Data encryption and decryption method, system and device and storage medium

Abstract

The invention provides a data encryption and decryption method, system and device and a storage medium, the data encryption and decryption method comprises the following steps: S1, reading fragment keys from members in a key management group; the members of the key management group store fragmentation keys and manage the fragmentation keys through the smart contract of the block chain; members in the key management group are trusted computing modules; s2, combining the plurality of read fragment keys to generate an integral key; and S3, encrypting or decrypting the data by using the overall key. According to the invention, the members of the key management group manage the fragmented keys through the smart contract of the block chain, so that the fragmented keys conform to the unified smart contract, and the fragmented keys can be combined to form an integral key. And the situation that the fragmented keys cannot be combined to form an integral key due to the fact that the members adopt different key management methods is avoided.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption, and in particular relates to a data encryption and decryption method, system, device and storage medium based on a trusted computing module. Background Art

[0002] The National Encryption SM4 algorithm is a block cipher algorithm and one of the commercial cryptographic algorithm standards issued by the National Cryptography Administration. With the rapid development of information technology, data security issues have become increasingly prominent, especially in key areas such as finance, government, and military, where data security and confidentiality are of vital importance. Therefore, the emergence and application of the National Encryption SM4 algorithm is of great significance for ensuring information security.

[0003] The SM4 algorithm adopts symmetric encryption and has the characteristics of high efficiency, security and easy implementation. It uses a 128-bit block length and a 128-bit key length, and implements the encryption and decryption process through a 32-round nonlinear iterative structure. The SM4 algorithm has the following advantages: (1) High security: The SM4 algorithm adopts a 128-bit key length, has undergone extensive security analysis and evaluation, and has passed the verification of multiple cryptographic standards. It has high security and anti-attack capabilities. It can effectively resist a variety of known cryptographic attack methods and ensure the confidentiality and integrity of data. (2) Efficiency: The SM4 algorithm has high efficiency in both hardware and software implementation, and can perform encryption and decryption operations quickly. It is particularly suitable for resource-constrained environments, such as IoT devices. Compared with international encryption algorithms such as AES, the SM4 algorithm may have higher execution efficiency in some cases. (3) Simplicity: The design of the SM4 algorithm is relatively simple, with a small amount of code, and is easy to understand and use. This helps to reduce the complexity of implementation and maintenance and reduce the possibility of errors. (4) Standardization: The SM4 algorithm is a cryptographic algorithm standard that has been widely used and recognized. It has become one of the internationally recognized cryptographic algorithms, helping to promote international interoperability and compatibility. (5) Wide support: The SM4 algorithm is supported and implemented in various platforms and programming languages, including Go, Java, C / C++, etc. This allows it to be applied and deployed across platforms in different systems and environments. (6) Scalability: The SM4 algorithm supports different working modes and filling methods, and can be flexibly configured according to specific needs. It can be used in combination with other cryptographic algorithms to provide a higher level of security protection.

[0004] Trusted Computing Module (TPM) is a hardware-based security module that provides functions such as secure storage, secure computing and secure communication, which can ensure the confidentiality, integrity and availability of data. TCM is usually integrated on the computer motherboard, has an independent processor, memory and communication interface, and can run independently of the operating system and application. TPM uses cryptographic algorithms that comply with standards (such as the SM4 algorithm) to provide external functions such as asymmetric key generation operations, asymmetric algorithm encryption and decryption operations, hash function operations, digital signature operations and random number generation operations. TPM stores a variety of keys, including endorsement keys (EK), platform identity authentication keys (AIK), storage keys (SK), etc. These keys are used for operations such as encryption, decryption, signing and verification to ensure the security of data transmission and storage.

[0005] However, the existing SM4 encryption key is usually stored in a trusted computing module. Once the key in the trusted computing module is leaked, it will lead to information leakage and cannot play a good role in confidentiality. To this end, some researchers split the key and then perform distributed encryption and storage to increase the difficulty of key decryption, thereby improving security. However, in the current distributed key storage scheme, each trusted computing module calculates the shard key separately. This method has the risk of mismatching the shard keys, resulting in the inability to form a valid overall key. Summary of the invention

[0006] In order to solve the above-mentioned problems of the prior art, the present invention provides a data encryption and decryption method, system, device and storage medium, which can overcome the problem of mismatch of shard keys and ensure the formation of a valid overall key for data encryption or decryption.

