the client;

[0037] The client is also used to generate an encryption key based on the received private key share, and to create and encrypt the disk based on the generated encryption key.

[0038] The disk encryption method based on threshold password in the embodiment of the present application, upon receiving the encrypted disk creation application, key initial parameters, super reversible matrix, and first encryption node set sent by the system management server, generates shared secrets corresponding to each other first encryption node according to the key initial parameters, and sends the generated shared secrets to the corresponding first encryption node; upon receiving the shared secrets sent by other first encryption nodes, verifies the received shared secrets, adds the first encryption node corresponding to the verified shared secret to the local second encryption node set, and determines the third encryption node that ultimately participates in the distributed key generation through a consistency negotiation method based on the local second encryption node set and the second encryption node sets of each other first encryption node. A set of secret nodes, and then, based on the third encryption node set and the super reversible matrix, respectively generate secret sharing shares corresponding to each other first encryption node, and send the generated secret sharing shares to the corresponding first encryption nodes; when receiving the secret sharing shares sent by other first encryption nodes, generate the private key share of this node according to the received secret sharing shares sent by other first encryption nodes, and send the private key share of this node to the client, the client generates an encryption key according to the received private key share, and creates and encrypts the disk according to the generated encryption key. By using the idea of ​​threshold cryptography, the disk encryption-related keys are divided and stored, and the idea of ​​distributed system is used to avoid the key loss and damage problems during single point failure. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A schematic diagram of a flow chart of a disk encryption method based on threshold passwords shown as an exemplary embodiment of the present application;

[0040] Figure 2A A schematic diagram of a flow chart of a disk encryption method based on threshold passwords shown as an exemplary embodiment of the present application;

[0041] Figure 2B A schematic diagram of a disk encryption method based on threshold password is shown as an exemplary embodiment of the present application;

[0042] Figure 3A A schematic diagram of a process of a user using a disk is shown as an exemplary embodiment of the present application;

[0043] Figure 3B A schematic diagram of a process of a user using a disk is shown as an exemplary embodiment of the present application;

[0044] Figure 4A A schematic diagram of a process of resetting a disk volume header key by a user according to an exemplary embodiment of the present application;

[0045] Figure 4B A schematic diagram showing a method for a user to reset a disk volume header key according to an exemplary embodiment of the present application;

[0046] Figure 5 A schematic diagram of the structure of a disk encryption device based on threshold password is shown as an exemplary embodiment of the present application;

[0047] Figure 6 The figure is a schematic diagram of the hardware structure of an electronic device shown as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to enable those skilled in the art to better understand the technical solutions provided by the embodiments of the present application, some technical terms involved in the embodiments of the present application are briefly explained below.

[0049] 1. Threshold Cryptography: A cryptographic technique used to share control of an encryption system among multiple parties. In this scheme, multiple participants (such as senders or receivers) participate in the encryption or decryption process without requiring any single entity to possess the complete key.

[0050] 2. Secret Sharing: Secret sharing is an information security technology that divides a secret into several shares so that only a certain number (threshold) of shares can reconstruct the secret.

[0051] 3. Byzantine Agreement: A consistency protocol used in distributed systems, which aims to solve the problem of how to reach consensus among all benign nodes when there are malicious or faulty nodes in the system.

[0052] 4. Distributed Key Generation (DKG): Distributed key generation is a process of jointly generating keys among multiple parties without requiring any single party to know the complete key. In this way, key generation is decentralized, enhancing the security and trust of the system.

[0053] In order to make the above-mentioned purposes, features and advantages of the embodiments of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application are further described in detail below with reference to the accompanying drawings.

[0054] See also Figure 1 , is a flow chart of a disk encryption method based on threshold password provided in an embodiment of the present application, wherein the disk encryption method based on threshold password can be applied to an encryption node (a network node where the threshold password module mentioned in the embodiment of the present application is deployed, which may include a host or a server), such as Figure 1 As shown, the disk encryption method based on threshold password may include the following steps:

[0055] Step S100, receiving the encryption disk creation application, key initial parameters, super reversible matrix, and first encryption node set sent by the system management server; wherein, the encryption disk creation application is forwarded to the encryption node by the system management server when receiving the encryption disk creation application sent by the client; the key initial parameters are generated by the system management server during the initialization process; the first encryption node set includes the first encryption node determined by the system management server and participating in the distributed key generation; the super reversible matrix is ​​determined by the system management server according to the number of the first encryption nodes in the first encryption node set and the maximum number of corrupt nodes that can be tolerated.

[0056] In the embodiment of the present application, when there is a need to create an encrypted disk, the user can initiate an encrypted disk creation application to the system management server through the client to apply for creating an encrypted disk.

[0057] When the system management server receives an encrypted disk creation application sent by any client (which can be called the target client), it can determine the encryption node set participating in the distributed key generation (which can be called the first encryption node set), and send the encrypted disk creation application, the initial key parameters and the first encryption node set to each encryption node in the first encryption node set (which can be called the first encryption node).

[0058] Exemplarily, the first encryption node may be selected by the system management server from the encryption node cluster according to the number of required encryption nodes.

[0059] Exemplarily, the encryption node cluster is a cluster of network nodes maintained by a system management server and equipped with a threshold cryptographic module.

[0060] The encryption nodes in the encryption node cluster include network nodes with threshold cryptographic modules installed that are automatically identified and added by the system management server through the device identification protocol, and / or network nodes with threshold cryptographic modules installed that are manually added.

[0061] Exemplarily, the first encryption node set may include some or all encryption nodes in the encryption node cluster.

[0062] Exemplarily, the number of first encryption nodes in the first encryption node set can be determined based on the maximum number of tolerable corrupt nodes.

[0063] The maximum number of tolerable corrupt nodes may be included in the encrypted disk creation application (which may be set by the user according to actual needs) or a default value may be used.

[0064] For example, the number n of the first encryption nodes in the first encryption node set and the maximum number t of tolerable corrupt nodes satisfy the following conditions:

[0065] n≥3t+1

[0066] In one example, the system management server can broadcast an encrypted disk key generation message to the encryption node cluster. Upon receiving the encrypted disk key generation message, the encryption nodes in the encryption node cluster can choose to join and return a join response message to the system management server. When the system management server receives n≥3t+1 join response messages, it terminates the broadcast and replies with a join consent message to the encryption nodes that sent the join response message, identifying these encryption nodes as the first encryption nodes.

[0067] In one example, the first set of crypto nodes may include all crypto nodes in a crypto node cluster.

[0068] The system management server may also generate a super reversible matrix when receiving an encrypted disk creation request.

[0069] In one example, the system management server may select a threshold l according to the maximum number of tolerable corrupt nodes, and generate a l*n super-reversible matrix A.

[0070] The threshold l is the number threshold of valid private key shares when the client generates encryption keys based on private key shares.

[0071] in, .

[0072] Step S110: Generate shared secrets corresponding to other first encryption nodes respectively according to the initial key parameters, and send the generated shared secrets to the corresponding first encryption nodes.

[0073] Step S120: When receiving a shared secret sent by other first encryption nodes, verify the received shared secret, and add the first encryption node corresponding to the verified shared secret to the local second encryption node set.

[0074] In the embodiment of the present application, when each first encryption node in the first encryption node cluster receives an encrypted disk creation application forwarded by the system management server, it can realize authentication between the first encryption nodes by means of sharing secrets.

[0075] Exemplarily, when an encryption node (the encryption node is selected as the first encryption node) receives an encryption disk creation application, initial key parameters, and a first encryption node set sent by a system management server, for any other first encryption node in the first encryption node set except the present node, a shared secret corresponding to the other first encryption node can be generated based on the initial key parameters, and the generated shared secret can be sent to the other first encryption node, so that the other first encryption node can verify the encryption node that sent the shared secret based on the received shared secret.

[0076] Similarly, the encryption node can also receive the shared secret sent by other first encryption nodes, and verify the received shared secret to verify the first encryption node that sent the shared secret.

[0077] In the embodiment of the present application, the encryption node may add the first encryption node corresponding to the verified shared secret to the local encryption node set (which may be referred to as the second encryption node set).

[0078] Step S130: Determine a third encryption node set that ultimately participates in distributed key generation through a consensus negotiation method based on the local second encryption node set and the second encryption node sets of other first encryption nodes.

