Team design resource image trusted sharing method and system based on permission control

Abstract

The application relates to a team design resource image credible sharing method and system based on permission control, a system general execution environment, a secure execution environment, a cloud encryption disk, a Hypervisor; hardware isolation is realized through a safe isolation base provided by the Hypervisor between the general execution environment and the credible execution environment; the general execution environment provides an interactive interface for a user, and receives login authentication and data interaction requests of the user; the credible execution environment is used for processing the login authentication and the data interaction requests of the user, and returns processing results; the credible TA program is simultaneously wirelessly communicated with the cloud encryption disk, and is used for calling required encrypted data from the cloud encryption disk or feeding back encrypted data to the cloud encryption disk in processing the login authentication and the data interaction requests of the user. The application combines a ciphertext generation mechanism, a correction mechanism and a data sharing mechanism based on a public key, and ensures user account security and data interaction security.

Description

Technical Field

[0001] This invention relates to the field of trusted execution environment technology, specifically to a method and system for trusted sharing of team design resource images based on access control. Background Technology

[0002] Against the backdrop of accelerated digital transformation, trusted data spaces have emerged to ensure secure data exchange and sharing among multiple stakeholders, providing additional protection and security guarantees during data processing and storage.

[0003] Existing trusted authentication technologies mostly employ remote verification techniques, which verify through hardware identifiers and dynamic software states. However, this mechanism cannot meet the requirements of real-time performance and does not take into account the individual differences of each user.

[0004] At the same time, existing trusted execution environments do not consider protecting user account security. If the trusted execution environment's account and data can be protected based on the user's login behavior, the drawback of existing remote authentication technologies being unable to meet the system's real-time requirements will be fundamentally eliminated. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a trusted image sharing system for team design resources based on access control, comprising a normal execution environment, a secure execution environment, a cloud-encrypted disk, and a hypervisor; wherein, Hardware isolation between the normal execution environment and the trusted execution environment is achieved through a secure isolation base provided by the Hypervisor. The normal execution environment includes an application program, a key processing module, a data encryption / decryption module, and a client communication module connected in sequence; the trusted execution environment includes a trusted TA program and a server communication module connected in sequence; the client communication module and the server communication module realize data interaction between the normal execution environment and the trusted execution environment through the Hypervisor; The application provides an interactive interface to the user and receives the user's login authentication and data interaction requests. The trusted TA program processes the user's login authentication and data interaction requests and returns the processing results. The key processing module, client communication module, and server communication module are used to implement encrypted data communication between the normal execution environment and the secure execution environment during the above interaction process. The Trusted TA program also wirelessly connects to the cloud-encrypted disk to retrieve or send encrypted data back to the cloud-encrypted disk during user login authentication and data interaction requests.

[0006] The cloud-encrypted disk contains a metadata area that stores the system root public key. The trusted execution environment maintains the system root private key. All data transmitted between the trusted execution environment and the cloud-encrypted disk is encrypted using the system root public key. The metadata area contains multiple sets of mutually bound user key slots and user tokens: each set of user key slots stores the username correction ciphertext, password correction ciphertext, and private key ciphertext for each corresponding user, and each user token records the username plaintext and user identifier for each corresponding user. The trusted execution environment also maintains a first mapping table, which maintains each user's user identifier and its corresponding public key, as well as the data block index information corresponding to the public key.

[0007] The trusted execution environment stores benchmark metrics. When a user initiates a login authentication request: the key processing module receives the plaintext username and password from the application and processes them to obtain the ciphertext username and password respectively; The client communication module and the server communication module sequentially send the encrypted username, encrypted password, and shared system environment information to the trusted TA program. The trusted TA program then performs the following processing: Environmental metrics are obtained based on system environment information; The username and password plaintext are obtained from the username ciphertext and password ciphertext; Obtain the username correction ciphertext and password correction ciphertext from the cloud encrypted disk, and obtain the username correction plaintext and password correction plaintext based on the username correction ciphertext, password correction ciphertext, username ciphertext, and password ciphertext. Successful authentication and login are only possible if the environmental metric and the baseline metric, the plaintext username and the corrected plaintext username, and the plaintext password and the corrected plaintext password are all consistent. After successful authentication and login, the system sends the public keys of all users in the system back to the normal execution environment.

[0008] When a user initiates a data encryption and storage request, the application sends the data to be encrypted and the public key information of the target user to be shared to the data encryption and decryption module. The data encryption / decryption module performs the following processing: it identifies the user who initiated the data encryption and storage request as the current trusted party, identifies their public key as the trusted public key, and identifies the data to be encrypted as the target data; it packages the target data and the target user's public key into a data packet, encrypts it with the trusted public key, and submits it to the trusted execution environment through the client communication module; After the server-side communication module of the Trusted Execution Environment receives the above data packet and passes it to the Trusted TA program, the Trusted TA program performs the following processing: obtains the ciphertext of the trusted user's private key from the cloud encrypted disk; obtains the plaintext of the trusted user's private key based on the ciphertext of the trusted user's password and username; decrypts the data packet encrypted with the trusted public key based on the plaintext private key to obtain the plaintext data packet; encrypts the target data in the plaintext data packet with the system root public key and passes it to the cloud encrypted disk; receives the data block information storing the encrypted target data from the cloud encrypted disk; and updates the first mapping table information based on the data block information and the public key information of the target user in the plaintext data packet.

[0009] When a user initiates a request to extract encrypted data, the Trusted TA program performs the following processing: The user who initiates the encrypted data extraction request is identified as a trusted user, and the public key of the trusted user is identified as a trusted public key. Obtain the data block information corresponding to the trusted public key from the first mapping table, and send a request to the cloud encrypted disk to extract the target data of the corresponding data block and the private key ciphertext of the trusted user; Receive the private key ciphertext and encrypted target data from the cloud-encrypted disk, decrypt them using the system root private key, and obtain the required target data; The target data is encrypted using a trusted public key and then sent back to the normal execution environment along with the private key ciphertext through the server-side communication module.