[0007] The present invention is achieved through the following technical solutions: The present invention provides a data encryption and decryption method, comprising: S1, reading shard keys from members of a key management group; the members of the key management group respectively store shard keys and manage shard keys through smart contracts of the blockchain; the members of the key management group are trusted computing modules; S2, combines several shard keys read to generate an overall key; S3, encrypts or decrypts data using the overall key.

[0008] Preferably, before S1, it also includes: S0, using multiple devices to read the zero-trust key respectively; using the device that reads the zero-trust key to read the member list of the key management group from the member database; the member database stores the member list of the key management group; In S1, the device that reads the zero-trust key reads the shard key from the members of the key management team.

[0009] Preferably, each member of the key management group is configured with a symmetric key implementation algorithm to allow the member to resend the shard key when necessary.

[0010] Preferably, the implementation algorithm of the symmetric key is SM4 algorithm, AES algorithm, DES algorithm, 3DES algorithm, BlowFish algorithm, ChaCha20 algorithm, Salsa20 algorithm, IDEA algorithm or RC series algorithm.

[0011] Preferably, the method for forming a shard key includes: Select several trusted computing modules to form a key management team; Generate an overall key using an encryption algorithm; By splitting the overall key, several shard keys are formed; The shard keys are stored in each member of the key management group respectively, and each member of the key management group stores one shard key.

[0012] Furthermore, the principle for selecting members of the key management group is: all trusted computing modules are sorted in order of network speed from fast to slow, and several trusted computing modules are selected from the front to form members of the key management group.

[0013] Furthermore, the SM4 encryption algorithm is used to generate the overall key.

[0014] The present invention provides a data encryption system, comprising: A shard key reading module, used to read shard keys from members of a key management group; the members of the key management group respectively store shard keys and manage shard keys through smart contracts of the blockchain; the members of the key management group are trusted computing modules; A combination module is used to combine several shard keys read to generate an overall key; The encryption and decryption module is used to encrypt or decrypt data using the overall key.

[0015] The present invention provides a computer device, characterized in that it includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the data encryption and decryption method described above when executing the computer program.

[0016] The present invention provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data encryption and decryption method described above are implemented.

[0017] Compared with the prior art, the present invention has the following beneficial effects: The data encryption and decryption method of the present invention splits the overall key, and stores the shard keys formed after the splitting in each member of the key management team respectively, and each member stores a shard key, so that the overall key can be better protected, so that the key cannot be tampered with and can be traced; a plurality of shard keys are combined to generate an overall key, ensuring the fault tolerance of the key, improving the security of the key, and thus raising the threshold for data encryption and decryption. At the same time, the members of the key management team of the present invention manage the shard keys through the smart contract of the blockchain, so that each shard key complies with a unified smart contract, so that each shard key can be combined to form an overall key, avoiding the situation that each member adopts a different key management method, resulting in each shard key being unable to be combined to form an overall key.

[0018] Furthermore, the present invention verifies the device for obtaining the shard key before obtaining the shard key, thereby further improving the security of the key.

[0019] Furthermore, the present invention configures a symmetric key implementation algorithm for each member of the key management group. After the key expires, the key can be reissued, and after the key is lost, the key can be replaced. The new key can decrypt the data of the old key, making all member data readable. There is no need to update the local keys of all members, thereby greatly improving the reliability of the key. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 The figure is a flowchart of the data encryption and decryption method of the present invention. DETAILED DESCRIPTION

[0022] The following describes the embodiments of the present invention through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention.

[0023] It should be noted that the process equipment or devices not specifically specified in the following embodiments are all conventional equipment or devices in the art.

[0024] It should be noted that the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. Moreover, unless otherwise specified, the numbering of each method step is only a convenient tool for identifying each method step, and is not intended to limit the order of arrangement of each method step or to define the scope of the present invention. Changes or adjustments in their relative relationships should also be regarded as the scope of the present invention without substantially changing the technical content.

[0025] The data encryption and decryption method based on the trusted computing module of the present invention comprises: S1, reading shard keys from members of a key management group; the members of the key management group respectively store shard keys and manage shard keys through smart contracts of the blockchain; S2, combines several shard keys read to generate an overall key; S3, encrypts or decrypts data using the overall key.