[0079] In an embodiment of the present application, when each first encryption node in the first encryption node set determines the second encryption node set in the above manner, the encryption node set that ultimately participates in the distributed key generation (which may be referred to as the third encryption node set) may be determined through a consistency negotiation method based on the second encryption node set determined by each first encryption node.

[0080] In one example, each first encryption node can use the MVBA (Multi-value Validated Asynchronous Byzantine Agreement) protocol to negotiate consistency. Each first encryption node uses the local second encryption node set as the input of the MVBA protocol to finally obtain the third encryption node set.

[0081] Step S140: Generate secret sharing shares corresponding to other first encryption nodes respectively according to the third encryption node set and the super reversible matrix, and send the generated secret sharing shares to the corresponding first encryption nodes.

[0082] Step S150: upon receiving secret sharing shares sent by other first encryption nodes, generate the private key share of this node according to the received secret sharing shares sent by other first encryption nodes.

[0083] In an embodiment of the present application, when the third encryption node set is determined, secret sharing shares corresponding to each other first encryption node can be generated respectively based on the third encryption node set and the super reversible matrix, and the generated secret sharing shares can be sent to the corresponding first encryption nodes.

[0084] Similarly, the encryption node can also receive secret sharing shares sent by other first encryption nodes, and generate the private key share of this node based on the secret sharing shares received from other first encryption nodes.

[0085] It should be noted that, in an embodiment of the present application, when the third encryption node set is determined, each third encryption node in the third encryption node set can generate a private key share according to the scheme provided in the embodiment of the present application; alternatively, each first encryption node in the first encryption node set can generate a private key share. In this case, the shared secret generated by each first encryption node in the non-third encryption node set needs to be set to a specific value, such as 0, to avoid its impact on the determination of the private key share.

[0086] Step S160: Send the private key share of this node to the client, so that the client generates an encryption key based on the received private key share, and creates and encrypts the disk based on the generated encryption key.

[0087] In the embodiment of the present application, when the encryption node generates the private key share of the node, it can send the private key share generated by the node to the client (that is, the client applying for the encrypted disk as mentioned above).

[0088] When the client receives the private key share, it can generate an encryption key based on the received private key share.

[0089] In one example, when the client generates an encryption key, it can first generate a volume header key based on the received private key share to encrypt the volume header information of the disk volume, and then generate a master key based on the volume header key. The master key is used to encrypt specific disk data.

[0090] Exemplarily, when the client completes the generation of the master key, the client may save the master key in the volume header of the disk volume.

[0091] For example, the client can generate a sub-volume header key based on the received private key share using the Lagrange interpolation method, and generate a master key based on the sub-volume header key and user identity information (which can be included in the encrypted disk creation application) using a hash function.

[0092] It can be seen that in Figure 1In the method flow shown, when receiving the encrypted disk creation application, the key initial parameters, the super reversible matrix, and the first encryption node set sent by the system management server, the shared secrets corresponding to the other first encryption nodes are respectively generated according to the key initial parameters, and the generated shared secrets are sent to the corresponding first encryption nodes; when receiving the shared secrets sent by the other first encryption nodes, the received shared secrets are verified, and the first encryption nodes corresponding to the verified shared secrets are added to the local second encryption node set, and based on the local second encryption node set and the second encryption node sets of the other first encryption nodes, the third encryption node set that finally participates in the distributed key generation is determined through a consistency negotiation method, and then the third encryption node set is generated. However, based on the third encryption node set and the super reversible matrix, secret sharing shares corresponding to each other first encryption node can be generated respectively, and the generated secret sharing shares can be sent to the corresponding first encryption nodes; when the secret sharing shares sent by other first encryption nodes are received, the private key share of this node is generated according to the secret sharing shares sent by other first encryption nodes, and the private key share of this node is sent to the client, and the client generates an encryption key according to the received private key share, and creates and encrypts the disk according to the generated encryption key. By using the idea of ​​threshold cryptography, the disk encryption-related keys are divided and stored, and the idea of ​​distributed system is used to avoid the problem of key loss and damage during single point failure.

[0093] In some embodiments, the key initialization parameters include a secret value range and a random independent generator.

[0094] The above-mentioned generating the shared secrets corresponding to each other first encryption node respectively according to the initial key parameters, and sending the generated shared secrets to the corresponding first encryption nodes, may include:

[0095] A uniform random sampling method is used to sample the first secret and the second secret from the secret value range;

[0096] Generate a first polynomial based on a first secret and coefficients randomly selected from a range of secret values; and generate a second polynomial based on a second secret and coefficients randomly selected from a range of secret values; wherein both the first polynomial and the second polynomial are t-order polynomials; t is the maximum number of corrupt nodes that can be tolerated;

[0097] The third secret and the fourth secret are obtained by sampling from the range of secret values ​​using a uniform random sampling method;

[0098] Generate a third polynomial based on a third secret and coefficients randomly selected from a range of secret values; and generate a fourth polynomial based on a fourth secret and coefficients randomly selected from a range of secret values; wherein both the third polynomial and the fourth polynomial are t-degree polynomials;

[0099] For any other first encryption node, respectively determine the values ​​of the first polynomial, the second polynomial, the third polynomial, and the fourth polynomial corresponding to the encryption node, and use the determined values ​​as the shared secret corresponding to the other first encryption node;

[0100] The shared secret corresponding to the other first encryption node and the commitment value corresponding to the shared secret are sent to the other first encryption node; wherein the commitment value is generated based on a random independent generator, a first secret, a second secret, a third secret and a fourth secret.

[0101] Exemplarily, when the encryption node receives an encryption disk creation application forwarded by the system management server, it can use uniform random sampling to sample two secrets (which can be respectively referred to as the first secret and the second secret) from the range of secret values ​​included in the key initial parameters.

[0102] In one example, the system management server may select a large prime number q, an elliptic curve group G of order q, and a finite field of order q based on the discrete logarithm problem. .in, This is the secret value range.

[0103] When the encryption node samples the first secret and the second secret, a t-order polynomial (which may be referred to as the first polynomial) may be generated based on the first secret and coefficients randomly selected from the secret value range.

[0104] The encryption node can also generate another t-order polynomial (which may be referred to as the second polynomial) based on the second secret and coefficients randomly selected from the secret value range.

[0105] For example, the first polynomial and the second polynomial can be as follows:

[0106]

[0107]

[0108] in, For the first secret, For the second secret, is a coefficient randomly selected from a secret range of values.

[0109] In addition, the encryption node can also use uniform random sampling to sample two other secrets (which can be called the third secret and the fourth secret, respectively) from the secret value range, and generate the third polynomial and the fourth polynomial in a similar manner.

[0110] Exemplarily, when the first polynomial, the second polynomial, the third polynomial, and the fourth polynomial are obtained, for any other encryption node, the values ​​of the first polynomial, the second polynomial, the third polynomial, and the fourth polynomial corresponding to the encryption node can be determined respectively, and the determined values ​​can be used as the shared secret corresponding to the other first encryption node.

[0111] For example, suppose the first polynomial of the encryption node i (i is the unique identifier of the node in the system) is:

[0112]

[0113] Then the value of the first polynomial corresponding to the encryption node j is:

[0114]

[0115] Exemplarily, when the shared secrets corresponding to each other first encryption node are determined, the determined shared secrets and the commitment values ​​corresponding to the shared secrets may be sent to the corresponding first encryption nodes.

[0116] Exemplarily, the commitment value corresponding to the shared secret is generated based on a random independent generator and the shared secret, and is used by other first encryption nodes to verify the received shared secret.

[0117] In one example, for the first encryption node j, the first encryption node i generates a commitment value corresponding to the shared secret in the following manner:

[0118]

[0119]

[0120] in, , , as well as The first polynomial, the second polynomial, the third polynomial and the fourth polynomial determined for the first encryption node i correspond to the values ​​of the first encryption node j; g and h are random independent generators.

[0121] Accordingly, in the case of receiving a shared secret sent by another first encryption node, verifying the received shared secret may include:

[0122] For any other first encryption node, the received shared secret is verified based on the received shared secret sent by the other first encryption node, the commitment value corresponding to the shared secret, and the random independent generator.

