Cloud certificate storage method and system based on threshold algorithm

Abstract

The invention discloses a cloud certificate storage method and system based on a threshold algorithm, and relates to the field of information security. The method comprises the following steps: generating a signature public key and a signature private key through a central node, and generating a certificate signature request based on the signature public key; the certificate signature request is sent to a key management center, and a key protection structure is generated and returned through the key management center and comprises an encryption private key and a symmetric key; using the signature private key to perform asymmetric decryption on the symmetric key in the key protection structure, and using the decrypted symmetric key to decrypt the encryption private key in the key protection structure; respectively splitting the signature private key and the decrypted encryption private key by using a threshold algorithm to generate a plurality of key fragments, and encrypting each key fragment; and storing the encrypted key fragments in a plurality of service nodes in a distributed manner. According to the scheme, the private key is split into a plurality of key fragments for distributed storage, so that the security of cloud certificate storage is improved, and the hardware cost and the operation and maintenance complexity are reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a cloud certificate storage method and system based on a threshold algorithm. Background Art

[0002] With the rapid development of cloud computing and digital services, cloud storage of certificates (cloud certificates) has become an important means to ensure network data security. Cloud certificate services break the reliance of traditional certificate management on devices, support users to access and manage certificates anytime and anywhere, and are compatible with multiple operating systems and browsers. Compared with traditional methods, cloud certificate storage significantly improves the convenience of certificate use, can help service providers quickly complete deployment and integration, and simplify cross-platform operations.

[0003] However, with the widespread application of cloud certificate services, the security of the system faces new challenges. In order to ensure the security of cloud certificate storage and use, most cloud certificate systems currently use security services such as data encryption servers, signature verification servers, and timestamp servers. These services protect the confidentiality, integrity, and authenticity of data through encryption technology to ensure the safe operation of the cloud certificate system. However, this approach relies heavily on high-cost hardware devices, which need to be deployed in professional computer rooms and physically isolated, and also require complex installation, debugging, and regular maintenance. This not only increases the cost of system construction and operation, but also places higher requirements on the professional skills of operation and maintenance personnel. In addition, the existing architecture is also limited in terms of system expansion and flexibility.

[0004] Therefore, how to reduce hardware costs and operation and maintenance complexity while ensuring high security and reliability of the system has become a technical problem that needs to be urgently solved in the current cloud certificate storage system. Summary of the invention

[0005] The purpose of the present invention is to provide a cloud certificate storage method and system based on a threshold algorithm, which splits the private key into multiple key shards and performs distributed storage through the threshold algorithm, thereby improving the security and efficiency of cloud certificate storage and reducing hardware costs and operation and maintenance complexity.

[0006] To achieve the above object, the present invention discloses the following technical solution: A first aspect of the present invention provides a cloud certificate storage method based on a threshold algorithm, which is applied to a central node, and the method includes: Generate a signature key pair through the central node, including a signature public key and a signature private key, and generate a certificate signing request based on the signature public key; Send the certificate signing request to the key management center of the CA organization, and generate and return a signing certificate, an encryption certificate and a key protection structure through the key management center. The key protection structure includes an encrypted private key encrypted using a symmetric key and a symmetric key encrypted using a signature public key; Use the signature private key to asymmetrically decrypt the symmetric key in the key protection structure, and use the decrypted symmetric key to decrypt the encrypted private key in the key protection structure; Using a threshold algorithm to split the signature private key and the decrypted encryption private key respectively to generate multiple key fragments, and encrypting each key fragment to generate encrypted key fragments; The encrypted key fragments are distributed and stored in multiple business nodes to perform distributed and secure storage of the key.

[0007] Optionally, in the cloud certificate storage method, the step of generating a signature key pair through a central node includes: Receive a certificate download request sent by a business node; According to the certificate download request, the central node generates a signature public key and a signature private key.

[0008] Optionally, in the above-mentioned cloud certificate storage method, the central node uses the Shamir key splitting algorithm to split the signature private key and the decrypted encryption private key respectively, generate multiple key shards, and use the SM4 symmetric encryption algorithm to encrypt each key shard.

[0009] Optionally, the cloud certificate storage method described above, when the central node executes the certificate signing, includes: Receive a digital signature request sent by a business node; The data to be signed is broadcasted to each business node, and each business node uses its own key shard to perform a partial signing operation on the original data; Each business node transmits the partial signature data generated by itself back to the central node, and the central node uses the Lagrange interpolation algorithm to merge the partial signature data to generate the signature result.

