Data migration method, device, equipment, storage medium and program product

Abstract

Embodiments of the present application provide a data migration method, device, equipment, storage medium and program product, relating to the technical field of information security technology. The method comprises: in response to an authentication trigger instruction, performing trustworthiness authentication with a target device; in the case where it is determined that the trustworthiness authentication is passed, performing encryption operation on the data to be migrated based on a set encryption algorithm to obtain ciphertext to be migrated, and performing signature operation on the data to be migrated based on a set signature algorithm to obtain a signature of the data to be migrated; and sending the ciphertext to be migrated and the signature of the data to be migrated to the target device, so that the target device verifies the signature of the data to be migrated based on a pre-acquired public key, and in the case where the verification is passed, decrypts the ciphertext to be migrated using a pre-acquired key to obtain the data to be migrated. The present scheme ensures the data transmission security of the migrated data on the premise of ensuring the trustworthiness of the source device and the target device.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a data migration method, apparatus, device, storage medium, and program product. Background Technology

[0002] A Trusted Execution Environment (TEE) is an isolated area within a computing system that consists of a collection of hardware, firmware, and software designed to protect the confidentiality and integrity of critical user data in a cloud environment. Because cloud environments often involve load balancing and response latency, it is frequently necessary to migrate critical user data (such as keys and authentication data from trusted cryptographic modules) within the TEE.

[0003] Therefore, it is essential to provide a data migration method that can guarantee the credibility of the identities of both parties involved in the data migration and the security of data transmission, but there is currently no relevant technology. Summary of the Invention

[0004] This application provides a data migration method, apparatus, device, storage medium, and program product that ensures the secure transmission of migrated data while ensuring the trustworthiness of the source and target devices.

[0005] In a first aspect, embodiments of this application provide a data migration method, the method being applied to a source device, both the source device and the target device carrying a trusted execution environment, wherein a trusted application and a data migration application run in the trusted execution environment, the method comprising:

[0006] In response to the authentication trigger command, perform trust authentication with the target device;

[0007] If the trust authentication is successful, in response to the data migration instruction, the data to be migrated in the trusted application is obtained through the data migration application, and the data to be migrated is encrypted based on the set encryption algorithm to obtain the ciphertext to be migrated, and the data to be migrated is signed based on the set signature algorithm to obtain the signature of the data to be migrated.

[0008] The ciphertext to be migrated and the signature of the data to be migrated are sent to the target device, so that the target device can verify the signature of the data to be migrated based on the pre-obtained public key, and if the verification is successful, use the pre-obtained key to decrypt the ciphertext to be migrated to obtain the data to be migrated.

[0009] Secondly, embodiments of this application provide a data migration apparatus. The apparatus is applied to a source device, and both the source device and the target device carry a trusted execution environment. A trusted application and a data migration application run within the trusted execution environment. The apparatus includes:

[0010] The authentication module is used to perform trust authentication with the target device in response to the authentication trigger command;

[0011] An encryption module is configured to, upon determining that the trust authentication has passed, respond to a data migration instruction by obtaining the data to be migrated from the trusted application through the data migration application, encrypting the data to be migrated based on a set encryption algorithm to obtain the ciphertext to be migrated, and signing the data to be migrated based on a set signature algorithm to obtain the signature of the data to be migrated.

[0012] The migration module is used to send the ciphertext to be migrated and the signature of the data to be migrated to the target device, so that the target device can verify the signature of the data to be migrated based on a pre-obtained public key, and if the verification is successful, decrypt the ciphertext to be migrated using a pre-obtained key to obtain the data to be migrated.

[0013] Thirdly, embodiments of this application provide a data migration method, which is applied to a target device. Both the target device and the source device carry a trusted execution environment, in which a trusted application and a data migration application run. The method includes:

[0014] In response to the authentication trigger command, perform trust authentication with the source device;

[0015] The system receives ciphertext to be migrated and a signature of data to be migrated sent by the source device after determining that the trust authentication has passed. The ciphertext to be migrated is obtained by the source device encrypting the data to be migrated based on a set encryption algorithm. The signature of data to be migrated is obtained by the source device signing the data to be migrated based on a set signature algorithm. The data to be migrated is obtained by the source device from the trusted application through the data migration application in response to the data migration instruction.

[0016] The signature of the data to be migrated is verified using a pre-obtained public key, and if the verification is successful, the ciphertext to be migrated is decrypted using a pre-obtained key to obtain the data to be migrated.

