CN113691530A - Symmetric key generation management system, method, equipment and medium based on SGX - Google Patents
Symmetric key generation management system, method, equipment and medium based on SGX Download PDFInfo
- Publication number
- CN113691530A CN113691530A CN202110973162.3A CN202110973162A CN113691530A CN 113691530 A CN113691530 A CN 113691530A CN 202110973162 A CN202110973162 A CN 202110973162A CN 113691530 A CN113691530 A CN 113691530A
- Authority
- CN
- China
- Prior art keywords
- key
- intelligent equipment
- intelligent
- service
- symmetric key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
Abstract
The invention relates to a symmetric key generation management system, method, equipment and medium based on SGX, wherein the system comprises intelligent equipment and a key server based on SGX technology; the key server comprises an application program module constructed based on an SGX technology, wherein the application program module is used for creating an enclave environment, and root key generation and key dispersion operation are carried out in the enclave environment. Compared with the prior art, the method has high safety, does not need a chip containing an SGX technology at an intelligent equipment end, and has less limitation and lower cost.
Description
Technical Field
The present invention relates to the field of communications security, and in particular, to a symmetric key generation management system, method, device, and medium based on an SGX.
Background
The symmetric encryption algorithm is a commonly used technology in the fields of data protection and communication security, and the generation and management of a symmetric key is an important technical problem in the application of the symmetric encryption algorithm.
When symmetric encryption is used, two parties of data interaction need to hold the same symmetric key K, and the two parties use the symmetric key K to perform data encryption and decryption or identity authentication. If the two parties cannot use the asymmetric session key negotiation algorithm to perform session key (symmetric key) negotiation, a third-party system is required to provide generation and distribution of the symmetric key for the two communication parties.
The asymmetric session key negotiation algorithm refers to an algorithm, such as ECDH, for generating a session key securely in an insecure communication channel by using an asymmetric encryption algorithm by two communication parties. But the session key negotiation algorithm needs both parties to hold asymmetric keys and be in a connected communication state.
At present, in the existing method, a symmetric key is mainly generated by an encryption machine, and an intelligent device obtains a service symmetric key from a key server (or a key system), but hardware of the encryption machine is difficult to store massive keys, so that the number of root keys in a general key library is small, and the root keys need to be introduced into the key server to perform key dispersion to obtain the service symmetric key. In exporting the root key to the key server, there are two processing methods: 1) exporting the root key plaintext to a key server; 2) and an encryption key is given to the encryption machine, the encryption machine encrypts the root key by using the encryption key, and the ciphertext is exported to the key server. The two derivation modes have the risk of secret key leakage, and hackers can obtain the root secret key by intercepting the plaintext of the root secret key or encrypting the plaintext of the secret key, so that the service symmetric secret keys of all intelligent devices are threatened. And performing distributed operation on the root key by using an application program on the key server, wherein the root key can be in a plain text in the memory and is used for distributed operation, and a hacker can acquire the root key by accessing the plain text data in the memory.
Intel Software Guard eXtensions (SGX) is an instruction set extension of an Intel processor, aims to provide a trusted execution environment of a user space by taking hardware security as mandatory guarantee and not depending on the security states of firmware and Software, realizes isolated operation among different programs through a group of new instruction set eXtensions and access control mechanisms, and guarantees confidentiality and integrity of user key codes and data not to be damaged by malicious Software. SGX allows applications to create enclaves, which can be understood as a secure environment for data to run, which we can call a "small black box". The SGX does not protect software to identify or isolate malware present in the system, but instead encapsulates legitimate software operations on sensitive data (e.g., encryption keys, passwords, user data, etc.) in a "small black box" so that malware cannot access the data.
Through retrieval, the chinese invention patent CN109150517A discloses a key security management system and method based on SGX, which uses SGX technology to perform secure storage and secure operation on keys at both the client and the key management server. However, the client software of the invention also needs to use the SGX technology, which belongs to the characteristics of the Intel chip, i.e. the client also needs to use the Intel chip, which limits the carrier used by the client; in the field of the Internet of things, the number of clients is large, and the cost of using an Intel chip is high.
