Secure digital signature method and system, electronic equipment and storage medium

Abstract

The invention provides a secure digital signature method and system, electronic equipment and a storage medium, and the method comprises the steps: obtaining a registration request, and registering a password service provider capable of intercepting a signature request and routing the signature request to a secure environment according to the registration request; when a digital signature needs to be generated in the SSL / TLS handshake process, intercepting a signature request through the password service provider, and determining to-be-signed data meeting the requirements of the secure environment interface according to the signature request; and sending the to-be-signed data to the secure environment, and triggering the secure environment to operate the to-be-signed data by using a pre-stored private key so as to generate a digital signature. According to the method, the private key does not appear in a main processor memory or a file system in a plaintext form under any condition, so that the key leakage risk caused by malicious software, memory extraction or operating system vulnerabilities is fundamentally avoided, and the security assurance level of the private key is improved.

Description

Technical Field

[0001] This invention relates to the field of secure communication technology, and in particular to a secure digital signature method, system, electronic device, and storage medium. Background Technology

[0002] In secure communication based on the SSL / TLS protocol, digital signatures are an indispensable and crucial step in achieving identity authentication and key exchange. During the handshake process, the server (or client) needs to use its private key to sign a specific handshake message to prove its legitimate identity and establish trust with the other end. Therefore, the secure storage and use of the private key is directly related to the security of the entire communication system.

[0003] However, the common method for storing private keys is to store them as encrypted files in the device's ordinary file system or memory. During signature operations, the private key needs to be decrypted and loaded into the main processor's system memory for processing. In this process, the private key exists in plaintext in memory, making it vulnerable to malware, memory scanning attacks, and other threats, posing a significant risk of key leakage. Summary of the Invention

[0004] This invention provides a secure digital signature method, system, electronic device, and storage medium to address the problems existing in related technologies. The technical solution is as follows: In a first aspect, embodiments of the present invention provide a secure digital signature method, comprising: Obtain the registration request, and register a cryptographic service provider that can intercept signature requests and route them to a secure environment based on the registration request; When a digital signature needs to be generated during the SSL / TLS handshake process, the signature request is intercepted by the cryptographic service provider, and the data to be signed that meets the security environment interface requirements is determined based on the signature request. The data to be signed is sent to a secure environment, which triggers the secure environment to use its pre-stored private key to process the data to generate a digital signature.

[0005] In one implementation, the secure environment is a secure chip, trusted platform module, or trusted execution environment that enables cryptographic operations and secure storage.

[0006] In one implementation, the cryptographic service provider includes a signing Cipher object, which is used to receive and extract data to be signed and route the data to be signed to a secure environment through a local API call.

[0007] In one implementation, the data to be signed is the hash value of the handshake message calculated according to the SSL / TLS protocol specification.

[0008] In one implementation, the secure environment pre-programs at least one private key, and the secure environment securely stores the private key in an encrypted manner.

[0009] In one implementation, it further includes: Receive the digital signature returned from the secure environment and submit it as a response to the intercepted signature request to the SSL / TLS handshake process.

[0010] In one implementation, it further includes: Set the cryptographic service provider as the highest priority provider in the cryptographic service call chain.

[0011] Secondly, embodiments of the present invention provide a secure digital signature system, comprising: The private key pre-setting module is used to burn at least one private key into a secure environment that works in conjunction with the main processor during the equipment production stage, and the secure environment encrypts and securely stores the private key. The provider registration module is used to obtain registration requests and register a cryptographic service provider that can intercept signature requests and route them to a secure environment based on the registration requests. The signature request interception module is used to intercept signature requests through a cryptographic service provider when a digital signature needs to be generated during the SSL / TLS handshake process, and to determine the data to be signed that meets the interface requirements of the security environment based on the signature request. The secure environment signature module is used to send the data to be signed to the secure environment, triggering the secure environment to use its pre-stored private key to perform calculations on the data to be signed to generate a digital signature.

[0012] Thirdly, embodiments of the present invention provide an electronic device comprising a memory and a processor. The memory and the processor communicate with each other via an internal connection path. The memory stores instructions, and the processor executes the instructions stored in the memory. When the processor executes the instructions stored in the memory, it causes the processor to perform the method described in any of the above embodiments.

[0013] Fourthly, embodiments of the present invention provide a computer-readable storage medium that stores a computer program, wherein when the computer program is run on a computer, the methods in any of the embodiments described above are executed.