[0017] Fourthly, embodiments of this application provide a data migration apparatus. The apparatus is applied to a target device, and both the target device and the source device carry a trusted execution environment. A trusted application and a data migration application run within the trusted execution environment. The apparatus includes:

[0018] The authentication module is used to perform trust authentication with the source device in response to the authentication trigger command;

[0019] A receiving module is configured to receive the ciphertext to be migrated and the signature of the data to be migrated sent by the source device after determining that the trust authentication has passed. The ciphertext to be migrated is obtained by the source device encrypting the data to be migrated based on a set encryption algorithm. The signature of the data to be migrated is obtained by the source device signing the data to be migrated based on a set signature algorithm. The data to be migrated is obtained by the source device from the trusted application through the data migration application in response to the data migration instruction.

[0020] The verification module is used to verify the signature of the data to be migrated based on a pre-obtained public key, and if the verification is successful, to decrypt the ciphertext to be migrated using a pre-obtained key to obtain the data to be migrated.

[0021] Fifthly, embodiments of this application also provide an electronic device, the electronic device including: a memory, a processor, and a communication interface; wherein, the memory stores executable code, and when the executable code is executed by the processor, the processor performs the method described in the first or third aspect above.

[0022] In a sixth aspect, embodiments of this application also provide a non-transitory machine-readable storage medium storing executable code, which, when executed by a processor of an electronic device, causes the processor to perform the method described in the first or third aspect above.

[0023] In a seventh aspect, embodiments of this application also provide a computer program product, the computer program product comprising: a computer program, which, when executed by a processor of an electronic device, causes the processor to perform the method described in the first or third aspect above.

[0024] In this embodiment, in response to an authentication trigger command, a trust authentication is performed with the target device. If the trust authentication is successful, the data to be migrated is encrypted using a predefined encryption algorithm to obtain ciphertext to be migrated, and signed using a predefined signature algorithm to obtain a signature of the data to be migrated. While ensuring the trustworthiness of both the source and target devices, the data to be migrated is encrypted and signed, and the ciphertext and signature are sent to the target device. Subsequently, only when the target device performs the corresponding verification and decryption operations can it obtain the data to be migrated, completing the data migration and ensuring the secure transmission of the migrated data. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0026] Figure 1 A flowchart of a data migration method provided as an exemplary embodiment of this application;

[0027] Figure 2 An application diagram illustrating a data migration method provided in an exemplary embodiment of this application;

[0028] Figure 3 Another flowchart of a data migration method provided for an exemplary embodiment of this application;

[0029] Figure 4 A flowchart of yet another data migration method provided as an exemplary embodiment of this application;

[0030] Figure 5 A schematic diagram of the structure of a data migration apparatus provided for an exemplary embodiment of this application;

[0031] Figure 6 A schematic diagram of the structure of yet another data migration apparatus provided as an exemplary embodiment of this application;

[0032] Figure 7 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this application. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0034] The following is a description of the terms used in the embodiments of this application:

[0035] Trusted Execution Environment (TEE): This is an area in a computing system that runs in an isolated environment. It is a collection of hardware and software used to protect the confidentiality and integrity of users' critical data in the cloud environment.

[0036] Rich Execution Environment (REE): refers to the regular execution environment in a device that runs a general-purpose system, such as Android, iOS, openEuler, or Windows.

[0037] Currently, due to the frequent involvement of load balancing and response latency issues in cloud environments, it is often necessary to migrate critical user data (such as keys and authentication data of trusted cryptographic modules) within a trusted execution environment. Therefore, it is essential to provide a data migration method that can guarantee the trustworthiness of both parties involved in the data migration, the data transmission speed during the migration process, and the security of data transmission. In view of this, embodiments of this application provide a data migration method.

[0038] Figure 1 This is a flowchart illustrating a data migration method provided in an embodiment of this application. The method is applied to a source device, where the source and target devices can be terminal devices (mobile phones, computers, etc.), servers, etc. Both the source and target devices host a trusted execution environment, in which a trusted application and a data migration application run. Figure 1 As shown, the method includes the following steps:

[0039] Step 101: In response to the authentication trigger command, perform trust authentication with the target device.

[0040] Step 102: If the trustworthiness authentication is successful, in response to the data migration instruction, obtain the data to be migrated from the trusted application through the data migration application, encrypt the data to be migrated based on the set encryption algorithm to obtain the ciphertext to be migrated, and sign the data to be migrated based on the set signature algorithm to obtain the signature of the data to be migrated.

