Data protection method, system and equipment for software cipher module and storage medium

Abstract

The invention provides a data protection method, system and device for a software cipher module and a storage medium, and relates to the field of network information security. According to the technical scheme, a three-level key management system is adopted, and a master key is generated through exclusive-or operation of a random factor, an equipment factor and a user factor; double encryption protection is carried out on the random factor, firstly, the SM4 algorithm is used for encryption by taking the lower 16 bytes of the SM3 hash value of the PIN code of the user as a secret key, and then the white box secret key is used for encryption; the master key is used for protecting a module authentication key, an identity authentication key, a collaborative signature terminal private key component and the like. White-box keys are generated by the hardware device and converted into lookup tables and codes, which can prevent the keys from being extracted during execution. The system combines multiple protection measures, ensures that the secret key is not stored in a plaintext mode, improves the safety of the software password module, and is suitable for the electronic signature and data encryption requirements of scenes such as a mobile terminal.

Description

Technical Field

[0001] This invention relates to the field of network information security, and in particular to a data protection method, system, device and storage medium for a software cryptographic module. Background Technology

[0002] With the rapid development and integration of network and communication technologies, mobile e-commerce has demonstrated enormous market potential. As a novel business and service model, mobile e-commerce brings low costs and convenience to users worldwide, but it also raises numerous security concerns. Security is crucial to the success of mobile e-commerce, and the limitations of mobile network devices present significant challenges in resolving these issues.

[0003] With the rapid development of e-commerce, traditional security devices such as USB tokens and USB keys can significantly improve the security of user identity authentication and effectively prevent information leakage threats. However, more and more e-commerce and transactions are transitioning and developing towards the mobile internet, and the demand for electronic signatures using digital certificates on mobile terminals (phones) is increasing daily. However, traditional USB tokens and USB keys are significantly inconvenient to carry, use, and maintain on conventional mobile smart terminals such as mobile phones and tablets, thus greatly limiting their widespread adoption. How to ensure a good user experience, adapt to the technological development of mobile and cloud computing, and simultaneously issue legally valid and reliable electronic signatures? This is a problem that researchers in the field of information security need to explore and solve.

[0004] To address the above issues, software cryptography modules have been developed to replace hardware cryptography modules. These modules provide service interfaces in the form of software SDKs, offering data encryption / decryption and digital signature / verification services to upper-layer business application systems. Because software cryptography operates in software form, its key system differs from traditional key management systems. It typically runs in a modifiable computing environment, and keys and critical sensitive parameters are usually stored on terminal devices. The keys, critical sensitive parameters, and cryptographic calculation processes lack secure and effective protection. Therefore, the security of keys and critical sensitive parameters must be fully considered when using software cryptography to avoid the risk of unauthorized access and leakage.

[0005] This patent proposes a new approach and solution to address the issue of secure storage of keys and critical sensitive parameters. Summary of the Invention

[0006] Purpose of the invention: To propose a data protection method, system, device, and storage medium for software cryptographic modules, which uses white-box keys to encrypt and protect key sensitive data (random factors) and adopts a three-level cryptographic protection system to improve the security protection mechanism of user keys and solve the problem of security protection of sensitive data in software cryptographic modules.

[0007] In a first aspect, the present invention provides a data protection method for a software cryptographic module, comprising the following steps:

[0008] Step 1: Generate the master key by performing an XOR operation on the random factor, device factor, and user factor.

[0009] Step 2: The random factor is protected by a double encryption mechanism. The first encryption protection is to use the lower 16 bytes of the hash value calculated by the user PIN code using the SM3 algorithm as the key, and then use the SM4 algorithm to encrypt the random factor to obtain ciphertext C1. The second encryption protection is to use the white-box key to encrypt the ciphertext C1 to obtain ciphertext C2.

[0010] Step 3: Use the master key to protect each key in the key system;

[0011] Step 4: Upon receiving a data signature or decryption command, input the user PIN code, use the PIN code derivation algorithm to obtain the first master key encryption key, and combine it with the white-box key to decrypt and obtain the random factor; use the random factor, device factor, and user factor to calculate and obtain the master key, and then use the master key to decrypt and recover the module authentication key, identity authentication key, and collaborative signature private key components to realize the signature or decryption operation of the target data.

[0012] In a further embodiment of the first aspect, the random factor mentioned in step one is generated by a hardware cryptographic device outside the module and sent to the module through a secure channel; the device factor is the high 16 bytes of the hash value calculated by the SM3 algorithm using terminal device feature information, and the terminal device feature information includes at least one of the terminal device's IEMI, unique device number, storage space, memory, and system application information, which are concatenated together; the user factor is the high 16 bytes of the hash value calculated by the SM3 algorithm using the user PIN code.