[0014] The advantages or beneficial effects of the above technical solutions include at least the following: This invention stores the private key in an independent, secure environment and uses a cryptographic service provider to route and forward the data to be signed to the secure environment. The secure environment then performs calculations on the data to be signed to generate a digital signature. This ensures that the private key never appears in plaintext in the main processor's memory or file system under any circumstances, fundamentally eliminating the risk of key leakage due to malware, memory extraction, or operating system vulnerabilities, thereby improving the security level of the private key.

[0015] The above overview is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments, and features described above, further aspects, embodiments, and features of the invention will become readily apparent from the accompanying drawings and the following detailed description. Attached Figure Description

[0016] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the various drawings denote the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings depict only some embodiments disclosed in the invention and should not be construed as limiting the scope of the invention.

[0017] Figure 1 This is a flowchart illustrating the secure digital signature method of the present invention; Figure 2 This is a schematic diagram of the modules of the secure digital signature system of the present invention; Figure 3 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0018] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0019] Example 1 This invention provides a secure digital signature method, which uses a main processor as the execution entity, such as... Figure 1 As shown, the method for implementing key protection and secure signature in SSL / TLS communication executed by the main processor mainly includes the following steps: Step S1: During the equipment production stage, at least one private key is burned into a secure environment that works in conjunction with the main processor. The secure environment encrypts and securely stores the private key, ensuring that the private key cannot be fully read by the main processor.

[0020] It should be noted that a secure environment refers to a dedicated security component that works in conjunction with the main processor and has physical or logical isolation characteristics. Its core function is to provide a protected execution environment for cryptographic operations and a secure storage space that prevents tampering of sensitive data (such as private keys). This environment ensures that the data processed internally and the operations performed are protected from external software attacks or physical probes through hardware or firmware-level security mechanisms. Its specific implementation forms include, but are not limited to: a secure chip (SE) with an independent cryptographic processor and memory, a trusted platform module (TPM) that follows the specifications of a trusted computing organization, or a trusted execution environment (TEE) built based on processor hardware security extensions (such as ARM TrustZone).

[0021] After the private key is burned into the secure environment, the ability to read the private key is permanently disabled, and only the interface for performing signature operations using the private key is retained. The plaintext of the private key never appears on any storage medium or bus outside the secure environment at any time (including during storage, transmission, and computation). The secure environment does not provide any instructions, interfaces, or debugging channels to export the plaintext or a complete copy of the private key. External parties (including the main processor) can only obtain the signature result by calling the signature function and passing in data; they cannot reverse-engineer or directly obtain the private key itself.

[0022] The secure environment achieves encrypted and secure storage of private keys through its built-in cryptographic processor and protected key memory. Specifically, during the private key programming phase, the secure environment first generates one or a series of non-exportable internal master keys based on its unique hardware identifier. Then, using this internal master key, it encrypts the plaintext private key to be stored using a certified encryption algorithm (such as AES-GCM) to generate ciphertext. This ciphertext is written to a protected area in the secure environment's tamper-proof, non-volatile memory. Throughout the process, the plaintext private key exists only in a secure area within the secure environment (such as the cryptographic processor's registers or secure RAM) and is immediately cleared after encryption. Decryption of the ciphertext must be performed by the cryptographic processor within the secure environment using the same internal master key. The decrypted plaintext also exists only in the internal secure area and is used only for momentary operations; no interface or channel is provided to output the plaintext private key outside the secure environment. This storage method combines hardware-based key generation, authentication encryption, secure storage, and strict access control, achieving end-to-end protection of private keys from writing and storage to use.

[0023] Step S2: Obtain the registration request and register a cryptographic service provider that can intercept signature requests and route them to a secure environment based on the registration request.

[0024] The registration method for the cryptographic service provider is as follows: During system initialization, a pre-instantiated and configured custom cryptographic service provider object is dynamically inserted into the first position of the system's global list of registered providers by calling the standard API of the cryptographic service framework (such as Java's Security.insertProviderAt() method). When the custom cryptographic service provider is initialized internally, a specific signature algorithm identifier (such as "SHA256withRSA") is mapped to a dedicated signature Cipher implementation class. This class is designed to be responsible only for forwarding signature calculation requests to the security environment interface module.

[0025] This embodiment sets the customized cryptographic service provider to the highest priority, ensuring that when the SSL / TLS engine requests the signature service through the standard interface during the subsequent handshake process, the cryptographic service framework will prioritize querying and calling the customized cryptographic service provider, so that the dedicated Cipher instance returned by it can complete the interception and secure routing of the signature request.