[0010] Optionally, in the above-mentioned cloud certificate storage method, the central node uses the Lagrange interpolation algorithm to merge part of the signature data to generate a signature result, including: Receive partial signature data from multiple business nodes; Determine the valid partial signature data to be merged according to the threshold value; Using the Lagrange interpolation algorithm to merge the valid partial signature data to generate a complete signature result; The generated signature result is returned to the application through the business node.

[0011] Optionally, the cloud certificate storage method described above, when the central node performs certificate decryption, includes: Receive the encrypted certificate data sent by the business node; The data to be decrypted is broadcast to each business node, and each business node uses its own key shard to perform partial decryption operations on the encrypted data; Each business node transmits the partially decrypted data generated by itself back to the central node, and the central node uses the Lagrange interpolation algorithm to merge the partially decrypted data to generate a decryption result.

[0012] Optionally, in the cloud certificate storage method, the central node uses a Lagrange interpolation algorithm to merge part of the decrypted data to generate a decryption result, including: Receiving partially decrypted data from multiple business nodes; Determine the valid partial decrypted data to be merged according to the threshold value; Using the Lagrange interpolation algorithm to merge the valid partial decrypted data to generate a complete decryption result; The generated decryption result is returned to the application through the business node.

[0013] Another aspect of the present invention provides a cloud certificate storage system based on a threshold algorithm, comprising a central node and a plurality of service nodes, wherein the central node is connected to each service node respectively; The central node is configured to generate a signature key pair, including a signature public key and a signature private key, and generate a certificate signing request based on the signature public key; send the certificate signing request to the key management center of the CA organization, and receive the signature certificate, encryption certificate and key protection structure returned by the key management center, the key protection structure including an encryption private key encrypted by a symmetric key and a symmetric key encrypted by a signature public key; use the signature private key to asymmetrically decrypt the symmetric key in the key protection structure, and use the decrypted symmetric key to decrypt the encryption private key in the key protection structure; use the threshold algorithm to split the signature private key and the decrypted encryption private key respectively to generate multiple key fragments, and encrypt each key fragment to generate an encrypted key fragment; store the encrypted key fragments in a distributed manner in multiple business nodes to perform distributed and secure storage of keys; The service node is configured to receive and store encrypted key fragments from the central node.

[0014] Optionally, in the above-mentioned cloud certificate storage system, when the system executes certificate signing, the central node is configured to receive a digital signature request sent by a business node; broadcast the data to be signed to each business node; receive partial signature data from each business node; and use the Lagrange interpolation algorithm to merge the partial signature data to generate a final signature result; The business nodes are configured to receive the data to be signed broadcasted by the central node; use the key fragments stored in each of them to perform a partial signing operation on the data to be signed to generate partial signature data; and send the partial signature data to the central node for the central node to merge and generate a signature result.

[0015] Optionally, in the above-mentioned cloud certificate storage system, when the system performs certificate decryption, the central node is configured to receive encrypted certificate data sent by the business node; broadcast the data to be decrypted to each business node; receive partial decrypted data from each business node; and use the Lagrange interpolation algorithm to merge the partial decrypted data to generate a final decryption result; The business nodes are configured to receive the data to be decrypted broadcasted by the central node; perform partial decryption operations on the data to be decrypted using the key fragments stored in each of them to generate partial decrypted data; and send the partial decrypted data to the central node for the central node to merge and generate a decryption result.

