A cluster data encryption and decryption method, device and system based on double trusted binding and decryption deadline control

Abstract

The application discloses a cluster data encryption and decryption method, device and system based on double trusted binding and decryption deadline control, relates to the technical field of information security, and comprises the following steps: collecting hardware characteristic information of a cluster terminal node, extracting a certain length of bytes as original machine code after processing; obtaining a dynamic key factor, extracting a specified length of bytes as a data key after processing; splicing the original machine code and certificate validity period information, generating certificate machine code after processing; splicing the original machine code and certificate validity period information, generating a machine envelope key after processing, performing symmetric encryption on the data key to obtain a machine key; generating a key certificate; and encrypting plaintext data by using the data key to obtain data ciphertext. The application introduces a multi-hardware characteristic fusion and multi-level key encryption system, and solves the problems of device identity impersonation, key leakage and uncontrollable data life cycle in a cluster environment.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a cluster data encryption and decryption method, apparatus and system based on dual trusted binding and decryption period control. Background Technology

[0002] With the rapid iteration of cloud computing and big data technologies, distributed clusters have become the core carrier for data storage, processing, and circulation, and the frequency and scale of data interaction between cluster nodes are growing exponentially. As a core production factor, the secure storage, reliable transmission, and compliant use of data in a cluster environment are crucial to ensuring business continuity and data value.

[0003] However, existing cluster data security solutions still have many technical shortcomings that need to be addressed in practical applications, making it difficult to meet the needs of high-security scenarios:

[0004] First, the simplistic trust model leads to significant risks of device spoofing. Current cluster environments rely heavily on software-level digital certificates, account passwords, or lightweight device identifiers for device authentication, lacking deep integration with physical hardware. This software-level authentication method has significant security vulnerabilities. Once attackers illegally obtain certificate files or crack passwords, they can impersonate legitimate nodes on unauthorized devices to access the cluster, triggering "certificate migration attacks." This causes the cluster's trust boundary to fail, leading to frequent security incidents of unauthorized devices stealing and tampering with data.

[0005] Secondly, the key management system has serious security vulnerabilities. Traditional cluster key management often adopts a centralized storage or key-device decoupling design, resulting in a lack of strong association between data keys and specific devices. On the one hand, once a centrally stored key is leaked, attackers can use that key to decrypt all encrypted data within the cluster, causing large-scale data breaches. On the other hand, the decoupling of keys from devices makes it impossible to trace the source of the leak after it occurs, and the lack of fine-grained access control policies makes it impossible to restrict the scope and scenarios in which keys can be used, further amplifying security risks.

[0006] Third, there is a lack of data lifecycle management mechanisms. Existing encryption schemes focus solely on confidentiality protection during data transmission and storage, lacking rigid constraints on the extended retention and usage periods of encrypted data. Once received, data can be retained, copied, or disseminated indefinitely, failing to achieve closed-loop management of "data expiration on schedule." This deficiency is particularly prominent in sectors with extremely high data compliance requirements, such as finance, healthcare, and government, easily leading to compliance risks such as data misuse and privacy breaches, thus violating the core requirements of data security governance.

[0007] Fourth, the hardware binding technology is poorly designed and lacks anti-counterfeiting capabilities. While some solutions attempt to introduce hardware features for binding, they often use a simple method of generating device identifiers by combining a single hardware serial number (such as a CPU serial number) with a single hash processing. This type of design is easily cracked by attackers through methods such as forging hardware serial numbers and tampering with hash results, failing to form an effective hardware-level identity authentication barrier and making it difficult to resist targeted device forgery attacks.

[0008] In summary, existing technologies cannot simultaneously solve the three core problems of trusted device identity authentication, secure key management, and closed-loop data lifecycle management in a cluster environment. There is an urgent need for an integrated technical solution that can achieve hardware-level identity binding, dynamic key isolation protection, and rigid control of decryption period, in order to build a full-link security and trust system from device access to data use and fill the gap in existing technologies.

[0009] The disclosure of the above background technical content is only for the purpose of assisting in understanding the concept and technical solution of this application, and does not necessarily provide technical instruction. Summary of the Invention

[0010] The purpose of this invention is to provide a cluster data encryption and decryption method, device, and system based on dual trusted binding and decryption period control. By introducing multi-hardware feature fusion and a multi-level key encryption system, it solves the problems of device identity spoofing, key leakage, and uncontrollable data lifecycle in the cluster environment.