[0041] Step 103: Send the ciphertext to be migrated and the signature of the data to be migrated to the target device so that the target device can verify the signature of the data to be migrated based on the pre-obtained public key, and if the verification is successful, use the pre-obtained key to decrypt the ciphertext to be migrated to obtain the data to be migrated.

[0042] In practical applications, users can issue data migration commands to cloud management systems (such as OpenStack Nova, Kubernetes Operator, etc.) or dedicated migration consoles. Upon receiving the data migration command, the cloud management system (such as OpenStack Nova, Kubernetes Operator, etc.) or dedicated migration console sends authentication trigger commands to both the source and target devices.

[0043] To facilitate understanding, the following will be combined with... Figure 2 The subsequent data migration process is described in detail:

[0044] exist Figure 2 In this context, the data migration application comprises a trusted migration application and a user migration application. The trusted migration application runs in a trusted execution environment and is responsible for all operations (such as key generation, encryption, and signing). The user migration application runs in a rich execution environment and is responsible for network communication.

[0045] In practice, after receiving the authentication trigger command, the source device and the target device perform local trust authentication and remote trust authentication, respectively. Local trust authentication ensures the trustworthiness of the data migration applications on both the source and target devices, while remote trust authentication allows them to verify the trustworthiness of each other's data migration applications, laying the foundation for secure data migration in the future.

[0046] The local trust authentication process for the source device may include the following steps:

[0047] In response to the authentication trigger command, the source device migrates the user application and sends a request to the trusted application to obtain the data to be migrated through the trusted application. The trusted application is configured with a whitelist for recording multiple service identifiers, and the request to obtain the data to be migrated carries the target service identifier corresponding to the trusted application. If the trusted application determines that the whitelist contains the target service identifier, it determines that the local trust authentication is successful.

[0048] Specifically, the source device receives the authentication trigger instruction through the migration user application MCAs and sends a request to acquire the data to be migrated to multiple trusted applications TAs through the migration trusted application MTAs. Based on the configuration request identifier (such as configuration fields, characters, etc.) carried in the request to acquire the data to be migrated, the target trusted application TAs is determined from among the multiple trusted application TAs. The target trusted application TAs is configured with a whitelist for recording multiple service identifiers.

[0049] After receiving a request to acquire data to be migrated, the target trusted application (TAs) can determine whether its local trustworthiness authentication is successful based on whether the service identifier corresponding to the migration trusted application (MTAs) that sent the request is in the whitelist. If it is, the authentication is successful (that is, it is determined that the migration user application (MCAs), the migration trusted application (MTAs), and the trusted application (TAs) are deployed on the same device, are trusted, and can communicate). Otherwise, the authentication fails.

[0050] Similarly, the local trust authentication process for the target device can include the following steps:

[0051] In response to the authentication trigger command, the target device migrates the user application and sends a request to the trusted application to obtain the data to be migrated through the trusted application. The trusted application is configured with a whitelist for recording multiple service identifiers, and the request to obtain the data to be migrated carries the target service identifier corresponding to the trusted application. If the trusted application determines that the whitelist contains the target service identifier, it determines that the local trust authentication is successful.

[0052] Specifically, the target device migrates the user application MCA. D Receive authentication trigger instruction and migrate trusted application MCA D To multiple trusted applications TA D Send a request to retrieve the data to be migrated, and based on the setting request identifier (such as setting fields, characters, etc.) carried in the request, in multiple trusted applications (TAs)... D In determining the target trusted application TA D Among them, the target trusted application TA D It is configured with a whitelist for recording multiple service identifiers.

[0053] Target Trusted Application (TA) D Upon receiving a request to retrieve data to be migrated, the migration trusted application (MCA) that sent the request can be used to determine the appropriate migration method. D Check if the corresponding service identifier is on the whitelist and verify if its local trust authentication is successful. If it is, the authentication is successful (i.e., the migration user application MCA is confirmed).D Migrate Trusted Applications (MTA) D and trusted application TA D (If the devices are deployed on the same device, are trusted, and can communicate), otherwise, authentication will fail.

[0054] By using a whitelist approach to perform local trustworthiness authentication on both the source and target devices, the process is convenient, fast, and efficient.