Aiming at the scenes that communication parties negotiate session keys (symmetric keys) and are in a connectionless state under the conditions of no asymmetric encryption algorithm and no asymmetric key, a method and a system for generating and safely storing the symmetric keys for the communication parties are developed, which have high safety, small limitation and low cost and are used for solving the problem of leakage of root keys, and the technical problem to be solved is solved.
Disclosure of Invention
The present invention aims to overcome the above-mentioned drawbacks of the prior art and provide a system, a method, a device and a medium for SGX-based symmetric key generation management with high security, low limitation and low cost.
The purpose of the invention can be realized by the following technical scheme:
according to a first aspect of the present invention, there is provided an SGX-based symmetric key generation management system, which includes a smart device and a key server based on SGX technology; the key server comprises an application program module constructed based on an SGX technology, wherein the application program module is used for creating an enclave environment, and root key generation and key dispersion operation are carried out in the enclave environment.
Preferably, when the key is dispersedly operated, the related code runs in the enclave environment, and neither an external application program nor a hacker application program or an operating system with high priority can access the memory and the application program in the enclave environment.
According to a second aspect of the present invention, there is provided a method based on the above SGX-based symmetric key generation management system, the method including the following steps:
step S1: presetting information in the intelligent equipment and the key server, namely presetting a same encryption key K1 in the intelligent equipment and the key server respectively;
step S2: the intelligent equipment generates a random number R, encrypts the R by using an encryption key K1, and simultaneously adds the R to the unique identification number of the intelligent equipment and sends the unique identification number to the key server;
step S3: after receiving the ciphertext, the secret key server decrypts the ciphertext by using the encryption secret key K1 to obtain an R plaintext;
step S4: the key server uses a root key Kroot to encrypt and hash the unique identification number of the intelligent equipment and R plaintext in an enclave environment to obtain a service symmetric key Ka of the intelligent equipment, safely stores the service symmetric key Ka in the enclave environment, and establishes a binding relationship with the unique identification number of the intelligent equipment;
step S5: the key server encrypts a service symmetric key Ka by using an encryption key K1 in an enclave environment and sends a ciphertext to the intelligent equipment;
step S6: and the intelligent equipment decrypts the ciphertext by using the K1 to obtain a service symmetric key Ka and stores the Ka.
Preferably, the step S1 is specifically: presetting an encryption key K1 in the intelligent equipment, and presetting a same encryption key K1 in the key server; when the key server runs for the first time, an application program constructed based on an SGX technology generates a root key Kroot in an enclave environment, stores the root key Kroot in the environment, and performs key dispersion at the same time, wherein the key dispersion uses the root key and parameters of intelligent equipment as operation factors to perform combination and hash algorithm operation so as to obtain a service symmetric key.
Preferably, the unique identification number in step S2 is an SN number.
Preferably, the service symmetric key Ka of the intelligent device has a validity period, and after the service symmetric key Ka expires, the intelligent device regenerates a new service symmetric key Ka'.
Preferably, after the service symmetric key Ka expires, the intelligent device regenerates a new service symmetric key Ka', which specifically includes the following steps:
step S71: the intelligent equipment generates a new random number R';
step S72: the intelligent equipment encrypts R' by using Ka, and sends the encrypted text of the unique identification number of the intelligent equipment to the key server;
step S73: the key server finds a matched Ka according to the unique identification number of the intelligent equipment, and decrypts by using the Ka to obtain an R' plaintext;
step S74: the key server encrypts and hash-operates the unique identification number of the intelligent equipment and the R ' plaintext by using Ka in an enclave environment to obtain a new service symmetric key Ka ' of the intelligent equipment, and safely stores the symmetric key Ka ' in the enclave environment, and updates the binding relationship with SN;
step S75: the key server encrypts Ka' by using the service symmetric key Ka in the enclave environment and sends the ciphertext to the intelligent equipment;
step S76: and the intelligent equipment decrypts the ciphertext by using the service symmetric key Ka to obtain a new service symmetric key Ka 'and stores the new service symmetric key Ka'.
