TW201520821A - Expandable confidential key management system - Google Patents

Abstract

This invention provides an expandable confidential key management system, which proposes an effective and safe key management system implementation architecture by using a master-slave architecture to save keys and confidential data in a hardware password module and distribute derivative keys as the basis for encrypted transmission. The system comprises a central control module and a secondary password module. The central control module manages the authority of the secondary password module, the process for accessing the key and the confidential data, and encryption of saved data. The secondary password module stores the key and the confidential data, so as to eliminate the steps of requiring encrypted storage for placing the data in the database. The secondary password module can be expanded if necessary, and the expandability allows setup of a proper amount of modules according to different system needs, allowing clear division of control and storage to effectively manage the key.

Description

Expandable confidential base code management system

The invention relates to a basic code management system; in particular, to an extensible confidential base code management system, which uses a cryptographic module to construct a master-slave base code storage architecture, and controls the stored base code and confidential data. Use the high security mechanism of the cryptographic module to store data and access the data according to the authority to achieve the purpose of control.

Generally, the storage of confidential information uses software to encrypt confidential information and use software control access rights. This software encryption mechanism shares resources with the access mechanism. In addition to affecting its storage performance, software deployment also allows software deployment. The chances of breaking confidential information are greatly increased. The advanced confidential data storage method uses the hardware password module to encrypt confidential information to improve the problem of encrypting and accessing shared resources. However, due to the storage method, the permission control depends on the storage mode, and the bad permission control. This will lead to a significant increase in the security risks of confidential information.

A similar concept is mentioned in the following prior patents: 20090240956; on the other hand, the application of the cryptographic module for storage mode, due to the above concept, still has the security risk of the theft of confidential information. Similar concepts are mentioned in the following prior patents: 491981, 20080130880.

It can be seen that there are still many shortcomings in the above-mentioned methods of use, which is not a good design, but needs to be improved.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventor of the present invention has improved and innovated, and after years of painstaking research, he finally succeeded in researching and developing this invention.

The invention provides an expandable confidentiality code management system, which can expand the appropriate number of modules according to requirements to make effective use of storage resources, and provide functions of distributed storage but centralized management through a master-slave architecture, and the password module is registered. After being assigned a unique derivative base code, the derived base code is used as an encryption transmission bridge, and this is used as a basis for the authority control to prevent the illegal permission from entering the risk of stealing confidential information.

The invention provides an expandable secret code management system for achieving the above object, which is to store all base codes and confidential data in a secure storage space in the cryptographic module, and to solve the steps of storing data in the database and storing the data in an encrypted manner. The access to the base code and confidential data is carried out through reliable encryption and authentication to achieve the security of accessing and storing confidential information.

The invention is a master-slave architecture using a cryptographic module, and the division of the central control module and the secondary cryptographic module achieves the purpose of effectively managing the base code. The function of the central control module is to control the permissions of the secondary cryptographic module, and decrypt the access base code and confidential information by the derivative base code generated by the secondary cryptographic module registration; The purpose of the cryptographic module is to store the base code and confidential information, to provide a secure storage environment for storing data, to improve the steps required to encrypt the data stored in the database, and the scalability feature enables the storage resources to be effectively utilized.

The group of expandable secret base code management system proposed by the present invention The system includes (1) a central control module and (2) a secondary cryptographic module. The central control module generates a unique derivative through the primary base code of the primary cryptographic module and the identification code of the secondary cryptographic module. The base code is used to derive the base code and confidential information of the secondary cryptographic module by using the derived base code encryption, and only the primary cryptographic module can obtain the derived base code of the secondary cryptographic module, thereby decrypting the encrypted base code. Base code or confidential information to achieve data security.

When the patented technical features provided by the present invention are compared with other conventional technologies, the following advantages are obtained:

1. The present invention can realize the scalability of the cryptographic module, can effectively expand the physical security storage resource, and build a suitable number of modules according to different system requirements, and solve the problem of unnecessary storage resource waste or storage space, and Achieve the advantages of distributed storage of resources but centralized management.

2. The invention can provide the function of the authority control, the central control module allocates the corresponding secondary password module processing requirements according to the client authority, and allocates a unique derivative base code by using the main password module, thereby deriving the base. The code is an encrypted transmission bridge, and this is used as a basis for permission control to prevent the client from using illegal rights to steal confidential information.