[0123] For example, suppose the shared secret sent by the first encryption node j and received by the first encryption node i includes , , as well as , and the corresponding commitment values ​​are and , then the first encryption node i can verify whether the following equation holds:

[0124]

[0125]

[0126] If the above equation holds true, it can be determined that the verification is passed; otherwise, it is determined that the verification is not passed.

[0127] In one example, the super reversible matrix is ​​a l*n matrix, where n is the number of first encryption nodes in the first encryption node set; and l is the threshold number of valid private key shares when the client generates an encryption key based on the private key shares.

[0128] The above-mentioned steps of respectively generating secret sharing shares corresponding to other first encryption nodes based on the third encryption node set and the super reversible matrix may include:

[0129] Generate a first submatrix and a second submatrix according to the super reversible matrix; wherein the first submatrix is ​​the first t+1 rows of the super reversible matrix, and the second submatrix is ​​the remaining rows of the super reversible matrix except the first t+1 rows;

[0130] Generate a fifth polynomial and a sixth polynomial of uniform random degree l according to the third encryption node set, the first sub-matrix, the second sub-matrix and the shared secret sent by each other first encryption node;

[0131] For any other first encryption node, determine the values ​​of the fifth polynomial and the sixth polynomial corresponding to the encryption node, and use the determined values ​​as the secret sharing shares corresponding to the encryption node.

[0132] Exemplarily, in the process of generating private shared shares, the super-reversible matrix can be split into two sub-matrices (which can be respectively referred to as a first sub-matrix and a second sub-matrix) according to the maximum tolerable number of corrupt nodes t.

[0133] The first submatrix is ​​the first t+1 rows of the super reversible matrix, and the second submatrix is ​​the remaining rows of the super reversible matrix except the first t+1 rows.

[0134] For example, suppose the super-reversible matrix A is:

[0135]

[0136] Then the first submatrix and the second submatrix They can be:

[0137]

[0138] A fifth polynomial and a sixth polynomial of uniform random degree 1 can be generated according to the third encryption node set, the first sub-matrix, the second sub-matrix and the shared secret sent by each other first encryption node.

[0139] As an example, the fifth and sixth polynomials of uniform random degree l are generated according to the third encryption node set, the first sub-matrix, the second sub-matrix, and the shared secrets sent by other first encryption nodes, including:

[0140] exist When and :

[0141]

[0142]

[0143] exist When and :

[0144]

[0145]

[0146] in, is the element in the kth row and jth column of the super-reversible matrix, The first polynomial determined for the first encryption node j corresponds to the value of the first encryption node i, The second polynomial determined for the first encryption node j corresponds to the value of the first encryption node i, The third polynomial determined by the first encryption node j corresponds to the value of the first encryption node i, The fourth polynomial determined by the first encryption node j corresponds to the value of the first encryption node i;

[0147] According to the and Generate the fifth and sixth polynomials:

[0148]

[0149]

[0150] Among them, z(x) is the fifth polynomial, and z'(x) is the sixth polynomial.

[0151] For example, the super reversible matrix is ​​still A, the first submatrix is ​​M, and the second submatrix is For example.

[0152] Encryption node i can generate the following values ​​locally:

[0153]

[0154]

[0155]

[0156]

[0157] in, That is , the value of the first polynomial determined for encryption node 1 corresponding to encryption node j. That is , the second polynomial determined for encryption node 1 corresponds to the value of encryption node j. That is , is the value of the third polynomial determined by encryption node 1 corresponding to encryption node j. That is , the value of the fourth polynomial determined by encryption node 1 corresponds to the encryption node j.

[0158] Based on this, we can know that:

[0159]

[0160] in, .

[0161] Encryption Node Owns every other node About Secret Values of (n is the total number of nodes, t+1 is the degree of the polynomial), that is, , ,and It is calculated again through these secret shares, so Each node Owned about Value The secret sharing shares are as follows:

[0162]

[0163]

[0164]

[0165]

[0166]

[0167] Bundle As a variable of a polynomial, After transformation, we can get a constant term as The degree is of is a polynomial in variables.

[0168] therefore, It can be seen that the polynomial is The value at .

[0169] Here, you can also The value is defined as:

[0170]

[0171]

[0172] set up ∈ It is A polynomial of degree is obtained through the super-reversible matrix. Polynomial of:

[0173]

[0174] in, The relevant calculations can be obtained in the same way.

[0175] Based on the fifth polynomial and the sixth polynomial, for any other first encryption node, the values ​​of the fifth polynomial and the sixth polynomial corresponding to the encryption node are determined, and the determined values ​​are used as the secret sharing shares corresponding to the encryption node.

[0176] In some embodiments, the encrypted disk creation application may include the identity of the client;

[0177] When the private key share of the node is generated, the solution provided by the embodiment of the present application may also include:

[0178] The private key share of this node is stored with the client's identity as the index, the private key share of this node, and the corresponding verification information as the value.

[0179] The above-mentioned sending of the private key share of this node to the client may include:

[0180] Upon receiving the address information and identity of the client sent by the system management server, a private channel is established with the client based on the address information, and the private key share of this node and the corresponding verification information queried based on the identity of the client are sent to the client through the private channel, so that the client verifies the corresponding private key share received based on the received verification information, and in a case where the number of verified private key shares exceeds a preset threshold, an encryption key is generated based on the verified private key shares, and disk creation and encryption are performed based on the generated encryption key.

[0181] Exemplarily, when the encryption node generates the private key share of this node in the above manner, it can also generate verification information corresponding to the private key share, and can store the private key share of this node using the client's identity identifier as an index, the private key share of this node, and the corresponding verification information as values.

[0182] For example, suppose the private key shares of the encryption node include , the corresponding verification information may include: , , .in:

[0183]

[0184]

[0185] Exemplarily, when the encryption node completes the generation of the private key share, it may send a key generation completion notification to the system management server.

[0186] When the system management server receives the notification that key generation is complete, it can send the client's address information (or user address) to the encryption node.

[0187] The encryption node can establish a private channel with the client based on the client's address information, and send the private key share of the node and the corresponding verification information to the client through the private channel.

[0188] The client can verify the corresponding private key share received based on the received verification information, and when the number of verified private key shares exceeds a preset threshold, generate an encryption key based on the verified private key shares, and create and encrypt the disk based on the generated encryption key.

[0189] For example, the client can maintain a set H locally to record the verified private key shares. When the client receives the private key shares and corresponding verification information sent from encryption node j, it can verify the received private key shares:

[0190]

[0191] in, .

[0192] If the verification is successful, the client will Add to collection middle.

[0193] When the number of elements in set H exceeds l, the private key can be restored by Lagrange interpolation method based on the private key shares in set H. .

[0194] For example, the client can as a secondary key, or, based on A secondary key is derived and used as the volume header key in the disk encryption process.

[0195] For example, the client can generate a master key (the master key is stored in the disk volume header, and the volume header is encrypted with the volume header key) using a hash algorithm based on the volume header key and the client's identity (user identity information), and use the volume header key and the master key to create a disk. After the disk is created, the disk is destroyed. All relevant data.

[0196] In one example, the client gets In this case, you can and specific additional information (such as user information, disk information), and use a hash algorithm to obtain a corresponding identifier (which may be called an encryption key identifier) ​​Z, and send a disk encryption key application success message to the system management server, which may include the identifier Z.

[0197] When the system management server receives the disk encryption key application success message sent by the client, it can broadcast the disk encryption key application success message to all encryption nodes.

[0198] When the encryption node receives a disk encryption key application success message broadcast by the system management server, it can query the corresponding private key share based on the client identity included in the disk encryption key application success message, and when the corresponding private key share is queried, the encryption key identifier included in the disk encryption key application success message is associated with the private key share and stored.

[0199] That is, the encryption node can store the private key share using the client's identity as an index and the private key share, the corresponding verification information, and the corresponding encryption key identifier as a value.

[0200] It should be noted that, when the encryption node fails to query the corresponding private key share, the received disk encryption key application success message may not be processed and the disk encryption key application success message may be ignored.