Preferably, the service symmetric key is used in the following process: the intelligent device which needs the service symmetric key sends the intelligent device parameters to the key server, an application program module in the key server obtains the service symmetric key safely and sends the service symmetric key to the intelligent device, and the process specifically comprises the following steps:
step S81: the intelligent equipment a and b respectively hold respective service symmetric secret keys Ka and Kb; the intelligent device b needs to be connected with the intelligent device a and carries out safe communication;
step S82: the intelligent device b sends the SN numbers of the intelligent devices a and b to the key server, and the key server searches the service symmetric keys Ka and Kb of the intelligent devices a and b in an enclave environment respectively;
step S83: the key server encrypts the Ka by using the Kb and sends the ciphertext to the intelligent device b;
step S84: the intelligent device b decrypts by using the Kb to obtain a Ka plaintext;
step S85: the intelligent device a acquires the Kb plaintext by using the same method as the steps S83-S84;
step S86: the intelligent equipment a and b both have service symmetric keys Ka and Kb;
step S87: and the intelligent devices a and b perform identity authentication and secure communication based on the service symmetric keys Ka and Kb.
According to a third aspect of the invention, there is provided an electronic device comprising a memory having stored thereon a computer program and a processor implementing the method when executing the program.
According to a fourth aspect of the invention, there is provided a computer-readable storage medium, on which a computer program is stored which, when executed by a processor, implements the method.
Compared with the prior art, the invention has the following advantages:
1) has high safety
The key plaintext does not have an enclave security environment and cannot acquire the key from a network attack mode; the secret key operation is carried out in the memory environment protected by the enclave, and the secret key cannot be obtained in a memory attack mode;
2) high cracking difficulty
The validity period can be set for the secret key, the secret key is regenerated after expiration, and the regenerated secret key is protected by using the secret key generated last time, so that the difficulty of secret key leakage and decryption is increased;
3) controllable cost
Compared with the prior art that the SGX technology is used for carrying out safe storage and safe operation on the secret key at the client and the secret key management server, the Intel chip is also used at the client, so that the use carrier of the client is limited; in the field of the Internet of things, the number of clients is large, the cost of using the Intel chip is high, the invention does not need to use the Intel chip containing the SGX technology at the client, the limitation of using a carrier by the client is relaxed, and the cost is relatively controllable.
Drawings
FIG. 1 is a schematic diagram of a system architecture according to the present invention;
FIG. 2 is a diagram of a prior art system architecture;
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, not all, embodiments of the present invention. All other embodiments, which can be obtained by a person skilled in the art without any inventive step based on the embodiments of the present invention, shall fall within the scope of protection of the present invention.
Fig. 2 is a schematic diagram of a system architecture in the prior art. The prior art generates symmetric keys by using an encryption engine, which is a hardware device dedicated to cryptographic algorithms and provides functions such as key generation, key storage, key derivation, and execution of cryptographic algorithms.
The method comprises the following steps that the intelligent equipment obtains a service symmetric key from a key server (or a key system), and the specific process comprises the following steps:
step 101: the intelligent equipment sends the encryption key k1 to the key server through various channels (online or offline);
step 102: the encryption machine sends the root key to the key server from the key library;
step 103; the key server uses the root key and the intelligent equipment parameters to perform key dispersion to obtain a service symmetric key (namely, the root key and the equipment parameters are used as factors to calculate a new key);
step 104: the key server encrypts the distributed business symmetric key by using the encryption key and sends the encrypted ciphertext to the intelligent equipment;
step 105: and the intelligent equipment decrypts the ciphertext by using the encryption key to obtain the service symmetric key.
As described above, in the prior art, since the hardware of the encryption apparatus cannot store a large amount of keys, the number of root keys in the general key library is small, and therefore, the root keys need to be introduced into the key server to obtain the service symmetric keys through key distribution.
In exporting the root key to the key server, there are two processing methods: 1) exporting the root key plaintext to a key server; 2) and an encryption key is given to the encryption machine, the encryption machine encrypts the root key by using the encryption key, and the ciphertext is exported to the key server. The two derivation modes have the risk of secret key leakage, and hackers can obtain the root secret key by intercepting the plaintext of the root secret key or encrypting the plaintext of the secret key, so that the service symmetric secret keys of all intelligent devices are threatened.
And performing distributed operation on the root key by using an application program on the key server, wherein the root key can be in a plain text in the memory and is used for distributed operation, and a hacker can acquire the root key by accessing the plain text data in the memory.