[0011] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0012] A cluster data encryption and decryption method based on dual trusted binding and decryption period control includes the following steps:

[0013] The hardware feature information of the cluster terminal nodes is collected, and after splicing, hashing and symmetric encryption, a certain length of bytes is extracted from the processing result as the original machine code.

[0014] The dynamic key factor is obtained, and after symmetric encryption and hashing, a specified length of bytes is extracted from the processing result as the data key.

[0015] After concatenating the original machine code with the certificate validity period information, the certificate machine code is generated through symmetric encryption, hashing, and byte extraction.

[0016] After concatenating the original machine code with the certificate validity information, a machine envelope key is generated by using a symmetric encryption key and multi-round hash processing logic different from the machine code used to generate the certificate. The data key is then symmetrically encrypted using the machine envelope key to obtain the machine key bound to the cluster terminal node.

[0017] The data encryption algorithm, decryption period setting, and key pair consisting of the certificate machine code and the machine key are encapsulated into a custom extension field of the key certificate according to a preset specification to generate a key certificate.

[0018] The plaintext data is encrypted using the data key to obtain ciphertext, and the ciphertext data is assembled according to the ciphertext format including the decryption period.

[0019] The ciphertext header of the data ciphertext is decrypted and its validity is verified. It is determined whether the current date exceeds the decryption deadline. If it does not exceed the deadline, the data ciphertext is decrypted using the data key. Decryption is completed after the data verification is passed.

[0020] Furthermore, based on any one or a combination of the aforementioned technical solutions, the process of generating the certificate machine code is as follows:

[0021] The original machine code is concatenated with the certificate validity information to form a concatenated string. The concatenated string is hashed to obtain a first digest. The first digest is symmetrically encrypted using the system's built-in key to obtain a first ciphertext. The first ciphertext is hashed to obtain a second digest. A specified length of bytes is extracted from the second digest as the certificate machine code.

[0022] Furthermore, based on any one or a combination of the aforementioned technical solutions, the process of generating the machine envelope key is as follows:

[0023] The original machine code is concatenated with the certificate validity information to form a concatenated string. The concatenated string is hashed to obtain a third digest. The third digest is symmetrically encrypted using the system's built-in key to obtain a second ciphertext. The second ciphertext is hashed to obtain a fourth digest. A certain number of bytes are extracted from the fourth digest to serve as the machine envelope key. The system's built-in key is different from the system's built-in key used to generate the certificate machine code.

[0024] Furthermore, following any one or a combination of the aforementioned technical solutions, the hardware feature information includes the CPU serial number, motherboard serial number, disk serial number, and network card serial number, and the hardware feature information is assembled based on the CPU serial number, the motherboard serial number, the disk serial number, and the network card serial number.

[0025] Furthermore, following any one or a combination of the aforementioned technical solutions, the hash processing adopts the national cryptographic SM3 algorithm, and the number of hash processing operations in the data key generation process is greater than or equal to 10.

[0026] Furthermore, following any one or a combination of the aforementioned technical solutions, the ciphertext format containing the decryption deadline includes a ciphertext header and data ciphertext, wherein the ciphertext header embeds the decryption deadline and is subjected to symmetric encryption.

[0027] The ciphertext header is 32 bytes long and includes a fixed ciphertext identifier, an encryption algorithm identifier, the length of the original data, the length of the ciphertext data, the original data checksum, the ciphertext data checksum, the header checksum, and a decryption deadline in UTC timestamp format.

[0028] Furthermore, following any one or a combination of the aforementioned technical solutions, the symmetric encryption uses mutually independent preset root keys, including a preset root key for generating the original machine code, a preset root key for generating the data key, a preset root key for generating the certificate machine code, a preset root key for generating the machine envelope key, and a preset root key for encrypting the ciphertext header.

[0029] Furthermore, following any one or a combination of the aforementioned technical solutions, the decryption period setting is configured by the cluster administrator when issuing the key certificate, and the configuration method includes a specific expiration date and a valid number of decryption days.

[0030] According to another aspect of the present invention, the present invention provides a cluster data encryption and decryption device based on dual trusted binding and decryption period control, wherein a machine code generation unit is used to collect hardware feature information of cluster terminal nodes, and after concatenation, hashing and symmetric encryption, extract a certain length of bytes from the processing result to generate the original machine code.

