Security domain initialization method and system and data controllable use method
By using the master node to encrypt and distribute the private key B in a distributed cluster, each slave node decrypts and initializes the security domain, the security domain initialization problem caused by the different keys of each node A in the distributed cluster is solved, and fast and secure multi-node security domain initialization is achieved.
Patent Information
- Application Number
- CN202411408822.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-10
- Publication Date
- 2025-03-11
AI Technical Summary
In a distributed cluster, each node generates A key based on the measurement value of its system, and it is impossible to uniformly distribute B private keys to each node, resulting in the inability to achieve unified initialization of the security domain.
After the master node receives the private key B from the operating organization and the first public key of each slave node, the master node uses the first public key to encrypt the private key B and distributes the encrypted data to each slave node. The slave node uses the first private key to decrypt the encrypted data, obtain the private key B, and is used to initialize the preset security domain.
It realizes the fast initialization of security domains for multiple nodes in a distributed cluster, ensuring the security and unity of security domain keys, and preventing data leakage and secondary trafficking.
Smart Images
Figure CN119598464A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of software engineering, and in particular to a security domain initialization method, system and data controllable use method. Background Art
[0002] Full disk encryption technology (LUKS): All data in a disk partition is encrypted with a certain key. The key is called B key (consisting of B public key and B private key).
[0003] A security domain refers to one or more disk partitions encrypted with the same set of B keys. For devices with B private keys, the security domain is completely transparent to applications. B keys correspond to security domains one by one. Therefore, in a distributed cluster, if the nodes have the same B keys, they can be considered to belong to the same security domain.
[0004] The existing technology provides a new paradigm for privacy computing: the storage / computing nodes of data users are divided into security domains controlled by data providers, and private data can only be processed and handled in the security domain. In specific implementation, the guardian module of a single node generates an A key (consisting of an A public key and an A private key) in the TPM based on the measurement value of its system, and sends the A public key to the server module. After receiving the A public key, the server module encrypts the B private key with the A public key, and sends the encrypted B private key to the guardian module. Subsequently, the guardian module calls the decryption function of the TPM to obtain the plaintext of the B key and stores it in a memory file.
[0005] That is, the prior art only considers the initialization of the security domain on a single machine. However, in a distributed cluster, each node generates a different A key based on the measurement value of its system, so it is impossible to uniformly distribute the B private key to each node. Summary of the invention
[0006] In view of the technical defects in the prior art, the purpose of the embodiments of the present invention is to provide a security domain initialization method, system and data controllable use method for a distributed cluster, so as to quickly initialize the security domain of multiple nodes on the basis of meeting the security domain requirements.
[0007] To achieve the above objectives, in a first aspect, an embodiment of the present invention provides a security domain initialization method, which is applicable to multiple nodes in a distributed cluster, wherein the distributed cluster includes a master node and at least two slave nodes; the security domain initialization method includes:
[0008] The master node receives the private key B from the operating organization and the first public key from each slave node;
[0009] The master node encrypts the private key B using the first public key to obtain encrypted data, and distributes the encrypted data to each slave node;
[0010] The slave node uses the first private key to decrypt the encrypted data to obtain the private key B, and uses the private key B to initialize a preset security domain; the first public key and the first private key constitute a pair of asymmetric keys.
[0011] As a preferred implementation of the present application, before the master node receives the first public key from each slave node, the method further includes:
[0012] Each of the slave nodes generates a first key in the TPM according to the measurement value of the system, and generates a first key certificate; wherein the first key includes a first private key and a first public key; and the first private key is stored in the TPM;
[0013] The first key proof is a signature given by the TPM and contains the measurement value of the system.
[0014] As a preferred implementation of the present application, after generating the first key certificate, the method further includes:
[0015] Each of the slave nodes completes system initialization and stores the system measurement value in the TPM;
[0016] After each of the slave nodes is started, the master node uses the first key to prove whether the measurement value of the verification system is legal.
[0017] As a specific implementation of the present application, the slave node uses the first private key to decrypt the encrypted data to obtain the private key B, specifically:
[0018] The slave node calls the decryption function of the TPM, uses the first private key to decrypt the encrypted data, obtains the plain text of the private key B, and stores it in the memory file.
[0019] As a preferred implementation of the present application, after obtaining the plain text of the private key B, the method further includes:
[0020] The plaintext of private key B is stored in the file system so that it can be reused after the system is restarted.