[0201] In one example, the solution provided by the embodiment of the present application may also include:

[0202] Upon receiving an encrypted disk password modification request from the system management server, a new private key share of the node is generated;

[0203] Query the corresponding private key share according to the client's identity included in the encrypted disk password modification application;

[0204] When the corresponding private key share is found, the private key share is used as the old private key share, and the old private key share and the corresponding verification information, as well as the new private key share and the corresponding verification information, are sent to the client through a private channel between the client and the client, and the new private key share and the corresponding verification information are stored using the client's identity identifier as an index;

[0205] If the corresponding private key share is not found, the new private key share and the corresponding verification information are sent to the client through the private channel between the client and the client, and the new private key share and the corresponding verification information are stored with the client's identity as the index;

[0206] Upon receiving a key reset completion message sent by the system management server, querying the corresponding private key share according to the identity identifier of the client included in the key reset completion message; wherein the key reset completion message is sent by the client after completing the key reset, and the key reset completion message includes the old key identifier and the new key identifier;

[0207] When the corresponding private key share is queried, determine whether the private key share is associated with the stored encryption key identifier; if so, compare the encryption key identifier with the old encryption key identifier included in the key reset completion message, and if the two are the same, delete the private key share, the corresponding new verification information and the associated encryption key identifier; if not, store the new encryption key identifier included in the key reset completion message in association with the private key share.

[0208] For example, when there is a need to modify the password of the encrypted disk, the user may send an encrypted disk password modification (or key reset) application to the system management server through the client.

[0209] When the system management server receives the encrypted disk password modification application sent by the client, it can re-perform the key generation process for the client. The specific implementation thereof can refer to the relevant description in the above embodiment.

[0210] It should be noted that, when the system management server regenerates the key for the client, the encryption node selected to participate in the key generation may be different from the previous encryption node.

[0211] The system management server may send an encrypted disk password modification request to the selected encryption node participating in the new key generation of the client.

[0212] When the encryption node receives the encryption disk password modification application sent by the system management server, it can generate a new private key share of the node. For the specific implementation process, please refer to the relevant description in the above embodiment.

[0213] The encryption node can modify the private key share corresponding to the client's identity included in the encryption disk password modification application.

[0214] When the corresponding private key share is queried, that is, the encryption node participated in the previous key generation of the client, the encryption node can use the queried private key share as the old private key share, and send the old private key share and the corresponding verification information, as well as the new private key share (the newly generated private key share) and the corresponding verification information to the client through a private channel between the client and the client, and store the new private key share and the corresponding verification information using the client's identity identifier as an index.

[0215] If the corresponding private key share is not found, the encryption node can send the new private key share and the corresponding verification information to the client through a private channel between the client and the client, and store the new private key share and the corresponding verification information using the client's identity identifier as an index.

[0216] The client can receive the new private key share and corresponding verification information sent by the encryption node, as well as the old private key share and corresponding verification information.

[0217] On the one hand, the received new private key shares can be verified based on the verification information corresponding to the received new private key shares, and when the number of new private key shares that have passed the verification exceeds a threshold, a new encryption key can be generated based on the verified new private key shares.

[0218] On the other hand, the received old private key shares can be verified based on the verification information corresponding to the received old private key shares, and when the number of old private key shares that pass the verification exceeds a threshold, an old encryption key can be generated based on the verified old private key shares.

[0219] The client can decrypt the encrypted disk based on the old encryption key, and if the decryption is successful, replace the old encryption key with the new encryption key, re-encrypt the disk, and achieve key reset.

[0220] When the key resetting is completed, the client may send a key resetting completion message to the system management server. The key resetting completion message may carry the old key identifier and the new key identifier.

[0221] The system management server may broadcast a key reset completion message to each encryption node.

[0222] When the encryption node receives the key reset completion message sent by the system management server, it can query the corresponding private key share according to the identity of the client included in the key reset completion message.

[0223] When the corresponding private key share is queried, determine whether the private key share is associated with the stored encryption key identifier; if so, compare the encryption key identifier with the old encryption key identifier included in the key reset completion message, and if the two are the same, delete the private key share, the corresponding new verification information and the associated encryption key identifier; if not, store the new encryption key identifier included in the key reset completion message in association with the private key share.

[0224] In one example, the solution provided by the embodiment of the present application may also include:

[0225] Upon receiving the encrypted disk use application sent by the system management server, querying the corresponding private key share and verification information according to the client identity included in the encrypted disk use application;

[0226] When the corresponding private key share and verification information are queried, a private channel is established with the client based on the client's address information included in the application for use of the encrypted disk, and the queried private key share and verification information are sent to the client through the private channel, so that the client verifies the received corresponding private key share based on the received verification information, and when the number of verified private key shares exceeds a preset threshold, an encryption key is generated based on the verified private key shares, and the encrypted disk is decrypted based on the generated encryption key.

[0227] Exemplarily, when a user needs to use an encrypted disk, the user may send an encrypted disk use application to the system management server through the client.

[0228] When the system management server receives the encrypted disk use application, it can broadcast the encrypted disk use application to the encryption nodes in the encryption node cluster.

[0229] When the encryption node receives an application for using an encrypted disk, it can query the corresponding private key share and verification information based on the identity of the client included in the application for using the encrypted disk.

[0230] When the corresponding private key share and verification information are queried, the encryption node can establish a private channel with the client based on the client's address information included in the encrypted disk usage application, and send the queried private key share and verification information to the client through the private channel.

[0231] The client can verify the corresponding private key share based on the received verification information, and when the number of verified private key shares exceeds a preset threshold, generate an encryption key based on the verified private key shares, and decrypt the encrypted disk based on the generated encryption key.

[0232] Exemplarily, the client may decrypt the sub-volume header according to the generated encryption key to obtain the master key, and use the master key to decrypt the disk data.

[0233] It should be noted that, if the encryption node fails to find the corresponding private key share and verification information based on the client's identity included in the encryption disk use application, it may not process the encryption disk use application, such as ignoring the encryption disk use application.

[0234] In order to enable those skilled in the art to better understand the technical solutions provided in the embodiments of the present application, the technical solutions provided in the embodiments of the present application are described below with reference to specific examples.

[0235] In this embodiment, in order to better realize the application of threshold keys in disk encryption systems, a disk encryption scheme based on threshold cryptography is proposed. In this scheme, after the system management server is initialized, it obtains the network nodes installed with the threshold cryptographic module to build an encryption node cluster. The user can apply to the system management server to create a disk. When the system management server receives the application (such as the above-mentioned encrypted disk creation application), it generates a uniformly random private key through a distributed key generation method, and shares the secret share of the private key with the honest nodes participating in the key generation through a sharing technology. When the key generation is completed, each node sends a secret share to the user to assist the user in reconstructing the private key, and the private key is destroyed after use.

[0236] The specific implementation steps are described below.

[0237] like Figure 2A and Figure 2B As shown, the disk encryption method based on threshold password may include the following steps:

[0238] Step 1: System initialization.

[0239] 1.1. Identification and addition of encryption nodes: The system management server can automatically identify and add network nodes (including hosts or servers) with threshold password modules installed through the device identification protocol. Administrators can also manually add network nodes with threshold password modules installed across network segments.

[0240] 1.2. Build an encrypted node cluster based on the identified and / or manually added network nodes.

[0241] Step 2: The user applies for an encrypted disk.

[0242] Exemplarily, a user applies to a system management server through a client to create an encrypted disk.

[0243] The encrypted disk creation application may include information such as user ID features, the maximum number of tolerable corrupt nodes (denoted as t), and disk size.

[0244] Step 3: The system management server receives the encrypted disk creation application, selects a corresponding number of encryption nodes for distributed key generation according to t, and obtains the first encryption node set. , and generate The super reversible matrix .

[0245] Exemplarily, the number of nodes in the first encryption node set is n≥3t+1. .

[0246] In one example, the first set of crypto nodes may include all crypto nodes in a crypto node cluster.

[0247] Step 4: Distributed key generation.

[0248] Exemplarily, the idea of ​​polynomial sampling can be used to perform distributed key generation.

[0249] 4.1. Generate initial key parameters: Based on the discrete logarithm problem, select a large prime number q, an elliptic curve group G of order q, and a finite field of order q , select g, h∈G as random independent generators of the group.

