SGX remote authentication protocol method and device

Abstract

The invention provides an SGX remote authentication protocol method and device, which are applied to an SGX server side, and comprise the following steps: receiving a first message from a client side, the first message being a client side Diffie-Hellman public key R obtained by the client side based on an elliptic curve Diffie-Hellman protocol; in response to the first message, obtaining a server Diffie-Hellman public key T based on a Diffie-Hellman protocol of an elliptic curve, and generating a master key; a query is generated through an SGX machine, a digital signature is completed, and a message verification code and a first ciphertext are generated; and encrypting the digital signature result, the message verification code and the certificate information by using the derivative key of the master key so as to achieve an anonymous effect. The invention provides a remote authentication protocol with anonymity, and even if an attacker bypasses an https protocol, the security of an interaction scheme between the client and the SGX server can be ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular, to a method and device for an SGX remote authentication protocol. Background Art

[0002] Data procurement is an important means for Internet enterprises to improve their marketing capabilities, but data leakage is a core issue.

[0003] The SGX (Software Guard Extensions) remote authentication protocol processes data in a trusted execution environment (TEE) to ensure that data does not leave the domain of the owner, thereby reducing the risk of data leakage. At the same time, SGX can support large amounts of data calculation to meet the performance requirements during the data procurement process.

[0004] The remote authentication protocol is an important means in SGX technology to verify the security of SGX machines and the trustworthiness of code. However, the existing remote authentication protocol lacks the function of hiding the identity information of both parties, and attackers can obtain the identity information of the two parties in the interaction by eavesdropping on the channel. Although the https protocol can bring authentication between the server and the client and secure transmission of the channel, this protocol can only build security at the server communication layer and cannot achieve the protection of the running time at the SGX level. Summary of the Invention

[0005] The present invention provides a method and device for an SGX remote authentication protocol to solve the defect that the existing remote authentication protocol lacks the function of hiding identity information and realize secure interaction between the client and the SGX server.

[0006] The present invention provides a method for an SGX remote authentication protocol for an SGX server, including the following steps: Receiving a first message from the client, where the first message is the client Diffie-Hellman public key R obtained by the client based on the Diffie-Hellman protocol of the elliptic curve; In response to the first message, based on the Diffie-Hellman protocol of the elliptic curve, obtaining the server Diffie-Hellman public key T and generating a master key; generating a quote through the SGX machine, completing the digital signature, and generating a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtaining the derived key of the master key, and encrypting the digital signature result, the message authentication code, and the certificate information with the derived key of the master key to achieve an anonymous effect.

[0007] According to the SGX remote authentication protocol method provided by the present invention, based on the Diffie-Hellman protocol of elliptic curves, the server Diffie-Hellman public key T is obtained, and the master key is generated; a quote is generated by the SGX machine, the digital signature is completed, and the message authentication code and the first ciphertext are generated; the derived key of the master key is used to encrypt the digital signature result, the message authentication code and the certificate information to achieve the anonymity effect, specifically including: In response to the first message, the server Diffie-Hellman public key T is generated based on the Diffie-Hellman protocol of elliptic curves; Based on the client Diffie-Hellman public key R and the server Diffie-Hellman public key T, the master key mk is generated; Based on the master key mk, the session key k is derived s , the message authentication code key k m , the message encryption key k e ; The client Diffie-Hellman public key R and the server Diffie-Hellman public key T are hashed and compressed to obtain the hash compression value h; The SGX machine signs the hash compression value h, and a quote is generated according to the SGX device mechanism; Based on the message authentication code key k m and the public key pk corresponding to the SGX machine b , the message authentication code mac corresponding to the public key pk b is obtained b ; Based on the message encryption key k e , quote and the message authentication code mac b , the first ciphertext c is calculated b ; T||c b is returned to the client as the second message.

[0008] According to the SGX remote authentication protocol method provided by the present invention, the method further includes: Receiving the third message returned by the client, based on the third message, parsing out the second ciphertext c of the client a , and using the message encryption key k e to decrypt to obtain mac a ||sign a ||cert a :=Dec(k e ; c a ), where maca Denote the message authentication code corresponding to the client public key; sign a Denote using the client private key sk a Calculate the signature sign of h a :=sig(sk a ; h); cert a Denote the client certificate; Use the public key pk in cert a to verify the signature sign a using the message authentication code key k a to verify mac m :=Mac(k a ;pk m ); a ); Parse the client's third ciphertext c from the third message and use the session key k s to decrypt to obtain the data key dk:=Dec(k s ; c).

[0009] According to the SGX remote authentication protocol method provided by the present invention, based on the client Diffie-Hellman public key R and the server Diffie-Hellman public key T, generate the master key mk, and the calculation formula is: mk:=Hash(R, T, t*R); wherein, R:=r*G, which is an elliptic curve point multiplication operation, r is a random number selected by the client based on the Diffie-Hellman protocol of the elliptic curve, and G is the base point on the elliptic curve; T:=t*G, which is an elliptic curve point multiplication operation, t is a random number selected by the SGX server based on the Diffie-Hellman protocol of the elliptic curve, and G is the base point on the elliptic curve.

[0010] According to the SGX remote authentication protocol method provided by the present invention, based on the master key mk, derive the session key k s , the message authentication code key k m , the message encryption key k e , specifically including: Derive the session key k s , the message authentication code key k m , the message encryption key k e respectively through the pseudo-random function based on the master key mk, expressed as: k s , k m , k e :=PRF(mk; 0 / 1 / 2).

[0011] According to the SGX remote authentication protocol method provided by the present invention, the client Diffie-Hellman public key R and the server Diffie-Hellman public key T are hashed and compressed to obtain a hash compression value h, which specifically includes: The client Diffie-Hellman public key R and the server Diffie-Hellman public key T are compressed to 32 bytes through SHA256 to obtain a hash compression value h: h := Hash(R||T).

[0012] According to the SGX remote authentication protocol method provided by the present invention, the SGX machine signs the hash compression value h, and a quote is generated according to the SGX device mechanism, which specifically includes: The SGX machine signs the hash compression value h to obtain a signature result sign b : sign b := sig(sk b ; h); Based on the signature result, a quote is generated according to the SGX device mechanism: quote := sign b ||...||cert b .

[0013] According to the SGX remote authentication protocol method provided by the present invention, based on the message authentication code key k m and the public key pk corresponding to the SGX machine b , the message authentication code mac b corresponding to the public key pk b is obtained, which specifically includes: Based on the message authentication code key k m and the public key pk corresponding to the SGX machine b , the message authentication code mac b corresponding to the public key pk b := Mac(k m ; pk b ).

