A method and system for dynamic recovery of key fragments

Abstract

The application relates to the technical field of network security, in particular to a key fragment dynamic recovery method and system. The method generates and fragments a target key in an SGX trusted execution environment, combines SASE network edge node states and fragment metadata to complete encrypted distribution and storage of the key fragments; in response to a key recovery request, zero-trust verification and risk assessment are performed on a request subject and a fragment state, access authorization, a recovery threshold and a trusted time window are generated, and fragment verification, recombination and target key recovery are completed within the time window; meanwhile, invalid fragments are recovered according to the available state of the fragments, and the target key and the corresponding key fragments are updated when the rotation condition is met. The application realizes trusted fragment storage, dynamic authorized recovery, abnormal fragment repair and rotation of the target key, thereby improving the security, reliability and adaptability of key management in a distributed network environment.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and system for dynamic recovery of key fragments. Background Technology

[0002] In related technologies, with the rapid development of cloud computing, edge computing, and zero-trust security architecture, key management has become an important technical means to ensure data encryption, identity authentication, and secure communication. Existing key management schemes typically use secret sharing technology to divide the complete key into multiple key fragments and store each key fragment separately on different nodes. When key recovery is needed, key fragments that have reached a preset recovery threshold are collected and reassembled to reduce the risk of single point of failure and leakage caused by centralized key storage.

[0003] However, existing key sharding recovery methods typically employ fixed recovery thresholds and static access authorization mechanisms, making it difficult to dynamically adjust key recovery conditions based on node operating status, network attack events, and the security status of the requesting entity. In cross-regional distributed storage scenarios, the security risks and availability status of different nodes exhibit dynamic changes. Fixed recovery thresholds can easily lead to overly lenient shard acquisition conditions in high-risk scenarios or limited recovery efficiency in low-risk scenarios. Furthermore, traditional key sharding technologies have low synergy with edge computing architectures and trusted execution environments. The processes of shard generation, storage, access, and recovery lack a unified trusted protection mechanism. Key recovery is also susceptible to security threats such as side-channel attacks, man-in-the-middle attacks, and long-term exposure of shards, making it difficult to simultaneously ensure the security, real-time performance, and high availability of key recovery.

[0004] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0005] The main objective of this application is to propose a key fragment dynamic recovery method and system to achieve trusted fragment storage of target keys, dynamic authorization recovery, and abnormal fragment repair and rotation, thereby improving the security, reliability and adaptability of key management in a distributed network environment.

[0006] To achieve the above objectives, one aspect of this application proposes a key fragmentation dynamic recovery method, the method comprising the following steps: A target key is generated in the SGX Trusted Execution Environment, and the target key is fragmented to obtain multiple key fragments and corresponding fragment metadata. Based on the edge node status and fragmented metadata of the SASE network, the key fragments are distributed to the corresponding edge nodes for encrypted storage. In response to a key recovery request, zero-trust verification is performed based on the request subject information, the edge node status, and the shard metadata to obtain verification results, and risk assessment is performed to obtain risk assessment results. Based on the verification results, fragmented access authorization information is generated, and based on the risk assessment results, a key recovery threshold and a trusted time window are determined, and key recovery control information is generated. The target key fragment is obtained based on the key recovery control information, and its validity is verified and reassembled within the trusted time window to recover the target key. Shard recovery is performed based on the shard availability status of edge nodes, and the target key and corresponding key shards are updated when preset rotation conditions are met.

[0007] In some embodiments, the step of generating a target key in the SGX Trusted Execution Environment and fragmenting the target key to obtain multiple key fragments and corresponding fragment metadata includes: Generate the target key in the SGX trusted execution environment and determine the number of fragments and the initial recovery threshold; Based on the number of fragments and the initial recovery threshold, the target key is fragmented using the Shamir secret sharing algorithm to obtain multiple initial key fragments. Each of the initial key fragments is sealed and encrypted to obtain multiple key fragments; Based on each key fragment, corresponding fragment metadata is generated; the fragment metadata includes fragment identifier, geolocation tag, access policy, risk score, and time decay factor.

[0008] In some embodiments, the distribution of the key fragments to the corresponding edge nodes for encrypted storage based on the edge node status and fragmented metadata of the SASE network includes: Based on the edge node status and the shard metadata, edge nodes in the SASE network are filtered to determine multiple target edge nodes; Based on the geographical location of each target edge node and the fragment metadata, a distribution relationship is established between the key fragment and the target edge node; Based on the distribution relationship, each key fragment is distributed to the corresponding target edge node, and the corresponding fragment storage location is recorded. The key fragment is bound to the hardware fingerprint of the corresponding target edge node, and the key fragment is encrypted and stored through the SGX secure channel.

[0009] In some embodiments, the step of responding to a key recovery request by performing zero-trust verification based on the requesting subject information, the edge node status, and the shard metadata to obtain a verification result, and performing a risk assessment to obtain a risk assessment result, includes: Obtain the request subject information corresponding to the key recovery request, and extract the access policy and risk score from the fragment metadata; Based on the request subject information and the access policy, a zero-trust policy verification is performed to obtain the verification result; Risk assessment parameters are determined based on the edge node status, the requesting entity information, and the risk score. Risk assessment is performed based on the aforementioned risk assessment parameters to obtain the risk assessment results.

[0010] In some embodiments, the zero-trust policy verification based on the request subject information and the access policy to obtain the verification result includes: Based on the request subject information, extract identity information, device status information, and request location information; The corresponding verification conditions are determined based on the access policy; the verification conditions include identity verification conditions, device trust conditions, and location access conditions. The identity information, device status information, and requested location information are matched with the corresponding verification conditions to obtain the strategy matching result; Based on the policy matching result, it is determined whether the key recovery request meets the zero-trust access condition, and the verification result is obtained.

[0011] In some embodiments, generating fragmented access authorization information based on the verification result and determining the key recovery threshold and trusted time window based on the risk assessment result includes: In response to the verification result being a verification pass instruction, a short-term access token is generated based on the request subject information, and the short-term access token is used as fragmented access authorization information; The current risk level is determined based on the risk assessment results; Based on the current risk level, the initial recovery threshold, and the fragment metadata, determine the key recovery threshold and the trusted time window; The fragmented access authorization information is associated with the key recovery threshold and the trusted time window to generate key recovery control information.