[0250] 4.2. The first encryption node i pair Perform uniform random secret sampling and get , ∈ ( , That is, the first secret and the second secret mentioned above), and use the low-level ACSS (Asynchronous Consensus and Secret Sharing) scheme to share the secret with all other nodes.

[0251] For example, assuming , ∈ These are the two used in the low-level ACSS solution. Polynomials of degree (i.e. the first and second polynomials above):

[0252]

[0253]

[0254] in, ∈ , and are randomly selected.

[0255] In addition, uniform random sampling is used to Sampling in (i.e. the third and fourth secrets mentioned above), and obtain (i.e. the third and fourth polynomials mentioned above).

[0256] For any other first encryption node j (j=1…n (excluding node i, a total of n-1)), node i can calculate and The value at the node j is sent to the node j. Node i can also send the corresponding commitment value to node j.

[0257]

[0258]

[0259] In addition, during the ACSS process, node i can also broadcast a commitment:

[0260]

[0261]

[0262] 4.3. Node i receives the first encryption node j and The value at the node i and the corresponding commitment value are verified, and the verified node j is saved in the local encrypted node set. (i.e. the second encryption node set mentioned above).

[0263] For example, the verification process could be as follows:

[0264] Node i can receive and calculate: ,as well as, , and determine whether the following equation holds:

[0265]

[0266]

[0267] in, and is the commitment value sent by node j to node i.

[0268] If the above equation holds true, it is determined that the verification is passed; otherwise, it is determined that the verification is not passed.

[0269] Step 5: Each first encryption node uses the MVBA protocol to negotiate consistency. Each first encryption node sends the locally obtained As the input of the MVBA protocol, after consensus negotiation, all honest nodes reach a consensus on the same set of node instances, set as set S (i.e. the third encrypted node set mentioned above).

[0270] For example, for an encryption node j outside the set S, let and , .

[0271] Step 6: Encrypt nodes according to matrix A , And other parameters for random extraction.

[0272] For example, the properties of super-reversible matrices are used to extract a The specific process is as follows:

[0273] Assume that the super-reversible matrix A is:

[0274]

[0275] make:

[0276]

[0277] Then node i can generate the following values ​​locally:

[0278]

[0279]

[0280]

[0281]

[0282] At this time, each node , all have , .

[0283] Here the node Owns every other node About Secret Values of The secret share is , ,and It is calculated again through these secret shares, so Each node Owned about Value The secret sharing shares are as follows:

[0284]

[0285]

[0286]

[0287]

[0288]

[0289] Bundle As a variable of a polynomial, After transformation, we can get a constant term as The degree is of is a polynomial in variables.

[0290] therefore, It can be seen that the polynomial is The value at .

[0291] Here, you can also The value is defined as:

[0292]

[0293]

[0294] set up ∈ It is A polynomial of degree is obtained through the super-reversible matrix. Polynomial of:

[0295]

[0296] in, The relevant calculations can be obtained in the same way.

[0297] Each node Compute locally about of Secret sharing share and sent to the node .

[0298] Specifically, assume that:

[0299]

[0300]

[0301]

[0302]

[0303] Therefore, for

[0304]

[0305] =

[0306] +

[0307] +…

[0308] +

[0309] Here we will still As a variable, it can be transformed into:

[0310]

[0311] +

[0312]

[0313] +

[0314] in

[0315] Therefore, each node Can be calculated about The secret sharing share.

[0316] To prevent possible communication errors between nodes, use The protocol uses the characteristics of Reed-Solomon (an error correction coding technology) coding to ensure that the original message can be successfully recovered even if some data is lost or erroneous.

[0317] Node Upon receiving Sent Then, let the set After receiving, run , .

[0318] Node j gets In the case of a private key share, the system management server is notified that the private key share has been generated and By user and disk related information as indexes, , , , The information is stored in the local database.

[0319] Step 7: When the system management server receives the notification that the private key share generation is complete, it notifies each encryption node of the client's address information (also called user address). Establish a private channel with the client and send the node's , , ,as well as Sent to the client through a private channel.

[0320]

[0321]

[0322] Step 8: The client maintains a set H locally to record the verified z(j) values. When the client receives information from node j, it verifies the received private key share, i.e., verifies:

[0323]

[0324] in, .

[0325] If the verification is successful, the client will Add to collection middle.

[0326] When the number of elements in set H exceeds l, the private key can be restored by Lagrange interpolation method based on the private key shares in set H. .

[0327] The client can as a secondary key, or, based on A secondary key is derived and used as the volume header key in the disk encryption process.

[0328] The client gets In this case, you can and specific additional information (such as user information, disk information), using a hash algorithm to obtain a corresponding identifier Z, and send a disk encryption key application success message to the system management server, the disk encryption key application success message may include the identifier Z.

[0329] Step 9: The client can generate a master key based on the volume header key and the client's identity (user identity information) using a hash algorithm (the master key is stored in the disk volume header, and the volume header is encrypted using the volume header key). Use the volume header key and the master key to create a disk. After the disk is created, destroy it. All relevant data.

[0330] Step 10: When the system management server receives the disk encryption key application success message from the client, it broadcasts the message to all encryption nodes. When the encryption node receives the disk encryption key application success message broadcast by the system management server, it can query the corresponding private key share according to the client's identity included in the disk encryption key application success message, and when the corresponding private key share is queried, the encryption key identifier included in the disk encryption key application success message is associated with the private key share and stored.

[0331] The following describes the implementation process of users using encrypted disks.

[0332] like Figure 3A and Figure 3B As shown, the process of using encrypted disk can be as follows:

[0333] 1) The client sends an application to the system management server to use the disk, and sends an encrypted disk use application to the system management server. When the system management server receives the encrypted disk use application, it notifies each encryption node in the encryption node cluster and carries relevant user information, such as the client's identity and address information.

[0334] 2) The encryption node queries the corresponding private key share and the corresponding verification information based on the user information. When the corresponding private key share and the corresponding verification information are found, a private channel is established with the client and the private key share and the corresponding verification information are sent to the client.

[0335] 3) The client maintains a collection locally , used to record the verified The client receives the value from the node In the case of the private key share and the corresponding verification information sent, the received private key share is verified, that is, verification:

[0336]

[0337] in, .

[0338] If the verification is successful, the client will Add to collection middle.

[0339] When the number of elements in set H exceeds l, the private key can be restored by Lagrange interpolation method based on the private key shares in set H. .

[0340] For example, the client can as a secondary key, or, based on A secondary key is derived and used as the volume header key in the disk encryption process.

[0341] The client can use the secondary key to decrypt the volume header, obtain the master key, and use the master key to decrypt the disk data.

[0342] The following describes the process of resetting the disk volume header key.

[0343] like Figure 4A and Figure 4B As shown, the process of resetting the disk volume header key can be as follows:

[0344] 1) When the user needs to modify the encrypted disk's volume header key, he can send an encrypted disk password modification application (or encrypted disk password reset application) to the system management server through the client. When the system management server receives the encrypted disk password modification application, it notifies each encryption node in the encryption node cluster and carries relevant user information, such as the client's identity and address information.

[0345] 2) When the encryption node receives an encryption disk password modification application, on the one hand, it generates a new private key share and corresponding verification information; on the other hand, it can query the corresponding private key share (which can be called the old private key share) and the corresponding verification information based on the user identity information included in the encryption disk password modification application.

[0346] a) If the old private key share and the corresponding verification information are not found, the new private key share and the corresponding verification information are sent to the client, and the private key share is marked as a new private key share through a flag; in addition, the new private key share is stored with the user identity information as the index and the new private key share and the corresponding verification information as the value.

[0347] b) If the old private key share and the corresponding verification information are found, the new private key share and the corresponding verification information, as well as the old private key share and the corresponding verification information, are sent to the client through a private channel; in addition, the new private key share is stored with the user identity information as the index and the new private key share and the corresponding verification information as the value.

[0348] 3) The client maintains two collections locally and , used to record the old private key share and the new private key share respectively.

[0349] The client verifies the corresponding private key share based on the received verification information, and adds the old private key share that has passed the verification to the set H, and the new private key share that has passed the verification to the set NH.

[0350] When the number of private key shares in set H exceeds l, the old private key is recovered by Lagrange interpolation , based on the old private key Decrypt the encrypted disk.