[0021] Furthermore, the slave node includes a guard module, a utility module and a kernel module, and uses the private key B to initialize a preset security domain, specifically:
[0022] The system automatically initiates a request to the utility module, the utility module specifies the security domain range through the guard module, and uses the private key B as the encryption key of the security domain;
[0023] The guard module also configures the security domain information into the kernel module.
[0024] In a second aspect, an embodiment of the present application further provides a security domain initialization system, including an operating organization, a master node and at least two slave nodes;
[0025] The operating organization is used to generate or import private key B;
[0026] The master node is used to:
[0027] Receive the private key B from the operating organization and the first public key from each slave node;
[0028] The private key B is encrypted using the first public key to obtain encrypted data, and the encrypted data is distributed to each slave node;
[0029] The slave node is used to:
[0030] The encrypted data is decrypted using the first private key to obtain a private key B, and the private key B is used to initialize a preset security domain; the first public key and the first private key constitute a pair of asymmetric keys.
[0031] In a third aspect, an embodiment of the present invention provides a method for controllable use of data, including:
[0032] Initialize the preset security domain using the method described in the first aspect above;
[0033] The data provider imports the encrypted data into the initialized security domain;
[0034] The data user decrypts the encrypted data to obtain the original data, and makes controllable use of the original data.
[0035] By implementing the embodiment of the present invention, for multiple nodes in a distributed cluster, while ensuring that the key of the security domain is not leaked (that is, the requirement of data controllability is met), the security domain initialization of the multiple nodes can be quickly completed.
[0036] In addition, in the embodiment of the present invention, the data user can only process the asymmetrically encrypted data delivered by the data provider in the preset security domain, which ensures that the privacy data of the data provider is visible to the data user, but prevents the data user from copying the data in various ways for secondary sales. At the same time, the method also has the advantages of non-intrusiveness to the original business system (that is, the data analysis source code does not need to be changed to meet the privacy protection requirements), supports various CPU architectures and computing devices, and ensures high performance. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the specific implementation of the present invention or the technical solution in the prior art, the drawings required for use in the specific implementation or the description of the prior art are briefly introduced below.
[0038] Figure 1 is a system flow chart of the present invention;
[0039] Figure 2 is a schematic flow chart of a security domain initialization method provided by an embodiment of the present invention;
[0040] Figure 3 It is a schematic flow chart of a method for controllable use of data provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0042] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.
[0043] like Figure 1 As shown, the actual scenario described in the present invention is that the operating organization encrypts and protects the data provided by the data provider while initializing the security domain for the distributed cluster node of the data user. The method of the embodiment of the present invention is applicable to multiple nodes in a distributed cluster, and the distributed cluster includes a master node and at least two slave nodes.
[0044] Please refer to Figure 2 , the security domain initialization method provided by an embodiment of the present invention includes:
[0045] S101, each slave node generates a first key in the TPM according to a measurement value of the system, and also generates a first key certificate.
[0046] like Figure 1 As shown, the method of this embodiment mainly involves an operating organization, a master node (Master node) and a slave node (Slave node).
[0047] The operating organization includes a setting module for generating or importing a key B; the master node includes a server module, and the slave node includes a daemon module, a utility module and a kernel module.
[0048] The daemon module is a daemon process running in the system, and its functions include initializing the system, processing related operations for the utility module, providing the kernel with configuration about the security domain, and communicating with the data provider.
[0049] The utility module is a tool for users to operate and configure. It provides operations such as initializing the security domain, extending the security domain, deleting the security domain, and exporting data from the security domain.
[0050] The kernel module checks the process for reading and writing files according to the configuration given by the daemon module, but can only write in the secure domain.
[0051] After the system is initialized (including after the system is restarted), the guardian module will store the system's measurement values in the TPM. The measurement content includes hardware, firmware, kernel modules, and guardian modules. After each slave node is started, its guardian module will verify whether the system's measurement values are legal. If illegal, an error is returned.
[0052] The guardian module of each slave node i generates A in TPM according to the measurement value of its system i Keys, including A i Private key and A i Public key. i The private key is stored in the TPM and an A i Key Proof. A i The key proof is a signature given by the TPM and contains the system's measurement value. This proof can ensure that A i The public key is generated by TPM and the system measurement value is legitimate, so it cannot be forged by anyone else.
[0053] Afterwards, each Slave node i will i Public key and A i The key certificate is sent to the Master node and is used by the Master node to encrypt B's private key.