[0014] According to the SGX remote authentication protocol method provided by the present invention, based on the message encryption key k e , quote and the message authentication code mac b , the ciphertext c b Calculate the ciphertext c b := Enc(k e ; mac b||quote).

[0015] The present invention provides an SGX remote authentication protocol method for a client, and the method includes: Based on the client Diffie-Hellman public key R obtained by the Diffie-Hellman protocol based on an elliptic curve, sending the client Diffie-Hellman public key R to the SGX server as a first message; Receiving a second message returned by the SGX server, where the second message is used by the SGX server to obtain a server Diffie-Hellman public key T based on the Diffie-Hellman protocol based on an elliptic curve and generate a master key; generating a quote through an SGX machine, completing a digital signature, and generating a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtaining a derived key of the master key, and encrypting the digital signature result, the message authentication code, and the certificate information using the derived key of the master key to achieve an anonymous effect; Based on the second message, parsing to obtain a session key and a message encryption key, and calculating a second ciphertext c through the message encryption key a , and calculating a third ciphertext c through the session key; Taking c||c a and returning it to the SGX server as a third message.

[0016] According to the SGX remote authentication protocol method provided by the present invention, based on the second message, parsing to obtain a session key and a message encryption key, and calculating a second ciphertext c through the message encryption key a , and calculating a third ciphertext c through the session key, specifically including: Based on the second message, parsing out the server Diffie-Hellman public key T of the SGX server: T := t*G, where t is a random number and G is a base point on the elliptic curve; Calculating the master key mk: mk := Hash(R, T, t*R); Deriving a session key k s , a message authentication code key k m , and a message encryption key k e from the master key mk using a pseudorandom function PRF: k s , k m , k e := PRF(mk; 0 / 1 / 2); Parsing out the first ciphertext c from the second messageb and use the message encryption key k e Decrypt to obtain mac b ||quote:=Dec(k e ; c b ); Verify quote through the SGX remote authentication SDK and verify mac using the message authentication code key b :=Mac(k m ;pk b ); Compress the client Diffie-Hellman public key R and the server Diffie-Hellman public key T to 32 bytes through SHA256 to obtain h:=Hash(R||T); Use the client private key sk a Calculate the signature sign of h a :=sig(sk a ; h); Generate the message authentication code mac corresponding to the client public key pk a :=Mac(k a ; pk m ); a ); Calculate the second ciphertext c using the encryption key a :=Enc(k e ; mac a ||sign a ||cert a ), where cert a is the client's certificate, and the certificate contains the client public key pk a ; Calculate the third ciphertext c:=Enc(k s ; dk), where dk is the client's custom data key

[0017] The present invention also provides an SGX remote authentication protocol device for an SGX server, and the device includes: A first message receiving module, configured to receive a first message from a client, where the first message is the client Diffie-Hellman public key R obtained by the client based on the elliptic curve Diffie-Hellman protocol; An encryption module, which is configured to, in response to the first message, obtain the server Diffie-Hellman public key T based on the Diffie-Hellman protocol of elliptic curves and generate a master key; generate a quote through an SGX machine, complete a digital signature, and generate a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtain a derived key of the master key, and use the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect.

[0018] The present invention also provides an SGX remote authentication protocol device for a client, and the device includes: A first message sending module, which is configured to use the client Diffie-Hellman public key R obtained based on the Diffie-Hellman protocol of elliptic curves as the first message and send the client Diffie-Hellman public key R to the SGX server. A second message receiving module, which is configured to receive a second message returned by the SGX server, where the second message is used for the SGX server to obtain the server Diffie-Hellman public key T based on the Diffie-Hellman protocol of elliptic curves and generate a master key; generate a quote through an SGX machine, complete a digital signature, and generate a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtain a derived key of the master key, and use the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect. A ciphertext calculation module, which is configured to, based on the second message, parse to obtain a session key and a message encryption key, calculate a second ciphertext ca through the message encryption key, and calculate a third ciphertext c through the session key. A third message returning module, which is configured to return c||ca as a third message to the SGX server.

[0019] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, where when the processor executes the computer program, the SGX remote authentication protocol method described in any one of the above is implemented.

[0020] The present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the SGX remote authentication protocol method described in any one of the above is implemented.

[0021] The present invention also provides a computer program product, including a computer program which, when executed by a processor, implements the SGX remote authentication protocol method as described in any one of the above.

[0022] The SGX remote authentication protocol method and device provided by the present invention receive a first message from a client, where the first message is a client Diffie-Hellman public key R obtained by the client based on the Diffie-Hellman protocol of elliptic curves; in response to the first message, based on the Diffie-Hellman protocol of elliptic curves, a server Diffie-Hellman public key T is obtained, and a master key is generated; a quote is generated by an SGX machine, digital signature is completed, and a message authentication code and a first ciphertext are generated; the digital signature result, the message authentication code, and the certificate information are encrypted using a derived key of the master key to achieve an anonymous effect. The present invention provides a remote authentication protocol with anonymity, which can ensure the security of the interaction solution between the client and the SGX server even if an attacker bypasses the https protocol. Brief Description of the Drawings

[0023] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0024] Figure 1 is one of the flow diagrams of the SGX remote authentication protocol method provided by the present invention.

[0025] Figure 2 is the second flow diagram of the SGX remote authentication protocol method provided by the present invention.

[0026] Figure 3 is the third flow diagram of the SGX remote authentication protocol method provided by the present invention.

[0027] Figure 4 is one of the flow diagrams of the SGX remote authentication protocol device provided by the present invention.

[0028] Figure 5 is the second flow diagram of the SGX remote authentication protocol device provided by the present invention.

[0029] Figure 6 is the structural diagram of the electronic device provided by the present invention. Detailed Embodiments

[0030] To make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below with reference to the accompanying drawings in the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present invention without creative efforts shall fall within the protection scope of the present invention.

[0031] Data procurement is the main means for Internet enterprises to build a complete user portrait and improve marketing capabilities. During the data procurement process, the issue of data leakage has always been the core concern of both parties. Based on cryptographic privacy intersection and traceable query methods, although they can protect data privacy with extremely high security, they often face performance bottlenecks when dealing with large amounts of data. In addition, data owners also have concerns about the security risks brought by the out-of-domain of ciphertext data. Using Intel's SGX (Software Guard Extensions) technology becomes a feasible solution. SGX processes data in a trusted execution environment (TEE) to ensure that data does not leave the domain of the owner, thereby reducing the risk of data leakage. At the same time, SGX can support the calculation of large amounts of data to meet the performance requirements during the data procurement process. Remote authentication protocol, The remote authentication protocol is an important means in SGX technology to verify the security of SGX machines and the trustworthiness of code. However, the existing remote authentication protocol lacks the function of hiding the identity information of both parties, and attackers can obtain the identity information of the two parties in the interaction by eavesdropping on the channel. Although the https protocol can bring authentication between the server and the client and secure transmission of the channel, this protocol can only build security at the server communication layer and cannot achieve the protection of the running time at the SGX level.