[0012] In some embodiments, determining the key recovery threshold and trusted time window based on the current risk level, the initial recovery threshold, and the fragment metadata includes: Determine the corresponding risk adjustment parameters based on the current risk level; The key recovery threshold is determined based on the risk adjustment parameters, the initial recovery threshold, and the preset maximum recovery threshold; Extract the time decay factor from the fragment metadata and determine the time window adjustment parameters based on the current risk level; The preset time window is adjusted based on the time decay factor and the time window adjustment parameters to obtain the reliable time window.

[0013] In some embodiments, obtaining a target key fragment based on the key recovery control information, and performing validity verification and reassembly within the trusted time window to recover the target key includes: Based on the key recovery control information, fragmented access authorization information, key recovery threshold, and trusted time window are determined; Based on the fragmented access authorization information, a fragment acquisition request is initiated to the corresponding edge node, and the target key fragment is obtained; In the SGX trusted execution environment of the edge node, the validity of the fragment access authorization information and the target key fragment is verified; Based on the trusted time window, valid key fragments are filtered, and it is determined whether the number of valid key fragments meets the key recovery threshold. In response to meeting the key recovery threshold, the valid key fragments are aggregated in the SGX Trusted Execution Environment and reassembled using the Shamir Secret Sharing Algorithm to recover the target key.

[0014] In some embodiments, the sharding recovery based on the sharding availability status of edge nodes, and the updating of the target key and corresponding key shards when preset rotation conditions are met, includes: Obtain the shard availability status of each edge node and identify the failed key shards; Based on available key fragments and backup nodes, the failed key fragments are recovered, and the corresponding fragment metadata is updated; Based on the preset key rotation period and the current state of the target key, determine whether the preset rotation conditions are met; In response to the satisfaction of the preset rotation conditions, the target key is updated in the SGX trusted execution environment, the corresponding key fragment is regenerated and distributed, and the original key fragment is securely erased.

[0015] To achieve the above objectives, another aspect of this application proposes a key fragmentation dynamic recovery system, the system comprising: The key generation module is used to generate a target key in the SGX trusted execution environment and to perform fragmentation processing on the target key to obtain multiple key fragments and corresponding fragment metadata. The sharded storage module is used to distribute the key shards to the corresponding edge nodes for encrypted storage based on the edge node status and sharded metadata of the SASE network. The verification and evaluation module is used to respond to the key recovery request by performing zero-trust verification and risk assessment based on the request subject information, the edge node status and the shard metadata, and to obtain the verification result and the risk assessment result. The recovery control module is used to generate fragmented access authorization information based on the verification results, and to determine the key recovery threshold and trusted time window based on the risk assessment results, and generate key recovery control information. The key recovery module is used to obtain the target key fragment based on the key recovery control information, and to perform validity verification and reassembly within the trusted time window to recover the target key. The sharding maintenance module is used to restore shards based on the sharding availability status of edge nodes, and to update the target key and corresponding key shards when preset rotation conditions are met.

[0016] To achieve the above objectives, another aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0017] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0018] To achieve the above objectives, another aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0019] The embodiments of this application include at least the following beneficial effects: This application provides a key fragmentation dynamic recovery method and system. This scheme completes the target key generation and fragmentation processing in the SGX trusted execution environment, ensuring that the complete key is in a trusted isolation environment during generation, fragmentation, and recovery, reducing the risk of plaintext key leakage. By combining the operating status and fragmentation metadata of each edge node in the SASE network, different key fragments are distributed and stored on corresponding edge nodes, avoiding single-point failure and centralized leakage problems caused by centralized storage of the complete key. For the key recovery process, zero-trust verification and risk assessment are performed based on the request subject information, edge node status, and fragmentation metadata. Based on the verification results and risk assessment results, fragmentation access authorization information, key recovery thresholds, and trusted time windows are dynamically generated, allowing the key recovery conditions to be dynamically adjusted according to the access subject and network operating risks, thereby improving the security and controllability of the fragmentation access and key reassembly process. Meanwhile, by validating and reassembling the target key fragments within a trusted time window, and performing fragment recovery in conjunction with the fragment availability status of edge nodes, the key recovery capability can be maintained when some fragments are abnormal, lost, or edge nodes are unavailable. When preset rotation conditions are met, the target key and corresponding key fragments are further updated, reducing the security risks caused by long-term use of fixed keys. This achieves integrated management of key fragment storage, dynamic authorization, secure recovery, anomaly repair, and periodic rotation, thereby improving the security, reliability, and dynamic adaptability of key management in a distributed network environment. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating a key fragment dynamic recovery method provided in an embodiment of this application; Figure 2 yes Figure 1 A flowchart illustrating step S1 in the process; Figure 3 This is a schematic diagram of the environmental monitoring and key generation process provided in the embodiments of this application; Figure 4 yes Figure 1 A flowchart illustrating step S2 in the process; Figure 5 yes Figure 1 A flowchart illustrating step S3 in the process; Figure 6 yes Figure 5 A flowchart illustrating step S32 in the process; Figure 7 yes Figure 1 A flowchart illustrating step S4 in the process; Figure 8 yes Figure 7 A flowchart illustrating step S43 in the process; Figure 9This is a flowchart of the collaborative control mechanism of dynamic threshold adjustment and reliable time window provided in the embodiments of this application; Figure 10 yes Figure 1 A flowchart illustrating step S5 in the process; Figure 11 yes Figure 1 A flowchart illustrating step S6 in the process; Figure 12 This is a schematic diagram of a key fragmentation dynamic recovery system provided in an embodiment of this application; Figure 13 This is a schematic diagram of the structure of a key fragmentation dynamic recovery system provided in an embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0022] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”