[0013] In a further embodiment of the first aspect, the terminal device feature information in step one is composed of the terminal device's IEMI, unique device number, storage space, memory, and system application information.

[0014] In a further embodiment of the first aspect, in step one, the user factor adopts the high 16 bytes of the user PIN code SM3 hash value.

[0015] In a further embodiment of the first aspect, the white-box key in step two is generated by a random number from an external hardware cryptographic device and converted into a lookup table and source code according to the SM4 white-box algorithm. After being integrated and compiled with other code, an executable program is generated. The lookup table portion is stored in a file, and the code portion is compiled together with other code into an executable file and stored in a program file.

[0016] In a further embodiment of the first aspect, in step two, the key used for the first layer of encryption protection of the random factor is specifically the lower 16 bytes of the user PIN code SM3 hash value.

[0017] In a further embodiment of the first aspect, step three specifically includes:

[0018] The master key is used to encrypt and protect the module authentication key, which is used for identifying the cryptographic supervisor role; the master key is also used to encrypt and protect the identity authentication key, which is used for identity authentication or negotiation of session keys with the signature collaboration server; and the master key is used to encrypt and protect the collaborative signature terminal private key component or its random factor, which is used to complete collaborative signature with the server's private key component.

[0019] A second aspect of the present invention provides a data protection system for a software cryptographic module, the system comprising:

[0020] The master key generation module is used to generate a master key by performing an XOR operation on a random factor, a device factor, and a user factor. The random factor is generated externally by a hardware cryptographic device and received through a secure channel. The device factor is the high-order 16 bytes of a hash value calculated using the SM3 algorithm based on terminal device characteristic information. The terminal device characteristic information includes at least one of the following: IEMI, unique device number, storage space, memory, and system application information of the terminal device, which are concatenated together. The user factor is the high-order 16 bytes of a hash value calculated using the SM3 algorithm based on the user PIN code.

[0021] A random factor encryption protection module is used to protect the random factor with double encryption. It includes a first encryption unit and a second encryption unit. The first encryption unit uses the lower 16 bytes of the hash value calculated by the user's PIN code using the SM3 algorithm as the key, and uses the SM4 algorithm to encrypt the random factor to obtain ciphertext C1. The second encryption unit uses a white-box key to encrypt the ciphertext C1 to obtain ciphertext C2. The white-box key is generated by a random number from an external hardware cryptographic device and converted into a lookup table and source code according to the SM4 white-box algorithm. After being integrated and compiled with other code, an executable program is generated. The lookup table part is stored in a file, and the code part is compiled with other code into an executable file and stored in a program file.

[0022] The key system protection module is used to protect each key in the key system using the master key, including: encrypting and protecting the module authentication key, which is used for cryptographic supervisor role authentication; encrypting and protecting the identity authentication key, which is used for identity authentication or negotiation session key with the signature collaboration server; and encrypting and protecting the collaborative signature terminal private key component or its random factor, which is used to complete collaborative signature with the server private key component.

[0023] The decryption and calculation module is used to, upon receiving a data signature or decryption instruction, input a user PIN code, obtain a first master key encryption key using a PIN code derivation algorithm, and decrypt the random factor using the white-box key; then, calculate the master key using the random factor, device factor, and user factor, and use the master key to decrypt and recover the module authentication key, identity authentication key, and collaborative signature private key components to achieve signature or decryption operations on the target data.

[0024] A third aspect of the present invention provides an electronic device comprising: a processor and a memory storing computer program instructions; wherein the processor, when executing the computer program instructions, implements the data protection method of the software cryptographic module described in the first aspect.

[0025] In a fourth aspect, the present invention provides a computer-readable storage medium storing at least one executable instruction that, when executed on an electronic device, causes the electronic device to perform the data protection method of the software cryptographic module described in the first aspect.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] (1) The master key is generated by XORing a random factor, a device factor, and a user factor. The random factor is generated by a hardware cryptographic device outside the module and sent to the module through a secure channel. The device factor uses the terminal device characteristic information (composed of the terminal device's IEMI, unique device number, storage space, memory, system application information, etc.) and calculates the hash value using the SM3 algorithm, taking the high 16 bytes. The user factor uses the high 16 bytes of the user PIN code's SM3 hash value.

[0028] (2) The random factor is protected by a multi-layered protection mechanism. The first layer of encryption protection uses the user PIN code derivation algorithm as the master key, and the second layer uses a white-box key. The white-box key is generated by a random number from an external hardware cryptographic device and converted into a lookup table and source code according to the white-box algorithm. This source code is then integrated and compiled with other code to generate the final executable program. The white-box key exists in the form of a lookup table and code. The lookup table portion is stored in a file, while the code portion is compiled with other code into an executable file and stored in the program file.