[0032] To solve the above problems, the present invention provides an SGX remote authentication protocol method and device, which uses the elliptic curve Diffie-Hellman protocol, combines the quote generation ability of SGX, completes digital signature and encryption, realizes anonymity and authentication, and ensures a secure interaction solution between the client and the SGX server.

[0033] The present invention will be specifically described below in conjunction with specific embodiments.

[0034] In some specific implementation manners of the present invention, as Figure 1 shown, the present solution provides an SGX remote authentication protocol method for an SGX server, and the method includes: Step 110: Receive a first message from the client, where the first message is the client Diffie-Hellman public key R obtained by the client based on the Diffie-Hellman protocol of the elliptic curve; Step 120: In response to the first message, based on the Elliptic Curve Diffie-Hellman (ECDH) protocol, obtain the server Diffie-Hellman public key T and generate the master key; generate a quote through the SGX machine to complete the digital signature, and generate a message authentication code and the first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtain the derived key of the master key, and use the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve the anonymity effect.

[0035] It should be noted that the existing remote authentication protocol solutions can only build security at the server communication layer, cannot achieve the protection of the running time at the SGX level, and lack the function of hiding the identity information of both parties. An attacker can obtain the identity information of both parties in the interaction by eavesdropping on the channel.

[0036] Therefore, based on the Elliptic Curve Diffie-Hellman protocol of the present invention, the server uses the SGX to generate measurement information such as quotes to complete the digital signature, and at the same time uses the derived key to encrypt the signature result, the message authentication code, and the certificate information to achieve the anonymity effect.

[0037] The above steps will be described in detail below with specific embodiments.

[0038] Step 110: Receive the first message from the client, where the first message is the client Diffie-Hellman public key R obtained by the client based on the Elliptic Curve Diffie-Hellman protocol. In the specific embodiment provided by the present invention, the input of the client Client can be defined as including: the long-term public-private key pair (sk a , pk a ), the certificate cert a and the custom data key dk; the input of the server Server includes: the public-private key pair (sk b , pk b ) corresponding to the SGX machine.

[0039] Specifically, Client selects a random number r, performs the elliptic curve point multiplication operation to obtain the client Diffie-Hellman public key R, that is: R := r * G (1), where G is the base point on the elliptic curve; and sends R as the first message msg1 to the server Server.

[0040] Step 120: In response to the first message, based on the Elliptic Curve Diffie-Hellman (ECDH) protocol, obtain the server Diffie-Hellman public key T and generate a master key; generate a quote through the SGX machine, complete the digital signature, and generate a message authentication code and a first ciphertext; use the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect.

[0041] In some possible embodiments of the present invention, based on the Elliptic Curve Diffie-Hellman (ECDH) protocol, obtain the server Diffie-Hellman public key T and generate a master key; generate a quote through the SGX machine, complete the digital signature, and generate a message authentication code and a first ciphertext; use the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect, which specifically includes: In response to the first message, generate the server Diffie-Hellman public key T based on the Elliptic Curve Diffie-Hellman (ECDH) protocol; Generate a master key mk based on the client Diffie-Hellman public key R and the server Diffie-Hellman public key T; Derive a session key k based on the master key mk s , a message authentication code key k m , a message encryption key k e ; Hash and compress the client Diffie-Hellman public key R and the server Diffie-Hellman public key T to obtain a hash-compressed value h; Sign the hash-compressed value h through the SGX machine and generate a quote according to the SGX device mechanism; Based on the message authentication code key k m and the public key pk corresponding to the SGX machine b , obtain the message authentication code mac corresponding to the public key pk b ; b ; Based on the message encryption key k e , the quote, and the message authentication code mac b , calculate the first ciphertext c b ; Return T||c b as a second message to the client.

[0042] Specifically, this embodiment provides an implementation of an anonymous remote authentication protocol. Based on the Diffie-Hellman protocol of elliptic curves, the server uses the SGX's ability to generate measurement information such as quotes to complete digital signatures. At the same time, a derived key is used to encrypt the signature result, message authentication code, and certificate information to achieve an anonymous effect.

[0043] In some possible implementation manners of the present invention, the SGX remote authentication protocol method for the SGX server further includes: Receiving a third message returned by the client, and based on the third message, parsing out the second ciphertext c of the client a , and using the message encryption key k e to decrypt to obtain: mac a ||sign a ||cert a :=Dec(k e ; c a ) (2), where mac a represents the message authentication code corresponding to the client public key; sign a represents the signature sign calculated using the client private key sk a := sig(sk a ; h); cert a a represents the client certificate; Using the public key pk a in cert a to verify the signature sign a , and using the message authentication code key k m to verify mac a : mac a := Mac(k m ; pk a ) (3); Parsing out the third ciphertext c of the client from the third message, and using the session key k s to decrypt to obtain the data key dk: dk := Dec(k s ; c) (4).

[0044] Specifically, this embodiment provides an implementation manner for parsing the third message returned by the client. The SGX remote authentication protocol can ensure the authentication between the client and the server, and the client securely provides a custom data key to the secure internal memory area of the SGX of the server.

[0045] In some possible embodiments of the present invention, based on the client Diffie-Hellman public key R and the server Diffie-Hellman public key T, a master key mk is generated, and the calculation formula is: mk := Hash(R, T, t*R) (5); where R := r*G, which is an elliptic curve point multiplication operation, r is a random number selected by the client based on the Diffie-Hellman protocol of the elliptic curve, and G is the base point on the elliptic curve; T := t*G, which is an elliptic curve point multiplication operation, t is a random number selected by the SGX server based on the Diffie-Hellman protocol of the elliptic curve, and G is the base point on the elliptic curve.

[0046] Specifically, this embodiment provides an implementation manner for calculating the master key mk, and through the hashing process, the security and integrity of the enclave in the SGX system are ensured.

[0047] Specifically, in SGX, calculating the hash value of the master key is to generate a unique measurement value (MRENCLAVE), which is used to verify the identity and integrity of the enclave. By hashing the code and data of the enclave, the remote party can ensure that it is communicating with a trusted environment that has not been tampered with. SGX uses SHA-2 (specifically SHA-256) as the hashing algorithm. This is a secure hashing algorithm that can convert input data of any length into a fixed-length output (256 bits), ensuring the integrity and immutability of the data.