[0031] The key generation unit is used to obtain the dynamic key factor, and after symmetric encryption and hashing, extract bytes of a specified length from the processing result to generate the data key.

[0032] The dual binding unit is used to concatenate the original machine code with the certificate validity period information, and generate a certificate machine code through symmetric encryption, hash processing and byte extraction. At the same time, after concatenating the original machine code with the certificate validity period information, a machine envelope key is generated through processing and byte extraction using a different symmetric encryption key and hash processing logic than the one used to generate the certificate machine code. The machine envelope key is then used to symmetrically encrypt the data key to obtain a machine key bound to the cluster terminal node.

[0033] The certificate management unit is used to encapsulate the data encryption algorithm, decryption period setting, and key pair consisting of the certificate machine code and the machine key into a custom extension field of the key certificate according to a preset specification to generate a key certificate.

[0034] The encryption processing unit is used to encrypt plaintext data with a data key to obtain ciphertext data, calculate the plaintext data check code and the ciphertext data check code, assemble ciphertext data according to the ciphertext format containing the decryption deadline, and perform symmetric encryption processing on the ciphertext header with the embedded decryption deadline.

[0035] The decryption processing unit is used to decrypt the ciphertext header and verify its validity. It determines whether the current date exceeds the decryption deadline. If it does not exceed the deadline, it calculates the checksum for the ciphertext and compares it with the ciphertext data checksum. If they match, it uses the data key to decrypt the ciphertext. Then, it calculates the plaintext checksum and compares it with the original data checksum. If both comparisons match, the decryption is successful.

[0036] According to another aspect of the present invention, the present invention provides a cluster data encryption and decryption system based on dual trusted binding and decryption period control. The trusted cluster management platform is equipped with the device described above, which is used to create a trusted cluster, receive hardware feature information reported by the cluster terminal nodes, generate raw machine code, perform dual trusted binding operation, generate and issue key certificates, and manage the authentication status and key certificate validity period of the terminal nodes in the cluster.

[0037] The cluster terminal node is equipped with the device as described above, used to collect the hardware feature information of the cluster terminal node and report it to the trusted cluster management platform, receive and store key certificates, extract data keys based on key certificates, and perform data encryption and decryption operations. When extracting the data keys, the cluster terminal node needs to reconstruct the original machine code and certificate machine code for identity verification.

[0038] The beneficial effects of the technical solution provided by this invention are as follows:

[0039] a. Deep device identity authentication protection layer: Collects four hardware serial numbers: CPU, motherboard, disk, and network card. After multiple rounds of hash-encryption-hash processing and extraction of non-contiguous bytes, high-entropy original machine code is generated, which greatly increases the difficulty of forgery.

[0040] b. Strong anti-migration effect of dual independent binding: The first binding ensures a unique correspondence between the device and the certificate, and the second binding ensures physical isolation between the data key and the device. The two are generated independently, completely eliminating certificate migration and key theft;

[0041] c. Secure and reliable key management system: Five independent pre-configured keys isolate different business processes. Data keys are generated based on dynamic factors, and the key corresponding to each certificate issuance is variable, avoiding the risk of leakage caused by long-term solidification.

[0042] d. Robust data lifecycle management: The encrypted format with a decryption deadline embeds the decryption deadline into the encrypted header, making it impossible to decrypt after the deadline, effectively preventing data from being retained beyond the deadline and misused. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 A schematic diagram of an encryption / decryption method provided as an exemplary embodiment of the present invention;

[0045] Figure 2 A schematic diagram of the overall system architecture of an encryption / decryption method provided as an exemplary embodiment of the present invention;

[0046] Figure 3 A schematic diagram of the overall flow of an encryption / decryption method provided as an exemplary embodiment of the present invention;

[0047] Figure 4 A high-strength raw machine code logic diagram provided as an exemplary embodiment of the present invention;

[0048] Figure 5 A schematic diagram of the logic for generating a dual-trusted binding key certificate is provided as an exemplary embodiment of the present invention.