[0026] The present invention pre-fabricates the overall key, generates it into a file, or saves it into a database. The overall key is split, and the fragmented keys formed after the splitting are respectively stored in each member of the key management group, and each member stores a fragmented key, so that the overall key can be better protected. The members in the key management group are trusted computing modules.

[0027] The overall key implementation method of the present invention is to use the SM4 algorithm. The SM4 algorithm has many advantages such as high security, high efficiency, simplicity, standardization, wide support, and scalability, and can ensure the confidentiality, integrity, and availability of data.

[0028] A smart contract is an automatically executed computer program that relies on a computer to run in cyberspace. It defines commitments in digital form, including the rights and obligations agreed to by the contract participants. Smart contracts are usually stored on blockchains to ensure their transparency and security. The decentralized and tamper-proof nature of blockchains provides strong technical support for smart contracts. In the present invention, each member of the key management team manages the shard key through the smart contract of the blockchain, so that each shard key complies with a unified smart contract, so that each shard key can be combined to form an overall key, avoiding different management methods that cause each shard key to be unable to be combined to form an overall key.

[0029] In order to better protect each shard key, the present invention sets a zero-trust key, the purpose of which is to verify the device that reads the shard key in the early stage. Only after the verification is successful can the subsequent shard key be read, otherwise the subsequent shard key is not allowed to be read, thereby ensuring the security of the shard key.

[0030] Specifically, before S1 of the above-mentioned data encryption and decryption method based on the trusted computing module, it includes: S0, using multiple devices to read the zero-trust key respectively; using the device that reads the zero-trust key to read the member list of the key management group from the member database; the member database stores the member list of the key management group; In S1, the device that reads the zero-trust key reads the shard key from the members of the key management team.

[0031] In some embodiments of the present invention, in order to further ensure that the overall key can be successfully obtained, a symmetric key implementation algorithm is added to each member of the key management team, so that after the key expires, the shard key can be reissued through the setting, and the new shard key can be compatible with the old shard key if the old shard key has not expired. This setting can ensure that if a member fails to send a shard key due to network supplementation, it can be sent again, or after the key expires, a new shard key is regenerated and sent.

[0032] The present invention does not impose any special restrictions on the implementation algorithm of the symmetric key, as long as it is an algorithm that can generate a symmetric key, such as the SM4 algorithm, the AES (Advanced Encryption Standard) algorithm, the DES (Data Encryption Standard) algorithm, the 3DES (Triple DES) algorithm, the BlowFish algorithm, the ChaCha20 algorithm, the Salsa20 algorithm, the IDEA (International Data Encryption Algorithm) algorithm, and the RC series algorithms (such as RC4, RC5, and RC6).

[0033] Example This embodiment includes two parts, one part is the key generation process, and the other part is the encryption method.

[0034] For the generation of the key, the method adopted by the present invention is as follows: Use SM4 encryption algorithm to pre-prepare and generate the key into a file; By splitting the SM4 encryption key, several shard keys are formed; The shard keys are stored in each member of the key management team respectively, and each member of the key management team saves a shard key; each member uses the blockchain's smart contract to manage the shard key, and each member is configured with a symmetric key implementation algorithm.

[0035] The present invention manages the SM4 encrypted key by distributed sharding when the key is generated. A key management group is configured in multiple devices. For example, there are 100 devices in total, and 5 devices are selected to form a key management group. Each device in the key management group stores 1 / 5 of the overall key.

[0036] Configure blockchain smart contracts for each member of the key management team to facilitate the management of shard keys and ensure that shard keys can be combined to form a valid overall key.

[0037] Each member is configured with a symmetric key implementation algorithm, so that after the key expires, the shard key can be reissued through settings, and the new shard key is compatible with the old shard key if the old shard key has not expired.

[0038] One way to select members of the key management group is to select them based on the network speed, that is, to select several devices with the fastest network speed as members of the key management group. In this way, the speed of shard key transmission can be guaranteed and the efficiency of encryption can be improved.