[0048] The generated hash value can be used for authentication. The generated hash value (MRENCLAVE) is used to verify the identity of the enclave during the remote authentication process. The remote party can compare it with the expected hash value to confirm the integrity of the enclave. If the content of the enclave is tampered with after creation, the calculated hash value will not match the original hash value, thus triggering a security alert to ensure the security of the data.

[0049] In some possible embodiments of the present invention, based on the master key mk, a session key k s , a message authentication code key k m , and a message encryption key k e are derived, specifically including: The session key k s , the message authentication code key k m , and the message encryption key k e are respectively derived from the master key mk through a pseudorandom function, expressed as: k s, k m , k e :=PRF(mk; 0 / 1 / 2) (6).

[0050] Specifically, this embodiment provides an implementation manner for deriving the master key mk. Multiple sub-keys are derived from a master key through a pseudo-random function to meet different security requirements. The pseudo-random function is used to generate random numbers and challenges in the authentication protocol to protect the security of the protocol.

[0051] It can be understood that the pseudo-random function is often used to expand and generate more keys from a single key. For example, it is used to generate session keys during the password negotiation process. The pseudo-random function is used to generate message authentication codes to verify the integrity and source of data. For example, HMAC (Hash-based Message Authentication Code) uses a pseudo-random function to generate an authentication tag to ensure that the received data has not been tampered with.

[0052] In this embodiment, the session key, the message authentication code key, and the message encryption key are all derived from the master key mk and are used for different encryption and authentication processes. The keys generated through the pseudo-random function enhance the security of the system. Each key has a specific purpose, reducing the risk of reusing keys and improving the flexibility and security of key management.

[0053] Specifically, the session key is used to encrypt the data exchanged during the session to ensure the confidentiality of the data. Using different keys for each session can prevent replay attacks and enhance the security of communication. The message authentication code key is used to generate a message authentication code (MAC) to verify the integrity and source of the data. The MAC generated through km ensures that the data has not been tampered with during transmission and can verify the identity of the sender. The message encryption key is used to encrypt specific data messages to provide confidentiality and integrity protection for the data. The independent use of ke can increase the complexity and security of the encryption process, so that even if some keys are cracked, other keys still remain secure.

[0054] With the above settings in this embodiment, the keys generated through the pseudo-random function should have the characteristics of anti-correlation and anti-differential attack, which means that even if an attacker observes multiple outputs, they cannot infer the key or other sensitive information, enhancing the security of the system. That is to say, the generated outputs should have randomness to make them unpredictable. At the same time, for different keys and inputs, the outputs should appear random and unpredictable, increasing the difficulty for an attacker to crack the key, thus ensuring the confidentiality, integrity, and reliability of the data and enhancing the security of the cryptographic system.

[0055] In some possible embodiments of the present invention, the client Diffie-Hellman public key R and the server Diffie-Hellman public key T are hashed and compressed to obtain a hashed and compressed value h, which specifically includes: The client Diffie-Hellman public key R and the server Diffie-Hellman public key T are compressed to 32 bytes through SHA256 to obtain the hashed and compressed value h: h := Hash(R||T) (7).

[0056] Specifically, this embodiment provides an implementation manner for hashing and compressing data. By compressing the client Diffie-Hellman public key R and the server Diffie-Hellman public key T, data simplification is achieved, so that the obtained hash value meets the requirement of fixed-length input for cryptographic algorithms.

[0057] It can be understood that with this setting of the present invention, since many cryptographic algorithms require fixed-length input, and hashing and compression can compress data of any length into a fixed-length hash value, it is very useful for processing input data of different lengths. Through the hash function, it can quickly verify whether the data has been tampered with during transmission or storage. If the hash value of the data changes, it can be considered that the original data is no longer complete. In digital signatures, hashing and compression are used to ensure the integrity and authenticity of messages. The sender generates a hash value for the message and signs it, and the receiver can confirm the integrity of the message and the identity of the sender by verifying the hash value. In user password storage, the plaintext password is usually not directly stored, but the hash value of the password is stored. In this way, even if the database is leaked, attackers cannot directly obtain the user's original password. Hash values are usually shorter than the original data, so comparing two hash values is faster than comparing the original data, which is very useful in scenarios where frequent comparisons are required. Since the length of the hash value is fixed and short, storing the hash value requires less storage space than storing the original data. In some cases, hashing and compression can be used to protect privacy. For example, in blockchain technology, addresses are usually hash values of public keys, which can effectively protect user privacy.

[0058] In some possible embodiments of the present invention, the hashed and compressed value h is signed by an SGX machine, and a quote is generated according to the SGX device mechanism, which specifically includes: The hashed and compressed value h is signed by an SGX machine to obtain a signature result sign b : sign b := sig(sk b ; h) (8); Generate a quote based on the signature result according to the SGX device mechanism: quote := sign b ||...|| cert b (9).

[0059] Specifically, this embodiment provides an implementation manner of generating a quote through the SGX device mechanism. The SGX machine signs the hash compression value h, and a quote is generated according to the SGX device mechanism.

[0060] In a possible embodiment, generating a quote through SGX can achieve remote authentication.

[0061] Specifically, in the remote authentication process of SGX, the quote is used to prove to a remote entity that the running system is on a platform supported by Intel SGX, within a correctly instantiated enclave, and has a known security configuration. In this way, the security status of the SGX machine and the credibility of the code can be verified.

[0062] Furthermore, generating a quote through SGX can achieve encrypted measurement. The Quote is the encrypted measurement value of the instantiated enclave, which contains specific information about the enclave, and this information is used to verify the integrity and authenticity of the enclave.

[0063] In a possible embodiment, generating a quote through SGX can be used for functions such as signature and verification, secure communication, and trust decision-making, and can be used to eliminate external dependencies.

[0064] Specifically, the Quote is signed by using the authentication materials stored in the data center cache service. The recipient (relying party) can use these authentication materials to verify the signature of the quote to ensure its validity. The Quote is sent to the relying party through a secure communication channel, ensuring the confidentiality and integrity of the quote during the communication process. If the quote is valid, the relying party will check the quote metadata and the trusted computing base (TCB) level related to the signature key, and decide whether to trust the enclave according to its security policy. Using SGX DCAP (Data Center Attestation Primitives), the data center can have its own authentication infrastructure, and the authentication materials required to generate and verify the quote are completely local, eliminating the runtime dependence on external services and enabling trust decisions to be made internally.

[0065] It can be understood that this setting of the present invention makes full use of the quote generation ability of SGX to complete digital signature and encryption, and achieve anonymity and authentication.

[0066] In some possible implementations of the present invention, based on the message authentication code key k m And the public key pk corresponding to the SGX machine b , get the public key pk b Corresponding message verification code mac b , including: Based on the message authentication code key k m And the public key pk corresponding to the SGX machine b , generate the public key pk b The corresponding message verification code: Mac b :=Mac(k m ; pk b ) (10).