[0016] The effects provided in the content of the invention are only the effects of the embodiments, not all the effects of the invention. One of the above technical solutions has the following advantages or beneficial effects: The cloud certificate storage method and system based on the threshold algorithm provided in the present application use the threshold algorithm to split the signature private key and the decrypted encryption private key, and encrypt the generated key shards and store them in multiple business nodes in a distributed manner. On the one hand, this distributed storage method avoids the security risks caused by single point failures and node compromise; on the other hand, through the fault-tolerant characteristics of the threshold algorithm, even if some key shards are lost or damaged, the complete key can still be restored through the shards that meet the threshold, thereby enhancing the fault tolerance and data availability of the system. In addition, this solution generates a signature key pair and a certificate signing request through a central node, and combines the signature certificate, encryption certificate and key protection structure generated by the key management center to ensure the security of certificates and keys during generation, storage and use. Through the symmetric encryption and asymmetric encryption mechanisms in the key protection structure, the encryption private key and symmetric key are effectively protected, further improving the confidentiality of the data. Compared with the prior art, this solution does not require high-cost dedicated hardware equipment, reduces hardware procurement and maintenance costs, and provides higher flexibility and scalability while ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] Figure 1 A schematic diagram of a cloud certificate storage method based on a threshold algorithm according to an embodiment of the present application; Figure 2 A schematic diagram of a digital certificate issuance process according to an embodiment of the present application; Figure 3 A schematic diagram of a certificate signing process in an embodiment of the present application; Figure 4 A schematic diagram of a certificate decryption process in an embodiment of the present application; Figure 5 A schematic diagram of a cloud certificate storage system architecture based on a threshold algorithm according to an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0020] It should be noted that references to "one embodiment", "embodiment", "example embodiment", etc. in this specification refer to the embodiment being described which may include specific features, structures or characteristics, but not every embodiment must include these specific features, structures or characteristics. In addition, such expressions do not refer to the same embodiment. Furthermore, when describing specific features, structures or characteristics in conjunction with an embodiment, whether or not there is an explicit description, it is indicated that incorporating such features, structures or characteristics into other embodiments is within the knowledge of those skilled in the art.

[0021] Since most of the existing cloud certificate storage systems rely on expensive hardware equipment, these devices need to be deployed in professional computer rooms and undergo complex installation, debugging and regular maintenance, resulting in high system construction and operation costs, while increasing the workload of operation and maintenance personnel. In addition, these systems are also subject to certain limitations in terms of scalability and flexibility. Based on this, the embodiment of the present application provides a cloud certificate storage method and system based on a threshold algorithm, which splits the private key into multiple key shards through a threshold algorithm, and distributes and manages these key shards, thereby effectively improving the security and efficiency of cloud certificate storage, improving the scalability and flexibility of the system, and providing a more reliable solution for data protection and key management in a cloud computing environment.

[0022] refer to Figure 1 , Figure 1 A schematic diagram of a cloud certificate storage method based on a threshold algorithm according to an embodiment of the present application is shown. The method package is applied to a central node and includes: S110, generating a signature key pair through the central node, including a signature public key and a signature private key, and generating a certificate signing request based on the signature public key; In this step, the signature public key is used to encrypt data or verify the digital signature, and the signature private key is used to decrypt data or generate a digital signature.

[0023] S120, sending the certificate signing request to the key management center of the CA organization, and generating and returning a signing certificate, an encryption certificate, and a key protection structure through the key management center. The key protection structure includes an encryption private key encrypted using a symmetric key and a symmetric key encrypted using a signature public key; In this step, the security of key management is enhanced through multiple encryption mechanisms, preventing key leakage or illegal access during transmission and storage, and providing reliable protection for subsequent distributed storage and use of keys.

[0024] S130, using the signature private key to asymmetrically decrypt the symmetric key in the key protection structure, and using the decrypted symmetric key to decrypt the encrypted private key in the key protection structure; In this step, through the hierarchical decryption process, it is ensured that the encrypted private key can only be safely restored in the legitimate central node, preventing the risk of key leakage during transmission or storage. At the same time, the decryption chain combines symmetric and asymmetric encryption technology to effectively enhance the security of the system.

[0025] S140, using a threshold algorithm to split the signature private key and the decrypted encryption private key respectively to generate multiple key fragments, and encrypting each key fragment to generate encrypted key fragments; In this step, a threshold algorithm is used to split each private key into multiple fragments, and each generated fragment is encrypted separately to ensure that even if the fragment is intercepted, the original key content cannot be directly decrypted.

[0026] S150. Distribute and store the encrypted key shards in multiple business nodes to perform distributed and secure storage of the key.

[0027] The method of this embodiment effectively avoids the security risks caused by single point failure and node compromise by splitting the private key into multiple key shards and performing distributed storage. At the same time, by utilizing the fault-tolerant characteristics of the threshold algorithm, even if some key shards are lost or damaged, the complete key can still be restored through the shards that meet the threshold, thereby improving the system's fault tolerance and data availability. In addition, this method does not require high-cost dedicated hardware equipment, reduces hardware procurement and maintenance costs, and enhances the scalability and flexibility of the system.