[0010] In the ordinary execution environment, after receiving the encrypted target data and the private key ciphertext, the data encryption / decryption module performs the following processing: Obtain the ciphertext of the trusted user's password and username from the key processing module; The private key is decrypted based on the ciphertext and username to obtain the plaintext private key. The encrypted target data is decrypted using the private key in plaintext to obtain the plaintext target data.

[0011] The ciphertext is obtained by performing a hash digest algorithm on the plaintext username to obtain the first username key; deriving the second username key from the first username key according to the first key derivation rule; and encrypting the plaintext username using the first username key as the key and the second username key as the IV using a symmetric encryption algorithm to obtain the ciphertext. The username ciphertext is obtained by performing a hash digest algorithm on the ciphertext to obtain the first cryptographic key; deriving the second cryptographic key from the first cryptographic key according to the second key derivation rule; using the first cryptographic key as the key and the second cryptographic key as the IV, encrypting the username plaintext using a symmetric encryption algorithm to obtain the username ciphertext.

[0012] The username verification ciphertext and password verification ciphertext are obtained through the following methods: The ciphertext and username ciphertext are sequentially encoded and converted to obtain standard ciphertext data and standard username ciphertext data, respectively. After concatenating the standard ciphertext data and the standard username ciphertext data, the SHA256 digest algorithm is executed to obtain the key derivation information. Extract the system root public key of the trusted execution environment; perform a one-way derivation operation on the system root public key based on the key derivation information to obtain the first correction encryption key; The second correction encryption key is derived from the first correction encryption key according to the third key derivation rule; Using the first correction encryption key as Key and the second correction encryption key as IV, the username plaintext and password plaintext are sequentially encrypted using a symmetric encryption algorithm to obtain the username correction ciphertext and password correction ciphertext, respectively. This invention also provides a sharing method based on the above-mentioned sharing system, comprising the following steps: Step S1: During system initialization, a baseline metric value is obtained based on the system environment information; Step S21: When a user registers for the first time, the key processing module obtains the encrypted username and password based on the plaintext username and password, and sends the encrypted username and password to the trusted execution module. Step S22: The trusted TA program of the trusted execution module obtains the username correction ciphertext and password correction ciphertext based on the username ciphertext and password ciphertext, and then sends them to the cloud encrypted disk for storage. Step S31: When a user initiates a login authentication request, the key processing module receives the plaintext username and password from the application and processes them to obtain the ciphertext username and password respectively. Step S32: The client communication module and the server communication module sequentially send the encrypted username, encrypted password, and shared system environment information to the trusted TA program. The trusted TA program then performs the following processing: Environmental metrics are obtained based on system environment information; The username and password plaintext are obtained from the username ciphertext and password ciphertext; Obtain the username correction ciphertext and password correction ciphertext from the cloud encrypted disk, and obtain the username correction plaintext and password correction plaintext based on the username correction ciphertext, password correction ciphertext, username ciphertext, and password ciphertext. Successful authentication and login are only possible if the environmental metric and the baseline metric, the plaintext username and the corrected plaintext username, and the plaintext password and the corrected plaintext password are all consistent. After successful authentication and login, the system sends the public keys of all users in the system back to the normal execution environment.

[0013] This invention combines a ciphertext generation mechanism, a correction mechanism, and a public key-based data sharing mechanism to ensure user account security and data interaction security. Attached Figure Description

[0014] Figure 1 The system architecture diagram of the team-designed resource image trusted sharing system based on access control of the present invention is shown below.

[0015] Figure 2 The present invention provides a logical diagram of the cloud-encrypted disk of a team-designed resource image trusted sharing system based on access control.

[0016] Figure 3 The flowchart illustrates the implementation of the team-designed resource image trusted sharing method based on access control of this invention. Detailed Implementation

[0017] To gain a better understanding of the technical solution and beneficial effects of the present invention, the technical solution of the present invention and its beneficial effects are described in detail below with reference to the accompanying drawings.

[0018] Figure 1 The system architecture diagram for the access control-based team resource image trusted sharing system of the present invention is as follows: Figure 1 As shown, the team-designed resource image trusted sharing system based on access control of the present invention includes a normal execution environment, a secure execution environment, a cloud-encrypted disk, and a hypervisor. The normal execution environment and the trusted execution environment are isolated by the secure isolation base provided by the hypervisor to achieve hardware isolation and data communication. The trusted execution environment and the cloud-encrypted disk are connected by wireless communication to realize the transmission, storage and retrieval of encrypted data. The implementation logic of the entire sharing system is described in detail below with the detailed structure and function of each module.

[0019] A typical execution environment includes an application program, a key processing module, a data encryption / decryption module, and a client communication module. The application program, the key processing module, and the client communication module are connected to each other in sequence, as are the application program, the data encryption / decryption module, and the client communication module. The key processing module and the data encryption / decryption module are also connected to each other in sequence.

[0020] The application provides an interactive interface to users, receiving user login authentication and data interaction requests, and providing feedback on the processing results of these requests. Data interaction requests include requests for encrypted data storage and requests for encrypted data retrieval. These requests are transmitted to the trusted execution environment for processing via the client communication module. The key processing module and the data encryption / decryption module assist in ensuring the security of the data interaction process. Specifically, the key processing module encrypts the user's plaintext username and password to obtain encrypted username and password, ensuring that the username and password are not stolen during transmission; the data encryption / decryption module encrypts the user's data to be stored and decrypts the encrypted data retrieved by the user.

[0021] The Trusted Execution Environment (TA) includes a Trusted TA program for information connection and a server-side communication module. The server-side communication module connects to the client-side communication module via a Hypervisor, building a bridge for data interaction between the ordinary execution environment and the Trusted Execution Environment. The Trusted TA program is used to actually process user login authentication and data interaction requests and return the processing results. The Trusted TA program also has a wireless communication connection with the cloud-encrypted disk, used to retrieve or transmit encrypted data from the cloud-encrypted disk during the processing of user login authentication and data interaction requests, as well as to retrieve ciphertext related to verifying usernames and passwords, and ciphertext of the private key associated with the username from the cloud-encrypted disk.

