An auditable key management method based on trusted execution environment

Abstract

The present invention discloses an auditable key management method based on a trusted execution environment, comprising: a data provider encrypts original data using k to obtain a ciphertext C, and calculates the hash value id of C;<id,k> The association is stored locally and<id,C> The data is uploaded to the cloud server; the data provider formulates and signs a data usage policy, and the data processor formulates and signs a data processing policy, both of which are sent to the security service program of the trusted execution environment; the signature and the authorization status of the processing policy are verified, and a key request and remote authentication report are sent to the data provider; after the data provider remotely verifies the remote report and agrees to the request, the key k is sent to the security service program via a secure channel and the key usage record is stored on the blockchain; the security service program downloads the ciphertext C, decrypts the data after verification, performs the processing operation, and returns the encrypted result to the designated recipient. This invention can audit and store the key usage process in real time, realizing cross-domain data control.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more particularly to an auditable key management method based on a trusted execution environment. Background Art

[0002] Currently, amidst the rapid growth of the digital economy, data, as a new production factor, forms the foundation of digitalization, networking, and intelligence. It has been rapidly integrated into every aspect of production, distribution, circulation, consumption, and social service management, profoundly transforming production methods, lifestyles, and social governance. However, in real life, data often contains various private information of businesses and users, making the collection and circulation of data elements extremely difficult. The development of trusted execution environment (TEE) technology has provided new solutions for the circulation and processing of data elements. Users can store their encrypted data and keys in a TEE. Implementing a user key management solution that can be audited in real time within a TEE is a valuable issue.

[0003] The trusted execution environment can ensure the privacy and security of data during the execution process through hardware means, ensuring that the user's original data will not be leaked. The trusted execution environment is a very important technology in the field of information security.

[0004] Most existing key management solutions for trusted execution environments usually store ciphertext data and decryption keys in the trusted execution environment. The data provider cannot implement real-time audit management of each key use, so there are still some limitations. For example, when data is authorized to multiple data processing parties, the data provider can only know the approximate range of data users, but cannot determine the specific identity of the user and the specific number of times the data is used in real time, which brings some hidden dangers to cross-domain data control and real-time key management. Summary of the Invention

[0005] In view of this, the present invention provides an auditable key management method based on a trusted execution environment, which ensures the user's data security and key security during the data circulation process. At the same time, the key usage process can be audited and evidenced in real time to achieve cross-domain control of data.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] The present invention provides an auditable key management method based on a trusted execution environment, comprising the following steps:

[0008] S1. The data provider generates an asymmetric key pair (sk, pk) and a symmetric key k, uses k to encrypt the original data to obtain the ciphertext C, and calculates the hash value id of C;

[0009] S2. The data provider will<id,k> The association is stored locally and<id,C> Upload to the cloud server;

[0010] S3. The data provider formulates and signs a data usage policy, which is then signed with sk and sent together with pk to the security service program in the trusted execution environment.

[0011] S4. The data processor formulates and signs a data processing policy, which is then sent to the security service program in the trusted execution environment.

[0012] S5. The security service program of the trusted execution environment verifies the signature and the authorization status of the processing policy, and sends a key request, a remote authentication report, and the identity signature of the data processor to the data provider;

[0013] S6. After the data provider remotely verifies the remote authentication report, if it agrees to the request, it sends the key k to the security service program through a secure channel and stores the key usage record on the blockchain;

[0014] S7. The security service program downloads the ciphertext C from the cloud server, decrypts the data after verifying that id = hash(C), performs the processing operation, and returns the encrypted result to the designated recipient.

[0015] In one embodiment, in step S3, the data usage policy includes:

[0016] Authorized parties, authorized processing operation types, hash values ​​corresponding to ciphertext data, cloud service addresses where ciphertext data is stored, scope of data usage, and recipients of data processing results.

[0017] In one embodiment, in step S4, the data processing strategy includes: a specific processing method, processing parameters, data required for processing, a recipient of the processing result, and its own signature.

[0018] In one embodiment, step S5 includes:

[0019] S51. The security service program in the trusted execution environment uses the public key to verify whether the signatures of the data provider and the data processor are correct; and check whether the processing data required in the data processing policy has been authorized for use;

[0020] S52. If the authorization is verified, the security service program requests the corresponding ciphertext data from the cloud server according to the data authorization policy;

[0021] S53. The cloud server sends the corresponding ciphertext hash value and ciphertext according to the request of the security service program.<id,C> , sent to the security service program;

[0022] S54. The security service program determines whether the cloud server has fraudulent behavior by checking whether id = hash (C) is equal. If so, the service is stopped;

[0023] S55. The security service program sends a key request, a remote authentication report, and the identity signature of the data processor to the data provider.