[0054] It should be noted that before carrying out the method of this embodiment, some preparation work needs to be done, specifically:
[0055] The operator selects the B key for encrypting the usage data and designates a Master node and multiple Slave nodes. The Master node is responsible for receiving the B private key set by the operator and the A private key from each Slave node i. i public key, and use A's private key to i The public key is encrypted and distributed to each slave node i. Slave node i is responsible for using its own A iThe private key decrypts the received B private key and initializes the security domain with B private key.
[0056] S102, the master node receives the private key B from the operating organization and the first public key from each slave node.
[0057] S103, the master node uses the first public key to encrypt the private key B to obtain encrypted data, and distributes the encrypted data to each slave node.
[0058] Specifically, step S3 includes:
[0059] (1) The operator first generates or imports the B key through the setting module, and transmits the B key encrypted with the C key to the Master node. Among them, the C key is only known by the operator and the Master node.
[0060] (2) The Master node receives A from each Slave node i i Public key and A i After the key is proven, the metric value contained in the signature is verified to be legitimate, and A i The private key is generated by the TPM (not accessible).
[0061] (3) The Master node decrypts the encrypted B key sent by the operator, and then uses the A key of each Slave node i to decrypt the B private key. i The public key is encrypted to obtain the encrypted data, and the encrypted B private key (encrypted data) is sent to the corresponding Slave node i.
[0062] S104, the slave node uses the first private key to decrypt the encrypted data to obtain a private key B, and uses the private key B to initialize a preset security domain.
[0063] The first public key and the first private key constitute a pair of asymmetric keys.
[0064] Specifically, step S4 includes:
[0065] (1) After each slave node i receives the encrypted B private key, the guardian module calls the TPM's decryption function to obtain the B key plaintext and stores it in its memory file. Optionally, if the B key needs to be reused after the system is restarted, the encrypted B private key can be stored in the file system.
[0066] (2) After the guard module obtains B's private key through decryption, the system automatically initiates a request to the utility module. The utility module specifies the security domain range through the guard module and uses B's private key as the encryption key for the security domain. The guard module also configures the security domain information to the kernel module.
[0067] Based on the same inventive concept, an embodiment of the present invention further provides a global initialization system, including an operation organization, a master node and at least two slave nodes;
[0068] The operating organization is used to generate or import private key B;
[0069] The master node is used to:
[0070] Receive the private key B from the operating organization and the first public key from each slave node;
[0071] The private key B is encrypted using the first public key to obtain encrypted data, and the encrypted data is distributed to each slave node;
[0072] The slave node is used to:
[0073] The encrypted data is decrypted using the first private key to obtain a private key B, and the private key B is used to initialize a preset security domain; the first public key and the first private key constitute a pair of asymmetric keys.
[0074] Furthermore, the slave node is also used for:
[0075] Generate a first key in the TPM according to the measurement value of the system, and generate a first key certificate; wherein the first key includes a first private key and a first public key; the first private key is stored in the TPM; the first key certificate is a signature given by the TPM and includes the measurement value of the system;
[0076] After the system is initialized, the system's measurements are stored in the TPM.
[0077] Further, the slave node includes a guard module, which is used to:
[0078] The decryption function of the TPM is called, and the encrypted data is decrypted using the first private key to obtain the plain text of the private key B, and store it in the memory file.
[0079] Furthermore, the slave node further includes a utility module and a kernel module; the utility module is used to receive a request automatically initiated by the system, specify a security domain range through the guard module, and use the private key B as an encryption key for the security domain;
[0080] The guard module also configures the security domain information into the kernel module.
[0081] It should be noted that for a more specific process of initializing the security domain system, please refer to the aforementioned method embodiment, which will not be repeated here.
[0082] The above method describes a method for initializing the security domain of each node in a distributed cluster. In addition, an embodiment of the present invention provides a method for controlling the use of data, such as Figure 3 As shown, including:
[0083] S201, initializing a preset security domain.
[0084] It should be noted that, for detailed steps of step S201, please refer to the aforementioned method embodiment.
[0085] S202: The data provider imports the encrypted data into the initialized security domain.
[0086] In the specific implementation, the data provider (which can be understood as the aforementioned master node) will use public key 1 to encrypt the encrypted data and deliver it to the data user (which can be understood as the aforementioned slave node). The interaction method includes but is not limited to hardware copying, network transmission, etc., which is not restricted here.
[0087] After receiving the encrypted data, the data consumer calls the utility module, which will import the encrypted data into the initialized security domain through the guardian module.
[0088] S203, the data user decrypts the encrypted data to obtain original data, and uses the original data in a controllable manner.