[0049] Figure 6 A schematic diagram of the logic for generating a data key based on a key factor is provided as an exemplary embodiment of the present invention;

[0050] Figure 7 A schematic diagram of certificate machine code generation logic provided as an exemplary embodiment of the present invention;

[0051] Figure 8 A schematic diagram of machine envelope key generation logic provided as an exemplary embodiment of the present invention;

[0052] Figure 9 A schematic diagram illustrating the logic of extracting a data key from a key certificate, provided as an exemplary embodiment of the present invention;

[0053] Figure 10 A schematic diagram of data encryption processing logic provided for an exemplary embodiment of the present invention;

[0054] Figure 11 A schematic diagram of data decryption processing logic provided for an exemplary embodiment of the present invention;

[0055] Figure 12 A diagram showing the structure of a proprietary ciphertext format with a decryption period, provided as an exemplary embodiment of the present invention;

[0056] Figure 13 A schematic diagram of an encryption / decryption device provided for an exemplary embodiment of the present invention. Detailed Implementation

[0057] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0058] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0059] In one embodiment of the present invention, a cluster data encryption and decryption method based on dual trusted binding and decryption period control is provided, comprising the following steps:

[0060] The hardware feature information of the cluster terminal nodes is collected, and after splicing, hashing and symmetric encryption, a certain length of bytes is extracted from the processing result as the original machine code.

[0061] The dynamic key factor is obtained, and after symmetric encryption and hashing, a specified length of bytes is extracted from the processing result as the data key.

[0062] After concatenating the original machine code with the certificate validity period information, the certificate machine code is generated through symmetric encryption, hashing, and byte extraction.

[0063] After concatenating the original machine code with the certificate validity information, a machine envelope key is generated by using a symmetric encryption key and multi-round hash processing logic different from the machine code used to generate the certificate. The data key is then symmetrically encrypted using the machine envelope key to obtain the machine key bound to the cluster terminal node.

[0064] The data encryption algorithm, decryption period setting, and key pair consisting of the certificate machine code and the machine key are encapsulated into a custom extension field of the key certificate according to a preset specification to generate a key certificate.

[0065] The plaintext data is encrypted using the data key to obtain ciphertext, and the ciphertext data is assembled according to the ciphertext format including the decryption period.

[0066] The ciphertext header of the data ciphertext is decrypted and its validity is verified. It is determined whether the current date exceeds the decryption deadline. If it does not exceed the deadline, the data ciphertext is decrypted using the data key. Decryption is completed after the data verification is passed.

[0067] For example, the hardware feature information includes the CPU serial number, motherboard serial number, disk serial number, and network card serial number, and the concatenation is performed by combining the CPU serial number, motherboard serial number, disk serial number, and network card serial number in that order.

[0068] The hashing process employs SHA-256, SHA-512, or the national cryptographic algorithm SM3, and the number of hashing operations in the data key generation process is greater than or equal to 10.

[0069] This invention focuses on the pain points of data security in distributed cluster environments. Addressing the issues of existing solutions such as a single trust model, high key management risks, and lack of data lifecycle control, it collects the hardware serial numbers of the computer's CPU, motherboard, disk, and network card. After concatenation, multiple rounds of hashing, and symmetric encryption, a specified length of bytes is extracted to generate a high-strength raw machine code. This, combined with certificate validity information, achieves dual-trust binding through different symmetric encryption keys and hash processing logic. The first binding generates a certificate machine code to ensure a unique correspondence between the certificate and the device. The second binding generates a machine envelope key and encrypts the data key generated based on a dynamic key factor, forming a machine key bound to the device. Subsequently, the data encryption algorithm, decryption period settings, and the "certificate machine code - machine" key are integrated into the machine key. The "device key" key pair is encapsulated into a custom extension field of the key certificate according to a preset specification to generate a key certificate. When encrypting data, the plaintext is encrypted using the data key pair to obtain ciphertext. The data is then assembled according to the ciphertext format including the decryption deadline. The ciphertext header embeds the decryption deadline and is processed by symmetric encryption. When decrypting, the ciphertext header is decrypted first and its validity is verified. If it is determined that the decryption deadline has not been exceeded, the data key pair is used to decrypt the ciphertext and complete the data verification. Multiple sets of independent preset root keys are used to achieve key isolation for different business links. Combined with a dual binding mechanism and decryption deadline control, the risk of certificate migration attacks and key leakage is completely eliminated. This achieves strong device identity authentication, dynamic key security management, and closed-loop control of the entire data lifecycle, greatly improving the security and compliance of cluster data circulation.

[0070] In one embodiment of the present invention, an exemplary scheme for cluster data encryption and decryption based on multiple hardware features and a fixed number of hash iterations includes:

[0071] System initialization configuration

[0072] Pre-set independent root keys: The system has 5 sets of mutually independent pre-set root keys K0, K1, K2, K3 and K4, all generated using the 256-bit national cryptographic SM4 algorithm. The keys are stored in the encryption chip of the cluster management platform and are not accessible from the outside.