[0351] When the number of private key shares in the set NH exceeds l, the new private key is recovered by Lagrange interpolation method , based on the new private key Encrypt the disk.

[0352] It should be noted that during the process of resetting the disk volume header key, the master key does not need to be modified.

[0353] When the disk volume header key reset is completed, the client can send a key reset completion message to the system management server. The message can include the old encryption key identifier (which can be recorded as Z) and the new encryption key identifier (which can be recorded as ).

[0354] 4) The system management server receives the key reset completion message and broadcasts it to all encryption nodes in the encryption cluster.

[0355] The encryption node receives the key reset completion message and queries the corresponding private key share based on the user identity information included in the key reset completion message.

[0356] a) If the corresponding private key share is found, the encryption key identifier stored in association with the private key share is compared with the old encryption key identifier; if the encryption key identifier stored in association with the private key share is empty, the new encryption key identifier is stored in association with the private key share; if the encryption key identifier associated with the private key share is the same as the old encryption key identifier, the private key share and the corresponding verification information and encryption key identifier are deleted.

[0357] b) If the corresponding private key share is not found, the key reset completion message is ignored.

[0358] The method provided by the present application is described above. The device provided by the present application is described below:

[0359] See also Figure 5 , is a schematic diagram of the structure of a disk encryption device based on a threshold password provided in an embodiment of the present application, such as Figure 5 As shown, the disk encryption device based on threshold password may include:

[0360] The communication unit 510 is used to receive an encryption disk creation application, a key initial parameter, a super reversible matrix, and a first encryption node set sent by a system management server; wherein the encryption disk creation application is forwarded to the encryption node by the system management server when receiving the encryption disk creation application sent by the client; the key initial parameter is generated by the system management server during the initialization process; the first encryption node set includes the first encryption node determined by the system management server and participating in the distributed key generation; the super reversible matrix is ​​determined by the system management server according to the number of first encryption nodes in the first encryption node set and the maximum number of tolerable corrupt nodes;

[0361] A generating unit 520, configured to generate a shared secret corresponding to each other first encryption node according to the key initial parameter, and send the generated shared secret to the corresponding first encryption node;

[0362] The communication unit 510 is further configured to send the generated shared secret to the corresponding first encryption node;

[0363] The verification unit 530 is used to verify the received shared secret when receiving the shared secret sent by other first encryption nodes, and add the first encryption node corresponding to the verified shared secret to the local second encryption node set;

[0364] The negotiation unit 540 is used to determine the third encryption node set that ultimately participates in the distributed key generation through a consistency negotiation method based on the local second encryption node set and the second encryption node sets of each other first encryption node;

[0365] The generating unit 520 is further configured to generate secret sharing shares corresponding to other first encryption nodes respectively according to the third encryption node set and the super reversible matrix;

[0366] The communication unit 510 is further configured to send the generated secret sharing share to the corresponding first encryption node;

[0367] The communication unit 510 is further used to receive secret sharing shares sent by other first encryption nodes;

[0368] The generating unit 520 is further used to generate the private key share of the node according to the secret sharing shares received from the other first encryption nodes;

[0369] The communication unit 510 is further used to send the private key share of the node to the client, so that the client generates an encryption key according to the received private key share, and creates and encrypts the disk according to the generated encryption key.

[0370] In some embodiments, the key initialization parameters include a secret value range and a random independent generator;

[0371] The generating unit 520 generates shared secrets corresponding to other first encryption nodes respectively according to the initial key parameters, including:

[0372] Using a uniform random sampling method, sampling from the secret value range to obtain the first secret and the second secret;

[0373] Generate a first polynomial based on the first secret and coefficients randomly selected from the secret value range; and generate a second polynomial based on the second secret and coefficients randomly selected from the secret value range; wherein the first polynomial and the second polynomial are both t-order polynomials; t is the maximum number of corrupt nodes that can be tolerated;

[0374] Using uniform random sampling, sampling the third secret and the fourth secret from the secret value range;

[0375] Generate a third polynomial based on the third secret and coefficients randomly selected from the secret value range; and generate a fourth polynomial based on the fourth secret and coefficients randomly selected from the secret value range; wherein the third polynomial and the fourth polynomial are both t-degree polynomials;

[0376] For any other first encryption node, respectively determine the values ​​of the first polynomial, the second polynomial, the third polynomial, and the fourth polynomial corresponding to the encryption node, and use the determined values ​​as the shared secret corresponding to the other first encryption node;

[0377] The communication unit 510 sends the generated shared secret to the corresponding first encryption node, including:

[0378] The shared secret corresponding to the other first encryption node and the commitment value corresponding to the shared secret are sent to the other first encryption node; wherein the commitment value is generated based on the random independent generator and the shared secret.

[0379] In some embodiments, for the first encryption node j, the first encryption node i generates a commitment value corresponding to the shared secret by the generation unit 520 in the following manner:

[0380]

[0381]

[0382] in, , , as well as The first polynomial, the second polynomial, the third polynomial and the fourth polynomial respectively determined for the first encryption node i are the values ​​corresponding to the first encryption node j; g and h are the random independent generators;

[0383] The verification unit 530 verifies the received shared secret when receiving the shared secret sent by other first encryption nodes, including:

[0384] For any other first encryption node, the received shared secret is verified based on the received shared secret sent by the other first encryption node, the commitment value corresponding to the shared secret, and the random independent generator.

[0385] In some embodiments, the super reversible matrix is ​​a l*n matrix, where n is the number of first encryption nodes in the first encryption node set; l is the number threshold of valid private key shares when the client generates an encryption key based on the private key shares;

[0386] The generating unit 520 generates secret sharing shares corresponding to other first encryption nodes respectively according to the third encryption node set and the super reversible matrix, including:

[0387] Generate a first submatrix and a second submatrix according to the super reversible matrix; wherein the first submatrix is ​​the first t+1 rows of the super reversible matrix, and the second submatrix is ​​the remaining rows of the super reversible matrix except the first t+1 rows;

[0388] Generate a fifth polynomial and a sixth polynomial of uniform random degree 1 according to the third encryption node set, the first submatrix, the second submatrix, and the shared secret sent by each other first encryption node;

[0389] For any other first encryption node, the values ​​of the fifth polynomial and the sixth polynomial corresponding to the encryption node are determined, and the determined values ​​are used as the secret sharing shares corresponding to the encryption node.

[0390] In some embodiments, the generating unit 520 generates a fifth polynomial and a sixth polynomial of uniform random degree 1 according to the third encryption node set, the first sub-matrix, the second sub-matrix, and the shared secret sent by each other first encryption node, including:

[0391] exist When and :

[0392]

[0393]

[0394] exist When and :

[0395]

[0396]

[0397] in, is the element in the kth row and jth column of the super-reversible matrix, The first polynomial determined for the first encryption node j corresponds to the value of the first encryption node i, The second polynomial determined for the first encryption node j corresponds to the value of the first encryption node i, The third polynomial determined by the first encryption node j corresponds to the value of the first encryption node i, The fourth polynomial determined by the first encryption node j corresponds to the value of the first encryption node i;

[0398] According to the and Generate the fifth and sixth polynomials:

[0399]

[0400]

[0401] in, is the fifth polynomial, is the sixth polynomial.

[0402] In some embodiments, the encrypted disk creation application includes the identity of the client;

[0403] The generating unit 520 is further configured to store the private key share of the node using the identity identifier of the client as an index, the private key share of the node, and the corresponding verification information as a value;

[0404] The communication unit 510 sends the private key share of the node to the client, including:

[0405] Upon receiving the address information and identity of the client sent by the system management server, a private channel is established with the client based on the address information, and the private key share of the node queried based on the identity of the client and the corresponding verification information are sent to the client through the private channel, so that the client verifies the corresponding private key share received based on the received verification information, and generates an encryption key based on the verified private key shares when the number of verified private key shares exceeds a preset threshold, and creates and encrypts the disk based on the generated encryption key.