[0067] Specifically, this embodiment provides a method for obtaining a public key pk b The corresponding message authentication code implementation method is to derive the message authentication code key k from the master key m And the public key corresponding to the SGX machine, and get the message verification code corresponding to the public key.

[0068] Specifically, message authentication codes are often used to verify user identities and ensure that the operator is an authorized user. When registering, logging in, or performing sensitive operations, the verification code can confirm the authenticity of the user and prevent malicious behavior. Message authentication code (MAC) is used to verify that the message has not been tampered with during transmission. By calculating the MAC value of the message and transmitting it together with the message, the receiver can verify the integrity of the message. As a security mechanism, message authentication code enhances the security of communication through shared keys and one-way hash functions. Different keys will produce different MAC values, thereby enhancing security.

[0069] In some possible implementations of the present invention, based on the message encryption key k e , quote and the message verification code mac b , calculate the first ciphertext c b : c b :=Enc(k e ; mac b ||quote) (11).

[0070] Specifically, this embodiment provides an implementation method for calculating a server ciphertext, and obtains the server ciphertext through calculation using a message encryption key, a quote, and a message verification code, thereby realizing the encryption function of the ciphertext.

[0071] Specifically, during the remote authentication process, the quote generated by SGX can be used to prove the integrity and authenticity of the code and data in the enclave to a remote entity. In this process, the calculation and verification of ciphertext are key steps, ensuring the security of remote authentication of the enclave.

[0072] More specifically, SGX ensures that the code running inside the enclave and the data being processed cannot be accessed or tampered with by the external environment by creating a protected area called the enclave. The process of calculating the ciphertext ensures the confidentiality of data during storage and processing, protecting sensitive data from being accessed by other users or potential malware even in a multi-tenant cloud environment. When calculating the ciphertext in the enclave, SGX utilizes its hardware-supported features to ensure data integrity. Any tampering with the code or data in the enclave will result in different measurements, which can be detected by the remote verifier. SGX provides instructions to operate the "sealed key", and can export the ciphertext encrypted by the "sealed key", which can be securely stored on an external storage medium such as a disk. This mechanism allows the encrypted form of the key to be stored and transmitted when needed while maintaining the confidentiality of the key.

[0073] In some specific embodiments of the present invention, as Figure 2 shown, the present solution provides an SGX remote authentication protocol method for a client, and the method includes: Step 210: Using the client Diffie-Hellman public key R obtained based on the Diffie-Hellman protocol of the elliptic curve, send the client Diffie-Hellman public key R as the first message to the SGX server; Step 220: Receive the second message returned by the SGX server. The second message is used for the SGX server to obtain the server Diffie-Hellman public key T based on the Diffie-Hellman protocol of the elliptic curve and generate the master key; generate a quote through the SGX machine, complete the digital signature, and generate a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtain the derived key of the master key, and use the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect; Step 230: Based on the second message, parse to obtain the session key and the message encryption key, calculate the second ciphertext c a through the message encryption key, and calculate the third ciphertext c through the session key; Step 240: Combine c||c aReturned to the SGX server as the third message.

[0074] Specifically, this embodiment provides a process in which the client authenticates the identity of the server by parsing the message, and then encrypts the data key by generating a signature and a message authentication code.

[0075] In some possible embodiments of the present invention, based on the second message, a session key and a message encryption key are parsed, and a second ciphertext c is calculated through the message encryption key a , and a third ciphertext c is calculated through the session key, specifically including: Based on the second message, parse out the server Diffie-Hellman public key T of the SGX server: T := t * G (12), where t is a random number and G is the base point on the elliptic curve; Calculate the master key mk: mk := Hash(R, T, t * R) (13); Derive the session key k s , the message authentication code key k m and the message encryption key k e from the master key mk using the pseudorandom function PRF: k s , k m , k e := PRF(mk; 0 / 1 / 2); Parse the first ciphertext c from the second message b , and decrypt it using the message encryption key k e to obtain: mac b ||quote := Dec(k e ; c b ) (14); Verify quote through the SGX remote authentication SDK and verify mac using the message authentication code key b := Mac(k m ; pk b ); Compress the client Diffie-Hellman public key R and the server Diffie-Hellman public key T to 32 bytes through SHA256 to obtain h := Hash(R||T); Calculate the signature of h using the client private key sk a : sign a := sig(sk a; h) (15); Generate the client public key pk a The corresponding message authentication code: mac a := Mac(k m ; pk a )(16); Calculate the second ciphertext using the encryption key: c a := Enc(k e ; mac a || sign a || cert a )(17), where cert a is the client's certificate, and the certificate contains the client public key pk a ; Calculate the third ciphertext using the session key: c := Enc(k s ; dk)(18), where dk is the client-defined data key.

[0076] Specifically, this embodiment provides an implementation method for encrypting the data key.

[0077] First, the client parses the message. Specifically, it needs to parse the second message, which usually contains the random number T sent by the server and the encrypted ciphertext c b , and the purpose of parsing is to extract this information for subsequent calculations and verifications.

[0078] Then, calculate the master key. The client uses the received random number T and the previously sent random number R to calculate the master key mk. This process is usually implemented through a hash function. For example: mk := Hash(R, T, t*R), where t is the random number generated by the server in the second message. Calculating the master key is the basis for generating the session key and other keys later.

[0079] Next, derive the session key. Using the master key, the client derives multiple keys through a pseudorandom function (PRF), including: the session key, the message authentication code key, and the message encryption key. These keys will be used for subsequent message encryption, decryption, and verification to ensure the security of the communication.

[0080] Furthermore, decrypt the ciphertext. The ciphertext contained in the second message received by the client needs to be decrypted using the message encryption key. The decryption result is usually a combination mac containing the message authentication code and the server's quote b||quote:=Dec(k e ; c b ), through decryption, the client can obtain the server's message authentication code and signature information.

[0081] Meanwhile, to verify the identity of the server, the client uses the SGX remote authentication SDK to verify the validity of the quote. This process ensures that the server's enclave is trustworthy and has not been tampered with. The steps to verify the quote include: checking whether the signature of the quote is valid; confirming that the measured values in the quote match the expected security configuration; meanwhile, the client also needs to use the message authentication code key to verify the mac b , by verifying the mac b , the client can ensure the integrity of the message and the authenticity of the source.

[0082] On this basis, a signature is generated. Specifically, when the server's identity authentication is successful, the client will generate a signature sign a , which is used to prove the identity of the client. This signature is calculated based on the client's private key and the hash value h: sign a :=sig(sk a ; h), where h is obtained by hashing R and T.