3. The base code production, access and use of the present invention are completed in the base code management system, and the steps of storing the data in the database for encryption and storage are solved, and the transmission of the base code is achieved through reliable encryption and authentication to achieve confidentiality. The security of the information.

102‧‧‧Central Control Module

104‧‧‧secondary password module

112‧‧‧Primary password module

202‧‧‧Central Control Module Function

204‧‧‧Secondary password module function

212‧‧‧Main password module function

302‧‧‧Secondary cipher module generates asymmetric base code

304‧‧‧ Secondary password module transmits the secondary public base code to the central control module

306‧‧‧The central control module transmits the main public base code of the primary cryptographic module to the secondary cryptographic module

308‧‧‧The primary cryptographic module generates the primary base code and the identification code and produces a unique derivative base code

310‧‧‧The central control module transmits the identification code and the derived base code of the secondary public base code encrypted and signed in the main password module to the secondary password module.

402‧‧‧Central Control Module generates and transmits index values to secondary cipher modules

404‧‧‧Secondary password module production base code

406‧‧‧ Minor password module transmits the base code identification code and index value of the encrypted signature to the central control module

408‧‧‧The central control module receives and verifies the signature value of the secondary cryptographic module via the primary cryptographic module and decrypts the obtained basecode identification code and index value

410‧‧‧The central control module accesses the base code identification code after confirming the index value

502‧‧‧Central Control Module generates index values

504‧‧‧The central control module transmits the base code identification code and index value to the secondary cipher module encrypted and signed by the derived base code of the primary cryptographic module

506‧‧‧ Minor password module verifies the signature value of the main cryptographic module and decrypts the base code identification code and index value

508‧‧‧ Minor password module obtains the base code corresponding to the base code

510‧‧‧Secondary password module returns the base code and index value of the encrypted signature to the central control module

512‧‧‧The central control module verifies the signature value of the secondary cryptographic module through the primary cryptographic module and decrypts the obtained base code and index value

514‧‧‧The central control module confirms the index value and accesses the base code

The detailed description of the present invention and the accompanying drawings will be further understood, and the technical contents of the present invention and the functions thereof can be further understood. The related drawings are: FIG. 1 is a structural diagram of the scalable confidential code management system of the present invention. .

2 is a schematic diagram of an extensible confidential base code management system of the present invention.

Figure 3 is a flow chart of the registration method of the extensible secret base code management system of the present invention.

4 is a flow chart of a method for manufacturing a base code of an expandable secret base code module of the present invention.

FIG. 5 is a flow chart of a method for accessing a base code by a primary cryptographic module of a scalable cryptographic base module of the present invention.

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The present invention is further described with reference to the accompanying drawings. The present invention is a scalable confidential code management system that provides a secure storage space for a base code and confidential information and assigns a unique derivative base code to the rights control. The confidential information stored in the file is widely used. The code module encrypts the confidential information, but because the storage method is adapted to local conditions, the privilege control depends on the storage mode and the planning and use. Poor privilege control will lead to a significant increase in the security risk of confidential information. The invention provides an efficient and secure storage space and can achieve a good control authority for the base code management system.

Please refer to FIG. 1. FIG. 1 is an expandable confidential base of the present invention. Architecture diagram of the code management system. As shown in FIG. 1, the system of the present invention is divided into two modules: a central control module 102 and a secondary cryptographic module 104. The central control module 102 includes a primary cryptographic module 112 for controlling The secondary password module 104 manages the rights, accesses the base code and the confidential data; the secondary password module 104 is used to store the base code and the confidential information, and the number of the secondary password modules 104 can be expanded as needed. The following describes the generation and use of the base code, the mounting and registration of the secondary cryptographic module 104, the overall architecture identity authentication and encryption process, and the transmission method of the base code.

In the initial stage of system operation, a master is required to be generated by the primary cryptographic module 112. The base code and a set of asymmetric base codes (primary public base code and primary private secret code), the primary base code and the primary private base code are stored in the primary cryptographic module 112, and the primary base code is used to generate the secondary cryptographic module 104. The derived base code is transmitted when the secondary cryptographic module 104 is registered.

Please refer to FIG. 2, which is an expandable confidential base of the present invention. A schematic diagram of the code management system. As shown in FIG. 2, the central control module function 202 manages the rights management of the client's demand command and the secondary password module. The primary password module function 212 generates the primary base code and registers the secondary password module. The derivative base code is generated, and the storage base code encrypted by the secondary cryptographic module is decrypted; the secondary cryptographic module function 204 is for producing and storing the base code and the confidential information, and the purpose of effectively managing the base code is achieved by clear division of labor.