[0022] The client communication module, the server communication module, and the Hypervisor can establish a communication channel through Vsock.

[0023] like Figure 2 As shown, the cloud-encrypted disk has a metadata area that stores the system root public key. The trusted execution environment maintains the system root private key and the system root public key. All data transmitted between the trusted execution environment and the cloud-encrypted disk is encrypted using the system root public key.

[0024] The metadata area contains multiple sets of interconnected user key slots and user tokens: each set of user key slots stores the username correction ciphertext, password correction ciphertext, and private key ciphertext for each corresponding user, and each user token records the username plaintext and user identifier for each corresponding user.

[0025] The trusted execution environment also maintains a first mapping table, which maintains each user's username, user identifier, and the public key and data block index information corresponding to the user and the public key, respectively.

[0026] lower combination Figure 3The invention also details the entire process of system initialization, user registration, user login, user data storage, and user data retrieval, describing the functional logic and implementation method of the shared system of the present invention.

[0027] Example 1 I. System Initialization During system initialization, the Trusted TA program of the Trusted Execution Environment (TA) obtains baseline metrics based on system environment information and stores them in the TA. This process includes the following steps: 1. Obtain hardware information from multiple dimensions of the system, including network interface and physical address identifiers, processor model and characteristic marker information (such as the number of physical cores), motherboard serial number, memory capacity, and control chip model. Form feature description data for each dimension of hardware information, and perform a first round of SHA-256 operation and multiple rounds of compression algorithm to form 16-byte single-dimensional data. Concatenate the single-dimensional data of each dimension of hardware information to obtain the hardware feature vector. 2. Obtain key file information from multiple dimensions of the system, including bootloader checksum, kernel image storage path, and file system running status. Form feature description data for each dimension of key file information, and perform a first round of SHA-256 operation and multiple rounds of compression algorithm to form 16-byte single-dimensional data. Concatenate the single-dimensional data of each dimension of key file information to obtain the key file feature vector. 3. The hardware feature vector and the key file feature vector are concatenated to obtain the comprehensive feature vector. The hash value obtained after the comprehensive feature vector is processed by the second round of SHA-256 operation is used as the benchmark metric value.

[0028] II. Initial User Registration 1. After a user's initial registration is successful, the key processing module obtains the plaintext username and password from the application, encrypts the username and password based on the plaintext username and password, and sends the encrypted username and password to the trusted execution environment. This process includes the following steps: (1) Perform a hash digest algorithm on the plaintext username to obtain the first username key; derive the second username key from the first username key according to the first key derivation rule; use the first username key as the Key and the second username key as the IV to encrypt the plaintext password through a symmetric encryption algorithm to obtain the ciphertext password; Key is the core parameter of the symmetric encryption and decryption process, and IV is the initialization vector, so that the same plaintext and the same core parameters produce different ciphertexts, thereby improving account security; (2) Perform a hash digest algorithm on the ciphertext to obtain the first ciphertext key; derive the second ciphertext key from the first ciphertext key according to the second key derivation rule; use the first ciphertext key as the key and the second ciphertext key as the IV to encrypt the username plaintext using a symmetric encryption algorithm to obtain the username ciphertext. (3) Send the encrypted username and password to the client communication module, which then sends the encrypted username and password to the server communication module via the Hypervisor.

[0029] 2. After receiving the username ciphertext and password ciphertext, the server-side communication module passes them to the trusted TA program. The trusted TA program obtains the username correction ciphertext and password correction ciphertext based on the username ciphertext and password ciphertext, and then sends them to the cloud encrypted disk for storage, including the following steps (1) to (2).

[0030] (1) First, the ciphertext of the password and the ciphertext of the username need to be decrypted to obtain the plaintext of the password and the plaintext of the username. The specific steps include the following: (1)-1: Perform a hash digest algorithm on the ciphertext to obtain the first ciphertext key; derive the second ciphertext key from the first ciphertext key according to the second key derivation rule; use the first ciphertext key as the key and the second ciphertext key as the IV to decrypt the username ciphertext through a symmetric decryption algorithm to obtain the username ciphertext. (1)-2: Perform a hash digest algorithm on the plaintext username to obtain the first username key; derive the second username key from the first username key according to the first key derivation rule; use the first username key as the key and the second username key as the IV to decrypt the ciphertext through a symmetric decryption algorithm to obtain the plaintext password.

[0031] (2) Next, based on the ciphertext and username ciphertext, the Key and IV are obtained, and the decrypted plaintext and username are re-encrypted to obtain the username correction ciphertext and the password correction ciphertext. The specific steps include the following: (2)-1: The password ciphertext and username ciphertext are encoded and converted in sequence to obtain standard password ciphertext data and standard username ciphertext data respectively; (2)-2: Concatenate the standard ciphertext data and the standard username ciphertext data and then execute the SHA256 digest algorithm to obtain the key derivation information; (2)-3: Extract the system root public key of the trusted execution environment; perform a one-way derivation operation on the system root public key based on the key derivation information to obtain the first correction encryption key; (2)-4: The second correction encryption key is derived from the first correction encryption key according to the third key derivation rule; (2)-5: Using the first correction encryption key as Key and the second correction encryption key as IV, the username plaintext and password plaintext are encrypted sequentially using a symmetric encryption algorithm to obtain the username correction ciphertext and password correction ciphertext respectively.

[0032] During initialization, the Trusted Execution Environment (TEE) generates a key pair containing the system root private key and the system root public key using a random number generator. The system root public key can be broadcast to the cloud-encrypted disk via digital signature and is also stored locally. The system root private key is permanently stored in the tamper-proof secure hardware area of ​​the TEE, which can only be called by the trusted TA program in the TEE and cannot be accessed by external programs.