[0029] (3) Use the master key to protect each key in the key system, use the master key to encrypt and protect the module authentication key, use the module authentication key to identify the cryptographic supervisor role; use the master key to encrypt and protect the identity authentication key, use the identity authentication key to authenticate the identity or negotiate the session key with the signature collaboration server; use the master key to encrypt and protect the private key component of the collaborative signature terminal or its random factor, and use the private key component of the collaborative signature terminal and the private key component of the server to complete the collaborative signature. Attached Figure Description

[0030] Figure 1 This is a flowchart of the data protection method for the software cryptographic module in the embodiment.

[0031] Figure 2 This is a schematic diagram of the data protection system of the software cryptography module in the embodiment. Detailed Implementation

[0032] In the following description, numerous specific details are set forth in order to provide a more thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention can be practiced without one or more of these details. In other instances, certain technical features well-known in the art have not been described in order to avoid obscuring the invention.

[0033] Before describing the embodiments, the terms that appear below will be explained.

[0034] Key: The critical information or parameters that control the operation of cryptographic algorithms.

[0035] White-box attack: The execution process of the software is completely visible to the attacker. If the cryptographic software running in this environment does not have special protection for the key, the attacker can easily obtain the key information by observing or executing the cryptographic software.

[0036] White-box cryptography: In order to protect the key in a white-box attack environment, the key information is hidden during the execution of the cryptographic software to prevent attackers from extracting the key in a white-box attack environment.

[0037] Research revealed that software cryptographic modules typically employ simple key management mechanisms, relying solely on PIN codes to protect critical and sensitive data. This poses a risk of sensitive data leakage or eavesdropping. This patent addresses this by using white-box keys to encrypt and protect critical and sensitive data (random factors) and employing a three-level cryptographic protection system. This enhances the security of user keys and solves the problem of sensitive data security protection in software cryptographic modules.

[0038] Software cryptography, existing in software form and running in a modifiable computing environment, cannot provide secure protection for important data stored on terminal devices, such as keys and critical sensitive parameters. This patent proposes a data protection method for software cryptographic modules based on white-box cryptography, employing a three-level key management system to effectively protect the data security of the software cryptographic module. White-box cryptography primarily prevents attackers from extracting the keys in cryptographic algorithms during algorithm execution. Because the key information of white-box algorithms is hidden in a lookup table and subjected to input / output scrambling encoding, it is difficult to recover the key information from the lookup table. Random factors are used to provide sufficient entropy sources. This patent utilizes white-box cryptography to protect the random factors, then calculates the master key through multi-factor computation, and uses the master key to protect user keys, etc. This effectively solves the problem of secure storage of sensitive parameters in software cryptographic modules.

[0039] This embodiment discloses the specific execution flow of a data protection method for a software cryptographic module, see [link to relevant documentation]. Figure 1 :

[0040] Step 1: Generating the master key: The master key is generated by XORing the random factor, device factor, and user factor.

[0041] The random factor is generated by a hardware cryptographic device outside the module and sent to the module through a secure channel. As a sensitive security parameter, the random factor needs to be protected.

[0042] The device factor uses terminal device characteristic information (composed of terminal device IEMI, unique device number, storage space, memory, system application information, or other information) and uses the SM3 algorithm to calculate the hash value, taking its high 16 bytes, i.e., device factor = [SM3(terminal device IEMI||unique device number||storage space||memory||system application information)] high 16 bytes;

[0043] The user factor is the high 16 bytes of the user PIN code's SM3 hash value, i.e., user factor = [SM3(PIN)]. 高16字节 .

[0044] Step 2: Double encryption protection mechanism for random factors: The lower 16 bytes of the user PIN code SM3 hash value are used as the key to perform the first layer of encryption protection on the random factors using the SM4 algorithm, resulting in ciphertext C1; then, the white-box key is used to perform the second layer of encryption protection on C1, resulting in C2.

[0045] The white-box key is generated by a random number from an external hardware cryptographic device and converted into a lookup table and source code according to the SM4 white-box algorithm. This is then integrated and compiled with the source code to generate the final executable program. The white-box key exists in the form of a lookup table and code. The lookup table portion is stored in a file, while the code portion is compiled together with other code into an executable file, which is stored in the program file.