[0028] In one embodiment, the generation of a signature key pair by a central node in the above step S110 includes: Receive a certificate download request sent by a business node; According to the certificate download request, the central node generates a signature public key and a signature private key.

[0029] After receiving the request from the business node, the central node generates a key pair, ensuring the uniqueness and pertinence of the key pair, while ensuring the security and efficiency of the key generation and distribution process.

[0030] In one embodiment, in the above step S140, the signature private key and the decrypted encryption private key are split respectively using a threshold algorithm to generate multiple key fragments, and each key fragment is encrypted to generate an encrypted key fragment, specifically including: The central node uses the Shamir key splitting algorithm to split the signature private key and the decrypted encryption private key respectively to generate multiple key shards; then, each key shard is encrypted using the SM4 symmetric encryption algorithm to generate encrypted key shards.

[0031] The Shamir key splitting algorithm is used to ensure the security and fault tolerance of key sharding. Combined with SM4 symmetric encryption, the confidentiality of key sharding is further enhanced, which can effectively prevent information leakage during transmission and storage of shards.

[0032] refer to Figure 2 Based on the above-mentioned cloud certificate storage method, a schematic diagram of the process of downloading a digital certificate in an embodiment of the present application is obtained as follows: Figure 2 As shown. Figure 2 In the figure, A-1 represents the certificate download interface of the central node, which can be used to generate signature key pairs and certificate signing requests. C-1 represents the certificate download interface of the business node, which can forward the application's request to the certificate download interface of the corresponding central node. A-2 represents the key splitting protection using the Shamir secret sharing scheme in the threshold algorithm. The central idea is that in a two-dimensional plane, any two points on a straight line can determine the straight line, and any three points on a parabola can determine the parabola. In the threshold algorithm, assuming that the original private key is d, in a scenario where at least 2 participants (t=1) are required for calculation, it is sufficient to construct a straight line passing through the point (0, d) with a slope a (not 0) that is a random value. Then the points on the line are assigned to different participants as their private key fragments, so that at least two participants can restore the line through these two points and thus recover the original private key. Similarly, in the scenario where at least 3 participants (t=2) are required to perform the calculation, we only need to construct a random quadratic equation . By analogy, constructing higher-order equations can solve the situation of more participants. The central node performs Shamir splitting and distribution of the private key. Before the split key shards are distributed to each business node, SM4 symmetric encryption is performed to enhance the protection of the key. A-3, B-3, and C-3 are used to represent key shards respectively.

[0033] In some embodiments, the above-mentioned cloud certificate storage method, when the central node executes the certificate signing, includes the following steps: Receive a digital signature request sent by a business node; The data to be signed is broadcasted to each business node, and each business node uses its own key shard to perform a partial signing operation on the original data; Each business node transmits the partial signature data generated by each of them back to the central node, and the central node uses the Lagrange interpolation algorithm to merge the partial signature data to generate the signature result. The central node uses the Lagrange interpolation algorithm to merge the partial signature data to generate the signature result, including: Receive partial signature data from multiple business nodes; Determine the valid partial signature data to be merged according to the threshold value; Use the Lagrange interpolation algorithm to merge the valid part of the signature data to generate a complete signature result; The generated signature result is returned to the application through the business node.

[0034] The certificate signing method of this process not only ensures the security and reliability of the signing process, but also makes full use of the threshold algorithm and distributed technology to improve the fault tolerance and scalability of the system and avoid the risk of single point failure.