[0033] 3. The Trusted TA program assigns a unique user identifier and key pair to the user. Specifically, the user identifier is converted into a 32-byte binary identifier, the user's first login time is converted into an 8-byte integer value (e.g., 20250611), the 32-byte binary identifier and the 8-byte integer value are concatenated to obtain the standard request data, and the standard request data is processed by the SM digital signature algorithm to obtain the key pair, which includes a public key and a private key.

[0034] 4. The trusted TA program encrypts the private key, specifically by using the first corrected encryption key obtained in step 2 as the Key and the second corrected encryption key as the IV, and encrypting the private key obtained in step 3 using a symmetric encryption algorithm to obtain the user's private key ciphertext.

[0035] 5. The Trusted TA program delivers the user's username correction ciphertext, password correction ciphertext, private key ciphertext, username plaintext, and user identifier to the cloud encrypted disk. The cloud encrypted disk then allocates key slots and tokens for the user and binds and stores them one by one. At the same time, the Trusted TA program maintains the username, user information, and public key in the key pair in the first mapping table of the Trusted Execution Environment.

[0036] In this invention, the so-called first key derivation rule, second key derivation rule, and third key derivation rule are specific tags or context parameters for transforming the key. The three key derivation rules can be the same or different; however, for a specific key derivation rule, such as the first key derivation rule, the derivation rule should be consistent when the key processing module in the ordinary execution environment generates ciphertext based on it and when the trusted TA program in the trusted execution environment obtains ciphertext based on it; the same applies to the second key derivation rule and the third key derivation rule.

[0037] Specifically, the first, second, and third key derivation rules can be agreed upon by the ordinary execution environment and the trusted execution environment during system initialization. During subsequent system use, these rules can remain unchanged or be updated periodically and re-agreed upon by the ordinary and trusted execution environments. In the case of periodic updates, it is more difficult to derive the plaintext username, plaintext password, plaintext username correction, and plaintext password from the ciphertext username, ciphertext password, ciphertext username correction, and plaintext password correction, thus enhancing system security.

[0038] The complete key generation and storage mechanism described above ensures absolute security for subsequent user login verification and data interaction processes. First, in this invention, the plaintext information directly exchanged between the ordinary execution environment and the trusted execution environment only involves the derivation rules of the username and key, while passwords, private keys, etc. are all exchanged in encrypted form; similarly, the passwords exchanged between the trusted execution environment and the cloud encrypted disk are also in encrypted form. This mechanism ensures the security of the account during data exchange. Secondly, for a specific user, the Key and IV required for encryption during the generation of their username verification ciphertext, password verification ciphertext, and private key ciphertext are all derived from the username ciphertext and password ciphertext. This means that if it is necessary to decrypt the username verification plaintext, password verification plaintext, and private key plaintext later, it must be done using the username ciphertext and password ciphertext obtained from the plaintext username and password entered by the user during login. In other words, even if the user's various ciphertexts stored in the key slot of the cloud encrypted disk are intercepted, or even if the three derivative rules are intercepted, as long as the user is not logged in, the plaintext corresponding to each ciphertext cannot be cracked, thus greatly improving the security of the account. Finally, the mechanism of periodically updating the derivative rules further increases the difficulty of cracking the account. This mechanism, combined with the correction ciphertext and private key ciphertext generation mechanism, and the hardware protection of the cloud-encrypted disk metadata area, ultimately builds a triple protection mechanism of two software layers and one hardware layer, which not only ensures the security of the account but also the security of the data.

[0039] III. User Login Phase When a user initiates a login authentication request, login will only be allowed if both the system environment information and the user's login information are successfully verified.

[0040] 1. The Trusted TA program first obtains environmental metrics based on the current system environment information. The method for obtaining environmental metrics is similar to the method for obtaining the baseline metrics mentioned above: (1) Obtain hardware information of multiple dimensions of the system at present, including network interface and physical address identifier, processor model and feature marker information (such as the number of physical cores), motherboard serial number, memory capacity, and control chip model. Form feature description data for each dimension of hardware information, and form 16-byte single-dimensional data through the first round of SHA-256 operation and multiple rounds of compression algorithm. Concatenate the single-dimensional data of each dimension of hardware information to obtain the hardware feature vector. (2) Obtain key file information of multiple dimensions of the system at present, including bootloader check value, kernel image storage path and file system running status, etc., form feature description data of key file information of each dimension, and form 16-byte single-dimensional data through the first round of SHA-256 operation and multiple rounds of compression algorithm. Concatenate the single-dimensional data of key file information of each dimension to obtain key file feature vector. (3) The hardware feature vector and the key file feature vector are concatenated to obtain the comprehensive feature vector. The hash value obtained after the comprehensive feature vector is processed by the second round of SHA-256 operation is used as the environmental metric value.

[0041] 2. Compare the baseline measurement value with the environmental measurement value. This invention can adopt a flexible comparison method. If the two are completely consistent or the difference is less than a certain threshold, the comparison is considered successful and the next step of verifying the user login information is carried out. Otherwise, the comparison fails, the failure information is directly fed back, and an alarm is triggered.

[0042] Under the flexible comparison mechanism, if the baseline metric and the environmental metric are inconsistent but the difference is less than a certain threshold, the baseline metric can be updated to the current environmental metric. When comparing metrics in the future, the updated baseline metric will be used.

[0043] 3. The key processing module receives the plaintext username and password from the application and processes them to obtain the ciphertext username and password respectively. The specific method is the same as step 1 in Part 2, and will not be repeated here. The key processing module sends the processed ciphertext username and password to the client communication module, which then sends them to the server communication module through the Hypervisor. The server communication module then passes them to the trusted TA program.

[0044] 4. The trusted TA program obtains the plaintext username and password based on the encrypted username and password. The specific method is the same as described in step 2 of Part 2, and will not be repeated here.