Based on the prior art, the present invention needs to solve the following technical problems:
1) a key generation and dispersion system is built on a key server;
2) ensuring that various keys on the key server cannot be obtained by hackers due to plaintext transmission;
3) the data in the memory cannot be illegally accessed in the operation processes of key generation, dispersion and the like on the key server;
4) through the symmetric secret key distribution capacity of the secret key server, two communication parties can establish a secure communication system based on the symmetric secret key;
5) the symmetric key may expire after a certain time and be regenerated.
Intel Software Guard eXtensions (SGX) is an instruction set extension of an Intel processor, aims to provide a trusted execution environment of a user space by taking hardware security as mandatory guarantee and not depending on the security states of firmware and Software, realizes isolated operation among different programs through a group of new instruction set eXtensions and access control mechanisms, and guarantees confidentiality and integrity of user key codes and data not to be damaged by malicious Software. SGX allows applications to create enclaves, which can be understood as a secure environment for data to run, which we can call a "small black box". The SGX does not protect software to identify or isolate malware present in the system, but instead encapsulates legitimate software operations on sensitive data (e.g., encryption keys, passwords, user data, etc.) in a "small black box" so that malware cannot access the data.
The following describes in detail a symmetric key generation and distribution management method and system based on SGX technology, which is based on a smart device and a key server with an SGX technology chip, with reference to fig. 1.
Deploying a key server of an Intel chip supporting the SGX technology, and installing a Linux or windows operating system; constructing a key management application program based on the SGX; the key management application program realizes the operations of generating a root key, dispersing the key, storing the root key and the like; the intelligent equipment needing the service symmetric key sends the equipment parameters to a key server; and the application program in the key server obtains the service symmetric key safely and sends the service symmetric key to the intelligent equipment.
The method specifically comprises the following steps:
1、SGX
1.1 the key server uses Intel chip with SGX technology;
1.2, constructing an application program on a key server based on an SGX technology;
1.3 the application program creates enclave, and sensitive operations such as root key generation, key dispersion and the like are executed in the enclave;
1.4, generating a random number as a root key, and storing the random number in an environment constructed by enclave for protection;
1.5 when the key is scattered, the related code runs in the enclave environment, and an external application program or a hacker application program or an operating system with high priority cannot access the memory and the application code in the enclave environment.
2. Preset instruction
2.1 presetting an encryption key K1 in the intelligent equipment;
2.2 presetting an identical encryption key K1 in the key server;
2.3 the application program built based on SGX in the key server generates a root key in a safe environment and disperses the key;
2.4, key dispersion is to take a root key and intelligent equipment parameters as operation factors, and carry out combination and hash algorithm operation to obtain a service symmetric key;
2.5 the key server generates a root key Kroot in an enclave environment when running for the first time, wherein the Kroot is stored in the enclave environment;
3. symmetric key generation and distribution process
3.1 an intelligent device a (hereinafter referred to as device a) generates a random number R;
3.2 device a encrypts R using K1 and sends the unique identifier of the device, e.g. SN + R ciphertext, to the key server;
3.3 the key server receives the ciphertext and decrypts the ciphertext by using K1 to obtain R plaintext;
3.4 the secret key server uses Kroot to encrypt and hash the SN number + R plaintext in an enclave environment to obtain a service symmetric secret key Ka of the equipment a, safely stores the symmetric secret key Ka in the enclave environment, and establishes a binding relationship with the SN;
3.5 the key server uses K1 to encrypt Ka in enclave environment and sends the ciphertext to device a;
3.6 the device a decrypts the ciphertext by using the K1 to obtain a service symmetric key Ka and stores the Ka;
3.7 when the key Ka of the device a expires (for example, 6 months), the device a may regenerate a new symmetric key Ka' for the service, and the process is as follows:
3.7.1 device a generates a new random number R';
3.7.2 device a encrypts R' using Ka and sends SN number + ciphertext to the key server;
3.7.3, the key server finds out the matched Ka according to the SN number, and obtains the R' plaintext by using the Ka for decryption;
3.7.4, the secret key server encrypts and hash-operates the SN + R ' plaintext by using Ka in an enclave environment to obtain a new service symmetric secret key Ka ' of the equipment a, and safely stores the symmetric secret key Ka ' in the enclave environment, and updates and binds the relationship with SN;
3.7.5, the key server uses Ka to encrypt Ka' in enclave environment and sends the ciphertext to the device a;
3.7.6, the device a receives the ciphertext and decrypts by Ka to obtain the service symmetric key Ka 'and stores Ka'.