[0055] The remote trust authentication process for source and target devices may include the following steps:

[0056] A key pair is created based on a specified signature algorithm, containing a public key and a private key. The private key is sealed to obtain a private key ciphertext. The private key ciphertext is stored locally and contains at least the private key and the device identifier of the source device. A remote authentication report is generated based on the key pair, and the remote authentication report containing the public key is sent to the target device so that the target device can perform remote trust authentication based on the public key, thus completing the establishment of a secure channel.

[0057] In specific implementation, the source device generates a key pair (public key Pubs, private key Pris) based on a set signature algorithm (such as SM2, ECDSA, EdDSA, etc., with SM2 being preferred in this embodiment). D Private key Pri D ).

[0058] The source device sends a remote authentication report to the target device. This report includes at least the public key Pubs and the TEE kernel signature. Upon receiving the remote authentication report, the target device determines the legitimacy of the source device's TEE environment based on the public key Pubs and the TEE kernel signature. If valid, the remote authentication is successful, the public key Pubs is stored locally, and its public key Pubs is... D The embedded remote authentication report is returned to the source device, which then performs the same verification process as described above and locally stores the target device's public key (Pub). D .

[0059] During this process, the source device and the target device respectively set their private keys Pris and Pri. D The process involves sealing the private key (also known as sealing) to obtain the ciphertext, which is then stored locally as the private key Pris and Pri. D Bind each device to its corresponding device identifier (i.e., device ID) and software metric (such as the hash value of a data migration application).

[0060] Based on the above, by generating a remote authentication report and incorporating the public key into the TEE-signed remote authentication report, the signature becomes invalid if the remote authentication report is tampered with, ensuring the accuracy of the remote trust authentication result. Furthermore, by sealing the private key in the key pair to obtain the ciphertext, and storing the ciphertext locally, the security of the private key can be ensured. Even if an attacker obtains the ciphertext, they cannot use it on other devices. In summary, to decrypt the ciphertext, the following conditions must be met simultaneously: 1. Same physical device; 2. Same software environment (i.e., the hash value of the data migration application is the same); 3. Same TEE version.

[0061] After confirming that the trustworthiness certification has passed, such as Figure 3 As shown, the method also includes the following steps:

[0062] Step 301: Generate session key encryption key and session key.

[0063] Step 302: Using the session key encryption key as the key, encrypt the session key using the set encryption algorithm to obtain the key ciphertext.

[0064] Step 303: Perform white-box conversion processing on the session key encryption key using a white-box key processing algorithm to obtain white-box information.

[0065] Step 304: Send the key ciphertext and white-box information to the target device so that the target device can use the white-box information as the key and the set decryption algorithm to decrypt the key ciphertext to obtain the session key.

[0066] In practical applications, after confirming successful trust authentication, the source device generates a session key encryption key KEK (which can be a 128-bit random number, such as 0x7A3F9C1E05D82B46, used to encrypt the session key) and a session key Km (which can be a 128-bit random number, such as 0x2E8A4D70B91F6C53, used to encrypt the data to be migrated) through the migration trusted application MTAs. Then, using KEK as the key, Km is encrypted using the SM4 algorithm-ECB mode to obtain the key ciphertext Cipher, where Cipher = SM4_ECB_encrypt(Km, KEK).

[0067] The session key encryption key is subjected to white-box transformation using a white-box key processing algorithm to obtain white-box information, namely the white-box table WB_KEK. Specifically:

[0068] WB_KEK= WhiteBox_SM4_Transform(KEK).

[0069] In summary, it involves integrating KEK into the SM4 algorithm logic to generate an irreversible lookup table structure.

[0070] Subsequently, the source device transmits the key ciphertext Cipher and white-box information WB_KEK via the migration user application MCA and the migration user application MCA. D Send Migration Trusted Application (MTA) D Migrate Trusted Applications (MTA) D Using the white-box information WB_KEK as the key, the Cipher is decrypted using the white-box SM4 decryption algorithm to obtain Km. Then, the source and destination devices can use Km as the key to encrypt and decrypt the data to be migrated using the SM4 algorithm.

[0071] In practical applications, the data M to be migrated in the trusted application TAs of the source device data The data is sent to the migration trusted applications (MTAs) via a secure channel (established by the source device during local authentication). The migration trusted applications (MTAs) then receive the data to be migrated, M. data Then, using Km as the key, the SM4 encryption algorithm is used to encrypt the ciphertext E to be migrated. data Simultaneously, the private key Pris generated based on the SM2 algorithm is used to transfer the data M. data Perform the signing to obtain the signature S of the data to be migrated. data Afterwards, the source device will transfer the ciphertext E to be migrated. data and the signature of the data to be migrated S data Migration User Application (MCA) sent to the target device via Migration User Application (MCA) D .