[0046] Step 3: Protect each key in the key system using the master key; encrypt and protect the module authentication key using the master key; authenticate the cryptographic supervisor role using the module authentication key; encrypt and protect the identity authentication key using the master key; authenticate the identity authentication key with the signature collaboration server or negotiate the session key using the identity authentication key; encrypt and protect the private key component of the collaborative signature terminal or its random factor using the master key; and complete the collaborative signature using the private key component of the collaborative signature terminal and the private key component of the server.

[0047] Step 4: Upon receiving the data signature / decryption command, the user's PIN code is entered, and the first master key encryption key is obtained using the PIN code derivation algorithm. Then, the white-box key is used to jointly decrypt and obtain the random factor. The random factor, device factor, and user factor are used to calculate and obtain the master key. The master key is then used to decrypt and recover the module authentication key, identity authentication key, and collaborative signature private key components, thereby achieving the signature / decryption operation on the target data.

[0048] This embodiment also discloses a data protection system 500 for a software cryptographic module, see [link / details]. Figure 2 The system consists of a master key generation module 501, a random factor encryption protection module 502, a key system protection module 503, and a decryption and calculation module 504.

[0049] The master key generation module 501 is used to generate a master key by performing an XOR operation on a random factor, a device factor, and a user factor. The random factor is generated by a hardware cryptographic device outside the module and received through a secure channel. The device factor is obtained by using terminal device feature information, calculating a hash value using the SM3 algorithm, and then taking the high 16 bytes. The terminal device feature information includes at least one of the terminal device's IEMI, unique device number, storage space, memory, and system application information, which are concatenated together. The user factor is obtained by using the user PIN code, calculating a hash value using the SM3 algorithm, and then taking the high 16 bytes.

[0050] The random factor encryption protection module 502 is used to provide double encryption protection for the random factor. It includes a first encryption unit and a second encryption unit. The first encryption unit uses the lower 16 bytes of the hash value calculated by the user's PIN code using the SM3 algorithm as the key, and uses the SM4 algorithm to encrypt the random factor to obtain ciphertext C1. The second encryption unit uses a white-box key to encrypt ciphertext C1 to obtain ciphertext C2. The white-box key is generated by a random number from an external hardware cryptographic device and converted into a lookup table and source code according to the SM4 white-box algorithm. After being integrated and compiled with other code, an executable program is generated. The lookup table part is stored in a file, and the code part is compiled with other code into an executable file and stored in the program file.

[0051] The key system protection module 503 is used to protect each key in the key system using the master key, including: encrypting and protecting the module authentication key, which is used for cryptographic supervisor role authentication; encrypting and protecting the identity authentication key, which is used for identity authentication or negotiation session key with the signature collaboration server; and encrypting and protecting the private key component of the collaborative signature terminal or its random factor, which is used to complete collaborative signature with the private key component of the server.

[0052] After receiving a data signature or decryption command, the decryption and operation module 501 inputs the user's PIN code, uses the PIN code derivation algorithm to obtain the first master key encryption key, and combines it with the white-box key decryption to obtain the random factor; then it uses the random factor, device factor, and user factor to calculate and obtain the master key, and uses the master key to decrypt and recover the module authentication key, identity authentication key, and collaborative signature private key components to realize the signature or decryption operation of the target data.

[0053] The logical ideas behind the methods disclosed in the above embodiments can be implemented, in whole or in part, through software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs.

[0054] When computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions according to the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. Semiconductor media can be solid-state drives (SSDs).

[0055] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0056] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0057] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0058] This invention employs multiple security measures, including white-box cryptography and PIN code protection, to safeguard the key system and avoid the security risk of being unable to obtain the key after a single measure is compromised. Secondly, it ensures that the key is not stored in plaintext within the entire key system. Thirdly, it uses white-box cryptography to prevent attackers from extracting the key from the cryptographic algorithm during algorithm execution. Because the key information for the white-box SM4 algorithm is hidden in a lookup table and its input and output are scrambled, the difficulty of recovering the key information from the lookup table impacts the security of the white-box algorithm.

[0059] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. Although the present invention has been shown and described with reference to specific preferred embodiments, it should not be construed as limiting the invention itself. Various changes in form and detail may be made without departing from the spirit and scope of the invention as defined in the appended claims.

Claims

1. A data protection method for a software cryptographic module, characterized in that, Includes the following steps: Step 1: Generate the master key by performing an XOR operation on the random factor, device factor, and user factor. Step 2: The random factor is protected by a double encryption mechanism. The first encryption protection is to use the lower 16 bytes of the hash value calculated by the user PIN code using the SM3 algorithm as the key, and then use the SM4 algorithm to encrypt the random factor to obtain ciphertext C1. The second encryption protection is to use the white-box key to encrypt the ciphertext C1 to obtain ciphertext C2. Step 3: Use the master key to protect each key in the key system; Step 4: Upon receiving a data signature or decryption command, input the user PIN code, use the PIN code derivation algorithm to obtain the first master key encryption key, and combine it with the white-box key to decrypt and obtain the random factor; use the random factor, device factor, and user factor to calculate and obtain the master key, and then use the master key to decrypt and recover the module authentication key, identity authentication key, and collaborative signature private key components to realize the signature or decryption operation of the target data.