[0024] In one embodiment, in step S5, the remote authentication report includes:

[0025] The data processor's identity information, the unique identifier of the trusted execution environment, the execution program hash value, and is signed by the trusted execution environment's hardware private key.

[0026] In one embodiment, in step S6, the blockchain evidence storage includes:

[0027] Timestamp, data provider identifier, key identifier, operation type, digital signature;

[0028] Automatically verified and written into the blockchain network through smart contracts.

[0029] In one embodiment, the step S7 further includes: destroying the decrypted data after processing in the security service program of the trusted execution environment.

[0030] In one embodiment, in step S1, the symmetric encryption algorithms used include SM4 and AES; the asymmetric encryption algorithms include SM2 and quantum-resistant encryption algorithms.

[0031] It can be seen from the above technical solutions that, compared with the prior art, the present invention has the following technical effects:

[0032] 1. The data provider's data key is stored locally and can be requested instantly by the security service program in the trusted execution environment. Users can immediately audit and store evidence of the data user. Once the data provider no longer trusts the data processor, the data flow can be terminated immediately, effectively realizing cross-domain control during the data flow process.

[0033] 2. In the present invention, the data provider stores the encrypted original data in the cloud server and only maintains the hash value and key corresponding to the ciphertext data locally, which greatly saves local storage resources. Since the cloud server cannot obtain the decryption key, it ensures that the user's original data cannot be cracked. Even if the cloud server maliciously tampers with the ciphertext data, the user or the security service program can verify the integrity of the data by verifying whether the hash value is consistent.

[0034] 3. The data decryption and processing processes are all performed in a trusted execution environment. The data provider can ensure that during the data processing process, the security service program and the trusted execution environment are not attacked by external adversaries by launching measurements, remote authentication reports, etc., thereby ensuring the privacy and security of its own data and ensuring that the recipient of the results can only obtain the processed data results but not the original data. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0036] Figure 1 This is a flow chart of the auditable key management method based on a trusted execution environment provided by the present invention.

[0037] Figure 2 This is a flowchart of the multi-party interaction involved in the method provided by the present invention. DETAILED DESCRIPTION

[0038] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0039] The embodiment of the present invention discloses an auditable key management method based on a trusted execution environment. In the specific implementation, the entities involved include: users, cloud servers, trusted execution environments, and blockchain networks;

[0040] Among them, users provide data and implement key management. Users can be divided into data providers and data processors (the two identities can coexist);

[0041] Data providers are responsible for generating keys, encrypting data, formulating authorization policies, and auditing and storing evidence;

[0042] Data processors, who submit processing requests and provide processing strategies;

[0043] Cloud servers provide storage services and store encrypted data;

[0044] The Trusted Execution Environment (TEE) provides computing services, including performing secure computations, verifying policies, and managing key requests.

[0045] Blockchain network: records of key usage (such as Hyperledger Fabric).

[0046] Reference Figure 1 As shown, specifically including:

[0047] S1. The data provider generates an asymmetric key pair (sk, pk) and a symmetric key k, uses k to encrypt the original data to obtain the ciphertext C, and calculates the hash value id of C;

[0048] S2. The data provider will<id,k> The association is stored locally and<id,C> Upload to the cloud server;

[0049] S3. The data provider formulates and signs a data usage policy, which is then signed with sk and sent together with pk to the security service program in the trusted execution environment.

[0050] S4. The data processor formulates and signs a data processing policy, which is then sent to the security service program in the trusted execution environment.

[0051] S5. The security service program of the trusted execution environment verifies the signature and the authorization status of the processing policy, and sends a key request, a remote authentication report, and the identity signature of the data processor to the data provider;

[0052] S6. After the data provider remotely verifies the remote authentication report, if it agrees to the request, it sends the key k to the security service program through a secure channel and stores the key usage record on the blockchain;

[0053] S7. The security service program downloads the ciphertext C from the cloud server, decrypts the data after verifying that id = hash(C), performs the processing operation, and returns the encrypted result to the designated recipient.

[0054] This method ensures the security of user data and keys during data circulation. At the same time, it can audit and store the key usage process in real time to achieve cross-domain control of data.

[0055] The following is a detailed description of the above S1-S7 through 18 sub-steps:

[0056] 1. The data provider generates a pair of asymmetric keys locally<sk,pk> , and the symmetric key k. The symmetric encryption algorithm used supports various symmetric encryption algorithms such as the national secret SM4 and AES. The asymmetric encryption algorithm used by users also supports various asymmetric encryption algorithms including SM2 and quantum-resistant cryptographic algorithms.