Please refer to FIG. 3, which is an expandable confidential base of the present invention. Flow chart of the registration method of the code management system. As shown in FIG. 3, if there is a method for the password module to be mounted in the confidential base code management system, the secondary cryptographic module generates a set of asymmetric base codes (secondary public base code and secondary privacy). Base code 302, transmitting the secondary public base code to the central control module for registration 304, after receiving the primary password module in the central control module, transmitting the primary public base code to the secondary password module 306, and generating An identification code is used to combine a primary base code of the primary cryptographic module with an identification code of the cryptographic module to generate a corresponding set of derived base codes 308, and each of the derived base codes and each secondary cryptographic module is uniquely identified. The relationship is that the identification code and the derived base code are concatenated with the secondary public base code, and then signed and transmitted to the secondary cipher module 310 by using the primary private base code. After receiving the secondary cryptographic module, the primary public base code verification signature is used to confirm the identity of the primary cryptographic module, and then the secondary private base code is used to decrypt the data content, and the decrypted identification code and the derived base code are stored in the secondary cryptographic module. The derived base code is used to transmit the base code of the encrypted confidential data, and can also be used as a central management module for controlling the authority management of the secondary password module. The above steps complete the registration process of the secondary password module.

When the client logs in via the host, the central control module is used by the client. The secondary cipher module corresponding to the client privilege allocation receives and responds to the client demand instruction, and issues an index. The index is encrypted by the derived base code, and then transmitted to the secondary cipher module by using the primary private base code signature. After the cryptographic module verifies the signature and confirms the identity and decrypts the derived base code, the index is obtained. The purpose of the index is to process the client's request for the login, and the life cycle is terminated until the client completes the demand instruction and logs out. The above steps complete the identity verification mode of the central control module and the secondary password module. The following production base code process and access base code process will use this identity confirmation mode.

Please refer to FIG. 4, which is an expandable confidential base of the present invention. Flow chart of the base code production method of the code module. As shown in Figure 4, in the management system The central control module controls the flow chart of the secondary cipher module production base code. The base code production and storage is limited to the secondary cipher module. When the system receives the request from the client to issue the production base code, The central control module sends an index to the corresponding secondary cipher module 402, requests the production base code, and the base code is stored in the secondary cipher module after the production is completed, and generates a corresponding base code identification code. 404. The base code identification code is concatenated with the index value, encrypted by the derived base code, and returned to the central control module 406 by using the secondary private base code signature. After the signature is confirmed by the primary password module, the identity is decrypted by using the derived base code. The base code identification code and the index value 408 are obtained, and after verifying the index value, the corresponding client backhaul instruction is returned, and the client base code identification code 410 is returned.

Please refer to FIG. 5, which is an expandable confidential base of the present invention. The main cryptographic module of the code module controls the flow chart of the method for accessing the base code of the secondary cryptographic module. As shown in FIG. 5, after the system receives the request for obtaining the base code or the confidential data sent by the client, the primary password module receives the index value 502 sent by the central control module, and serially connects the base code identification code and the index. The value is encrypted by the derived base code and transmitted to the secondary cipher module 504 by using the primary private base code signature. After the secondary cryptographic module is verified and decrypted, the base code identification code and the index value 506 are obtained, and the base corresponding to the base code identification code is obtained. The code 508 encrypts the base code serialized index value with the derived base code and returns the signature to the central control module 510. The primary cryptographic module verifies and decrypts the obtained base code and the index value 512, and obtains the base code after confirming the index value. 514, providing a base code to the client to complete the encryption and decryption, digital signature and verification applications, and complete the process of obtaining the base code.

The above detailed description is directed to one possible embodiment of the present invention. The detailed description is not intended to limit the scope of the invention, and the equivalents and modifications may be included in the scope of the present invention.

In summary, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned effects that are not in the traditional methods of the past. And the progressive statutory invention patent requirements, 提出 apply in accordance with the law, and ask your office to approve the invention patent application, in order to invent invention, to the sense of virtue.