[0045] 5. Based on the obtained plaintext username, the Trusted TA program requests the corresponding username correction ciphertext and password correction ciphertext from the cloud encrypted disk. The cloud encrypted disk can directly transmit the username correction ciphertext and password correction ciphertext to the Trusted TA program, or it can encrypt the username correction ciphertext and password correction ciphertext using the system root public key and then transmit them to the Trusted TA program. The Trusted TA program then decrypts the ciphertext using the system root private key to obtain the username correction ciphertext and password correction ciphertext.

[0046] 6. The trusted TA program decrypts the username verification ciphertext and password verification ciphertext to obtain the username verification plaintext and password verification plaintext, respectively. This process includes the following steps: (1) The password ciphertext and username ciphertext are encoded and converted in sequence to obtain standard password ciphertext data and standard username ciphertext data respectively; (2) After concatenating the standard ciphertext data and the standard username ciphertext data, execute the SHA256 digest algorithm to obtain the key derivation information; (3) Extract the system root public key of the trusted execution environment; perform a one-way derivation operation on the system root public key based on the key derivation information to obtain the first correction encryption key; (4) Derive the second correction encryption key from the first correction encryption key according to the third key derivation rule; (5) Using the first correction encryption key as Key and the second correction encryption key as IV, the username correction ciphertext and the password correction ciphertext are decrypted sequentially using a symmetric decryption algorithm to obtain the username correction plaintext and the password correction plaintext.

[0047] 7. Compare the plaintext username obtained in step 4 with the plaintext username verification obtained in step 6, and the plaintext password obtained in step 4 with the plaintext password verification obtained in step 6. If all the comparisons are consistent, provide the user with a login success message and provide the user with the user's public key and the public keys of all other registered users in the system.

[0048] In this way, the username verification plaintext, password verification plaintext, and private key plaintext cannot be directly obtained from the data or key derivation rules recorded on the cloud encrypted disk or trusted execution environment. Instead, they must be obtained using the username and password entered by the user when logging in. Thus, even if the user's various ciphertexts stored in the key slot of the cloud encrypted disk are intercepted when the user is not logged in, or even if all three derivation rules are intercepted, the user's password cannot be obtained, which greatly improves the security of accounts and data.

[0049] IV. User initiates data encryption storage request At this stage, the data that the user needs to encrypt is encrypted using the user's own public key and transmitted to the trusted execution environment. At the same time, the user can decide which users can share the encrypted data by selecting other users' public keys besides their own public key, specifically including the following steps 1 to 3.

[0050] 1. Users send the data to be encrypted and the public key information of the target user to be shared to the data encryption / decryption module through the application.

[0051] 2. The data encryption / decryption module performs the following processing: it identifies the user who initiated the data encryption and storage request as the current trusted party, identifies their public key as the trusted public key, and identifies the data to be encrypted as the target data; it packages the target data and the target user's public key into a data packet, encrypts it with the trusted public key, and submits it to the trusted execution environment through the client communication module.

[0052] For example, let user A represent the currently logged-in user. At this time, the system also stores user B, user C, and user D; the public keys of the above users are public key A, public key B, public key C, and public key D, respectively. Thus, user A is the current trusted party, and public key A is the trusted public key. After user A successfully logs in and authenticates, the trusted execution environment will send back its own public key A and the public keys B, public key C, and public key D of all other users to the user. If user A decides that users B, user C, and user D can all share the data that it wants to encrypt and store, then users B, user C, and user D are the target users. The data encryption and decryption module packages the target data and public keys B, public key C, and public key D into a data packet, encrypts it with public key A, and transmits it to the client communication module. The client communication module then transmits it to the server communication module of the trusted execution environment through the Hypervisor.

[0053] 3. After the server-side communication module receives the above data packet and passes it to the trusted TA program, the trusted TA program executes the following steps (1) to (4).

[0054] (1) Obtain the private key ciphertext of the trusted user from the cloud encrypted disk. Similarly, the cloud encrypted disk can directly pass the private key ciphertext to the trusted TA program, or it can encrypt the private key ciphertext with the system root public key and then pass it to the trusted TA program. The trusted TA program can then decrypt the private key ciphertext using the system root private key.

[0055] (2) Obtain the trusted user's private key plaintext based on the trusted user's password ciphertext and username ciphertext, specifically including: (2)-1: Encode and convert the password ciphertext and username ciphertext sequentially to obtain standard password ciphertext data and standard username ciphertext data respectively; (2)-2: Concatenate the standard ciphertext data and the standard username ciphertext data and then execute the SHA256 digest algorithm to obtain the key derivation information; (2)-3: Extract the system root public key of the trusted execution environment; perform a one-way derivation operation on the system root key based on the key derivation information to obtain the first correction encryption key; (2)-4: The second correction encryption key is derived from the first correction encryption key according to the third key derivation rule; (2)-5: Using the first correction encryption key as Key and the second correction encryption key as IV, the private key ciphertext is decrypted using a symmetric decryption algorithm to obtain the private key plaintext of the trusted user.

[0056] (3) Decrypt the data packet encrypted with the trusted public key based on the plaintext of the private key to obtain the plaintext data packet. The plaintext data packet contains the target data and the public key of the target user, namely public key B, public key C and public key D.

[0057] (4) Encrypt the target data with the system root public key and transmit the encrypted target data to the cloud encrypted disk; receive the data block information of the encrypted target data stored by the cloud encrypted disk; update the first mapping table based on the data block information and the public key information of the target user in the plaintext data packet. Assuming that the target data is stored in data block 1, the mapping information in the first mapping table is as follows: Table 1: Example of the first mapping representation in Example 1

[0058] The meaning of the above mapping information is as follows: When the data provider initiates a data storage request, it sets that users B, C, and D can obtain the data. In this way, when users B, C, or D log in later, the trusted TA program can retrieve data block 1 from the mapping information, and then request the data stored in data block 1 from the cloud encrypted disk and return it to users B, C, or D.