[0073] Hash algorithm configuration: The national cryptographic SM3 hash algorithm is uniformly adopted. The number of hash iterations is 10 during the data key generation process and 2 in the remaining stages.

[0074] Both the trusted cluster management platform and the terminal nodes must ensure that the basic computing resources meet the requirements for encryption, decryption, and hash processing.

[0075] Example of specific implementation steps:

[0076] Trusted Cluster Creation: Administrators create a "Trusted Data Cluster" through the cluster management platform, entering the cluster name, number of terminal nodes, and administrator account information. The platform automatically generates a unique identifier for the cluster.

[0077] High-intensity raw machine code generation:

[0078] Terminal nodes collect local CPU serial number (e.g., CPU-XXXX1234), motherboard serial number (e.g., MB-XXXX5678), disk serial number (e.g., DISK-XXXX90AB), and network card serial number (e.g., NET-XXXXCDEF).

[0079] By concatenating the CPU serial number, motherboard serial number, disk serial number, and network card serial number in that order, the original string "S=CPU-XXXX1234MB-XXXX5678DISK-XXXX90ABNET-XXXXCDEF" is generated.

[0080] Perform two SM3 hash operations on S to obtain the first digest H1. Encrypt H1 using SM4 symmetric encryption with K1 to obtain the ciphertext SK. Perform two SM3 hash operations on SK to obtain H2. Extract 16 bytes from H2 according to the interval rule of "byte 1, 3, 5... 31" to obtain the original machine code M. raw .

[0081] Dual Trust Binding and Certificate Issuance:

[0082] First binding: M raw S1 is obtained by concatenating the certificate validity period "2025-01-01 to 2026-01-01" with S1. S1 is then hashed twice using SM3 to obtain H. 1-1 H is encrypted using K2. 1-1 Obtain SK1, perform SM3 hashing on SK1 twice to obtain H. 2-1 Extract 16 bytes as the certificate machine code M cert .

[0083] Second binding: M raw S2 is obtained by concatenating it with the certificate validity period. S2 is then hashed twice using SM3 to obtain H. 1-2 H is encrypted using K3 1-2 Obtain SK2, perform SM3 hashing on SK2 twice to obtain H. 2-2 Extract 16 bytes as the machine envelope key K machine .

[0084] Data key generation: Obtain the dynamic key factor F (a 32-byte string randomly generated by the platform), encrypt F with K0 to obtain SK-F, perform SM3 hashing on SK-F 10 times to obtain HF, and extract 16 bytes as the data key K. data .

[0085] Machine key generation: using K machine For K dataSM4 encryption is used to obtain K wrapped , will "M cert -K wrapped The key pair, SM4 encryption algorithm identifier, and decryption deadline "2026-01-01" are encapsulated into a custom extension field of the pfx certificate according to the PKCS#12 specification and issued by the platform to the terminal node.

[0086] Data encryption:

[0087] Terminal nodes use K data The plaintext "customer transaction record.xlsx" is encrypted using SM4 to obtain the ciphertext. The plaintext check code (SM3 digest) and the ciphertext check code (SM3 digest) are then calculated.

[0088] Data is assembled in a ciphertext format including a decryption deadline: The ciphertext header (32 bytes) contains a fixed identifier "0x0001", an encryption algorithm identifier "0x02", the original length "20480 bytes", the ciphertext length "10240 bytes", the original checksum, the ciphertext checksum, the decryption deadline "2026-01-01 (UTC timestamp)", and a header checksum. After encrypting the ciphertext header with K4, it is concatenated with the data ciphertext to obtain the final ciphertext file.

[0089] Data Decryption:

[0090] After receiving the encrypted file, the terminal node decrypts the encrypted header using K4, verifies the validity of the fixed identifier and the consistency of the header checksum, and determines that the current date has not exceeded the decryption deadline.

[0091] Calculate the checksum of the encrypted data and compare it with the checksum in the ciphertext header. If they match, use K... data Decrypt the ciphertext, then calculate the plaintext checksum and compare it with the plaintext checksum in the ciphertext header. If both comparisons match, the decryption is successful.