[0026] Step S3: When a digital signature needs to be generated during the SSL / TLS handshake process, the signature request is intercepted by the cryptographic service provider, and the data to be signed that meets the security environment interface requirements is determined based on the signature request.

[0027] When the SSL / TLS handshake process requires a signature, the cryptographic service framework queries the corresponding cryptographic service provider based on the algorithm identifier, and the cryptographic service provider creates an instance of a dedicated signature Cipher implementation class, thereby obtaining a signature Cipher object.

[0028] When the signing Cipher object is invoked, it retrieves the raw data pre-calculated by the SSL / TLS engine according to the protocol specification from the passed-in signature request parameters. In this embodiment, the raw data is the hash value of the handshake message. Based on the known interface specifications of the security environment, the raw data undergoes necessary format conversion and encapsulation. This conversion process includes, but is not limited to: encoding or reconstructing the raw hash value according to the input data format required by the security environment (such as PKCS#1 v1.5 padding format, or a raw hash value without padding), and possibly attaching context-required metadata (such as key identifiers). Finally, a standardized input data block with a complete structure that can be directly received and processed by the security environment's signature engine is generated, thus obtaining the data to be signed.

[0029] Step S4: Send the data to be signed to the secure environment, triggering the secure environment to use its pre-stored private key to perform operations on the data to be signed to generate a digital signature.

[0030] When its signature method is called, the Cipher object receives the data to be signed, forwards the data to be signed to a secure environment for signature computation, and thus generates the corresponding digital signature.

[0031] The secure environment receives the data to be signed through its protected input interface. Then, the cryptographic processor integrated within the secure environment, in conjunction with a preset security policy, determines and invokes the target private key, which is pre-stored in a hardware-protected storage area corresponding to the computation request. The computation process is executed entirely within a secure, isolated area within the secure environment. The hardware cryptographic engine performs cryptographic calculations on the input data to be signed using the target private key according to the selected signature algorithm (such as RSA-PSS or ECDSA) specification, generating the original signature result. Before output, the result is finally encoded by the internal logic of the secure environment according to standard protocol format requirements (such as ASN.1 DER encoding) to generate a digital signature that can be directly used for SSL / TLS handshake messages. The final signature data is then returned to the main processor through a controlled output interface, while the plaintext of the private key and the intermediate computation state are never exposed.

[0032] Step S5: Receive the digital signature returned from the secure environment and submit it as a response to the intercepted signature request to the SSL / TLS handshake process.

[0033] The main processor receives the digital signature according to the protocol format requirements (e.g., encapsulated in a ServerKeyExchange or CertificateVerify message) and continues assembling the current handshake message. Subsequently, this complete handshake message is delivered to the network layer of the protocol stack and sent to the communicating peer. Upon receiving the message, the peer uses the public key corresponding to its certificate to verify the digital signature. If the verification is successful, it signifies successful authentication based on the private key, and both parties will continue with subsequent key negotiation, cipher suite confirmation, and other steps in sequence, ultimately establishing an authenticated encrypted communication channel. Throughout this process, the signing operation is transparent to the standard protocol flow; the secure environment is only invoked as a trusted signing black box, without affecting the normal progression of the handshake protocol's state machine and message sequence.

[0034] Example 2 This embodiment provides a secure digital signature system that executes the secure digital signature method as described in Embodiment 1. Figure 2 As shown, the system mainly includes: The private key pre-setting module is used to burn the private key required for SSL / TLS communication into a secure environment that works in conjunction with the main processor during the device production stage. The secure environment then encrypts and securely stores the private key. The provider registration module is used to obtain registration requests and register a cryptographic service provider that can intercept signature requests and route them to a secure environment based on the registration requests. The signature request interception module is used to intercept signature requests through the cryptographic service provider when a digital signature needs to be generated during the SSL / TLS handshake process, and to determine the data to be signed that meets the security environment interface requirements based on the signature request; The secure environment signature module is used to send the data to be signed to the secure environment, triggering the secure environment to use its pre-stored private key to perform calculations on the data to be signed to generate a digital signature; The signature result return module is used to return the generated digital signature to the custom signature Cipher object through the security environment interface module, and then the object returns it to the SSL / TLS engine to continue the handshake process.

[0035] It should be noted that the functions of each module in the system of this embodiment can be found in the corresponding descriptions in the above methods, and will not be repeated here.