[0057] 2. The data provider uses a symmetric encryption algorithm and key k to encrypt the original plaintext data into C.

[0058] 3. The data provider uses a hash algorithm to map the ciphertext C to an id.

[0059] 4. The data provider maps the ciphertext to the corresponding id and encryption key k.<id,k> The associated form is saved locally.

[0060] 5. The data provider sends the ciphertext C and the hash value id mapped to the ciphertext to the cloud server for storage.

[0061] 6. The data provider formulates a policy for the use of the original data, which includes the parties who can be authorized to use the data, the types of operations that can be performed, the hash value corresponding to the encrypted data, the cloud service address corresponding to the encrypted data, the scope of data use, and the recipients of the data processing results.

[0062] 7. The data provider signs the usage policy and sends the usage policy and public key pk to the trusted execution environment.

[0063] 8. If the data processor is also the data provider, steps 1-7 need to be repeated.

[0064] 9. The data processor shall formulate a data processing strategy, including the specific processing method, processing parameters, data required for processing, the recipient of the processing results, and its own signature.

[0065] 10. The data processor sends the data processing policy and its own signature to the security service program in the trusted execution environment.

[0066] 11. The security service program in the trusted execution environment uses the public key to verify whether the signatures of the data provider and the data processor are correct.

[0067] 12. The security service program in the trusted execution environment checks whether the processed data required by the data processing policy has been authorized for use.

[0068] 13. If the authorization is verified, the security service program requests the corresponding encrypted data from the cloud service according to the data authorization policy.

[0069] 14. The cloud server sends the corresponding ciphertext hash value and ciphertext according to the request of the security service program.<id,C> , sent to the security service program.

[0070] 15. The security service program checks whether id=hash(C) is equal to determine whether the cloud server has fraudulent behavior. If so, the service is stopped.

[0071] 16. The security service program sends a key request, a remote attestation report, and the data processor's signature to the data provider. After the data processor submits its data processing policy to the security service program in the trusted execution environment, the security service program generates an attestation request. The remote attestation report includes the data processor's identity, the trusted execution environment's unique identifier, and the hash value of the executable program. The trusted execution environment signs the report using its own hardware-based unique private key and sends it to the data provider.

[0072] 17. The data provider verifies the remote authentication report. After receiving the remote authentication report sent by the security service program, the data provider uses the public key of the trusted execution environment hardware to verify the digital signature of the report to ensure the authenticity and integrity of the report.

[0073] The data provider and the trusted execution environment use advanced encryption protocols (such as TLS / SSL) to protect the confidentiality and integrity of data during transmission. TLS / SSL establishes a secure session through a handshake protocol to ensure that data will not be eavesdropped or tampered with during transmission. It uses a two-way authentication mechanism (such as client certificate authentication) to verify the identities of both communicating parties, ensuring that only legitimate entities can access the secure channel, and regularly refreshes the session key to ensure that even if the session key is leaked, attackers cannot decrypt previous session data. If the data provider agrees that the data processor can use the data, the symmetric key k will be sent to the security service program in the trusted execution environment through a secure channel, and the key usage record will be stored locally in real time. In order to ensure the immutability and transparency of the key usage record, this solution uses blockchain technology for real-time storage of key usage records.

[0074] The data provider stores key usage records through a suitable blockchain network (such as Hyperledger Fabric, Ethereum, or a self-built consortium chain). The format of the key usage records includes but is not limited to:

[0075] Timestamp: records the specific time when the key is used;

[0076] Data provider identifier: unique identifier of the data provider;

[0077] Key ID: unique identifier of the key;

[0078] Operation type: the specific operation of the key (such as transmission, decryption, etc.);

[0079] Signature information: The data provider digitally signs the recorded content to ensure the authenticity and integrity of the record, as well as the number of times the data has been used.

[0080] Data providers configure corresponding smart contracts, which automatically enforce predefined rules on the blockchain to ensure data consistency and integrity. Whenever a key usage event occurs, the data provider immediately writes the record to the blockchain through the smart contract. The smart contract automatically verifies the integrity of the record and the validity of the signature. Data providers and other authorized entities can query key usage records through the smart contract, ensuring transparency and traceability. If the data provider no longer trusts the data processor, they will refuse to provide the decryption key, and the service will be terminated immediately.

[0081] 18. After waiting for all data providers to return the decryption key, the security service program decrypts the ciphertext data used in the processing strategy and performs the corresponding data processing operations. All data processing is performed in a trusted execution environment. After the decrypted data is used, it is destroyed by the security service program. After successful execution, the security service program verifies the authorization policy of the data used, verifies whether the result recipient is consistent, and encrypts the processing result using the public key of the specified participant (the public key has been provided at the beginning) and returns it to the result recipient specified by the authorization policy.