[0035] refer to Figure 3 Based on the above-mentioned cloud certificate storage method, a digital signature process diagram of an embodiment of the present application is obtained as follows: Figure 3 As shown. Figure 3 In the figure, A-1 represents the signature interface of the central node, which can request shard signatures from all business nodes after receiving the original signature. C-1 represents the signature interface of the business node, which can forward the request to the corresponding central node signature interface according to the request parameters of the application. A-2 represents joint Shamir zero secret sharing, and its process is similar to the joint Shamir random secret sharing process. The only difference is that the secret value chosen by each participant to share is 0. Therefore, the secret shared by all participants is 0. This method can be used to implement verification and consistency checks in distributed systems without leaking any actual secrets, ensuring the security and correctness of multi-party computing or protocol execution. A-4 means that each participant regards himself as a trusted center, randomly selects a secret value Si, and constructs a polynomial according to the t-order Shamir secret sharing scheme (SS) . Each participant then generates shares based on the polynomial and distributes these shares to the other n-1 participants. After receiving the shares of other participants, each participant calculates its own comprehensive secret share . This process ensures that even in a distributed environment, the secret sharing of each participant can be completed securely, and only the set of participants that meet the threshold conditions can recover the final secret. A-3 indicates that in the joint secret sharing process, each participant sums up all the secret shares received by itself and calculates the aggregated comprehensive secret share. A-5 indicates further summing or verification of the result in A-3. A-6 indicates that at least t+1 participants perform point multiplication operations and broadcast the results to other participants. A-7 indicates that the final secret value is recovered through the interpolation formula, and the interpolation formula recovers the complete secret based on the shares of all participants (at least t+1). A-8 indicates that partial secret sharing is performed to obtain the point multiplication result, providing the necessary data for the recovery process. A-9 indicates that the central node provides a shard signature interface. A-10 indicates that the signature share is calculated based on the shard. A-11 indicates that the final signature result is recovered through the interpolation formula. Subsequently, the signature verification process is consistent with the standard signature verification process.

[0036] In some embodiments, the cloud certificate storage method described above, when the central node performs certificate decryption, includes: Receive the encrypted certificate data sent by the business node; The data to be decrypted is broadcast to each business node, and each business node uses its own key shard to perform partial decryption operations on the encrypted data; Each business node transmits the partially decrypted data generated by each node back to the central node, and the central node uses the Lagrange interpolation algorithm to merge the partially decrypted data to generate the decryption result. Among them, the central node uses the Lagrange interpolation algorithm to merge the partially signed data to generate the decryption result, including: Receiving partially decrypted data from multiple business nodes; Determine the valid partial decrypted data to be merged according to the threshold value; Using the Lagrange interpolation algorithm to merge the valid partial decrypted data to generate a complete decryption result; The generated decryption result is returned to the application through the business node.

[0037] The certificate decryption method of this process can effectively deal with uncertain factors such as node failures and network problems while ensuring high security and high fault tolerance, making the entire process more reliable, flexible and efficient.

[0038] refer to Figure 4 Based on the above cloud certificate storage method, a data decryption process diagram of an embodiment of the present application is obtained as follows: Figure 4 As shown. Figure 4In the figure, A-1 represents the decryption interface of the central node, which can be used to receive ciphertext and distribute it to the decryption interface of all node shards. C-1 represents the decryption interface of the business node, which can forward the request to the decryption interface of the corresponding central node according to the request parameters of the application. A-2, B-2, and C-2 represent the shard decryption interfaces of the business nodes. The business nodes perform shard decryption operations according to the ciphertext fragments assigned to them by the central node. A-3, B-3, and C-3 represent that at least t+1 participants calculate the point product results related to the ciphertext, generate the preliminary decryption results of each participant and broadcast them. A-4 represents the point recovery through the interpolation formula, and the interpolation formula (Lagrange interpolation) is used to recover the final decryption result. According to the point product results of at least t+1 participants, the interpolation formula will synthesize the final decrypted data.

[0039] In summary, the cloud certificate storage method based on the threshold algorithm of this embodiment significantly improves the high security and efficiency of cloud certificate storage by splitting the private key into multiple key shards and performing distributed storage, combining the threshold algorithm and symmetric encryption technology. This method ensures that only the key shard set that meets the preset threshold value can restore the complete private key, thereby effectively preventing single point failures, key leakage and malicious attacks, and enhancing the protection capabilities of the system. At the same time, distributed storage reduces the dependence on expensive hardware devices, simplifies the deployment and maintenance of the system, and improves the scalability and flexibility of the system.

[0040] refer to Figure 5 , Figure 5 A schematic diagram of a cloud certificate storage system architecture based on a threshold algorithm in an embodiment of the present application is shown. The cloud certificate storage system includes a central node (such as central node A) and multiple service nodes (such as service node B and service node C), and the central node is connected to each service node respectively; The central node is configured to generate a signature key pair, including a signature public key and a signature private key, and generate a certificate signing request based on the signature public key; send the certificate signing request to the key management center of the CA organization, and receive the signature certificate, encryption certificate and key protection structure returned by the key management center, the key protection structure including an encryption private key encrypted by a symmetric key and a symmetric key encrypted by a signature public key; use the signature private key to asymmetrically decrypt the symmetric key in the key protection structure, and use the decrypted symmetric key to decrypt the encryption private key in the key protection structure; use the threshold algorithm to split the signature private key and the decrypted encryption private key respectively to generate multiple key shards, and encrypt each key shard to generate encrypted key shards; store the encrypted key shards in a distributed manner in multiple business nodes to perform distributed and secure storage of keys; The service node is configured to receive and store the encrypted key shards from the central node.