[0072] Migration User Application (MCA) for Target Devices D Upon receiving the ciphertext E to be migrated from the source device data and the signature of the data to be migrated S data Then, the migration data S is signed using the public key Pubs of the migration trusted application MTAs. data Verification is performed; if the verification passes, it proves that the data originated from the source device and has not been tampered with. Afterwards, the trusted application MTA is migrated. D Using Km as the key, the original data M to be migrated is obtained by decrypting it using the SM4 decryption algorithm. data And the data to be migrated M data Send to the trusted application TA via the secure channel established by the target device during local authentication. D Trusted Application (TA) D Upon receiving the data M to be migrated data Then, the data is encrypted and stored using its own key, thus completing the entire data migration process.

[0073] By employing a dual-key protection mechanism—using both session key encryption and session key—the security of the data to be migrated is enhanced. In this process, the use of white-box transmission not only prevents key theft but also improves data transmission speed (it should be understood that traditional data transmission schemes typically require multiple interactions and negotiations between the sender and receiver to complete a single data transmission, while white-box transmission only requires a single interaction).

[0074] Based on the above, the data migration method provided in this application, in response to an authentication trigger command, performs trust authentication with the target device. If the trust authentication is successful, it encrypts the data to be migrated using a predefined encryption algorithm to obtain ciphertext to be migrated, and signs the data to be migrated using a predefined signature algorithm to obtain a signature of the data to be migrated. While ensuring the trustworthiness of both the source and target devices, the encryption and signing operations on the data to be migrated are performed, and the ciphertext and signature are sent to the target device. Subsequently, only when the target device performs the corresponding verification and decryption operations can it obtain the data to be migrated, completing the data migration and ensuring the secure transmission of the migrated data.

[0075] In summary, this application fully utilizes the local and remote authentication capabilities of the Trusted Execution Environment (TEE), combined with the SM2 and SM4 cryptographic algorithms, to ensure the confidentiality and integrity of data during migration. Simultaneously, by leveraging the SM4 white-box cryptographic algorithm mechanism, it eliminates the frequent key negotiation interactions, securely sending the channel encryption key to the peer, thereby improving the migration speed of critical data under the TEE. Furthermore, both the SM2 and SM4 algorithms are implemented within the migration trusted application (MTA), protected by the TEE, preventing the leakage of migration keys and data during encryption / decryption.

[0076] Figure 4 This is a flowchart illustrating a data migration method provided in an embodiment of this application. The method is applied to a target device, where both the target device and the source device host a trusted execution environment. Within this trusted execution environment, a trusted application and a data migration application run. Figure 4 As shown, the method includes the following steps:

[0077] Step 401: In response to the authentication trigger command, perform trust authentication with the source device.

[0078] Step 402: Receive the ciphertext to be migrated and the signature of the data to be migrated sent by the source device after confirming that the trust authentication is passed. The ciphertext to be migrated is obtained by the source device encrypting the data to be migrated based on the set encryption algorithm. The signature of the data to be migrated is obtained by the source device signing the data to be migrated based on the set signature algorithm. The data to be migrated is obtained by the source device from the trusted application through the data migration application in response to the data migration instruction.

[0079] Step 403: Verify the signature of the data to be migrated based on the pre-obtained public key, and if the verification is successful, decrypt the ciphertext to be migrated using the pre-obtained key to obtain the data to be migrated.

[0080] Figure 4 The method shown can perform the steps in the foregoing embodiments. For detailed execution process and technical effects, please refer to the description in the foregoing embodiments, which will not be repeated here.

[0081] Figure 5 This is a schematic diagram of a data migration apparatus provided in an embodiment of this application. The apparatus is applied to a source device, and both the source device and the target device carry a trusted execution environment. A trusted application and a data migration application run in the trusted execution environment. The apparatus includes:

[0082] The authentication module 51 is used to perform trust authentication with the target device in response to the authentication trigger command.