[0059] V. User initiates encrypted data extraction request Assuming user B initiates an encrypted data extraction request after logging in, after the verification process in the third part of the user login phase described above, the trusted TA program will first execute the following steps: 1. Determine user B, who initiated the encrypted data extraction request, as a trusted user, and determine the trusted user's public key B as a trusted public key; 2. Obtain the data block information corresponding to trusted public key B, i.e., data block 1, from the first mapping table, and send a request to the cloud encrypted disk to extract the target data of the corresponding data block 1 and the private key ciphertext of the trusted user; the target data returned by the cloud encrypted disk is data encrypted with the system root public key, and the private key ciphertext returned by the cloud encrypted disk can be directly passed to the trusted TA program, or the private key ciphertext can be encrypted with the system root public key and then passed to the trusted TA program, and the trusted TA program can decrypt it with the system root private key to obtain the private key ciphertext; 3. Decrypt the encrypted target data using the system root private key to obtain the required target data; 4. After encrypting the target data with a trusted public key, it is transmitted to the server communication module along with the private key ciphertext and the system root public key. The server communication module then transmits the data to the client communication module in the normal execution environment through the Hypervisor, and finally the client communication module sends the data encryption / decryption module back to the data encryption / decryption module.

[0060] Secondly, after receiving the encrypted target data and the private key ciphertext, the data encryption / decryption module in the normal execution environment performs the following steps: 1. Obtain the ciphertext of the trusted user's password and username from the key processing module.

[0061] 2. Decrypt the private key ciphertext based on the password ciphertext and username ciphertext to obtain the private key plaintext. The specific steps are the same as step (2) in step 3 of Part 4 above, and will not be repeated here.

[0062] 3. Decrypt the encrypted target data based on the plaintext private key to obtain the plaintext target data, and then send the plaintext target data back to the trusted user through the application.

[0063] After a user logs out, the data encryption / decryption module destroys the plaintext private key, the ciphertext private key, and the system root public key; the key processing module destroys the plaintext username, the ciphertext username, the plaintext password, and the ciphertext password.

[0064] Example 2: The difference between this embodiment and Embodiment 1 is that the first mapping table also stores information about the data provider corresponding to the data block index, as follows: Table 2: Example of the first mapping representation in Example 2

[0065] Thus, regarding Part 5, assuming user B initiates an encrypted data extraction request after logging in, and after the verification process during the user login phase in Part 3, the trusted TA program first executes the following steps: 1. Determine user B, who initiated the encrypted data extraction request, as a trusted user, and determine the trusted user's public key B as a trusted public key; 2. Obtain the data block information corresponding to trusted public key B from the first mapping table, namely data block 1, data block 2, and data block 3. Initiate a request to the cloud encrypted disk to extract the target data corresponding to data block 1, data block 2, and data block 3, as well as the private key ciphertext of the trusted user. The target data returned by the cloud encrypted disk is data encrypted with the system root public key. The private key ciphertext returned by the cloud encrypted disk can be directly passed to the trusted TA program, or it can be encrypted with the system root public key and then passed to the trusted TA program. The trusted TA program can then decrypt the private key ciphertext using the system root private key. 3. Decrypt the encrypted target data using the system root private key to obtain the required target data; 4. Package each target data and the corresponding data provider information into different shared data packets. After encrypting each shared data packet with a trusted public key, transmit it along with the private key ciphertext and the system root public key to the server communication module. The server communication module then transmits it to the client communication module in the normal execution environment through the Hypervisor, and finally the client communication module sends it back to the data encryption / decryption module.

[0066] In this embodiment, the target data is not uniformly integrated, but rather bound to the corresponding data provider one by one. For example, the target data corresponding to data block 1 is bound to user A's user information as a shared data packet, the target data corresponding to data block 2 is bound to user C's user information as a shared data packet, and the target data corresponding to data block 3 is bound to user D's user information as a shared data packet.

[0067] Secondly, after receiving the encrypted target data and the private key ciphertext, the data encryption / decryption module in the normal execution environment performs the following steps: 1. Obtain the ciphertext of the trusted user's password and username from the key processing module.

[0068] 2. Decrypt the private key ciphertext based on the password ciphertext and username ciphertext to obtain the private key plaintext. The specific steps are the same as step (2) in step 3 of Part 4 above, and will not be repeated here.

[0069] 3. Decrypt the encrypted shared data packets using the plaintext private key to obtain the plaintext target data and the corresponding data provider information. Then, send the plaintext target data and the corresponding data provider information back to the trusted user through the application. The trusted user can decide which data to obtain based on the data provider information: for example, user B only obtains the data shared by users A and C.

[0070] After a user logs out, the data encryption / decryption module destroys the plaintext private key, the ciphertext private key, and the root key; the key processing module destroys the plaintext username, the ciphertext username, the plaintext password, and the ciphertext password.

[0071] In this embodiment, a second mapping table can be added. The second mapping table stores the correspondence between username / user identifier and user attribute information. The user attribute information may include the user's team, position, level, etc. The data provider information fed back to trusted users is the detailed attribute information of the data provider, so that trusted users can determine whether they need to obtain the shared data based on this attribute information.