[0039] like Figure 1 As shown, the specific process of the encryption method of this embodiment includes the following steps: (1) using multiple devices to read the zero-trust key respectively; using the device that reads the zero-trust key to read the member list of the key management group from the member database; the member database stores the member list of the key management group; (2) using a device that reads the zero-trust key to read the shard key from a member of the key management team; the members of the key management team respectively store the shard key and manage the shard key through a smart contract on the blockchain; (3) The members of the key management team submit their respective partial keys in order and combine them to generate a new overall key; (4) When the user logs in, a new overall key is obtained and the overall key is used to encrypt or decrypt the data.

[0040] The present invention combines the shard keys of the devices in the key management group to obtain the overall key through security authentication of the device that reads the shard key. In the process of splitting and combining the keys, the SM4 algorithm is combined, and the device information is registered in the key to achieve a safer purpose. The maintenance processing of adding and deleting devices in the key management group requires manual processing.

[0041] The following are device embodiments of the present invention, which can be used to perform method embodiments of the present invention. For details not disclosed in the device embodiments, please refer to the method embodiments of the present invention.

[0042] In an embodiment of the present invention, a host computer client software self-update management system based on the Qt framework is provided, including: The update detection module obtains the latest version information file, compares the version information in the version information file with the version information of the local old version software, and determines whether the software needs to be updated; the version information file contains the version information of the new version software; Download module, used to automatically download the update package of the new version of the software from the server to the local temporary directory; An installation module, used to automatically execute the installation script, and decompress and install the update package; Restart module, used to automatically restart and load the new version of software.

[0043] In another embodiment of the present invention, a computer device is provided, the computer device includes a processor and a memory, the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions in the computer storage medium to implement the corresponding method flow or corresponding function; the processor described in the embodiment of the present invention can be used for the controller to start the operation of the redundant data synchronization method for the first time.

[0044] In another embodiment of the present invention, the present invention further provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It is understandable that the computer-readable storage medium here can include both a built-in storage medium in a computer device and an extended storage medium supported by the computer device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the method for first starting redundant data synchronization by the controller in the above embodiment.

[0045] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0046] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0047] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0048] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A data encryption and decryption method, characterized in that: include: S1, read the shard key from the members of the key management group; The members of the key management group store shard keys respectively and manage the shard keys through the smart contract of the blockchain; the members of the key management group are trusted computing modules; each member of the key management group is configured with a symmetric key implementation algorithm to allow the member to resend the shard key when necessary; S2, combines several shard keys read to generate an overall key; S3, encrypts or decrypts data using the overall key.

2. The data encryption and decryption method according to claim 1, characterized in that: Prior to S1, this also included: S0, using multiple devices to read the zero-trust key respectively; using the device that reads the zero-trust key to read the member list of the key management group from the member database; the member database stores the member list of the key management group; In S1, the device that reads the zero-trust key reads the shard key from the members of the key management team.

3. The data encryption and decryption method according to claim 1, characterized in that: The implementation algorithm of the symmetric key is SM4 algorithm, AES algorithm, DES algorithm, 3DES algorithm, BlowFish algorithm, ChaCha20 algorithm, Salsa20 algorithm, IDEA algorithm or RC series algorithm.

4. The data encryption and decryption method according to claim 1, characterized in that: The shard key formation methods include: Select several trusted computing modules to form a key management team; Generate an overall key using an encryption algorithm; By splitting the overall key, several shard keys are formed; The shard keys are stored in each member of the key management group respectively, and each member of the key management group stores one shard key.

5. The data encryption and decryption method according to claim 4, characterized in that: The principle for selecting members of the key management team is as follows: all trusted computing modules are sorted in order of network speed from fast to slow, and several trusted computing modules with the fastest network speed are selected as members of the key management team.

6. The data encryption and decryption method according to claim 4, characterized in that: The overall key is generated using the SM4 encryption algorithm.

7. A data encryption system, characterized in that: include: A shard key reading module, used to read shard keys from members in the key management group; The members of the key management team respectively store shard keys and manage shard keys through smart contracts of the blockchain; the members of the key management team are trusted computing modules; A combination module is used to combine the read shard keys to generate an overall key; each member of the key management group is configured with a symmetric key implementation algorithm to allow the member to resend the shard keys when necessary; The encryption and decryption module is used to encrypt or decrypt data using the overall key.

8. A computer device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the data encryption and decryption method as claimed in any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data encryption and decryption method according to any one of claims 1 to 6 are implemented.

Images