[0083] Generate a message authentication code. The client will also generate its own message authentication code maca for subsequent message verification: mac a :=Mac(k m ; pk a ); Encrypt the certificate ciphertext c a and the data key c. The client encrypts the custom data key dk using the session key c:=Enc(k s ; dk), and this encryption process ensures the confidentiality of the data key during transmission.

[0084] Finally, send the response message. The client packs the encrypted data key and the ciphertext c containing the signature, message authentication code, and certificate a together to form the third message and send it to the server.

[0085] Through the above settings in this embodiment, through multiple steps such as key calculation, message decryption, identity authentication, and response generation, the secure communication between the client and the server is ensured, preventing data leakage and identity forgery, which is a crucial part of the SGX remote authentication protocol.

[0086] In some specific implementation schemes of the present invention, such as Figure 3As shown in the figure, this solution provides an SGX remote authentication protocol method for the interaction between the SGX server and the client. The method includes: Step 310: The Client initiates a session, and the Server generates a quote and a session key. First, the client performs the following steps: Step 3101: Select a random number r Step 3102: Perform an elliptic curve point multiplication operation R := r * G, where G is the base point on the elliptic curve Step 3103: Send R as msg1 to the Server.

[0087] On this basis, the server performs the following steps: Step 3104: After receiving the message msg1, select a random number t Step 3105: Perform an elliptic curve point multiplication operation T := t * G Step 3106: Calculate the master key mk := Hash(R, T, t * R), where Hash is the SHA256 operation Step 3107: Derive the session key, message authentication code key, and message encryption key k from the master key through a pseudo-random function s , k m , k e := PRF(mk; 0 / 1 / 2) Step 3108: Compress the two Diffie-Hellman public keys to 32 bytes through SHA256, i.e., h := Hash(R||T) Step 3109: Let SGX sign h, sign b := sig(sk b ; h), and generate quote := sign according to the SGX device mechanism b ||...||cert b Step 3110: Generate a message authentication code mac for the Server public key b := Mac(k m ; pk b ) Step 3111: Calculate the ciphertext c b := Enc(k e ; mac b ||quote) Step 3112: Return T||c b as msg2 to the Client.

[0088] Step 320, the Client verifies the Server's quote and provides the data key, while the Server verifies the Client's identity.

[0089] First, the client performs the following steps: Step 3201, after receiving the message msg2, parse out T and calculate the master key mk := Hash(R, T, t*R) Step 3202, derive the session key, message authentication code key, and message encryption key k respectively from the master key through the pseudorandom function s , k m , k e := PRF(mk; 0 / 1 / 2) Step 3203, parse out the ciphertext c from msg2 b , and decrypt using the message encryption key to obtain mac b ||quote := Dec(k e ; c b ) Step 3204, verify the quote through the SGX remote authentication SDK and verify mac using the message authentication code key b := Mac(k m ; pk b ) Step 3205, compress the two Diffie-Hellman public keys to 32 bytes through SHA256, i.e., h := Hash(R||T) Step 3206, calculate the signature sign of h using the private key a := sig(sk a ; h) Step 3207, generate the message authentication code mac corresponding to the Client public key a := Mac(k m ; pk a ) Step 3208, calculate the ciphertext c using the encryption key a := Enc(k e ; mac a ||sign a ||cert a ), where cert a is the Client's certificate, which contains pk a Step 3209, calculate the ciphertext c := Enc(k s ; dk), where dk is the data key selected by the Client Step 3210, c||ca Returned to the Server as msg3 On this basis, the server performs the following steps: Step 3211: After receiving the message msg3, parse out c a , and decrypt it using the message encryption key to obtain mac a ||sign a ||cert a := Dec(k e ; c a ) Step 3212: Use the public key in cert a to verify the signature, and use the message authentication code key to verify mac a := Mac(k m ; pk a ) Step 3213: Parse out c from msg3, and decrypt it using the session key to obtain the data key dk := Dec(k s ; c) Step 3214: If the verification or decryption fails, return fail; otherwise, return succ

[0090] In this step, the fourth message msg4 can be set to output the result of verification or decryption

[0091] The embodiment of the present invention designs a remote authentication protocol with anonymity. Based on the Diffie-Hellman protocol of elliptic curves, the server uses the SGX to generate measurement information such as quote to complete digital signature. At the same time, the derived key is used to encrypt the signature result, message authentication code, and certificate information to achieve the anonymity effect. At the same time, the protocol ensures the authentication between the client and the server. Finally, the client securely provides the custom data key to the secure internal memory area of the SGX on the server side. Even if the attacker bypasses the HTTPS protocol, it can still protect the secure interaction between the client and the SGX server

[0092] Next, the SGX remote authentication protocol device provided by the present invention will be described. The SGX remote authentication protocol device described below can be correspondingly referred to the SGX remote authentication protocol method described above

[0093] In some specific embodiments of the present invention, as Figure 4 shown Figure 4 is one of the flow diagrams of the SGX remote authentication protocol device provided by the present invention. The present solution provides an SGX remote authentication protocol device for the SGX server. The device includes: The first message receiving module 41 is configured to receive a first message from a client, where the first message is a client Diffie-Hellman public key R obtained by the client based on the Diffie-Hellman protocol of an elliptic curve. The encryption module 42 is configured to, in response to the first message, obtain a server Diffie-Hellman public key T based on the Diffie-Hellman protocol of an elliptic curve, and generate a master key; generate a quote through an SGX machine, complete a digital signature, and generate a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtain a derived key of the master key, and encrypt the digital signature result, the message authentication code, and the certificate information using the derived key of the master key to achieve an anonymous effect.

[0094] In some specific embodiments of the present invention, as Figure 5 shown, Figure 5 FIG. 2 is a second schematic flowchart of an SGX remote authentication protocol device provided by the present invention. The present solution provides an SGX remote authentication protocol device for a client. The device includes: The first message sending module 51 is configured to use the client Diffie-Hellman public key R obtained based on the Diffie-Hellman protocol of an elliptic curve as a first message and send the client Diffie-Hellman public key R to the SGX server. The second message receiving module 52 is configured to receive a second message returned by the SGX server. The second message is used for the SGX server to obtain a server Diffie-Hellman public key T based on the Diffie-Hellman protocol of an elliptic curve, and generate a master key; generate a quote through an SGX machine, complete a digital signature, and generate a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtain a derived key of the master key, and encrypt the digital signature result, the message authentication code, and the certificate information using the derived key of the master key to achieve an anonymous effect. The ciphertext calculation module 53 is configured to parse the second message to obtain a session key and a message encryption key, calculate a second ciphertext ca through the message encryption key, and calculate a third ciphertext c through the session key. The third message returning module 54 is configured to return c||ca as a third message to the SGX server.