[0092] In one embodiment of the present invention, an exemplary cluster data encryption / decryption scheme based on multiple hardware features and dynamic hash iteration count includes:

[0093] System initialization configuration

[0094] Pre-set independent root keys: Similar to Example 1, five sets of 256-bit SM4 pre-set root keys K0-K4 are used.

[0095] Hash algorithm configuration: The national cryptographic SM3 hash algorithm is adopted. The number of hash iterations during the data key generation process is dynamically adjusted according to the key factor complexity (range 10-20 times), and the number of hash iterations in other stages is dynamically adjusted (range 2-5 times).

[0096] Resource configuration: Same as in Example 1, no additional resource pool needs to be allocated.

[0097] Example of specific implementation steps:

[0098] The hardware acquisition and splicing process for creating a trusted cluster and generating raw machine code is the same as in Example 1.

[0099] High-intensity raw machine code generation:

[0100] Perform SM3 hashing on the original string S three times to obtain H1 (the number of iterations is dynamically adjusted to three). Encrypt H1 with K1 to obtain SK. Perform SM3 hashing on SK four times to obtain H2 (the number of iterations is dynamically adjusted to four). Extract 16 bytes according to the interval rule of "byte 2, 4, 6... 32" as the original machine code M. raw .

[0101] Dual Trust Binding and Certificate Issuance:

[0102] First binding: After concatenating string S1, perform SM3 hash twice, encrypt with K2, perform SM3 hash three times, and extract 16 bytes as M. cert .

[0103] The second binding: After concatenating string S2, perform 3 SM3 hashes, encrypt with K3, perform 5 SM3 hashes, and extract 16 bytes as K. machine .

[0104] Data key generation: The encryption process for the dynamic key factor F is the same as in Example 1. After performing SM3 hashing on SK-F 15 times (dynamically adjusted to 15 times), 16 bytes are extracted as K. data .

[0105] Data encryption and decryption: Except for the hash algorithm being changed to SM3, the rest of the process is the same as the previous embodiment.

[0106] In one embodiment of the present invention, an exemplary lightweight cluster data encryption and decryption scheme based on core hardware features and simplified hash processing is provided.

[0107] System initialization configuration

[0108] Pre-set independent root keys: Similar to Example 1, five sets of 256-bit SM4 pre-set root keys K0-K4 are used.

[0109] Hash algorithm configuration: The SM3 hash algorithm is adopted, and the number of hash iterations in all stages is fixed at 1, which is suitable for edge cluster nodes with limited resources.

[0110] Resource configuration: Adapt to edge node hardware resources, only need to ensure basic computing power, no high-performance hardware support is required.

[0111] Specific implementation steps

[0112] Trusted Cluster Creation: Create an "Edge Device Monitoring Cluster" to meet the lightweight requirements of edge nodes.

[0113] High-intensity raw machine code generation:

[0114] The terminal node only collects the CPU serial number and network card serial number (core hardware characteristics), and concatenates them as "CPU serial number + network card serial number" to generate the original string S.

[0115] Perform an SM3 hash on S once to obtain H1, encrypt H1 with K1 to obtain SK, perform an SM3 hash on SK once to obtain H2, and extract 16 bytes according to the "first 16 bytes" rule as the raw machine code M. raw .

[0116] Dual Trust Binding and Certificate Issuance:

[0117] First binding: After concatenating the string, perform one SM3 hash, encrypt with K2, perform one SM3 hash, and extract the first 16 bytes as M. cert .

[0118] Second binding: After concatenating the string, perform one SM3 hash, encrypt with K3, perform one more SM3 hash, and extract the first 16 bytes as K. machine .

[0119] Data key generation: After performing 10 SM3 hashes on SK-F (to ensure key security), extract 16 bytes as the key. data .

[0120] Data encryption and decryption: The ciphertext header format is the same as in Example 1, the encryption algorithm adopts the national standard SM4, and the remaining processes are adapted and simplified to the aforementioned examples.

[0121] In one embodiment of the present invention, a cluster data encryption / decryption device based on dual trusted binding and decryption period control is provided, comprising the following units:

[0122] The machine code generation unit is used to collect hardware feature information of cluster terminal nodes, and after concatenation, hashing and symmetric encryption, extracts a certain length of bytes from the processing result to generate the original machine code.

[0123] The key generation unit is used to obtain the dynamic key factor, and after symmetric encryption and hashing, extract bytes of a specified length from the processing result to generate the data key.