[0089] In specific implementation, the data user calls private key 1 (which and public key 1 form a pair of asymmetric encryption keys) to decrypt the encrypted data, obtain the original data, and use the original data in a controllable manner within the security domain based on the operation request (read request or write request).
[0090] From the above description, it can be seen that by implementing the embodiment of the present invention, for multiple nodes in a distributed cluster, while ensuring that the keys of the security domain are not leaked (that is, the requirement of data controllability is met), the security domain initialization of multiple nodes can be quickly completed.
[0091] In addition, in the embodiment of the present invention, the data user can only process the asymmetrically encrypted data delivered by the data provider in the preset security domain, which ensures that the privacy data of the data provider is visible to the data user, but prevents the data user from copying the data in various ways for secondary sales. At the same time, the method also has the advantages of non-intrusiveness to the original business system (that is, the data analysis source code does not need to be changed to meet the privacy protection requirements), supports various CPU architectures and computing devices, and ensures high performance.
[0092] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.
Claims
1. A security domain initialization method, characterized in that: The security domain initialization method is applicable to multiple nodes in a distributed cluster, wherein the distributed cluster includes a master node and at least two slave nodes; The security domain initialization method comprises: The master node receives the private key B from the operating organization and the first public key from each slave node; The master node encrypts the private key B using the first public key to obtain encrypted data, and distributes the encrypted data to each slave node; The slave node uses the first private key to decrypt the encrypted data to obtain the private key B, and uses the private key B to initialize a preset security domain; the first public key and the first private key constitute a pair of asymmetric keys.
2. The security domain initialization method according to claim 1, characterized in that: Before the master node receives the first public key from each slave node, the method further includes: Each of the slave nodes generates a first key in the TPM according to the measurement value of the system, and generates a first key certificate; wherein the first key includes a first private key and a first public key; and the first private key is stored in the TPM; The first key proof is a signature given by the TPM and contains the measurement value of the system.
3. The security domain initialization method according to claim 2, characterized in that: After generating the first key certificate, the method further includes: Each of the slave nodes completes system initialization and stores the system measurement value in the TPM; After each of the slave nodes is started, the master node uses the first key to prove whether the measurement value of the verification system is legal.
4. The security domain initialization method according to claim 1, characterized in that: The slave node decrypts the encrypted data using the first private key to obtain a private key B, which is specifically: The slave node calls the decryption function of the TPM, uses the first private key to decrypt the encrypted data, obtains the plain text of the private key B, and stores it in the memory file.
5. The security domain initialization method according to claim 1, characterized in that: The slave node includes a guard module, a utility module and a kernel module, and uses the private key B to initialize a preset security domain, specifically: The system automatically initiates a request to the utility module, the utility module specifies the security domain range through the guard module, and uses the private key B as the encryption key of the security domain; The guard module also configures the security domain information into the kernel module.
6. A security domain initialization system, characterized in that: The security domain initialization system includes an operating organization, a master node and at least two slave nodes; The operating organization is used to generate or import private key B; The master node is used to: Receive the private key B from the operating organization and the first public key from each slave node; The private key B is encrypted using the first public key to obtain encrypted data, and the encrypted data is distributed to each slave node; The slave node is used to: The encrypted data is decrypted using the first private key to obtain a private key B, and the private key B is used to initialize a preset security domain; the first public key and the first private key constitute a pair of asymmetric keys.
7. The security domain initialization system according to claim 6, characterized in that: The slave node is also used for: Generate a first key in the TPM according to the measurement value of the system, and generate a first key certificate; wherein the first key includes a first private key and a first public key; the first private key is stored in the TPM; the first key certificate is a signature given by the TPM and includes the measurement value of the system; After the system is initialized, the system's measurements are stored in the TPM.
8. The security domain initialization system according to claim 7 or 8, characterized in that: The slave node includes a guard module, which is used to: The decryption function of the TPM is called, and the encrypted data is decrypted using the first private key to obtain the plain text of the private key B, and store it in the memory file.
9. The security domain initialization system according to claim 8, characterized in that: The slave node further includes a utility module and a kernel module; the utility module is used to receive a request automatically initiated by the system, specify a security domain range through the guard module, and use the private key B as an encryption key for the security domain; The guard module also configures the security domain information into the kernel module.
10. A method for controllable use of data, characterized in that: include: Initialize the preset security domain using the method described in any one of claims 1 to 5; The data provider imports the encrypted data into the initialized security domain; The data user decrypts the encrypted data to obtain the original data, and makes controllable use of the original data.