[0095] The SGX remote authentication protocol device provided by the embodiments of the present invention has the same implementation principle and beneficial effects as those of the SGX remote authentication protocol method shown in the above embodiments. For the implementation principle and beneficial effects, please refer to the SGX remote authentication protocol method shown in the above embodiments, and details are not described herein again.

[0096] Figure 6 An example of the physical structure diagram of an electronic device is shown as Figure 6 shown. The electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640. Among them, the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call the logical instructions in the memory 630 to execute the SGX remote authentication protocol method, which is used for the SGX server and includes: receiving a first message from the client, where the first message is the client Diffie-Hellman public key R obtained by the client based on the elliptic curve Diffie-Hellman protocol; in response to the first message, obtaining the server Diffie-Hellman public key T based on the elliptic curve Diffie-Hellman protocol and generating a master key; generating a quote through the SGX machine, completing the digital signature, and generating a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtaining the derived key of the master key, and using the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve the anonymous effect.

[0097] The processor 610 may call the logical instructions in the memory 630 to execute the SGX remote authentication protocol method for the client, which includes: obtaining the client Diffie-Hellman public key R based on the elliptic curve Diffie-Hellman protocol and sending the client Diffie-Hellman public key R as the first message to the SGX server; receiving the second message returned by the SGX server, where the second message is used by the SGX server to obtain the server Diffie-Hellman public key T based on the elliptic curve Diffie-Hellman protocol and generate the master key; generating a quote through the SGX machine to complete the digital signature and generating a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtaining the derived key of the master key and using the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect; parsing the session key and the message encryption key based on the second message, and calculating the second ciphertext c through the message encryption key a , and calculating the third ciphertext c through the session key; returning c||c a as the third message to the SGX server.

[0098] In addition, when the logical instructions in the above-mentioned memory 630 can be implemented in the form of software functional units and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0099] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the SGX remote authentication protocol method provided by each of the above methods. This method is used for the SGX server and includes: receiving a first message from a client, where the first message is the client Diffie-Hellman public key R obtained by the client based on the elliptic curve Diffie-Hellman protocol; in response to the first message, based on the elliptic curve Diffie-Hellman protocol, obtaining the server Diffie-Hellman public key T and generating a master key; generating a quote through the SGX machine, completing a digital signature, and generating a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtaining a derived key of the master key and using the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect.

[0100] When the computer program is executed by a processor, the computer can execute the SGX remote authentication protocol method provided by each of the above methods. This method is used for the client and includes: using the client Diffie-Hellman public key R obtained based on the elliptic curve Diffie-Hellman protocol as the first message and sending it to the SGX server; receiving a second message returned by the SGX server, where the second message is used for the SGX server to obtain the server Diffie-Hellman public key T based on the elliptic curve Diffie-Hellman protocol and generate a master key; generating a quote through the SGX machine, completing a digital signature, and generating a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtaining a derived key of the master key and using the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect; parsing the second message to obtain a session key and a message encryption key, calculating a second ciphertext c through the message encryption key a , calculating a third ciphertext c through the session key; returning c||c a as a third message to the SGX server.

[0101] In another aspect, the present invention further provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the SGX remote authentication protocol method provided by each of the above methods. This method is used for the SGX server and includes: receiving a first message from a client, where the first message is the client Diffie-Hellman public key R obtained by the client based on the Diffie-Hellman protocol of the elliptic curve; in response to the first message, based on the Diffie-Hellman protocol of the elliptic curve, obtaining the server Diffie-Hellman public key T and generating a master key; generating a quote through the SGX machine, completing a digital signature, and generating a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtaining a derived key of the master key and using the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect.

[0102] When the computer program is executed by a processor, it implements the SGX remote authentication protocol method provided by each of the above methods. This method is used for the client and includes: obtaining the client Diffie-Hellman public key R based on the Diffie-Hellman protocol of the elliptic curve and sending the client Diffie-Hellman public key R as a first message to the SGX server; receiving a second message returned by the SGX server, where the second message is used for the SGX server to obtain the server Diffie-Hellman public key T based on the Diffie-Hellman protocol of the elliptic curve and generate a master key; generating a quote through the SGX machine, completing a digital signature, and generating a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtaining a derived key of the master key and using the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect; based on the second message, parsing to obtain a session key and a message encryption key, and calculating a second ciphertext c through the message encryption key a , calculating a third ciphertext c through the session key; returning c||c a as a third message to the SGX server.

[0103] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative work.

[0104] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0105] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments or perform equivalent replacements for some of the technical features. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for SGX remote authentication protocol, characterized in that For the SGX server, the method includes: Receiving a first message from a client, where the first message is the client Diffie-Hellman public key R obtained by the client based on the Elliptic Curve Diffie-Hellman protocol; In response to the first message, based on the Elliptic Curve Diffie-Hellman protocol, obtaining the server Diffie-Hellman public key T and generating a master key; generating a quote through the SGX machine, completing a digital signature, and generating a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtaining a derived key of the master key, and using the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect.

2. The SGX remote authentication protocol method according to claim 1, wherein Based on the Elliptic Curve Diffie-Hellman protocol, obtaining the server Diffie-Hellman public key T and generating a master key; generating a quote through the SGX machine, completing a digital signature, and generating a message authentication code and a first ciphertext; Using the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect, specifically including: In response to the first message, generating the server Diffie-Hellman public key T based on the Elliptic Curve Diffie-Hellman protocol; Based on the client Diffie-Hellman public key R and the server Diffie-Hellman public key T, generating a master key mk; Derive a session key k based on the master key mk s , a message authentication code key k m , and a message encryption key k e ; Performing hash compression on the client Diffie-Hellman public key R and the server Diffie-Hellman public key T to obtain a hash compression value h; Signing the hash compression value h through the SGX machine and generating a quote according to the SGX device mechanism; Based on the message authentication code key k m and the public key pk corresponding to the SGX machine b , the message authentication code mac corresponding to the public key pk b is obtained b ; Based on the message encryption key k e , quote and the message authentication code mac b , calculate the first ciphertext c b ; Return T||c b to the client as the second message.

3. The SGX remote authentication protocol method according to claim 2, characterized in that, The method further includes: Receive the third message returned by the client, and based on the third message, parse out the second ciphertext c of the client a , and use the message encryption key k e to decrypt to obtain mac a || sign a || cert a := Dec(k e ; c a ), where mac a represents the message authentication code corresponding to the client public key; sign a represents the signature sign of h calculated using the client private key sk a := sig(sk a ; h); cert a a represents the client certificate;​ Use cert a to verify the public key pk a in a , and use the message authentication code key k a to verify mac m : = Mac(k a ; pk m ); a ) Parse the third ciphertext c of the client from the third message, and use the session key k s Decrypt to obtain the data key dk := Dec(k s ; c).