[0406] In some embodiments, the communication unit 510 is further used to query the corresponding private key share and verification information according to the identity of the client included in the encrypted disk use application when receiving the encrypted disk use application sent by the system management server;

[0407] When the corresponding private key share and verification information are queried, a private channel is established with the client based on the client's address information included in the encrypted disk use application, and the queried private key share and verification information are sent to the client through the private channel, so that the client verifies the received corresponding private key share based on the received verification information, and when the number of verified private key shares exceeds a preset threshold, an encryption key is generated based on the verified private key shares, and the encrypted disk is decrypted based on the generated encryption key.

[0408] In some embodiments, the communication unit 510 is further used to receive a disk encryption key application success message sent by the system management server, query the corresponding private key share according to the identity of the client included in the disk encryption key application success message, and when the corresponding private key share is queried, associate the encryption key identifier included in the disk encryption key application success message with the private key share and store it; wherein the disk encryption key application success message is sent by the client to the system management server when the encryption key is successfully generated;

[0409] The generating unit 520 is further configured to generate a new private key share of the node upon receiving an encrypted disk password modification application sent by the system management server; query the corresponding private key share according to the identity of the client included in the encrypted disk password modification application;

[0410] The communication unit 510 is further configured to, when the corresponding private key share is found, use the private key share as the old private key share, send the old private key share and the corresponding verification information, and the new private key share and the corresponding verification information to the client through a private channel between the client and the client, and store the new private key share and the corresponding verification information using the client's identity identifier as an index; when the corresponding private key share is not found, send the new private key share and the corresponding verification information to the client through a private channel between the client and the client, and store the new private key share and the corresponding verification information using the client's identity identifier as an index;

[0411] The verification unit 530 is used to query the corresponding private key share based on the client's identity identifier included in the key reset completion message when receiving the key reset completion message sent by the system management server; wherein the key reset completion message is sent by the client when the key reset is completed, and the key reset completion message includes the old key identifier and the new key identifier; when the corresponding private key share is queried, determine whether the private key share is associated with the encryption key identifier stored; if so, compare the encryption key identifier with the old encryption key identifier included in the key reset completion message, and when the two are the same, delete the private key share, the corresponding new verification information and the associated encryption key identifier; if not, store the new encryption key identifier included in the key reset completion message in association with the private key share.

[0412] An embodiment of the present application also provides an electronic device, including a processor and a memory, wherein the memory is used to store computer programs; the processor is used to implement the threshold password-based disk encryption method described above when executing the program stored in the memory.

[0413] See also Figure 6 , is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 601 and a memory 602 storing machine executable instructions. The processor 601 and the memory 602 may communicate via a system bus 603. In addition, by reading and executing the machine executable instructions corresponding to the threshold password-based disk encryption logic in the memory 602, the processor 601 may execute the threshold password-based disk encryption method described above.

[0414] The memory 602 mentioned herein may be any electronic, magnetic, optical or other physical storage device that may contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium may be: RAM (RadomAccess Memory, random access memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as optical disk, DVD, etc.), or similar storage medium, or a combination thereof.

[0415] In some embodiments, a machine-readable storage medium is also provided. Figure 6 The memory 602 in the machine-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are executed by the processor, the disk encryption method based on threshold password described above is implemented. For example, the machine-readable storage medium can be ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

[0416] The embodiment of the present application also provides a computer program product, which stores a computer program, and when a processor executes the computer program, it prompts the processor to execute the disk encryption method based on threshold password described above.

[0417] The embodiment of the present application also provides a disk encryption system based on threshold password, including: a system management server, an encryption node, and a client; wherein:

[0418] The system management server is used to receive the encrypted disk creation application sent by the client, determine the first encryption node set participating in the distributed key generation, and generate a super reversible matrix according to the number of first encryption nodes in the first encryption node set and the maximum number of tolerable corrupt nodes, and send the key initial parameters, the encrypted disk creation application, the super reversible matrix, and the first encryption node set to each first encryption node in the first encryption node set; wherein the key initial parameters are generated by the system management server during the initialization process;

[0419] The encryption node is used to generate a shared secret corresponding to each other first encryption node according to the key initial parameter, and send the generated shared secret to the corresponding first encryption node;

[0420] The encryption node is further used to verify the received shared secret when receiving the shared secret sent by other first encryption nodes, and add the first encryption node corresponding to the verified shared secret to the local second encryption node set;

[0421] The encryption node is further used to determine a third encryption node set that ultimately participates in the distributed key generation through a consistency negotiation method based on the local second encryption node set and the second encryption node sets of each other first encryption node;

[0422] The encryption node is further used to generate secret sharing shares corresponding to each other first encryption node according to the third encryption node set and the super reversible matrix, and send the generated secret sharing shares to the corresponding first encryption node;

[0423] The encryption node is further used to generate a private key share of the node according to the received secret sharing shares sent by each other first encryption node when receiving the secret sharing shares sent by other first encryption nodes;

[0424] The encryption node is also used to send the private key share of the node to the client;

[0425] The client is also used to generate an encryption key based on the received private key share, and to create and encrypt the disk based on the generated encryption key.

[0426] Exemplarily, the system management server, the encryption node, and the client can implement disk encryption based on threshold cryptography in the manner described in the above method embodiment.

Claims

1. A disk encryption method based on threshold password, characterized in that: Applied to an encryption node, the method comprises: Receive an encryption disk creation application, key initial parameters, a super reversible matrix, and a first encryption node set sent by a system management server; wherein the encryption disk creation application is forwarded to the encryption node by the system management server when receiving the encryption disk creation application sent by the client; the key initial parameters are generated by the system management server during the initialization process; the first encryption node set includes the first encryption node determined by the system management server and participating in the distributed key generation; the super reversible matrix is ​​determined by the system management server according to the number of first encryption nodes in the first encryption node set and the maximum number of tolerable corrupt nodes; Generating shared secrets corresponding to other first encryption nodes respectively according to the initial key parameters, and sending the generated shared secrets to the corresponding first encryption nodes; When receiving a shared secret sent by other first encryption nodes, verify the received shared secret, and add the first encryption node corresponding to the verified shared secret to the local second encryption node set; Determine the third encryption node set that ultimately participates in the distributed key generation through a consensus negotiation method based on the local second encryption node set and the second encryption node sets of other first encryption nodes; Generating secret sharing shares corresponding to other first encryption nodes respectively according to the third encryption node set and the super reversible matrix, and sending the generated secret sharing shares to the corresponding first encryption nodes; When receiving secret sharing shares sent by other first encryption nodes, generating a private key share of the node according to the received secret sharing shares sent by each other first encryption node; The private key share of this node is sent to the client, so that the client generates an encryption key according to the received private key share, and creates and encrypts the disk according to the generated encryption key.

2. The method according to claim 1, characterized in that The key initial parameters include a secret value range and a random independent generator; The step of generating a shared secret corresponding to each other first encryption node according to the initial key parameter, and sending the generated shared secret to the corresponding first encryption node comprises: Using a uniform random sampling method, sampling from the secret value range to obtain the first secret and the second secret; Generate a first polynomial based on the first secret and coefficients randomly selected from the secret value range; and generate a second polynomial based on the second secret and coefficients randomly selected from the secret value range; wherein the first polynomial and the second polynomial are both t-order polynomials; t is the maximum number of corrupt nodes that can be tolerated; Using uniform random sampling, sampling the third secret and the fourth secret from the secret value range; Generate a third polynomial based on the third secret and coefficients randomly selected from the secret value range; and generate a fourth polynomial based on the fourth secret and coefficients randomly selected from the secret value range; wherein the third polynomial and the fourth polynomial are both t-degree polynomials; For any other first encryption node, respectively determine the values ​​of the first polynomial, the second polynomial, the third polynomial, and the fourth polynomial corresponding to the encryption node, and use the determined values ​​as the shared secret corresponding to the other first encryption node; The shared secret corresponding to the other first encryption node and the commitment value corresponding to the shared secret are sent to the other first encryption node; wherein the commitment value is generated based on the random independent generator and the shared secret.

3. The method according to claim 2, characterized in that For the first encryption node j, the first encryption node i generates a commitment value corresponding to the shared secret in the following manner: in, , , as well as The first polynomial, the second polynomial, the third polynomial and the fourth polynomial respectively determined for the first encryption node i are the values ​​corresponding to the first encryption node j; g and h are the random independent generators; The step of verifying the received shared secret upon receiving the shared secret sent by other first encryption nodes comprises: For any other first encryption node, the received shared secret is verified based on the received shared secret sent by the other first encryption node, the commitment value corresponding to the shared secret, and the random independent generator.