[0082] In this embodiment, the data processor wishes to use the data provider's data for data processing and analysis. However, the data provider does not want the data processor to obtain its original data; it only wants the data processor to receive the processed data results. During the data processing process, the data provider can immediately audit and record each processing operation proposed by the data processor. To conserve local storage resources, the data provider stores the encrypted data on the cloud server.

[0083] In the solution, users use symmetric encryption, hashing algorithms, asymmetric encryption algorithms, blockchain, and trusted execution environment technologies to ensure the secure storage of data providers and key management audits. First, the data provider encrypts all original data using a symmetric encryption algorithm to ensure encryption efficiency on the user side. On the cloud storage service side, the cloud server obtains the symmetric encrypted data.<id,C> Without the private key, the cloud server cannot obtain any private information from the ciphertext. The security service program in the trusted execution environment can ensure that the ciphertext data sent by the cloud server has not been tampered with by verifying whether the hash value of the ciphertext has changed. This method can greatly save the data provider's local storage resources while ensuring the security and availability of the data. During data processing, each processing request from the data processor will be sent to the data provider by the security service program. The data provider can verify the security of the security service program and the trusted execution environment in real time to ensure the security of the data during program execution. At the same time, the data provider can store evidence of each decryption request to ensure traceability during the data circulation process.

[0084] like Figure 2 As shown in the figure, in this example, there are data provider A, data processor B, a trusted execution environment, and a cloud server (which may have malicious behavior). In this process, it is assumed that all data providers and data processors have already negotiated offline and synchronized the necessary information, as well as the measurement values ​​of the trusted execution environment and security service program for subsequent verification.

[0085] 1) Data provider A and data processor B each generate a pair of public and private keys locally , , and the private key And save it locally.

[0086] 2) Data provider A and data processor B use their own keys to symmetrically encrypt the original data and obtain , then data provider A and data processor B each ciphertext and Perform hash operation to get .

[0087] 3) Data provider A and data processor B map the ciphertext to the hash value and the corresponding symmetric key Save locally for maintenance.

[0088] 4) Data provider A and data processor B send their respective ciphertexts and the hash values ​​corresponding to the ciphertexts. Sent to their respective cloud servers for storage.

[0089] 5) Data Provider A and Data Provider B develop signature policies for their respective data, specifying information such as the authorized users of the data, authorized processing operations, the hash value corresponding to the ciphertext data, the service interface for storing the ciphertext data, and the recipient of the data processing results. Data Provider A and Data Provider B sign their respective authorization documents.

[0090] 6) Data provider A and data provider B send their respective data authorization policies, authorization policy signatures, and public keys to the security service program in the trusted execution environment. The security service program verifies whether the signatures are correct and saves the authorization policies.

[0091] 7) Data Processor B formulates a data processing policy, specifying the data to be used during the processing, the processing operations selected in the security service program, the recipient of the processing results, and its own signature authentication information. The data processor signs the data processing policy and sends it to the security service program. The security service program verifies the signature and saves the authorization policy.

[0092] 8) After receiving the data processing instruction from the data processor, the security service program in the trusted execution environment detects the input data required in the processing strategy and whether there is an authorization policy file for the data in the trusted execution environment. If not, the service is terminated. If so, the authorization policy files for all required input data are authorized to verify the data processing operation and whether the data processor corresponding to the data processing operation is authorized to use the data. If the verification is successful, a decryption request, a remote authentication report, and the data signature of the data processor are sent to the corresponding data owner.

[0093] 9) After receiving the decryption request from the security service, the data owner first remotely authenticates the security service, using security metrics to ensure that the security service and the trusted execution environment have not been compromised by adversaries and are secure and trustworthy. The data provider can determine in real time whether they still agree to the data processor processing their data. If not, they reject the request and interrupt the processing. If they agree, they send the decryption key to the security service and store it locally, facilitating cross-domain control of key management and use, as well as traceability and auditing of data usage.

[0094] 10) After receiving the decryption keys from all data providers, the security service program will use the hash value corresponding to the ciphertext to Request the cloud server to download the corresponding ciphertext data file.

[0095] 11) After receiving the download request from the security service program, the cloud server will send the corresponding ciphertext data Sent to the security server program, the security service program verifies ,to defend against possible malicious behaviors from cloud servers or external adversaries.

[0096] 12) After the security service program is verified, use the key Ciphertext data Decrypt to get plaintext data , and perform corresponding operations according to the data processing strategy.