[0083] The encryption module 52 is configured to, upon determining that the trust authentication has passed, respond to a data migration instruction by obtaining the data to be migrated from the trusted application through the data migration application, encrypting the data to be migrated based on a set encryption algorithm to obtain the ciphertext to be migrated, and signing the data to be migrated based on a set signature algorithm to obtain the signature of the data to be migrated.

[0084] The migration module 53 is used to send the ciphertext to be migrated and the signature of the data to be migrated to the target device, so that the target device can verify the signature of the data to be migrated based on the pre-obtained public key, and if the verification is successful, use the pre-obtained key to decrypt the ciphertext to be migrated to obtain the data to be migrated.

[0085] Optionally, the authentication module 51 is specifically configured to: perform local trust authentication in response to an authentication trigger command, wherein the local trust authentication is used to authenticate the trustworthiness of the source device's own data migration application; and perform remote trust authentication, wherein the remote trust authentication is used to enable the source device and the target device to verify the trustworthiness of each other's data migration application.

[0086] Optionally, the data migration application includes a migration trusted application and a migration user application; the authentication module 51 is further configured to: in response to an authentication trigger instruction, the migration user application sends a request to acquire data to be migrated to the trusted application through the migration trusted application, wherein the trusted application is configured with a whitelist for recording multiple service identifiers, and the request to acquire data to be migrated carries the target service identifier corresponding to the migration trusted application; if the trusted application determines that the whitelist contains the target service identifier, it determines that the local trust authentication is successful; and, based on the set signature algorithm, a key pair is created, the key pair containing a public key and a private key; a remote authentication report is generated based on the key pair, and the remote authentication report containing the public key is sent to the target device so that the target device performs remote trust authentication based on the public key.

[0087] Optionally, the device further includes: a sealing module for sealing the private key in the key pair to obtain private key ciphertext; and for locally storing the private key ciphertext, wherein the private key ciphertext includes at least: the private key and the device identifier of the source device.

[0088] Optionally, the device further includes: an encryption / decryption module, configured to generate a session key encryption key and a session key; encrypt the session key using the session key encryption key as the key and the set encryption algorithm to obtain key ciphertext; perform white-box conversion processing on the session key encryption key using a white-box key processing algorithm to obtain white-box information; and send the key ciphertext and the white-box information to the target device, so that the target device uses the white-box information as the key and the set decryption algorithm to decrypt the key ciphertext to obtain the session key.

[0089] Figure 5 The device shown can perform the steps in the foregoing embodiments. For detailed execution process and technical effects, please refer to the description in the foregoing embodiments, which will not be repeated here.

[0090] Figure 6 This is a schematic diagram of a data migration apparatus provided in an embodiment of this application. The apparatus is applied to a target device, and both the target device and the source device carry a trusted execution environment. A trusted application and a data migration application run in the trusted execution environment. The apparatus includes:

[0091] Authentication module 61 is used to perform trust authentication with the source device in response to authentication trigger command;

[0092] The receiving module 62 is configured to receive the ciphertext to be migrated and the signature of the data to be migrated sent by the source device after determining that the trust authentication has passed. The ciphertext to be migrated is obtained by the source device encrypting the data to be migrated based on a set encryption algorithm. The signature of the data to be migrated is obtained by the source device signing the data to be migrated based on a set signature algorithm. The data to be migrated is obtained by the source device from the trusted application through the data migration application in response to the data migration instruction.

[0093] The verification module 63 is used to verify the signature of the data to be migrated based on the pre-obtained public key, and if the verification is successful, to decrypt the ciphertext to be migrated using the pre-obtained key to obtain the data to be migrated.

[0094] Figure 6 The device shown can perform the steps in the foregoing embodiments. For detailed execution process and technical effects, please refer to the description in the foregoing embodiments, which will not be repeated here.

[0095] This application also provides an electronic device, such as... Figure 7 As shown, the electronic device may include: a processor 71, a memory 72, and a communication interface 73. The memory 72 stores executable code, which, when executed by the processor 71, enables the processor 71 to implement the data migration method as described in the preceding embodiments.

[0096] In addition, embodiments of this application provide a non-transitory machine-readable storage medium storing executable code, which, when executed by a processor of an electronic device, enables the processor to at least implement the data migration method provided in the foregoing embodiments.

[0097] This application provides a computer program product, which includes a computer program that, when executed by a processor of an electronic device, causes the processor to perform the data migration method provided in the foregoing embodiments.