4. The SGX remote authentication protocol method according to claim 2, characterized in that, Based on the client Diffie-Hellman public key R and the server Diffie-Hellman public key T, generating a master key mk, and the calculation formula is: mk := Hash(R, T, t*R); where R := r*G, which is an elliptic curve point multiplication operation, r is a random number selected by the client based on the Elliptic Curve Diffie-Hellman protocol, and G is the base point on the elliptic curve; T := t*G, which is an elliptic curve point multiplication operation, t is a random number selected by the SGX server based on the Elliptic Curve Diffie-Hellman protocol, and G is the base point on the elliptic curve.

5. The SGX remote authentication protocol method according to claim 2, wherein Derive the session key k based on the master key mk s , the message authentication code key k m , the message encryption key k e , specifically including: Derive a session key k, a message authentication code key k, and a message encryption key k respectively based on the master key mk through a pseudo-random function, expressed as: s , a message authentication code key k m , a message encryption key k e , expressed as: k s , k m , k e :=PRF(mk; 0 / 1 / 2).

6. The SGX remote authentication protocol method according to claim 2, wherein Performing hash compression on the client Diffie-Hellman public key R and the server Diffie-Hellman public key T to obtain a hash compression value h, specifically including: Compressing the client Diffie-Hellman public key R and the server Diffie-Hellman public key T to 32 bytes through SHA256 to obtain a hash compression value h: h := Hash(R || T).

7. The SGX remote authentication protocol method according to claim 2, characterized in that, Sign the hash compressed value h by the SGX machine and generate a quote according to the SGX device mechanism, specifically including: Sign the hash compression value h using the SGX machine to obtain a signature result sign b : sign b := sig(sk b ; h); Generate a quote based on the signature result according to the SGX device mechanism: quote:=sign b ||...||cert b 。 8. The SGX remote authentication protocol method according to claim 2, wherein Based on the message authentication code key k m and the public key pk corresponding to the SGX machine b , obtain the message authentication code mac b corresponding to the public key pk b , specifically including: Based on the message authentication code key k m and the public key pk corresponding to the SGX machine b , generate the message authentication code mac b corresponding to the public key pk b := Mac(k m ; pk b ).

9. The SGX remote authentication protocol method according to claim 2, characterized in that, Based on the message encryption key k e , quote and the message authentication code mac b , the ciphertext c is calculated b Compute ciphertext c b := Enc(k e ; mac b || quote).

10. A method for an SGX remote authentication protocol, characterized in that, For the client, the method includes: Based on the client Diffie-Hellman public key R obtained by the Diffie-Hellman protocol based on the elliptic curve, send the client Diffie-Hellman public key R as the first message to the SGX server; Receive the second message returned by the SGX server. The second message is used for the SGX server to obtain the server Diffie-Hellman public key T based on the Diffie-Hellman protocol based on the elliptic curve and generate a master key; generate a quote through the SGX machine, complete the digital signature, and generate a message authentication code and a first ciphertext. The quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtain the derived key of the master key and use the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect; Based on the second message, a session key and a message encryption key are parsed, and a second ciphertext c is calculated through the message encryption key; a and a third ciphertext c is calculated through the session key. Return c||c a to the SGX server as the third message.

11. The SGX remote authentication protocol method according to claim 10, wherein Based on the second message, a session key and a message encryption key are parsed, and a second ciphertext c is calculated through the message encryption key. a , and a third ciphertext c is calculated through the session key, specifically including: Based on the second message, parse out the server Diffie-Hellman public key T of the SGX server: T := t * G, where t is a random number and G is the base point on the elliptic curve; Calculate the master key mk: mk := Hash(R, T, t * R); Derive a session key k, a message authentication code key k, and a message encryption key k from a master key mk using a pseudorandom function PRF s , a message authentication code key k m and a message encryption key k e : k s , k m , k e :=PRF(mk; 0 / 1 / 2); Parse the first ciphertext c from the second message b , and use the message encryption key k e to decrypt and obtain mac b || quote := Dec(k e ; c b ); Verify the quote through the SGX Remote Attestation SDK and verify the mac using the message authentication code key b :=Mac(k m ; pk b ); Compress the client Diffie-Hellman public key R and the server Diffie-Hellman public key T to 32 bytes through SHA256 to get h := Hash(R || T); Use the client private key sk a Calculate the signature sign of h a := sig(sk a ; h); Generate the client public key pk a The corresponding message authentication code mac a :=Mac(k m ; pk a ); Compute the second ciphertext c using the encryption key a := Enc(k e ; mac a || sign a || cert a ), where cert a is the certificate of the client, and the certificate contains the client public key pk a； Calculate the third ciphertext c := Enc(k s ; dk) using the session key, where dk is a data key customized by the client.

12. An SGX remote authentication protocol device, characterized in that, For the SGX server, the device includes: A first message receiving module, configured to receive a first message from the client, where the first message is the client Diffie-Hellman public key R obtained by the client based on the Diffie-Hellman protocol based on the elliptic curve; An encryption module, configured to, in response to the first message, obtain the server Diffie-Hellman public key T based on the Diffie-Hellman protocol based on the elliptic curve and generate a master key; generate a quote through the SGX machine, complete the digital signature, and generate a message authentication code and a first ciphertext. The quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtain the derived key of the master key and use the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect.

13. An SGX remote authentication protocol device, characterized in that, For the client, the device includes: A first message sending module, configured to send the client Diffie-Hellman public key R as the first message to the SGX server based on the client Diffie-Hellman public key R obtained by the Diffie-Hellman protocol based on the elliptic curve; A second message receiving module, configured to receive a second message returned by the SGX server, where the second message is used by the SGX server to obtain a server Diffie-Hellman public key T based on the Diffie-Hellman protocol of the elliptic curve and generate a master key; generate a quote through an SGX machine, complete a digital signature, and generate a message authentication code and a first ciphertext, where the quote is used to describe a proof information or authentication data structure generated in the SGX environment; obtain a derived key of the master key, and use the derived key of the master key to encrypt the digital signature result, the message authentication code, and the certificate information to achieve an anonymous effect; A ciphertext calculation module, configured to parse the second message to obtain a session key and a message encryption key, calculate a second ciphertext ca through the message encryption key, and calculate a third ciphertext c through the session key; A third message returning module, configured to return c||ca as a third message to the SGX server.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the SGX remote authentication protocol method according to any one of claims 1 to 11.

Images