4. Example of service symmetric key usage
4.1 there are two devices a and b, which have their own symmetric keys Ka, Kb;
4.2 if the device b needs to be connected with the device a and carry out safe communication;
4.3 the device b sends the SN numbers of the devices a and b to the key server, and the key server searches the service symmetric keys Ka and Kb of the devices a and b in the enclave environment;
4.4 the key server encrypts Ka using Kb and sends the ciphertext to device b;
4.5 the device b decrypts to obtain Ka plaintext by using Kb;
4.6 the device a obtains Kb by using the same method;
4.7 at this time, the devices a and b both have the keys Ka and Kb at the same time;
4.8 the devices a and b can perform identity authentication and secure communication based on Ka and Kb.
It can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working process of the described module may refer to the corresponding process in the foregoing method embodiment, and is not described herein again.
The electronic device of the present invention includes a Central Processing Unit (CPU) that can perform various appropriate actions and processes according to computer program instructions stored in a Read Only Memory (ROM) or computer program instructions loaded from a storage unit into a Random Access Memory (RAM). In the RAM, various programs and data required for the operation of the device can also be stored. The CPU, ROM, and RAM are connected to each other via a bus. An input/output (I/O) interface is also connected to the bus.
A plurality of components in the device are connected to the I/O interface, including: an input unit such as a keyboard, a mouse, etc.; an output unit such as various types of displays, speakers, and the like; storage units such as magnetic disks, optical disks, and the like; and a communication unit such as a network card, modem, wireless communication transceiver, etc. The communication unit allows the device to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.
The processing unit performs the respective methods and processes described above, such as the methods S1 to S6, S71 to S76, S81 to S87. For example, in some embodiments, the methods S1-S6, S71-S76, S81-S87 may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and/or installed onto the device via ROM and/or the communication unit. When the computer program is loaded into the RAM and executed by the CPU, one or more of the steps of methods S1-S6, S71-S76, S81-S87 described above may be performed. Alternatively, in other embodiments, the CPU may be configured to perform methods S1-S6, S71-S76, S81-S87 in any other suitable manner (e.g., by means of firmware).
The functions described herein above may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a system on a chip (SOC), a load programmable logic device (CPLD), and the like.
Program code for implementing the methods of the present invention may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the program codes, when executed by the processor or controller, cause the functions/operations specified in the flowchart and/or block diagram to be performed. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package partly on the machine and partly on a remote machine or entirely on the remote machine or server.
In the context of the present invention, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
While the invention has been described with reference to specific embodiments, the invention is not limited thereto, and various equivalent modifications and substitutions can be easily made by those skilled in the art within the technical scope of the invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.
Claims (10)
1. A symmetric key generation management system based on SGX is characterized by comprising intelligent equipment and a key server based on SGX technology; the key server comprises an application program module constructed based on an SGX technology, wherein the application program module is used for creating an enclave environment, and root key generation and key dispersion operation are carried out in the enclave environment.
2. The SGX-based symmetric key generation management system according to claim 1, wherein when the key is operated dispersedly, the relevant code runs in an enclave environment, and neither an external application nor a hacked application or an operating system with high priority can access the memory and applications in the enclave environment.
3. A method for a symmetric key generation management system based on SGX technology according to claim 1, characterized in that it comprises the following steps:
step S1: presetting information in the intelligent equipment and the key server, namely presetting a same encryption key K1 in the intelligent equipment and the key server respectively;
step S2: the intelligent equipment generates a random number R, encrypts the R by using an encryption key K1, and simultaneously adds the R to the unique identification number of the intelligent equipment and sends the unique identification number to the key server;
step S3: the secret key server decrypts the ciphertext by using the encryption secret key K1 to obtain an R plaintext after receiving the ciphertext;
step S4: the key server uses a root key Kroot to encrypt and hash the unique identification number of the intelligent equipment and R plaintext in an enclave environment to obtain a service symmetric key Ka of the intelligent equipment, safely stores the service symmetric key Ka in the enclave environment, and establishes a binding relationship with the unique identification number of the intelligent equipment;
step S5: the key server encrypts a service symmetric key Ka by using an encryption key K1 in an enclave environment and sends a ciphertext to the intelligent equipment;
step S6: and the intelligent equipment decrypts the ciphertext by using the K1 to obtain a service symmetric key Ka and stores the Ka.