[0098] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0099] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0100] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0101] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0102] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0103] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0104] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0105] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0106] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A data migration method, characterized in that, The method, applied to both a source device and a target device, includes a trusted execution environment (TEE) running a trusted application and a data migration application within the TEE. In response to the authentication trigger command, perform trust authentication with the target device; If the trust authentication is successful, in response to the data migration instruction, the data to be migrated in the trusted application is obtained through the data migration application, and the data to be migrated is encrypted based on the set encryption algorithm to obtain the ciphertext to be migrated, and the data to be migrated is signed based on the set signature algorithm to obtain the signature of the data to be migrated. The ciphertext to be migrated and the signature of the data to be migrated are sent to the target device, so that the target device can verify the signature of the data to be migrated based on the public key carried in the remote report, and if the verification is successful, the ciphertext to be migrated is decrypted using the pre-obtained key to obtain the data to be migrated; The trust authentication with the target device includes: A key pair is created based on the specified signature algorithm, the key pair containing a public key and a private key; The private key is sealed to obtain the private key ciphertext; The private key ciphertext is stored locally, and the private key in the private key ciphertext is bound to the corresponding source device identifier and software metric value; A remote authentication report is generated based on the key pair, and the remote authentication report containing the public key is sent to the target device so that the target device can perform remote trust authentication based on the public key.

2. The method according to claim 1, characterized in that, The step of performing trust authentication with the target device in response to the authentication trigger command includes: In response to an authentication trigger command, a local trust authentication is performed, which is used to authenticate the trustworthiness of the source device's own data migration application.

3. The method according to claim 2, characterized in that, The data migration application includes: a migration trusted application and a migration user application; the local trust authentication in response to the authentication trigger command includes: In response to the authentication trigger command, the migration user application sends a request to obtain the data to be migrated to the trusted application through the migration trusted application. The trusted application is configured with a whitelist for recording multiple service identifiers, and the request to obtain the data to be migrated carries the target service identifier corresponding to the migration trusted application. If the trusted application determines that the target service identifier is included in the whitelist, then the local trust authentication is successful.

4. The method according to claim 1, characterized in that, After determining that the trustworthiness authentication has passed, the method further includes: Generate the session key encryption key and the session key; Using the session key encryption key as the key, the session key is encrypted using the set encryption algorithm to obtain the key ciphertext; The session key encryption key is subjected to white-box conversion processing using a white-box key processing algorithm to obtain white-box information; The key ciphertext and the white-box information are sent to the target device, so that the target device uses the white-box information as the key and a set decryption algorithm to decrypt the key ciphertext to obtain the session key.

5. A data migration method, characterized in that, The method, applied to a target device and a source device, both of which host a trusted execution environment (TEA), wherein a trusted application and a data migration application run within the TEA, comprises: In response to the authentication trigger command, perform trust authentication with the source device; The system receives ciphertext to be migrated and a signature of data to be migrated sent by the source device after determining that the trust authentication has passed. The ciphertext to be migrated is obtained by the source device encrypting the data to be migrated based on a set encryption algorithm. The signature of data to be migrated is obtained by the source device signing the data to be migrated based on a set signature algorithm. The data to be migrated is obtained by the source device from the trusted application through the data migration application in response to the data migration instruction. The signature of the data to be migrated is verified based on the public key carried in the remote report. If the verification is successful, the ciphertext to be migrated is decrypted using the pre-obtained key to obtain the data to be migrated. The trust authentication with the source device includes: A key pair is created based on the specified signature algorithm, the key pair containing a public key and a private key; The private key is sealed to obtain the private key ciphertext; The private key ciphertext is stored locally, and the private key in the private key ciphertext is bound to the corresponding source device identifier and software metric value; A remote authentication report is generated based on the key pair, and the remote authentication report containing the public key is sent to the source device so that the source device can perform remote trust authentication based on the public key.

6. An electronic device, characterized in that, include: The device includes a memory, a processor, and a communication interface; wherein the memory stores executable code, which, when executed by the processor, causes the processor to perform the data migration method as described in any one of claims 1 to 4, or claim 5.

7. A non-transitory machine-readable storage medium, characterized in that, The non-transitory machine-readable storage medium stores executable code that, when executed by a processor of an electronic device, causes the processor to perform the data migration method as described in any one of claims 1 to 4, or claim 5.

8. A computer program product, characterized in that, include: A computer program, when executed by a processor of an electronic device, causes the processor to perform the data migration method as described in any one of claims 1 to 4, or claim 5.

Images