[0023] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0025] Before providing a detailed description of the embodiments of this application, some of the nouns and terms used in the embodiments of this application will be explained first. The nouns and terms used in the embodiments of this application shall be interpreted as follows: SGX (Software Guard Extensions) is a security technology based on processor hardware to achieve trusted isolated execution. It protects sensitive data and program execution processes by constructing a secure enclave isolated from the normal execution environment. In this embodiment, the generation, fragmentation, sealing and encryption, validity verification, and key reassembly of the target key are completed based on the SGX trusted execution environment, enabling the target key and related intermediate data to be processed in a protected environment. SASE (Secure Access Service Edge) is a network security technology that integrates network connectivity and secure access capabilities into a cloud edge architecture. It provides unified network access and security control to users or devices in different regions through distributed edge nodes. In this embodiment, the target edge node is selected based on the edge node status and shard metadata in the SASE network, and different key shards are stored distributed across the corresponding edge nodes to achieve cross-node, cross-regional distributed storage of key shards. A POP (Point of Presence) is an edge service node deployed in different regions within a SASE network to provide network access and security services. In this embodiment, different key fragments are configured to different POP edge nodes. The corresponding POP nodes store the key fragments and respond to fragment retrieval requests based on fragment access authorization information, thereby forming cross-regional redundant fragment storage. ZTNA (Zero Trust Network Access) refers to a secure access mechanism that implements continuous authentication of the accessing subject, device trust verification, and access condition judgment based on the zero trust principle. In this embodiment, ZTNA zero trust verification is performed based on the identity information, device status information, and request location information of the requesting subject, and the verification result determines whether the requesting subject has the access rights of the corresponding key fragment. Shamir's Secret Sharing (SSS) is a cryptographic algorithm based on a threshold secret sharing mechanism that splits a target secret into multiple secret fragments. The original secret can only be recovered when the number of valid fragments participating in the reconstructing reaches a preset recovery threshold. In this embodiment, the Shamir secret sharing algorithm is used to divide the target key into multiple key fragments, and the valid key fragments are aggregated and reconstructed when the current key recovery threshold is met to recover the target key. SGX Sealing refers to the process of converting sensitive data in a trusted execution environment into encrypted data associated with corresponding trusted hardware or security attributes, ensuring that the encrypted data remains protected even after leaving the secure enclave. In this embodiment, SGX Sealing is applied to the initial key fragments, ensuring that the corresponding key fragments can only be desealed and accessed when preset trust conditions are met. TPM (Trusted Platform Module) refers to a hardware security component that provides functions such as device identification, key protection, and platform integrity verification. In this embodiment, a hardware fingerprint of the edge node can be formed based on the TPM hardware information, and key fragments can be bound to the corresponding hardware fingerprint to restrict the use of key fragments after they have been copied to unauthorized nodes. PUF (Physical Unclonable Function) is a hardware security technology that utilizes microscopic physical differences generated during hardware manufacturing to generate response data unique to each device. In this embodiment, the PUF response value is dynamically calibrated based on operating environment data such as temperature and voltage, and the calibrated PUF response is used as one of the entropy data sources in the key generation process. A QRNG (Quantum Random Number Generator) is a random number generation device that generates random numbers based on quantum physical processes. In this embodiment, the QRNG output is mixed with the calibrated PUF response using multi-source entropy to improve the randomness of the entropy data used in the key seed, and further used for target key generation. A trusted time window refers to the effective time range for fragment access and key recovery dynamically determined based on parameters such as the current risk level and time decay factor. In this embodiment, the trusted time window is shortened when the risk level increases, requiring the target key fragment to complete acquisition, verification, and reassembly in a shorter time, thereby reducing the security risks caused by long-term exposure of key fragments.

[0026] This application provides a method and system for dynamic key fragmentation recovery. This scheme completes the target key generation and fragmentation process within the SGX Trusted Execution Environment, ensuring the complete key remains in a trusted, isolated environment throughout generation, fragmentation, and recovery, reducing the risk of plaintext key leakage. By combining the operational status and fragmentation metadata of each edge node in the SASE network, different key fragments are distributed and stored on their respective edge nodes, avoiding single points of failure and centralized leakage issues caused by centralized storage of the complete key. For the key recovery process, zero-trust verification and risk assessment are performed based on the requesting subject information, edge node status, and fragmentation metadata. Based on the verification and risk assessment results, fragmentation access authorization information, key recovery thresholds, and trusted time windows are dynamically generated, allowing key recovery conditions to be dynamically adjusted according to the accessing subject and network operational risks, thereby improving the security and controllability of fragmentation access and key reassembly processes. Meanwhile, by validating and reassembling the target key fragments within a trusted time window, and performing fragment recovery in conjunction with the fragment availability status of edge nodes, the key recovery capability can be maintained when some fragments are abnormal, lost, or edge nodes are unavailable. When preset rotation conditions are met, the target key and corresponding key fragments are further updated, reducing the security risks caused by long-term use of fixed keys. This achieves integrated management of key fragment storage, dynamic authorization, secure recovery, anomaly repair, and periodic rotation, thereby improving the security, reliability, and dynamic adaptability of key management in a distributed network environment.

[0027] This application provides a key fragmentation dynamic recovery method, relating to the field of network security technology. This key fragmentation dynamic recovery method can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or vehicle terminal, but is not limited thereto; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application implementing a key fragmentation dynamic recovery method, but is not limited to the above forms.

[0028] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0029] Figure 1 This is an optional flowchart of a key fragmentation dynamic recovery method provided in an embodiment of this application. Figure 1 The method may include, but is not limited to, steps S1 to S6: S1: Generate the target key in the SGX Trusted Execution Environment, and perform fragmentation on the target key to obtain multiple key fragments and corresponding fragment metadata; Among them, reference Figure 2 As shown, a target key is generated in the SGX Trusted Execution Environment, and the target key is fragmented to obtain multiple key fragments and corresponding fragment metadata, including: S11: Generate the target key in the SGX Trusted Execution Environment and determine the number of fragments and the initial recovery threshold; S12: Based on the number of fragments and the initial recovery threshold, the target key is fragmented using the Shamir secret sharing algorithm to obtain multiple initial key fragments; S13: Seal and encrypt each initial key fragment to obtain multiple key fragments; S14: Generate corresponding fragment metadata based on each key fragment; the fragment metadata includes fragment identifier, geolocation label, access policy, risk score and time decay factor.

[0030] In this embodiment, a secure enclave is initialized within the SGX Trusted Execution Environment, and a target key is generated in the protected memory of the enclave, ensuring that the plaintext of the target key is not written to ordinary memory or external storage. Based on the security level of the target key, the number of available edge nodes, and the fragmentation redundancy requirements, the number of fragments and the initial recovery threshold are determined. Subsequently, within the SGX secure enclave, based on the number of fragments and the initial recovery threshold, the Shamir secret sharing algorithm is used to fragment the target key, resulting in multiple initial key fragments. This ensures that no single fragment can independently recover the target key; recovery is only possible when the number of valid fragments reaches the initial recovery threshold.