[0036] Example 3 This embodiment provides an electronic device. Figure 3 A structural block diagram of an electronic device according to an embodiment of the present invention is shown. Figure 3 As shown, the electronic device includes a memory 100 and a processor 200. The memory 100 stores a computer program that can run on the processor 200. When the processor 200 executes the computer program, it implements the secure digital signature method described in the above embodiments. The number of memories 100 and processors 200 can be one or more.

[0037] The electronic device also includes: The communication interface 300 is used to communicate with external devices and perform data exchange and transmission.

[0038] If the memory 100, processor 200, and communication interface 300 are implemented independently, they can be interconnected via a bus to communicate with each other. This bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc.

[0039] Optionally, in a specific implementation, if the memory 100, processor 200, and communication interface 300 are integrated on a single chip, then the memory 100, processor 200, and communication interface 300 can communicate with each other through an internal interface.

[0040] This invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method provided in this invention.

[0041] This invention also provides a chip, which includes a processor for calling and executing instructions stored in a memory, causing a communication device on which the chip is installed to perform the method provided in this invention.

[0042] This invention also provides a chip, including: an input interface, an output interface, a processor, and a memory. The input interface, output interface, processor, and memory are connected through an internal connection path. The processor is used to execute code in the memory. When the code is executed, the processor is used to execute the method provided in this invention.

[0043] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting the Advanced Reduced Instruction Set Computing (RISC) machine (ARM) architecture.

[0044] Further, optionally, the aforementioned memory may include read-only memory and random access memory, and may also include non-volatile random access memory. The memory may be volatile or non-volatile, or may include both. Non-volatile memory may include read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may include random access memory (RAM), which serves as an external cache. Many forms of RAM are available by way of example, but not limitation. Examples include static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0045] In the above embodiments, implementation can be achieved, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the present invention is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0046] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0047] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0048] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in the present invention, and these should all be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A secure digital signature method, characterized in that, include: Obtain a registration request, and register a cryptographic service provider capable of intercepting signature requests and routing them to a secure environment based on the registration request; When a digital signature needs to be generated during the SSL / TLS handshake process, the signature request is intercepted by the cryptographic service provider, and the data to be signed that meets the requirements of the security environment interface is determined based on the signature request. The data to be signed is sent to the secure environment, which triggers the secure environment to use its pre-stored private key to perform calculations on the data to be signed to generate a digital signature.

2. The secure digital signature method according to claim 1, characterized in that, The security environment is a secure chip, trusted platform module, or trusted execution environment that enables cryptographic operations and secure storage.

3. The secure digital signature method according to claim 1, characterized in that, The cryptographic service provider includes a signature Cipher object, which is used to receive and extract the data to be signed, and route the data to be signed to the secure environment through a local API call.

4. The secure digital signature method according to claim 1, characterized in that, The data to be signed is the hash value of the handshake message calculated according to the SSL / TLS protocol specification.

5. The secure digital signature method according to claim 1, characterized in that, The secure environment has at least one private key pre-programmed into it, and the secure environment securely stores the private key in an encrypted manner.

6. The secure digital signature method according to claim 1, characterized in that, Also includes: The digital signature returned from the secure environment is received and submitted to the SSL / TLS handshake process as a response to the intercepted signature request.

7. The secure digital signature method according to claim 1, characterized in that, Also includes: Set the cryptographic service provider as the highest priority provider in the cryptographic service call chain.

8. A secure digital signature system, characterized in that, The system comprises: executing the secure digital signature method as described in any one of claims 1 to 7; A private key pre-setting module is used to burn at least one private key into a secure environment that works in conjunction with the main processor during the equipment production stage, and the secure environment encrypts and securely stores the private key. The provider registration module is used to obtain a registration request and register a cryptographic service provider that can intercept signature requests and route them to a secure environment based on the registration request. The signature request interception module is used to intercept the signature request through the cryptographic service provider when a digital signature needs to be generated during the SSL / TLS handshake process, and determine the data to be signed that meets the requirements of the security environment interface based on the signature request; The secure environment signature module is used to send the data to be signed to the secure environment, triggering the secure environment to use its pre-stored private key to perform calculations on the data to be signed to generate a digital signature.

9. An electronic device, characterized in that, include: A processor and a memory, wherein the memory stores instructions that are loaded and executed by the processor to implement the secure digital signature method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the secure digital signature method as described in any one of claims 1 to 7.

Images