4. The method according to claim 2, characterized in that: The super reversible matrix is ​​a l*n matrix, where n is the number of first encryption nodes in the first encryption node set; l is the number threshold of valid private key shares when the client generates an encryption key based on the private key shares; The step of generating secret sharing shares corresponding to other first encryption nodes respectively based on the third encryption node set and the super reversible matrix includes: Generate a first submatrix and a second submatrix according to the super reversible matrix; wherein the first submatrix is ​​the first t+1 rows of the super reversible matrix, and the second submatrix is ​​the remaining rows of the super reversible matrix except the first t+1 rows; Generate a fifth polynomial and a sixth polynomial of uniform random degree 1 according to the third encryption node set, the first submatrix, the second submatrix, and the shared secret sent by each other first encryption node; For any other first encryption node, the values ​​of the fifth polynomial and the sixth polynomial corresponding to the encryption node are determined, and the determined values ​​are used as the secret sharing shares corresponding to the encryption node.

5. The method according to claim 4, characterized in that The step of generating a fifth polynomial and a sixth polynomial of degree 1 uniformly random according to the third encryption node set, the first sub-matrix, the second sub-matrix, and the shared secret sent by each other first encryption node comprises: exist When and : exist When and : in, is the element in the kth row and jth column of the super-reversible matrix, The first polynomial determined for the first encryption node j corresponds to the value of the first encryption node i, The second polynomial determined for the first encryption node j corresponds to the value of the first encryption node i, The third polynomial determined by the first encryption node j corresponds to the value of the first encryption node i, The fourth polynomial determined by the first encryption node j corresponds to the value of the first encryption node i; According to the and Generate the fifth and sixth polynomials: in, is the fifth polynomial, is the sixth polynomial.

6. The method according to claim 1, characterized in that The encrypted disk creation application includes the identity of the client; When the private key share of the node is generated, the method further includes: The private key share of the node is stored with the identity identifier of the client as the index, the private key share of the node, and the corresponding verification information as the value; The sending of the private key share of the node to the client includes: Upon receiving the address information and identity of the client sent by the system management server, a private channel is established with the client based on the address information, and the private key share of the node queried based on the identity of the client and the corresponding verification information are sent to the client through the private channel, so that the client verifies the corresponding private key share received based on the received verification information, and generates an encryption key based on the verified private key shares when the number of verified private key shares exceeds a preset threshold, and creates and encrypts the disk based on the generated encryption key.

7. The method according to claim 6, characterized in that The method further comprises: Upon receiving the encrypted disk use application sent by the system management server, querying the corresponding private key share and verification information according to the identity identifier of the client included in the encrypted disk use application; When the corresponding private key share and verification information are queried, a private channel is established with the client based on the client's address information included in the encrypted disk use application, and the queried private key share and verification information are sent to the client through the private channel, so that the client verifies the received corresponding private key share based on the received verification information, and when the number of verified private key shares exceeds a preset threshold, an encryption key is generated based on the verified private key shares, and the encrypted disk is decrypted based on the generated encryption key.

8. The method according to claim 6, characterized in that The method further comprises: Receive a disk encryption key application success message sent by the system management server, query the corresponding private key share according to the identity identifier of the client included in the disk encryption key application success message, and if the corresponding private key share is queried, associate the encryption key identifier included in the disk encryption key application success message with the private key share and store it; wherein the disk encryption key application success message is sent by the client to the system management server when the encryption key is successfully generated; Upon receiving the encrypted disk password modification application sent by the system management server, generating a new private key share of the node; Querying the corresponding private key share according to the identity of the client included in the encrypted disk password modification application; When the corresponding private key share is found, the private key share is used as the old private key share, and the old private key share and the corresponding verification information, as well as the new private key share and the corresponding verification information, are sent to the client through a private channel between the client and the client, and the new private key share and the corresponding verification information are stored using the client's identity identifier as an index; If the corresponding private key share is not found, the new private key share and the corresponding verification information are sent to the client through the private channel between the client and the client, and the new private key share and the corresponding verification information are stored with the client's identity as the index; Upon receiving a key reset completion message sent by the system management server, querying the corresponding private key share according to the identity identifier of the client included in the key reset completion message; wherein the key reset completion message is sent by the client after completing the key reset, and the key reset completion message includes an old key identifier and a new key identifier; When the corresponding private key share is queried, determine whether the private key share is associated with an encryption key identifier; if so, compare the encryption key identifier with the old encryption key identifier included in the key reset completion message, and if the two are the same, delete the private key share, the corresponding new verification information and the associated encryption key identifier; if not, store the new encryption key identifier included in the key reset completion message in association with the private key share.

9. A disk encryption device based on threshold password, characterized in that: Deployed at an encryption node, the device includes: A communication unit, used for receiving an encryption disk creation application, a key initial parameter, a super reversible matrix, and a first encryption node set sent by a system management server; wherein the encryption disk creation application is forwarded to the encryption node by the system management server when receiving the encryption disk creation application sent by a client; the key initial parameter is generated by the system management server during the initialization process; the first encryption node set includes the first encryption node determined by the system management server and participating in the distributed key generation; the super reversible matrix is ​​determined by the system management server according to the number of first encryption nodes in the first encryption node set and the maximum number of corruption nodes that can be tolerated; A generating unit, configured to generate a shared secret corresponding to each other first encryption node according to the initial key parameter, and send the generated shared secret to the corresponding first encryption node; The communication unit is further used to send the generated shared secret to the corresponding first encryption node; A verification unit, configured to verify the received shared secret when receiving the shared secret sent by other first encryption nodes, and add the first encryption node corresponding to the verified shared secret to the local second encryption node set; A negotiation unit, configured to determine a third encryption node set that ultimately participates in the distributed key generation through a consistency negotiation method based on the local second encryption node set and the second encryption node sets of each other first encryption node; The generating unit is further used to generate secret sharing shares corresponding to other first encryption nodes respectively according to the third encryption node set and the super reversible matrix; The communication unit is further used to send the generated secret sharing share to the corresponding first encryption node; The communication unit is further used to receive secret sharing shares sent by other first encryption nodes; The generating unit is further used to generate the private key share of the node according to the secret sharing shares received from the other first encryption nodes; The communication unit is also used to send the private key share of the node to the client, so that the client generates an encryption key according to the received private key share, and creates and encrypts the disk according to the generated encryption key.

10. An electronic device, characterized in that: comprising a processor and a memory, wherein: Memory, used to store computer programs; A processor, for implementing the method according to any one of claims 1 to 8 when executing a program stored in a memory.

11. A disk encryption system based on threshold password, characterized in that: include: A system management server, an encryption node, and a client; wherein: The system management server is used to receive the encrypted disk creation application sent by the client, determine the first encryption node set participating in the distributed key generation, and generate a super reversible matrix according to the number of first encryption nodes in the first encryption node set and the maximum number of tolerable corrupt nodes, and send the key initial parameters, the encrypted disk creation application, the super reversible matrix, and the first encryption node set to each first encryption node in the first encryption node set; wherein the key initial parameters are generated by the system management server during the initialization process; The encryption node is used to generate a shared secret corresponding to each other first encryption node according to the key initial parameter, and send the generated shared secret to the corresponding first encryption node; The encryption node is further used to verify the received shared secret when receiving the shared secret sent by other first encryption nodes, and add the first encryption node corresponding to the verified shared secret to the local second encryption node set; The encryption node is further used to determine a third encryption node set that ultimately participates in the distributed key generation through a consistency negotiation method based on the local second encryption node set and the second encryption node sets of each other first encryption node; The encryption node is further used to generate secret sharing shares corresponding to each other first encryption node according to the third encryption node set and the super reversible matrix, and send the generated secret sharing shares to the corresponding first encryption node; The encryption node is further used to generate a private key share of the node according to the received secret sharing shares sent by each other first encryption node when receiving the secret sharing shares sent by other first encryption nodes; The encryption node is also used to send the private key share of the node to the client; The client is also used to generate an encryption key based on the received private key share, and to create and encrypt the disk based on the generated encryption key.

Images