[0041] In some embodiments, when the system executes a certificate signature, the central node is configured to receive a digital signature request sent by a business node; broadcast the data to be signed to each business node; receive partial signature data from each business node; merge the partial signature data using the Lagrange interpolation algorithm to generate a final signature result. The business node is configured to receive the data to be signed broadcast by the central node; perform a partial signature operation on the data to be signed using the key fragments stored by each of them to generate partial signature data; and send the partial signature data to the central node for the central node to merge and generate a signature result.

[0042] In some embodiments, when the system performs certificate decryption, the central node is configured to receive encrypted certificate data sent by the service node; broadcast the data to be decrypted to each service node; receive partial decrypted data from each service node; merge the partial decrypted data using the Lagrange interpolation algorithm to generate a final decryption result. The service node is configured to receive the data to be decrypted broadcast by the central node; perform partial decryption operations on the data to be decrypted using the key fragments stored by each of them to generate partial decrypted data; send the partial decrypted data to the central node for the central node to merge and generate a decryption result.

[0043] exist Figure 5 In the CA, the CA organization is the authority that issues and manages digital certificates. A-1, B-1, and C-1 are used to store the structured information of logs such as request logs and user operation logs received by the node service. A-2 is used to store all CA-related docking configurations, all node configuration information, all application configuration information, user PIN codes, user certificate information, and key sharding information. B-2 and C-2 are used to store the central node and current node configuration information, the application configuration information docked by the current node, user certificate information, and key sharding information. A-3, B-3, and C-3 are mainly responsible for storing cache information to improve the processing efficiency of the entire system. A-4, B-4, and C-4 are mainly responsible for storing the detailed content of logs such as interface request logs and user operation logs, and are encrypted and stored using a symmetric encryption algorithm. A-5 represents the central node service, which is managed by an authoritative organization or department and is used to provide CA configuration management, PIN code storage, verification, and change services, the splitting and distribution of keys to each node after issuance, and the merging of the results of signature decryption and processing of each node. It only provides services to business nodes and does not provide services to the outside. B-5 and C-5 represent business node services, which can be managed by different application service providers. One service provider can only manage one business node, which is mainly responsible for providing services such as certificate issuance, signing, and decryption, and providing key sharding storage, signing, and decryption services for the A-5 central node. C-6 represents the server of the certificate application. The client is a certificate app, mini-program, etc.

[0044] Regarding the processes not described in detail in the cloud certificate storage system based on the threshold algorithm in this embodiment, please refer to the relevant parts in the above-mentioned cloud certificate storage method embodiment based on the threshold algorithm, which will not be repeated here.

[0045] The above description is only a preferred embodiment of the present invention and does not limit the present invention in other forms. Any technician familiar with the profession may use the technical content disclosed above to change or modify it into an equivalent embodiment with equivalent changes and apply it to other fields. However, any simple modification, equivalent change and modification made to the above embodiment based on the technical essence of the present invention without departing from the content of the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A cloud certificate storage method based on threshold algorithm, characterized in that: Applied to the central node, the method includes: Generate a signature key pair through the central node, including a signature public key and a signature private key, and generate a certificate signing request based on the signature public key; Send the certificate signing request to the key management center of the CA organization, and generate and return a signing certificate, an encryption certificate and a key protection structure through the key management center. The key protection structure includes an encrypted private key encrypted using a symmetric key and a symmetric key encrypted using a signature public key; Use the signature private key to asymmetrically decrypt the symmetric key in the key protection structure, and use the decrypted symmetric key to decrypt the encrypted private key in the key protection structure; Using a threshold algorithm to split the signature private key and the decrypted encryption private key respectively to generate multiple key fragments, and encrypting each key fragment to generate encrypted key fragments; The encrypted key fragments are distributed and stored in multiple business nodes to perform distributed and secure storage of the key.