2. The data protection method for a software cryptographic module according to claim 1, characterized in that, The random factor mentioned in step one is generated by a hardware cryptographic device outside the module and sent to the module through a secure channel; the device factor is the high 16 bytes of the hash value calculated by the SM3 algorithm using terminal device feature information. The terminal device feature information includes at least one of the following: IEMI, unique device number, storage space, memory, and system application information of the terminal device, which are concatenated together; the user factor is the high 16 bytes of the hash value calculated by the SM3 algorithm using the user PIN code.

3. The data protection method for a software cryptographic module according to claim 2, characterized in that, The terminal device feature information mentioned in step one is composed of the terminal device's IEMI, unique device number, storage space, memory, and system application information.

4. A data protection method for a software cryptographic module according to claim 1 or 2, characterized in that, In step one, the user factor is the high 16 bytes of the user PIN code SM3 hash value.

5. The data protection method for a software cryptographic module according to claim 1, characterized in that, The white-box key mentioned in step two is generated by random numbers from an external hardware cryptographic device and converted into a lookup table and source code according to the SM4 white-box algorithm. After being integrated and compiled with other code, an executable program is generated. The lookup table part is stored in a file, and the code part is compiled together with other code into an executable file and stored in the program file.

6. A data protection method for a software cryptographic module according to claim 1 or 5, characterized in that, In step two, the key used for the first layer of encryption protection of the random factor is specifically the lower 16 bytes of the user PIN code SM3 hash value.

7. The data protection method for a software cryptographic module according to claim 1, characterized in that, Step three specifically includes: The master key is used to encrypt and protect the module authentication key, which is used for identifying the cryptographic supervisor role; the master key is also used to encrypt and protect the identity authentication key, which is used for identity authentication or negotiation of session keys with the signature collaboration server; and the master key is used to encrypt and protect the collaborative signature terminal private key component or its random factor, which is used to complete collaborative signature with the server's private key component.

8. A data protection system for a software cryptographic module, characterized in that, include: The master key generation module is used to generate a master key by performing an XOR operation on a random factor, a device factor, and a user factor. The random factor is generated externally by a hardware cryptographic device and received through a secure channel. The device factor is the high-order 16 bytes of a hash value calculated using the SM3 algorithm based on terminal device characteristic information. The terminal device characteristic information includes at least one of the following: IEMI, unique device number, storage space, memory, and system application information of the terminal device, which are concatenated together. The user factor is the high-order 16 bytes of a hash value calculated using the SM3 algorithm based on the user PIN code. A random factor encryption protection module is used to protect the random factor with double encryption. It includes a first encryption unit and a second encryption unit. The first encryption unit uses the lower 16 bytes of the hash value calculated by the user's PIN code using the SM3 algorithm as the key, and uses the SM4 algorithm to encrypt the random factor to obtain ciphertext C1. The second encryption unit uses a white-box key to encrypt the ciphertext C1 to obtain ciphertext C2. The white-box key is generated by a random number from an external hardware cryptographic device and converted into a lookup table and source code according to the SM4 white-box algorithm. After being integrated and compiled with other code, an executable program is generated. The lookup table part is stored in a file, and the code part is compiled with other code into an executable file and stored in a program file. The key system protection module is used to protect each key in the key system using the master key, including: encrypting and protecting the module authentication key, which is used for cryptographic supervisor role authentication; encrypting and protecting the identity authentication key, which is used for identity authentication or negotiation session key with the signature collaboration server; and encrypting and protecting the collaborative signature terminal private key component or its random factor, which is used to complete collaborative signature with the server private key component. The decryption and calculation module is used to, upon receiving a data signature or decryption instruction, input a user PIN code, obtain a first master key encryption key using a PIN code derivation algorithm, and decrypt the random factor using the white-box key; then, calculate the master key using the random factor, device factor, and user factor, and use the master key to decrypt and recover the module authentication key, identity authentication key, and collaborative signature private key components to achieve signature or decryption operations on the target data.

9. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the data protection method of the software cryptographic module as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The storage medium stores at least one executable instruction, which, when executed on an electronic device, causes the electronic device to perform the data protection method of the software cryptographic module as described in any one of claims 1 to 7.

Images