[0072] Example 3 The difference between this embodiment and embodiment 2 is that: assuming user B initiates an encrypted data extraction request after logging in, and after the verification process in the third part of the user login stage, the trusted TA program first executes the following steps: 1. Determine user B, who initiated the encrypted data extraction request, as a trusted user, and determine the trusted user's public key B as a trusted public key; 2. Obtain the data block information corresponding to the trusted public key B and the data provider information corresponding to the data block information from the first mapping table, and feed back the data block information and the data provider information corresponding to the data block information to the normal execution environment through the server communication module. After the user selects the required data provider in the normal execution environment, the data provider selected by the user is determined as the target user: Assume that the trusted execution environment feeds back to the normal execution environment that the data that trusted user B can share comes from user A, user C and user D, and user B only needs to share the data of user A and user C, then user A and user C are the target users; 3. Send a request to the cloud-encrypted disk to extract the target data of the data block corresponding to the target user and the private key ciphertext of the trusted user; the target data returned by the cloud-encrypted disk is data encrypted with the system root public key, and the private key ciphertext returned by the cloud-encrypted disk can be directly passed to the trusted TA program, or the private key ciphertext can be encrypted with the system root public key and then passed to the trusted TA program, which can then decrypt it with the system root private key to obtain the private key ciphertext. 4. Decrypt the encrypted target data using the system root private key to obtain the required target data; 5. Package each target data and the corresponding data provider information into different shared data packets. After encrypting each shared data packet with a trusted public key, transmit it along with the private key ciphertext and the system root public key to the server communication module. The server communication module then transmits it to the client communication module in the normal execution environment through the Hypervisor, and finally the client communication module sends it back to the data encryption / decryption module.

[0073] Secondly, after receiving the encrypted target data and the private key ciphertext, the data encryption / decryption module in the normal execution environment performs the following steps: 1. Obtain the ciphertext of the trusted user's password and username from the key processing module; 2. Decrypt the private key ciphertext based on the password ciphertext and username ciphertext to obtain the private key plaintext. The specific steps are the same as step (2) in step 3 of Part 4 above, and will not be repeated here. 3. Decrypt the encrypted shared data packet based on the plaintext of the private key to obtain each plaintext target data and the data provider information corresponding to the plaintext target data. Feed back each plaintext target data and the data provider information corresponding to the plaintext target data to the trusted user through the application. After a user logs out, the data encryption / decryption module destroys the plaintext private key, the ciphertext private key, and the root key; the key processing module destroys the plaintext username, the ciphertext username, the plaintext password, and the ciphertext password.

[0074] In this embodiment, the operation of a trusted user selecting a target user is performed in advance. In this way, the required data is extracted only based on the trusted user's selection, which saves the amount of data interaction and reduces the system burden.

[0075] This invention is applicable to data sharing in various fields, and specifically to resource sharing of team-designed images.

[0076] The technical effects of this invention are as follows: 1. By generating encrypted username, encrypted password, encrypted username verification, encrypted password, and encrypted private key, it is ensured that all types of encrypted text can only be decrypted and verified when the user is logged in. Even if the user cracks all types of encrypted text or the key derivation mechanism in the encryption process when the user is not logged in, the user's password cannot be obtained from them, thus ensuring the security of the account during data interaction. 2. The mechanism of irregularly updating derived rules increases the difficulty of account cracking. This mechanism, combined with the correction ciphertext and private key ciphertext generation mechanism, and hardware protection of the cloud-encrypted disk metadata area, ultimately builds a three-layer protection mechanism of two software layers and one hardware layer. By ensuring the security of the account, the security of the data is also further ensured. 3. By broadcasting public keys, users can choose their own data sharing partners, and by selecting users, they can also choose the provider of the data they want to share. At the same time, by constructing a first mapping table and coordinating the entire process of encryption with the system root public key, decryption with the system root private key, encryption with the public key of a specific user, and decryption with the private key of a specific user, data is encrypted with different public keys during interaction between the trusted execution environment, the cloud encrypted disk, and the ordinary execution environment. This ensures that each piece of data is stored only once, occupies only one storage space, but can be bound to different data sharing partners and shared with different users, improving the flexibility, autonomy, and security of users using the sharing system.

[0077] Although the present invention has been described using the above preferred embodiments, it is not intended to limit the scope of protection of the present invention. Any changes and modifications made by those skilled in the art to the above embodiments without departing from the spirit and scope of the present invention shall still fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be defined by the claims.

Claims

1. A team-designed resource image trusted sharing system based on access control, characterized in that, include: Standard execution environment, secure execution environment, cloud-encrypted disk, Hypervisor; among them, Hardware isolation between the normal execution environment and the trusted execution environment is achieved through a secure isolation base provided by the Hypervisor. The normal execution environment includes an application program, a key processing module, a data encryption / decryption module, and a client communication module connected in sequence; the trusted execution environment includes a trusted TA program and a server communication module connected in sequence; the client communication module and the server communication module realize data interaction between the normal execution environment and the trusted execution environment through the Hypervisor; The application provides an interactive interface to the user and receives the user's login authentication and data interaction requests. The trusted TA program processes the user's login authentication and data interaction requests and returns the processing results. The key processing module, client communication module, and server communication module are used to implement encrypted data communication between the normal execution environment and the secure execution environment during the above interaction process. The Trusted TA program also wirelessly connects to the cloud-encrypted disk to retrieve or send encrypted data back to the cloud-encrypted disk during user login authentication and data interaction requests.

2. The team-designed resource image trusted sharing system based on access control as described in claim 1, characterized in that: The cloud-encrypted disk contains a metadata area that stores the system root public key. The trusted execution environment maintains the system root private key. All data transmitted between the trusted execution environment and the cloud-encrypted disk is encrypted using the system root public key. The metadata area contains multiple sets of mutually bound user key slots and user tokens: each set of user key slots stores the username correction ciphertext, password correction ciphertext, and private key ciphertext for each corresponding user, and each user token records the username plaintext and user identifier for each corresponding user. The trusted execution environment also maintains a first mapping table, which maintains each user's user identifier and its corresponding public key, as well as the data block index information corresponding to the public key.