[0031] It should be noted that the reference Figure 3 As shown, Figure 3 This is a flowchart illustrating the environmental monitoring and key generation process. Specifically, temperature and voltage information of the current operating environment are collected using temperature and voltage sensors, and the collected results are converted into digital environmental data. The PUF response value is dynamically calibrated based on the environmental data to reduce the impact of temperature and voltage changes on the stability of the PUF response. Subsequently, the calibrated PUF response is mixed with the QRNG output through multi-source entropy mixing to obtain entropy data with higher randomness. Error correction coding is then applied to the entropy data to detect and correct bit errors caused by environmental disturbances, improving the consistency and stability of subsequent key materials.

[0032] The error-corrected data is mapped to a key seed of a preset length, and a target key is generated based on the key seed in the protected memory of the SGX trusted execution environment, ensuring that the target key and intermediate data during the generation process are not exposed to the ordinary execution environment. After generating the target key, it can be fragmented using the Shamir secret sharing algorithm according to a predetermined number of fragments and an initial recovery threshold, resulting in multiple initial key fragments. Sealing encryption and fragment metadata generation are then performed, thus connecting with the subsequent SASE edge node distribution and dynamic recovery process.

[0033] Furthermore, each initial key fragment undergoes SGX sealing encryption, transforming it into a key fragment protected by a trusted execution environment. The key fragments are then associated with corresponding SGX security attributes, ensuring that they can only be desealed when preset trust conditions are met. After sealing encryption, each key fragment undergoes integrity verification, and a correspondence is established between each initial key fragment and the sealed key fragments. For fragments that fail to seal or exhibit verification anomalies, the sealing process is re-executed to ensure the integrity and availability of subsequently distributed key fragments.

[0034] After obtaining multiple key shards, corresponding shard metadata is generated and bound to the respective key shards. The shard identifier uniquely identifies the corresponding key shard; the geographic location tag limits or indicates the SASE POP area where the shard is allowed to be deployed; the access policy characterizes the zero-trust authentication conditions required to access the corresponding shard; the risk score indicates the risk status of the corresponding shard or storage environment; and the time decay factor is used to determine the trusted time window in conjunction with real-time risk assessment results. This forms shard data containing key shards and their corresponding security attributes, providing a foundation for subsequent edge node selection, shard distribution, and dynamic key recovery.

[0035] S2: Based on the edge node status and fragmented metadata of the SASE network, the key fragments are distributed to the corresponding edge nodes for encrypted storage; Among them, reference Figure 4 As shown, based on the edge node status and fragmented metadata of the SASE network, key fragments are distributed to the corresponding edge nodes for encrypted storage, including: S21: Based on the edge node status and fragment metadata, filter the edge nodes in the SASE network to determine multiple target edge nodes; S22: Based on the geographical location and fragment metadata of each target edge node, establish the distribution relationship between key fragments and target edge nodes; S23: Based on the distribution relationship, distribute each key fragment to the corresponding target edge node and record the corresponding fragment storage location; S24: Bind the key fragment to the hardware fingerprint of the corresponding target edge node, and encrypt and store the key fragment through the SGX secure channel.

[0036] In this embodiment, the survival status, operational status, and risk status of each edge node in the SASE network are obtained. Combined with the shard identifier, geographic location tag, access policy, and risk score corresponding to each key shard, edge nodes are screened. Nodes that are offline, abnormal, or whose risk level does not meet preset security requirements are eliminated. Further, it is determined whether the remaining nodes are located in the storage area allowed by the shard and whether they meet the corresponding access control conditions, thereby identifying multiple target edge nodes. Preferably, the target edge nodes corresponding to different key shards are distributed in different regions to form cross-regional redundancy, avoiding the concentration of key shards that have reached the recovery threshold in the same area.

[0037] A distribution relationship between key shards and target edge nodes is established based on the geographical location of each target edge node and the geographical location tag in the shard metadata, so that multiple key shards corresponding to the same target key are configured to different POP nodes. According to the distribution relationship, each key shard is sent to its corresponding target edge node, and the shard identifier, target edge node identifier, and shard storage location are recorded to form a shard storage record. The shard storage location can also be written to the blockchain audit layer for subsequent key recovery to determine the node where the corresponding shard is located and to perform tamper-proof verification of the shard storage location.

[0038] After receiving the key fragment, the target edge node binds the fragment to the corresponding node's hardware fingerprint. The hardware fingerprint can be represented by TPM hardware information, thus preventing the fragment from being illegally copied to other nodes. Simultaneously, the target edge node enables its local SGX Trusted Execution Environment, receiving and accessing the key fragment through an SGX secure channel, and storing it in encrypted form in a protected area. Subsequent access to the corresponding key fragment is only permitted if the hardware fingerprint matches and the SGX trusted access conditions are met, thereby enhancing the security of the fragment storage process.

[0039] S3: In response to the key recovery request, zero-trust verification is performed based on the request subject information, edge node status and shard metadata to obtain the verification result and risk assessment is performed to obtain the risk assessment result. Among them, reference Figure 5 As shown, in response to a key recovery request, zero-trust verification is performed based on the requesting subject information, edge node status, and shard metadata to obtain verification results, and risk assessment is performed to obtain risk assessment results, including: S31: Obtain the request subject information corresponding to the key recovery request, and extract the access policy and risk score from the fragment metadata; S32: Perform zero-trust policy verification based on the request subject information and access policy, and obtain the verification result; S33: Determine risk assessment parameters based on edge node status, request subject information, and risk score; S34: Conduct risk assessment based on risk assessment parameters to obtain risk assessment results.

[0040] In this embodiment, upon receiving a key recovery request, the corresponding request subject information is obtained. This request subject information may include user identity information, authentication credentials, device health status, current geographical location, and request source. Based on the target key identifier, the shard metadata corresponding to the key to be recovered is determined, and access policies and risk scores are extracted from it. The access policy restricts the zero-trust conditions that the request subject must meet to access the corresponding key shard, and the risk score characterizes the current risk status of the corresponding shard or its storage environment. In this embodiment, user identity, device health status, and real-time geographical location are used as the basis for determining the ZTNA dynamic access policy.

[0041] Furthermore, the requesting entity information is matched and verified against the access policy to determine whether the requesting entity's identity is valid, whether the device status meets the trust requirements, and whether the current access location falls within the preset access range, thus obtaining a zero-trust verification result. If any key verification condition is not met, the verification result is determined to be unsuccessful; if all conditions are met, the verification result is determined to be successful. Simultaneously, by combining the edge node's liveness, abnormality, or security status, the requesting entity's authentication status, device trust status, access source, and the risk score in the shard metadata, risk assessment parameters corresponding to this key recovery request are determined.