4. The method according to claim 3, wherein the step S1 is specifically: presetting an encryption key K1 in the intelligent equipment, and presetting a same encryption key K1 in the key server; when the key server runs for the first time, an application program constructed based on an SGX technology generates a root key Kroot in an enclave environment, stores the root key Kroot in the environment, and performs key dispersion at the same time, wherein the key dispersion uses the root key and parameters of intelligent equipment as operation factors to perform combination and hash algorithm operation so as to obtain a service symmetric key.
5. The method according to claim 3, wherein the unique identification number in step S2 is an SN number.
6. The method according to claim 3, wherein the service symmetric key Ka of the smart device has a validity period, and after the service symmetric key Ka expires, the smart device regenerates a new service symmetric key Ka'.
7. The method according to claim 6, wherein after the service symmetric key Ka expires, the process of regenerating a new service symmetric key Ka' by the intelligent device specifically includes the following steps:
step S71: the intelligent equipment generates a new random number R';
step S72: the intelligent equipment encrypts R' by using Ka, and sends the encrypted text of the unique identification number of the intelligent equipment to the key server;
step S73: the key server finds a matched Ka according to the unique identification number of the intelligent equipment, and decrypts by using the Ka to obtain an R' plaintext;
step S74: the key server encrypts and hash-operates the unique identification number of the intelligent equipment and the R ' plaintext by using Ka in an enclave environment to obtain a new service symmetric key Ka ' of the intelligent equipment, and safely stores the symmetric key Ka ' in the enclave environment, and updates the binding relationship with SN;
step S75: the key server encrypts Ka' by using the service symmetric key Ka in the enclave environment and sends the ciphertext to the intelligent equipment;
step S76: and the intelligent equipment decrypts the ciphertext by using the service symmetric key Ka to obtain a new service symmetric key Ka 'and stores the new service symmetric key Ka'.
8. The method of claim 3, wherein the service symmetric key is used by: the intelligent device which needs the service symmetric key sends the intelligent device parameters to the key server, an application program module in the key server obtains the service symmetric key safely and sends the service symmetric key to the intelligent device, and the process specifically comprises the following steps:
step S81: the intelligent equipment a and b respectively hold respective service symmetric secret keys Ka and Kb; the intelligent device b needs to be connected with the intelligent device a and carries out safe communication;
step S82: the intelligent device b sends the SN numbers of the intelligent devices a and b to the key server, and the key server searches the service symmetric keys Ka and Kb of the intelligent devices a and b in an enclave environment respectively;
step S83: the key server encrypts the Ka by using the Kb and sends the ciphertext to the intelligent device b;
step S84: the intelligent device b decrypts by using the Kb to obtain a Ka plaintext;
step S85: the intelligent device a acquires the Kb plaintext by using the same method as the steps S83-S84;
step S86: the intelligent equipment a and b both have service symmetric keys Ka and Kb;
step S87: and the intelligent devices a and b perform identity authentication and secure communication based on the service symmetric keys Ka and Kb.
9. An electronic device comprising a memory and a processor, the memory having stored thereon a computer program, wherein the processor, when executing the program, implements the method of claims 3-8.