102‧‧‧Central Control Module

104‧‧‧secondary password module

112‧‧‧Primary password module

Claims (12)

An expandable secret base code management system, comprising at least: a secondary password module, mounted on a primary password module, storing a base code and confidential information; and a central control module for controlling the secondary password module Access rights and processes, and access to base code and confidential information; and a primary cryptographic module built into the central control module to construct a master-slave base code storage architecture, control the base code for storage and Confidential information. The scalable confidential code management system according to claim 1, wherein the central control module controls the authority of the secondary cryptographic module, and the corresponding secondary cryptographic module access base is allocated by the central control module. Code and confidential information. The scalable secret code management system according to claim 1, wherein the primary cryptographic module needs to generate a primary base code and an asymmetric base code in an initial operation of the system, and the asymmetric base code system is mainly The primary base code and the primary private base code are used for transmission to the registered secondary cryptographic module for encryption purposes, and the primary private base code is used for receiving data decryption from the secondary cryptographic module. The scalable secret code management system of claim 1, wherein the secondary cryptographic module further comprises a derivative base code. The scalable secret code management system of claim 4, wherein the primary cryptographic module encrypts and decrypts the base code access, and stores the derivative base code of the secondary cryptographic module. . For example, the scalable confidential code management system described in claim 1 of the patent scope, The secondary cryptographic module generates and stores the base code and the confidential information to ensure that the data is stored in a secure storage space within the cryptographic module. An expandable secret base code management method, which at least includes: a. a registration method for establishing an identification relationship between a central control module and a secondary cryptographic module; b. a base code production method; and c. a primary password The module controls the secondary cryptographic module access base code method, and describes the manner of securely accessing the base code in the expandable secret code base system; A method for registering an extensible secret base code module, assigning a unique derivative base code through a primary cryptographic module, using the derived base code as an encrypted transmission bridge, constructing a secure transmission bridge, and using this as a basis for authority control, The steps include at least: a. the secondary cryptographic module generates an asymmetric base code, and the asymmetric base code is a secondary public base code and a secondary private base code, and the secondary public base code is used for transmission to the primary cryptographic module for encryption purposes. The secondary privacy code is used to receive data decryption from the primary cryptographic module. b. The secondary password module transmits the secondary public base code to the primary password module for registration; c. after receiving the public base code, the central control module is stored in the primary password module and transmits the primary disclosure base Code to the secondary password module; d. the primary password module generates a set of identifiers used by the secondary password module; e. the primary password module uses the primary public base code and the secondary password module Knowledge Combining the different codes, generating a corresponding set of derived base codes, and connecting the identification code and the derived base code to the publicized base code for encryption, and then signing and transmitting to the primary private base code And the secondary cryptographic module verifies the signature to confirm the identity, and decrypts the decrypted identification code and the derived base code in the secondary cryptographic module by decrypting the private base code. For example, the method for registering the expandable secret base code module described in claim 7 is wherein the derivative base code is the authority management basis for the central control module to control the secondary cryptographic module. A base code production method for an expandable secret cryptographic module, the base code is generated by the cryptographic module, and the corresponding base code identification code is transmitted to the central control module, and the steps include at least: a. the central control The module sends an index, the index further includes a plurality of corresponding index values, and is transmitted to the corresponding secondary cryptographic module to request the production base code; b. the secondary cryptographic module production base code is stored at the time Requiring a cryptographic module and generating a corresponding base code identification code; c. the base code identification code is concatenated with the index values, encrypted by the derived base code, and the main cipher mode is returned by the private base code signature The central control module confirms the identity by the main cryptographic module verification signature, and decrypts the derived base code to obtain the base code identification code and the index values; and e. the central control module The base code identification code is accessed after confirming the index values. The basis of the expandable confidential password module as described in claim 10 The code production method uses the index value as the code of the current demand, and the central control module receives the return information, confirms that the index value is the same as the demand index value, and confirms the correctness of the received data. The main cryptographic module of the scalable secret code management system controls the secondary cipher module access base code method, and obtains the base code stored in the secondary cipher module through the base code identification code, and the access code is accessed through Deriving the base code encryption, the step further comprises: a. the central control module generates an index value; b. the central control module serially connects the base code identification code and the index value via the primary cryptographic module, The derived base code is encrypted and transmitted to the secondary cipher module by using the primary private base code signature; c. after the secondary cryptographic module verifies the signature to confirm the identity, the derived base code is used to decrypt and obtain the base code identification code and the Index value; d. obtaining the corresponding base code in the secondary cipher module by the base code identification code; e. the base code serially aligning the index value by the derived base code and signing back with the private base code signature The central control module; f. the central control module is verified by the main cryptographic module to verify the identity, and then decrypted by the derived base code to obtain the base code and the index value; and g. the central control The pipe module accesses the base code after confirming the index value.