[0042] Based on this, a comprehensive analysis of the risk assessment parameters is performed to determine the risk level or risk status corresponding to the current key recovery request, thus obtaining the risk assessment result. For example, when the requesting entity is trustworthy, the device is in normal condition, and the target edge node is operating stably, it can be determined as a low risk; when there is an abnormal access source, abnormal node status, or a high sharding risk score, the corresponding risk level is increased. The obtained risk assessment result is used to dynamically determine the key recovery threshold and trusted time window, enabling the key recovery conditions to be adjusted according to changes in the current network environment and access risks.

[0043] Specifically, refer to Figure 6 As shown, zero-trust policy verification is performed based on the request subject information and access policy, and the verification results are as follows: S321: Extract identity information, device status information, and requested location information based on the request subject information; S322: Determine the corresponding verification conditions based on the access policy; these verification conditions include identity verification conditions, device trust conditions, and location access conditions. S323: Match the identity information, device status information, and requested location information with the corresponding verification conditions to obtain the policy matching result; S324: Determine whether the key recovery request meets the zero-trust access condition based on the policy matching result, and obtain the verification result.

[0044] In this embodiment, upon receiving a key recovery request, user identity information, device status information, and request location information are extracted from the corresponding request subject information. The identity information represents the authenticated identity and corresponding authentication credentials of the current request subject; the device status information represents whether the terminal device initiating the request is in a healthy and trusted state; and the request location information represents the real-time geographical location corresponding to the current access request. Subsequently, zero-trust verification conditions are determined based on the access policy corresponding to the key fragment to be accessed. These verification conditions include identity verification conditions, device trust conditions, and location access conditions.

[0045] The extracted identity information is matched against authentication conditions to determine the validity of the requesting entity's identity and authentication credentials; device status information is matched against device trust conditions to determine whether the requesting device meets preset security requirements; and request location information is matched against location access conditions to determine whether the current access location is within an allowed access area. Based on these matching results, a corresponding policy matching result is generated. When the identity, device, and location conditions all meet the corresponding access policy, the policy matching result is determined to be successful; if any key condition is not met, the corresponding matching item is determined to be unsuccessful.

[0046] The system comprehensively evaluates the matching results of various policies to determine whether the current key recovery request meets the zero-trust access conditions. If all verification results meet the access policy requirements, the zero-trust verification result is deemed successful, and subsequent fragmented access authorization and key recovery processes are allowed. If there are issues such as identity anomalies, untrusted device status, or unsuitable access locations, the verification result is deemed unsuccessful, and the corresponding key fragmented access request is rejected. This method enables dynamic zero-trust verification based on the real-time status of the requesting subject before fragmented access, avoiding unauthorized access caused by relying solely on static identity authentication.

[0047] S4: Generate fragmented access authorization information based on the verification results, and determine the key recovery threshold and trusted time window based on the risk assessment results, and generate key recovery control information; Among them, reference Figure 7 As shown, fragmented access authorization information is generated based on the verification results, and the key recovery threshold and trusted time window are determined based on the risk assessment results, including: S41: In response to the verification result being a verification pass instruction, generate a short-term access token based on the request subject information and use the short-term access token as fragmented access authorization information; S42: Determine the current risk level based on the risk assessment results; S43: Based on the current risk level, initial recovery threshold, and fragment metadata, determine the key recovery threshold and trusted time window; S44: Associate the fragmented access authorization information with the key recovery threshold and trusted time window to generate key recovery control information.

[0048] In this embodiment, when the zero-trust verification result is successful, a short-term access token corresponding to this key recovery request is generated based on the requesting subject information, and this short-term access token is used as shard access authorization information. The short-term access token can be associated with the requesting subject identifier, the target key identifier, the allowed shard range, and the authorization validity period, and is used by the target edge node to verify whether the requesting subject has shard access permissions. To reduce the risk of shard exposure caused by long-term authorization validity, the short-term access token has a short validity period.

[0049] Based on the aforementioned risk assessment results, the current risk level is determined. Using the initial recovery threshold as the basic recovery condition, and combining the current risk level with parameters such as risk score and time decay factor in the shard metadata, the key recovery threshold and trusted time window corresponding to this key recovery are dynamically determined. When the current risk level is low, a relatively low recovery threshold and a longer trusted time window can be used to reduce the number of shard calls and improve recovery efficiency. When the current risk level increases, the key recovery threshold is increased, while the trusted time window is shortened, requiring the requesting entity to acquire more valid shards in a shorter time before key recovery can be completed.

[0050] Finally, the generated fragment access authorization information is associated with the dynamically determined key recovery threshold and trusted time window to form key recovery control information corresponding to this key recovery request. This key recovery control information is used to limit the target key fragments that can be accessed, the number of valid fragments required to complete key recovery, and the time range within which fragment acquisition and reassembly are allowed. It also serves as the control basis for subsequent verification of short-term access tokens by target edge nodes, return of target key fragments, and execution of fragment reassembly in the SGX trusted execution environment, thereby achieving unified control over access authorization, recovery thresholds, and time constraints.

[0051] Specifically, refer to Figure 8 As shown, based on the current risk level, initial recovery threshold, and fragment metadata, the key recovery threshold and trusted time window are determined, including: S431: Determine the corresponding risk adjustment parameters based on the current risk level; S432: Determine the key recovery threshold based on risk adjustment parameters, initial recovery threshold, and preset maximum recovery threshold; S433: Extract the time decay factor from the fragment metadata and determine the time window adjustment parameters based on the current risk level; S434: Adjust the preset time window based on the time decay factor and time window adjustment parameters to obtain a reliable time window.

[0052] In this embodiment, the current risk level is determined based on the aforementioned risk assessment results, and the risk adjustment parameter corresponding to the current risk level is determined according to the preset correspondence between risk levels and risk adjustment parameters. This risk adjustment parameter is used to characterize the degree of adjustment of the current security risk to the key recovery conditions. When the node state is stable, the requesting subject is trustworthy, and there are no obvious attack events, a smaller risk adjustment parameter can be used; when the risk level increases, the risk adjustment parameter is increased accordingly to improve the security requirements of subsequent key recovery conditions.