[0124] The dual binding unit is used to concatenate the original machine code with the certificate validity period information, and generate a certificate machine code through symmetric encryption, hash processing and byte extraction. At the same time, after concatenating the original machine code with the certificate validity period information, a machine envelope key is generated through processing and byte extraction using a different symmetric encryption key and hash processing logic than the one used to generate the certificate machine code. The machine envelope key is then used to symmetrically encrypt the data key to obtain a machine key bound to the cluster terminal node.

[0125] The certificate management unit is used to encapsulate the data encryption algorithm, decryption period setting, and key pair consisting of the certificate machine code and the machine key into a custom extension field of the key certificate according to a preset specification to generate a key certificate.

[0126] The encryption processing unit is used to encrypt plaintext data with a data key to obtain ciphertext data, calculate the plaintext data check code and the ciphertext data check code, assemble ciphertext data according to the ciphertext format containing the decryption deadline, and perform symmetric encryption processing on the ciphertext header with the embedded decryption deadline.

[0127] The decryption processing unit is used to decrypt the ciphertext header of the ciphertext and verify the validity of the header. It determines whether the current date exceeds the decryption deadline. If it does not exceed the deadline, it calculates the checksum of the ciphertext and compares it with the ciphertext data checksum. If the comparison is consistent, it uses the data key to decrypt the ciphertext. Then it calculates the plaintext checksum and compares it with the original data checksum. If the two comparisons are consistent, the decryption is successful.

[0128] In one embodiment of the present invention, a cluster data encryption and decryption system based on dual trusted binding and decryption period control is provided, including a trusted cluster management platform and cluster terminal nodes;

[0129] The trusted cluster management platform is equipped with the device described above, which is used to create a trusted cluster, receive hardware feature information reported by cluster terminal nodes, generate raw machine code, perform dual trusted binding operations, generate and issue key certificates, and manage the authentication status and key certificate validity period of terminal nodes within the cluster.

[0130] The cluster terminal node is equipped with the device described above, which is used to collect local hardware feature information and report it to the trusted cluster management platform, receive and store key certificates, extract data keys based on key certificates, and perform data encryption and decryption operations. When extracting data keys, the original machine code and certificate machine code need to be reconstructed locally for identity verification.

[0131] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0132] The above description is only a specific embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A cluster data encryption and decryption method based on double trusted binding and decryption deadline management, characterized in that, The method comprises the following steps: Collecting hardware feature information of a cluster terminal node, splicing, hashing and symmetric encryption, and extracting a certain length of bytes from the processing result as an original machine code; Obtaining a dynamic key factor, symmetric encryption and hashing, and extracting a specified length of bytes from the processing result as a data key; Splicing the original machine code and certificate validity period information, symmetric encryption, hashing and byte extraction to generate a certificate machine code; Splicing the original machine code and certificate validity period information, using a different symmetric encryption key and multi-Hash processing logic to generate a machine envelope key, and symmetrically encrypting the data key using the machine envelope key to obtain a machine key bound to the cluster terminal node; A data encryption algorithm, decryption deadline setting and the key pair composed of the certificate machine code and the machine key are encapsulated into a custom extension field of a key certificate according to a preset specification to generate a key certificate; Encrypting plaintext data using the data key to obtain data ciphertext, and assembling the ciphertext data according to a ciphertext format containing a decryption deadline; Decrypting the ciphertext header of the ciphertext data and verifying the validity, determining whether the current date exceeds the decryption deadline, and if not, decrypting the data ciphertext using the data key, and completing decryption after data verification.

2. The cluster data encryption and decryption method based on dual-trust binding and decryption deadline management according to claim 1, characterized in that, The process of generating the certificate machine code is: Splicing the original machine code and certificate validity period information to form a spliced string, hashing the spliced string to obtain a first digest, symmetrically encrypting the first digest using a first system built-in key to obtain first ciphertext, hashing the first ciphertext to obtain a second digest, and extracting a specified length of bytes from the second digest as a certificate machine code.

3. The cluster data encryption and decryption method based on dual-trust binding and decryption deadline management according to claim 2, characterized in that, The process of generating the machine envelope key is: Splicing the original machine code and certificate validity period information to form a spliced string, hashing the spliced string to obtain a third digest, symmetrically encrypting the third digest using a second system built-in key to obtain second ciphertext, hashing the second ciphertext to obtain a fourth digest, and extracting a certain length of bytes from the fourth digest as a machine envelope key, wherein the first system built-in key and the second system built-in key are different.