3. The team-designed resource image trusted sharing system based on access control as described in claim 2, characterized in that: Benchmark metrics are stored in the trusted execution environment; When a user initiates a login authentication request: the key processing module receives the plaintext username and password from the application and processes them to obtain the ciphertext username and password respectively; The client communication module and the server communication module sequentially send the encrypted username, encrypted password, and shared system environment information to the trusted TA program. The trusted TA program then performs the following processing: Environmental metrics are obtained based on system environment information; The username and password plaintext are obtained from the username ciphertext and password ciphertext; Obtain the username correction ciphertext and password correction ciphertext from the cloud encrypted disk, and obtain the username correction plaintext and password correction plaintext based on the username correction ciphertext, password correction ciphertext, username ciphertext, and password ciphertext. Successful authentication and login are only possible if the environmental metric and the baseline metric, the plaintext username and the corrected plaintext username, and the plaintext password and the corrected plaintext password are all consistent. After successful authentication and login, the system sends the public keys of all users in the system back to the normal execution environment.

4. The team-designed resource image trusted sharing system based on access control as described in claim 3, characterized in that: When a user initiates a data encryption and storage request, the application sends the data to be encrypted and the public key information of the target user to be shared to the data encryption and decryption module. The data encryption / decryption module performs the following processing: it identifies the user who initiated the data encryption and storage request as the current trusted party, identifies their public key as the trusted public key, and identifies the data to be encrypted as the target data; The target data and the target user's public key are packaged into a data packet, encrypted with a trusted public key, and submitted to the trusted execution environment through the client communication module. After the server-side communication module of the Trusted Execution Environment receives the above data packet and passes it to the Trusted TA program, the Trusted TA program performs the following processing: obtains the ciphertext of the trusted user's private key from the cloud encrypted disk, obtains the plaintext of the trusted user's private key based on the ciphertext of the trusted user's password and username, and decrypts the data packet encrypted with the trusted public key based on the plaintext of the private key to obtain the plaintext data packet. Encrypt the target data in the plaintext data packet using the system root public key and transmit it to the cloud encrypted disk; receive the data block information of the stored encrypted target data from the cloud encrypted disk; Update the first mapping table information based on the data block information and the target user's public key information in the plaintext data packet.

5. The team-designed resource image trusted sharing system based on access control as described in claim 3, characterized in that: When a user initiates a request to extract encrypted data, the Trusted TA program performs the following processing: The user who initiates the encrypted data extraction request is identified as a trusted user, and the public key of the trusted user is identified as a trusted public key. Obtain the data block information corresponding to the trusted public key from the first mapping table, and send a request to the cloud encrypted disk to extract the target data of the corresponding data block and the private key ciphertext of the trusted user; Receive the private key ciphertext and encrypted target data from the cloud-encrypted disk, and decrypt it using the system root private key to obtain the required target data; The target data is encrypted using a trusted public key and then sent back to the normal execution environment along with the private key ciphertext through the server-side communication module.

6. The team design resource image trusted sharing system based on access control as described in claim 5, characterized in that: After receiving the encrypted target data and the private key ciphertext, the data encryption / decryption module in the normal execution environment performs the following processing: Obtain the ciphertext of the trusted user's password and username from the key processing module; The private key is decrypted based on the ciphertext and username to obtain the plaintext private key. The encrypted target data is decrypted using the private key in plaintext to obtain the plaintext target data.

7. The team design resource image trusted sharing system based on access control as described in claim 3, characterized in that: The ciphertext is obtained by performing a hash digest algorithm on the plaintext username to obtain the first username key; deriving the second username key from the first username key according to the first key derivation rules; and encrypting the plaintext password using a symmetric encryption algorithm with the first username key as the key and the second username key as the IV to obtain the ciphertext. The username ciphertext is obtained by performing a hash digest algorithm on the ciphertext to obtain the first cryptographic key; deriving the second cryptographic key from the first cryptographic key according to the second key derivation rule; using the first cryptographic key as the key and the second cryptographic key as the IV, encrypting the username plaintext using a symmetric encryption algorithm to obtain the username ciphertext.

8. The team design resource image trusted sharing system based on access control as described in claim 7, characterized in that: The username verification ciphertext and password verification ciphertext are obtained through the following methods: The ciphertext and username are encoded and converted sequentially to obtain standard ciphertext data and standard username data, respectively. After concatenating the standard ciphertext data and the standard username ciphertext data, the SHA256 digest algorithm is executed to obtain the key derivation information. Extract the system root public key of the trusted execution environment; perform a one-way derivation operation on the system root public key based on the key derivation information to obtain the first correction encryption key; The second correction encryption key is derived from the first correction encryption key according to the third key derivation rule; Using the first correction encryption key as Key and the second correction encryption key as IV, the username plaintext and password plaintext are encrypted sequentially using a symmetric encryption algorithm to obtain the username correction ciphertext and password correction ciphertext respectively.

9. A sharing method based on the sharing system according to any one of claims 1-8, characterized in that, Includes the following steps: Step S1: During system initialization, a baseline metric value is obtained based on the system environment information; Step S21: When a user registers for the first time, the key processing module obtains the encrypted username and password based on the plaintext username and password, and sends the encrypted username and password to the trusted execution module. Step S22: The trusted TA program of the trusted execution module obtains the username correction ciphertext and password correction ciphertext based on the username ciphertext and password ciphertext, and then sends them to the cloud encrypted disk for storage. Step S31: When a user initiates a login authentication request, the key processing module receives the plaintext username and password from the application and processes them to obtain the ciphertext username and password respectively. Step S32: The client communication module and the server communication module sequentially send the encrypted username, encrypted password, and shared system environment information to the trusted TA program. The trusted TA program then performs the following processing: Environmental metrics are obtained based on system environment information; The username and password plaintext are obtained from the username ciphertext and password ciphertext; Obtain the username correction ciphertext and password correction ciphertext from the cloud encrypted disk, and obtain the username correction plaintext and password correction plaintext based on the username correction ciphertext, password correction ciphertext, username ciphertext, and password ciphertext. Successful authentication and login are only possible if the environmental metric and the baseline metric, the plaintext username and the corrected plaintext username, and the plaintext password and the corrected plaintext password are all consistent. After successful authentication and login, the system sends the public keys of all users in the system back to the normal execution environment.

Images