[0053] Furthermore, based on the initial recovery threshold determined during the target key generation phase, the number of valid shards required for recovery is adjusted in conjunction with risk adjustment parameters, and a preset maximum recovery threshold is used as the upper limit for adjustment to obtain the key recovery threshold corresponding to this key recovery. When the current risk level is low, the key recovery threshold can be made close to the initial recovery threshold to reduce the number of shard calls; when the current risk level is high, the key recovery threshold is increased so that the requesting entity needs to obtain more valid shards to complete the target key recovery, thereby enhancing the recovery security in high-risk scenarios.

[0054] Specifically, the formula for calculating the key recovery threshold is as follows: =[ ]; in, Indicates the dynamic key recovery threshold; Indicates the basic recovery threshold; This represents the risk adjustment factor, used to control the impact of the current risk score on the baseline recovery threshold. This parameter reflects the magnitude of the adjustment of the dynamic threshold as risk changes. The larger the value, the greater the adjustment range of the recovery threshold caused by the same risk change. The default value in this embodiment is 0.5. Indicates the current risk score; This indicates the maximum risk threshold.

[0055] Simultaneously, a time decay factor is extracted from the fragment metadata, and a time window adjustment parameter is determined based on the current risk level. The preset time window is then adjusted based on the time decay factor and the time window adjustment parameter to obtain a trusted time window. In low-risk conditions, a longer trusted time window can be maintained to improve fragment acquisition and reassembly efficiency; as the risk level increases, the trusted time window is shortened, requiring the target key fragment to be acquired and reassembled in a shorter time. The trusted time window can also be bound to the SGX trusted clock for subsequent determination of whether fragment access and reassembly operations are within the valid time range, thereby reducing the risk of long-term fragment exposure.

[0056] Specifically, the formula for calculating the reliable time window is as follows: ; in, Indicates a reliable time window; Indicates the base time window; This represents the time decay coefficient.

[0057] like Figure 9 As shown, Figure 9 This is a flowchart illustrating the collaborative control mechanism of dynamic threshold adjustment and trusted time window. First, a target key is generated in the SGX trusted execution environment. Multiple key fragments are then generated using the Shamir secret sharing algorithm according to a preset number of fragments and an initial recovery threshold. Simultaneously, fragment metadata such as risk scores and time decay factors are configured for each key fragment. Subsequently, the SASE controller acquires information such as the edge node liveness status, network attack events, and the zero-trust score of the fragment request source. It performs a real-time risk assessment of the current key recovery request and dynamically determines the key recovery threshold and trusted time window based on the risk assessment results. When the requesting entity passes ZTNA zero-trust verification and the currently available fragments meet the dynamic recovery conditions, the SASE controller generates corresponding fragment access authorization information to limit the scope and validity period of the fragments allowed for this key recovery.

[0058] In the subsequent fragment aggregation phase, the target key fragment is obtained from the corresponding POP node based on the fragment access authorization information. Within the SGX trusted execution environment, each fragment is verified to ensure it is within a trusted time window and meets integrity requirements. When the number of valid fragments reaches the current key recovery threshold, the Shamir secret sharing algorithm is used for aggregation and reassembly to recover the target key. If a change in risk status is detected during the recovery process, the key recovery threshold and trusted time window can be readjusted, and verification can be performed again. Furthermore, when the risk decreases to a preset security range, the recovery threshold can be reverted to a lower one to improve recovery efficiency. For key fragments in high-risk edge nodes, encrypted backups can be automatically generated and migrated to low-risk areas, thus forming a secure recovery mechanism that combines dynamic thresholds, time constraints, and fragment self-healing.

[0059] S5: Obtain the target key fragment based on the key recovery control information, and perform validity verification and reassembly within the trusted time window to recover the target key; Among them, reference Figure 10 As shown, the target key fragment is obtained based on the key recovery control information, and its validity is verified and reassembled within a trusted time window to recover the target key, including: S51: Based on the key recovery control information, determine the fragment access authorization information, key recovery threshold, and trusted time window; S52: Based on the fragment access authorization information, initiate a fragment acquisition request to the corresponding edge node and acquire the target key fragment; S53: In the SGX trusted execution environment of the edge node, verify the validity of the fragmented access authorization information and the target key fragment; S54: Filter valid key fragments based on a trusted time window and determine whether the number of valid key fragments meets the key recovery threshold; S55: In response to meeting the key recovery threshold, the valid key fragments are aggregated in the SGX Trusted Execution Environment and reassembled using the Shamir Secret Sharing Algorithm to recover the target key.

[0060] In this embodiment, the fragment access authorization information, key recovery threshold, and trusted time window are obtained by parsing the key recovery control information. Combined with the target key identifier and fragment storage record, the corresponding edge node is determined. Subsequently, a fragment retrieval request is initiated to the corresponding edge node, carrying the fragment access authorization information, to obtain the target key fragment. In this embodiment, the user client can initiate fragment retrieval requests to multiple POP nodes, and the corresponding node returns the fragment after verifying the access token.

[0061] Upon receiving a shard acquisition request, each edge node verifies the shard access authorization information within its local SGX trusted execution environment. This includes determining the validity of the short-term access token, the access privileges of the requesting entity, and the match of the target key identifier. If verification is successful, the corresponding target key shard is read, and the shard identifier, shard version, and data integrity are further verified. Abnormal or invalid shards are removed.

[0062] Furthermore, the verified target key fragments are filtered according to the trusted time window, and fragments within the valid time range are identified as valid key fragments, and their number is counted. When the number of valid key fragments does not reach the key recovery threshold, fragments are obtained from other authorized edge nodes; when the number of valid key fragments reaches the key recovery threshold, the key reassembly process begins.

[0063] Finally, the valid key fragments are aggregated within the SGX Trusted Execution Environment and reassembled using the Shamir Secret Sharing Algorithm to recover the target key. The entire fragment aggregation and key reassembly process is completed within SGX protected memory, ensuring that the plaintext of the target key is not exposed to ordinary memory or external storage, thereby improving the security of the key recovery process.

[0064] S6: Based on the availability status of the shards at the edge nodes, perform shard recovery and update the target key and corresponding key shards when the preset rotation conditions are met.

[0065] Among them, reference Figure 11 As shown, shard recovery is performed based on the shard availability status of edge nodes, and the target key and corresponding key shards are updated when preset rotation conditions are met, including: S61: Obtain the fragment availability status of each edge node and determine the failed key fragment; S62: Based on available key fragments and backup nodes, recover failed key fragments and update the corresponding fragment metadata; S63: Based on the preset key rotation period and the current state of the target key, determine whether the preset rotation conditions are met; S64: In response to the satisfaction of the preset rotation conditions, update the target key in the SGX trusted execution environment, regenerate and distribute the corresponding key fragments, and securely erase the original key fragments.