4. The cluster data encryption and decryption method based on dual-trust binding and decryption deadline control according to any one of claims 1-3, characterized in that, The hardware feature information includes CPU serial number, motherboard serial number, disk serial number and network card serial number, and the splicing of the hardware feature information is combined according to the CPU serial number, the motherboard serial number, the disk serial number and the network card serial number.

5. The cluster data encryption and decryption method based on dual-trust binding and decryption deadline management according to claim 4, characterized in that, The hashing uses SHA-256, SHA-512 or national standard SM3 algorithm, and the number of hashing in the data key generation process is greater than or equal to 10 times.

6. The cluster data encryption and decryption method based on dual-trust binding and decryption deadline management according to claim 2, characterized in that, The ciphertext format containing the decryption deadline includes a ciphertext header and data ciphertext, and the ciphertext header is embedded with a decryption deadline and is symmetrically encrypted; The length of the ciphertext header is 32 bytes, including a fixed ciphertext identifier, an encryption algorithm identifier, an original data length, a ciphertext data length, an original data check code, a ciphertext data check code, a header check code and a UTC timestamp format decryption deadline.

7. The cluster data encryption and decryption method based on dual-trust binding and decryption deadline management according to claim 6, characterized in that, The symmetric encryption adopts preset root keys independent of each other, including a preset root key for generating the original machine code, a preset root key for generating the data key, a preset root key for generating the certificate machine code, a preset root key for generating the machine envelope key, and a preset root key for encrypting the ciphertext header.

8. The cluster data encryption and decryption method based on dual-trust binding and decryption deadline management according to claim 1, characterized in that, The decryption deadline is configured by a cluster administrator when issuing the key certificate, and the configuration mode includes a specific deadline or a valid decryption day number.

9. A cluster data encryption and decryption device based on double trusted binding and decryption deadline management, characterized in that, The device comprises: a machine code generation unit configured to collect hardware feature information of a cluster terminal node, splice, hash process and symmetrically encrypt the hardware feature information, and extract a certain length of bytes from a processing result to generate original machine code; a key generation unit configured to obtain a dynamic key factor, symmetrically encrypt and hash process the dynamic key factor, and extract a specified length of bytes from a processing result to generate a data key; a double binding unit configured to splice the original machine code and certificate validity period information, symmetrically encrypt, hash process and extract bytes from the spliced result to generate a certificate machine code, splice the original machine code and the certificate validity period information again, symmetrically encrypt and hash process the spliced result using a symmetric encryption key and a hash processing logic different from those used for generating the certificate machine code to generate a machine envelope key, and symmetrically encrypt the data key using the machine envelope key to obtain a machine key bound to the cluster terminal node; a certificate management unit configured to encapsulate a data encryption algorithm, a decryption deadline setting, and a key pair composed of the certificate machine code and the machine key into a self-defined extension field of a key certificate according to a preset specification to generate a key certificate; an encryption processing unit configured to encrypt plaintext data using the data key to obtain data ciphertext, calculate a plaintext data check code and a ciphertext data check code, assemble the ciphertext data according to a ciphertext format containing a decryption deadline, and symmetrically encrypt a ciphertext header embedded with a decryption deadline; a decryption processing unit configured to decrypt the ciphertext header of the ciphertext data and check the header validity, determine whether the current date exceeds the decryption deadline, calculate a data ciphertext check code and compare the data ciphertext check code with the ciphertext data check code if the current date does not exceed the decryption deadline, decrypt the data ciphertext using the data key after the comparison result is consistent, calculate a plaintext check code and compare the plaintext check code with the plaintext data check code, and perform decryption successfully if the two comparison results are consistent.

10. A cluster data encryption and decryption system based on double trusted binding and decryption deadline management, characterized in that, The device comprises a trusted cluster management platform and a cluster terminal node. The trusted cluster management platform is provided with the device of claim 9, and is configured to create a trusted cluster, receive hardware feature information reported by the cluster terminal node, generate original machine code, perform a double trusted binding operation, generate and issue a key certificate, and manage authentication states and key certificate validity periods of terminal nodes in the cluster. The cluster terminal node is installed with the device of claim 9, and is configured to collect hardware feature information of the cluster terminal node and report the hardware feature information to the trusted cluster management platform, receive and store a key certificate, extract a data key based on the key certificate, and perform data encryption and decryption operations.

Images