[0097] 13) After the security service program completes the processing operation, the security service program also needs to check the authorization policy of all data used and whether the result recipient is consistent. If consistent, the processing result is returned to the result recipient specified by the authorization policy.

[0098] For example, in the medical data analysis scenario:

[0099] Data Provider A: The hospital encrypts patient data (SM4) and formulates a strategy to authorize research institution B to perform statistical analysis;

[0100] Processor B: Submits an aggregate analysis request, and requests a key after TEE verification.

[0101] Audit evidence: The hospital queries the number of times B's data was used through the blockchain (e.g., decryption operation at 2025-05-01 10:00:00);

[0102] Risk control: If B accesses excessively, the hospital will reject subsequent key requests and terminate the service.

[0103] In practice, Hospital A encrypts patient data and authorizes Pharmaceutical Company B to analyze it, but without access to the original data. Pharmaceutical Company B must perform each analysis within a secure environment. Hospital A can see in real time when and which data Pharmaceutical Company B uses, and can immediately suspend access if any anomalies are detected, facilitating data flow while ensuring security. Hospital A maintains control of the original data throughout Pharmaceutical Company B's analysis process. All key requests must undergo two-factor authentication (TEE integrity verification + dynamic policy checking), and an unalterable audit record is generated for each key usage.

[0104] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0105] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An auditable key management method based on a trusted execution environment, characterized in that: The following steps are involved: S1. The data provider generates an asymmetric key pair (sk, pk) and a symmetric key k, uses k to encrypt the original data to obtain the ciphertext C, and calculates the hash value id of C; S2. The data provider will<id, k> The association is stored locally and<id, C> Upload to the cloud server; S3. The data provider formulates and signs a data usage policy, which is then signed with sk and sent together with pk to the security service program in the trusted execution environment. S4. The data processor formulates and signs a data processing policy, which is then sent to the security service program in the trusted execution environment. S5. The security service program of the trusted execution environment verifies the signature and the authorization status of the processing policy, and sends a key request, a remote authentication report, and the identity signature of the data processor to the data provider; S6. After the data provider remotely verifies the remote authentication report, if it agrees to the request, it sends the key k to the security service program through a secure channel and stores the key usage record on the blockchain; S7. The security service program downloads the ciphertext C from the cloud server, decrypts the data after verifying that id = hash(C), performs the processing operation, and returns the encrypted result to the designated recipient.

2. The auditable key management method based on a trusted execution environment according to claim 1, characterized in that: In step S3, the data usage strategy includes: Authorized parties, authorized processing operation types, hash values ​​corresponding to ciphertext data, cloud service addresses where ciphertext data is stored, scope of data usage, and recipients of data processing results.

3. The auditable key management method based on a trusted execution environment according to claim 1, characterized in that: In step S4, the data processing strategy includes: the specific processing method, processing parameters, data required for processing, the recipient of the processing result, and its own signature.

4. The auditable key management method based on a trusted execution environment according to claim 1, characterized in that: The step S5 comprises: S51. The security service program in the trusted execution environment uses the public key to verify whether the signatures of the data provider and the data processor are correct; and check whether the processing data required in the data processing policy has been authorized for use; S52. If the authorization is verified, the security service program requests the corresponding ciphertext data from the cloud server according to the data usage policy; S53. The cloud server sends the corresponding ciphertext hash value and ciphertext according to the request of the security service program.<id,C> , sent to the security service program; S54. The security service program determines whether the cloud server has fraudulent behavior by checking whether id = hash (C) is equal. If so, the service is stopped; S55. The security service program sends a key request, a remote authentication report, and the identity signature of the data processor to the data provider.

5. The auditable key management method based on a trusted execution environment according to claim 4, characterized in that: In step S5, the remote authentication report includes: The data processor's identity information, the unique identifier of the trusted execution environment, the execution program hash value, and is signed by the trusted execution environment's hardware private key.

6. The auditable key management method based on a trusted execution environment according to claim 1, characterized in that: In step S6, the blockchain evidence storage includes: Timestamp, data provider identifier, key identifier, operation type, and digital signature; Automatically verified and written into the blockchain network through smart contracts.

7. The auditable key management method based on a trusted execution environment according to claim 1, characterized in that: The step S7 further includes: destroying the decrypted data after processing in the security service program of the trusted execution environment.

8. The auditable key management method based on a trusted execution environment according to claim 1, characterized in that: In step S1, the symmetric encryption algorithms used include SM4 and AES; the asymmetric encryption algorithms include SM2 and quantum-resistant encryption algorithms.

Images