[0066] In this embodiment, the shard availability status of each edge node is periodically acquired, including node online status, shard read status, and shard integrity status. When an edge node is detected to be offline, a shard cannot be read, or integrity verification fails, the corresponding key shard is identified as a failed key shard, and the corresponding shard identifier and failed node information are recorded. Subsequently, shard recovery is performed based on the currently available key shards and preset backup nodes. When the number of valid shards meets the recovery threshold, the corresponding key data can be recovered based on the existing valid shards in the SGX Trusted Execution Environment, and a new shard to replace the failed shard can be regenerated. Alternatively, the corresponding backup shard can be retrieved from the backup node, and the recovered shards can be redistributed to available edge nodes. After recovery is completed, the storage location, node status, and risk information in the corresponding shard metadata are updated synchronously.

[0067] Furthermore, the system determines whether the preset rotation conditions are met based on the preset key rotation period and the current state of the target key. These preset rotation conditions may include situations such as the target key reaching a set usage period or an anomaly occurring in the relevant fragment of the current target key. In this embodiment, the implementation of the master key periodic update can, for example, perform key rotation according to a preset period. If the rotation conditions are not yet met, the current target key and its corresponding key fragment continue to be used; if the preset rotation conditions are met, the subsequent key update process is triggered.

[0068] In response to the fulfillment of preset rotation conditions, a new target key is generated in the SGX Trusted Execution Environment. Based on this new target key, fragmentation and sealing encryption are re-executed to obtain the corresponding new version key fragment. Subsequently, the distribution node is re-determined according to the current SASE edge node status, and the new version key fragment is distributed to the corresponding POP node, updating the relevant fragment metadata and storage records. Once the new version key fragment is stored and confirmed to be usable, the old fragment corresponding to the original target key is securely erased, thus completing the update of the target key and its corresponding key fragment, avoiding the risk of leakage caused by the continued retention of the old fragment.

[0069] Please see Figure 12This application also provides a key fragment dynamic recovery system, the system comprising: The key generation module is used to generate a target key in the SGX Trusted Execution Environment and to perform fragmentation on the target key to obtain multiple key fragments and corresponding fragment metadata. The sharded storage module is used to distribute key shards to the corresponding edge nodes for encrypted storage based on the edge node status and sharded metadata of the SASE network. The verification and evaluation module is used to respond to key recovery requests by performing zero-trust verification and risk assessment based on the request subject information, edge node status, and shard metadata, and to obtain verification results and risk assessment results. The recovery control module is used to generate fragmented access authorization information based on the verification results, and to determine the key recovery threshold and trusted time window based on the risk assessment results, and generate key recovery control information. The key recovery module is used to obtain the target key fragment based on the key recovery control information, and to perform validity verification and reassembly within a trusted time window to recover the target key. The sharding maintenance module is used to restore shards based on the shard availability status of edge nodes, and to update the target key and corresponding key shards when preset rotation conditions are met.

[0070] like Figure 13 As shown, Figure 13 This is an architecture diagram of a key sharding dynamic recovery system based on SASE and SGX. It mainly includes the user side, the SGX trusted execution environment, multiple POP edge nodes in the SASE network, and a blockchain audit layer. The user side initiates key generation or recovery requests; the SGX trusted execution environment completes target key generation, Shamir sharding, shard encryption, and shard recovery and reassembly, ensuring that the target key and related intermediate data are always processed in a protected environment. Multiple POP nodes in the SASE network store corresponding key shards and respond to shard retrieval requests based on shard access authorization information, thereby achieving cross-node, cross-regional distributed storage of key shards.

[0071] During key recovery, shard access authorization information is generated based on zero-trust verification results and risk assessment results, and the key recovery threshold and trusted time window are dynamically determined. Subsequently, a shard acquisition request is initiated to the corresponding POP node, valid key shards that meet the authorization conditions and time constraints are selected, and aggregation and reassembly are completed in the SGX trusted execution environment to recover the target key. The blockchain audit layer records the shard storage location, shard access process, and related audit information to support subsequent shard location verification and access traceability, thus forming a complete secure closed loop for target key generation, sharding, storage, access, and recovery.

[0072] It is understood that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0073] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0074] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0075] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0076] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0077] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0078] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0079] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0080] This application provides a method and system for dynamic key fragmentation recovery. This scheme completes the target key generation and fragmentation process within the SGX Trusted Execution Environment, ensuring the complete key remains in a trusted, isolated environment throughout generation, fragmentation, and recovery, reducing the risk of plaintext key leakage. By combining the operational status and fragmentation metadata of each edge node in the SASE network, different key fragments are distributed and stored on their respective edge nodes, avoiding single points of failure and centralized leakage issues caused by centralized storage of the complete key. For the key recovery process, zero-trust verification and risk assessment are performed based on the requesting subject information, edge node status, and fragmentation metadata. Based on the verification and risk assessment results, fragmentation access authorization information, key recovery thresholds, and trusted time windows are dynamically generated, allowing key recovery conditions to be dynamically adjusted according to the accessing subject and network operational risks, thereby improving the security and controllability of fragmentation access and key reassembly processes. Meanwhile, by validating and reassembling the target key fragments within a trusted time window, and performing fragment recovery in conjunction with the fragment availability status of edge nodes, the key recovery capability can be maintained when some fragments are abnormal, lost, or edge nodes are unavailable. When preset rotation conditions are met, the target key and corresponding key fragments are further updated, reducing the security risks caused by long-term use of fixed keys. This achieves integrated management of key fragment storage, dynamic authorization, secure recovery, anomaly repair, and periodic rotation, thereby improving the security, reliability, and dynamic adaptability of key management in a distributed network environment.

[0081] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0082] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0083] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0084] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0085] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for dynamic recovery of key fragments, characterized in that, The method includes the following steps: A target key is generated in the SGX Trusted Execution Environment, and the target key is fragmented to obtain multiple key fragments and corresponding fragment metadata. Based on the edge node status and fragmented metadata of the SASE network, the key fragments are distributed to the corresponding edge nodes for encrypted storage. In response to a key recovery request, zero-trust verification is performed based on the request subject information, the edge node status, and the shard metadata to obtain verification results, and risk assessment is performed to obtain risk assessment results. Based on the verification results, fragmented access authorization information is generated, and based on the risk assessment results, a key recovery threshold and a trusted time window are determined, and key recovery control information is generated. The target key fragment is obtained based on the key recovery control information, and its validity is verified and reassembled within the trusted time window to recover the target key. Shard recovery is performed based on the shard availability status of edge nodes, and the target key and corresponding key shards are updated when preset rotation conditions are met.