2. The cloud certificate storage method according to claim 1, characterized in that: The generating of the signature key pair through the central node includes: Receive a certificate download request sent by a business node; According to the certificate download request, the central node generates a signature public key and a signature private key.

3. The cloud certificate storage method according to claim 1 or 2, characterized in that: The central node uses the Shamir key splitting algorithm to split the signature private key and the decrypted encryption private key respectively to generate multiple key fragments, and uses the SM4 symmetric encryption algorithm to encrypt each key fragment.

4. The cloud certificate storage method according to claim 3, characterized in that: When the central node performs certificate signing, it includes: Receive a digital signature request sent by a business node; The data to be signed is broadcasted to each business node, and each business node uses its own key shard to perform a partial signing operation on the original data; Each business node transmits the partial signature data generated by itself back to the central node, and the central node uses the Lagrange interpolation algorithm to merge the partial signature data to generate the signature result.

5. The cloud certificate storage method according to claim 4, characterized in that: The central node uses the Lagrange interpolation algorithm to merge part of the signature data to generate a signature result, including: Receive partial signature data from multiple business nodes; Determine the valid partial signature data to be merged according to the threshold value; Using the Lagrange interpolation algorithm to merge the valid partial signature data to generate a complete signature result; The generated signature result is returned to the application through the business node.

6. The cloud certificate storage method according to claim 3, characterized in that: When the central node performs certificate decryption, it includes: Receive the encrypted certificate data sent by the business node; The data to be decrypted is broadcast to each business node, and each business node uses its own key shard to perform partial decryption operations on the encrypted data; Each business node transmits the partially decrypted data generated by itself back to the central node, and the central node uses the Lagrange interpolation algorithm to merge the partially decrypted data to generate a decryption result.

7. The cloud certificate storage method according to claim 6, characterized in that: The central node uses the Lagrange interpolation algorithm to merge the partial decrypted data to generate a decryption result, including: Receiving partially decrypted data from multiple business nodes; Determine the valid partial decrypted data to be merged according to the threshold value; Using the Lagrange interpolation algorithm to merge the valid partial decrypted data to generate a complete decryption result; The generated decryption result is returned to the application through the business node.

8. A cloud certificate storage system based on threshold algorithm, characterized in that: It includes a central node and multiple service nodes, wherein the central node is connected to each service node respectively; wherein, The central node is configured to generate a signature key pair, including a signature public key and a signature private key, and generate a certificate signing request based on the signature public key; send the certificate signing request to the key management center of the CA organization, and receive the signature certificate, encryption certificate and key protection structure returned by the key management center, the key protection structure including an encryption private key encrypted by a symmetric key and a symmetric key encrypted by a signature public key; use the signature private key to asymmetrically decrypt the symmetric key in the key protection structure, and use the decrypted symmetric key to decrypt the encryption private key in the key protection structure; use the threshold algorithm to split the signature private key and the decrypted encryption private key respectively to generate multiple key fragments, and encrypt each key fragment to generate an encrypted key fragment; store the encrypted key fragments in a distributed manner in multiple business nodes to perform distributed and secure storage of keys; The service node is configured to receive and store encrypted key fragments from the central node.

9. The cloud certificate storage system according to claim 8, characterized in that: When the system executes the certificate signing, the central node is configured to receive the digital signature request sent by the business node; broadcast the data to be signed to each business node; receive partial signature data from each business node; use the Lagrange interpolation algorithm to merge the partial signature data to generate a final signature result; The service node is configured to receive the data to be signed broadcasted by the central node; Perform partial signing operations on the data to be signed using the key shards stored separately to generate partial signature data; The partial signature data is sent to the central node for the central node to combine and generate a signature result.

10. The cloud certificate storage system according to claim 8, characterized in that: When the system performs certificate decryption, the central node is configured to receive encrypted certificate data sent by the service node; broadcast the data to be decrypted to each service node; receive partial decrypted data from each service node; and combine the partial decrypted data using the Lagrange interpolation algorithm to generate a final decryption result; The service node is configured to receive the data to be decrypted broadcasted by the central node; A partial decryption operation is performed on the data to be decrypted using the key fragments stored respectively to generate partial decrypted data; the partial decrypted data is sent to the central node for the central node to combine and generate a decryption result.

Images