2. The method according to claim 1, characterized in that, The process involves generating a target key within the SGX Trusted Execution Environment and then fragmenting the target key to obtain multiple key fragments and corresponding fragment metadata, including: Generate the target key in the SGX trusted execution environment and determine the number of fragments and the initial recovery threshold; Based on the number of fragments and the initial recovery threshold, the target key is fragmented using the Shamir secret sharing algorithm to obtain multiple initial key fragments. Each of the initial key fragments is sealed and encrypted to obtain multiple key fragments; Based on each key fragment, corresponding fragment metadata is generated; the fragment metadata includes fragment identifier, geolocation tag, access policy, risk score, and time decay factor.

3. The method according to claim 1, characterized in that, The SASE-based edge node status and fragmented metadata, and the distribution of the key fragments to the corresponding edge nodes for encrypted storage, include: Based on the edge node status and the shard metadata, edge nodes in the SASE network are filtered to determine multiple target edge nodes; Based on the geographical location of each target edge node and the fragment metadata, a distribution relationship is established between the key fragment and the target edge node; Based on the distribution relationship, each key fragment is distributed to the corresponding target edge node, and the corresponding fragment storage location is recorded. The key fragment is bound to the hardware fingerprint of the corresponding target edge node, and the key fragment is encrypted and stored through the SGX secure channel.

4. The method according to claim 1, characterized in that, In response to the key recovery request, the system performs zero-trust verification based on the requesting subject information, the edge node status, and the shard metadata to obtain verification results, and performs risk assessment to obtain risk assessment results, including: Obtain the request subject information corresponding to the key recovery request, and extract the access policy and risk score from the fragment metadata; Based on the request subject information and the access policy, a zero-trust policy verification is performed to obtain the verification result; Risk assessment parameters are determined based on the edge node status, the requesting entity information, and the risk score. Risk assessment is performed based on the aforementioned risk assessment parameters to obtain the risk assessment results.

5. The method according to claim 4, characterized in that, The zero-trust policy verification based on the request subject information and the access policy, to obtain the verification result, includes: Based on the request subject information, extract identity information, device status information, and request location information; The corresponding verification conditions are determined based on the access policy; the verification conditions include identity verification conditions, device trust conditions, and location access conditions. The identity information, device status information, and requested location information are matched with the corresponding verification conditions to obtain the strategy matching result; Based on the policy matching result, it is determined whether the key recovery request meets the zero-trust access condition, and the verification result is obtained.

6. The method according to claim 1, characterized in that, The process of generating fragmented access authorization information based on the verification results and determining the key recovery threshold and trusted time window based on the risk assessment results includes: In response to the verification result being a verification pass instruction, a short-term access token is generated based on the request subject information, and the short-term access token is used as fragmented access authorization information; The current risk level is determined based on the risk assessment results; Based on the current risk level, the initial recovery threshold, and the fragment metadata, determine the key recovery threshold and the trusted time window; The fragmented access authorization information is associated with the key recovery threshold and the trusted time window to generate key recovery control information.

7. The method according to claim 6, characterized in that, The process of determining the key recovery threshold and trusted time window based on the current risk level, the initial recovery threshold, and the fragment metadata includes: Determine the corresponding risk adjustment parameters based on the current risk level; The key recovery threshold is determined based on the risk adjustment parameters, the initial recovery threshold, and the preset maximum recovery threshold; Extract the time decay factor from the fragment metadata and determine the time window adjustment parameters based on the current risk level; The preset time window is adjusted based on the time decay factor and the time window adjustment parameters to obtain the reliable time window.

8. The method according to claim 1, characterized in that, The process of obtaining the target key fragment based on the key recovery control information, and performing validity verification and reassembly within the trusted time window to recover the target key includes: Based on the key recovery control information, fragmented access authorization information, key recovery threshold, and trusted time window are determined; Based on the fragmented access authorization information, a fragment acquisition request is initiated to the corresponding edge node, and the target key fragment is obtained; In the SGX trusted execution environment of the edge node, the validity of the fragment access authorization information and the target key fragment is verified; Based on the trusted time window, valid key fragments are filtered, and it is determined whether the number of valid key fragments meets the key recovery threshold. In response to meeting the key recovery threshold, the valid key fragments are aggregated in the SGX Trusted Execution Environment and reassembled using the Shamir Secret Sharing Algorithm to recover the target key.

9. The method according to claim 1, characterized in that, The fragment recovery based on the fragment availability status of edge nodes, and the updating of the target key and corresponding key fragments when preset rotation conditions are met, includes: Obtain the shard availability status of each edge node and identify the failed key shards; Based on available key fragments and backup nodes, the failed key fragments are recovered, and the corresponding fragment metadata is updated; Based on the preset key rotation period and the current state of the target key, determine whether the preset rotation conditions are met; In response to the satisfaction of the preset rotation conditions, the target key is updated in the SGX trusted execution environment, the corresponding key fragment is regenerated and distributed, and the original key fragment is securely erased.

10. A key fragmentation dynamic recovery system, characterized in that, The system includes: The key generation module is used to generate a target key in the SGX trusted execution environment and to perform fragmentation processing on the target key to obtain multiple key fragments and corresponding fragment metadata. The sharded storage module is used to distribute the key shards to the corresponding edge nodes for encrypted storage based on the edge node status and sharded metadata of the SASE network. The verification and evaluation module is used to respond to the key recovery request by performing zero-trust verification and risk assessment based on the request subject information, the edge node status and the shard metadata, and to obtain the verification result and the risk assessment result. The recovery control module is used to generate fragmented access authorization information based on the verification results, and to determine the key recovery threshold and trusted time window based on the risk assessment results, and generate key recovery control information. The key recovery module is used to obtain the target key fragment based on the key recovery control information, and to perform validity verification and reassembly within the trusted time window to recover the target key. The sharding maintenance module is used to restore shards based on the sharding availability status of edge nodes, and to update the target key and corresponding key shards when preset rotation conditions are met.

Images