10. A computer-readable storage medium, on which a computer program is stored, which program, when being executed by a processor, carries out the method according to any one of claims 3 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110973162.3A CN113691530B (en) | 2021-08-24 | 2021-08-24 | Symmetric key generation management system, method, equipment and medium based on SGX |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110973162.3A CN113691530B (en) | 2021-08-24 | 2021-08-24 | Symmetric key generation management system, method, equipment and medium based on SGX |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113691530A true CN113691530A (en) | 2021-11-23 |
| CN113691530B CN113691530B (en) | 2023-04-07 |
Family
ID=78582006
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110973162.3A Active CN113691530B (en) | 2021-08-24 | 2021-08-24 | Symmetric key generation management system, method, equipment and medium based on SGX |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113691530B (en) |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101005359A (en) * | 2006-01-18 | 2007-07-25 | 华为技术有限公司 | Method and device for realizing safety communication between terminal devices |
| US20120099729A1 (en) * | 2009-06-26 | 2012-04-26 | Tian Tian | Method and system for delaying transmission of media information in internet protocol ( ip) multimedia subsystem |
| CN105307165A (en) * | 2015-10-10 | 2016-02-03 | 中国民生银行股份有限公司 | Communication method based on mobile application, server and client |
| CN105792095A (en) * | 2014-12-23 | 2016-07-20 | 中兴通讯股份有限公司 | Secret key negotiation method and system for MTC (Machine Type Communication) packet communication and network entity |
| CN109150517A (en) * | 2018-09-04 | 2019-01-04 | 大唐高鸿信安（浙江）信息科技有限公司 | Key security management system and method based on SGX |
| CN109981579A (en) * | 2019-02-25 | 2019-07-05 | 北京工业大学 | Hadoop code key management service based on SGX reinforces safely method |
| CN110889696A (en) * | 2019-11-27 | 2020-03-17 | 杭州趣链科技有限公司 | Storage method, device, equipment and medium for alliance block chain secret key based on SGX technology |
| CN112637156A (en) * | 2020-12-14 | 2021-04-09 | 卓尔智联(武汉)研究院有限公司 | Key distribution method, device, computer equipment and storage medium |
-
2021
- 2021-08-24 CN CN202110973162.3A patent/CN113691530B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101005359A (en) * | 2006-01-18 | 2007-07-25 | 华为技术有限公司 | Method and device for realizing safety communication between terminal devices |
| US20120099729A1 (en) * | 2009-06-26 | 2012-04-26 | Tian Tian | Method and system for delaying transmission of media information in internet protocol ( ip) multimedia subsystem |
| CN105792095A (en) * | 2014-12-23 | 2016-07-20 | 中兴通讯股份有限公司 | Secret key negotiation method and system for MTC (Machine Type Communication) packet communication and network entity |
| CN105307165A (en) * | 2015-10-10 | 2016-02-03 | 中国民生银行股份有限公司 | Communication method based on mobile application, server and client |
| CN109150517A (en) * | 2018-09-04 | 2019-01-04 | 大唐高鸿信安（浙江）信息科技有限公司 | Key security management system and method based on SGX |
| CN109981579A (en) * | 2019-02-25 | 2019-07-05 | 北京工业大学 | Hadoop code key management service based on SGX reinforces safely method |
| CN110889696A (en) * | 2019-11-27 | 2020-03-17 | 杭州趣链科技有限公司 | Storage method, device, equipment and medium for alliance block chain secret key based on SGX technology |
| CN112637156A (en) * | 2020-12-14 | 2021-04-09 | 卓尔智联(武汉)研究院有限公司 | Key distribution method, device, computer equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113691530B (en) | 2023-04-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP2973183B1 (en) | Intra-computer protected communications between applications | |
| US9647834B2 (en) | Systems and methods with cryptography and tamper resistance software security | |
| US11316685B1 (en) | Systems and methods for encrypted content management | |
| CN107453880B (en) | Cloud data secure storage method and system | |
| CN110708291B (en) | Data authorization access method, device, medium and electronic equipment in distributed network | |
| JP6476167B2 (en) | Self-authentication device and self-authentication method | |
| CN111191217B (en) | Password management method and related device | |
| CN109450620A (en) | The method and mobile terminal of security application are shared in a kind of mobile terminal | |
| CN113849847A (en) | Method, apparatus and medium for encrypting and decrypting sensitive data | |
| Perwej | The hadoop security in big data: a technological viewpoint and analysis | |
| US10635826B2 (en) | System and method for securing data in a storage medium | |
| CN114942729A (en) | Data safety storage and reading method for computer system | |
| CN113726733B (en) | Encryption intelligent contract privacy protection method based on trusted execution environment | |
| EP3292654B1 (en) | A security approach for storing credentials for offline use and copy-protected vault content in devices | |
| CN112883396B (en) | Trusted cryptographic module security management method and system | |
| CN113722741A (en) | Data encryption method and device and data decryption method and device | |
| CN111901312A (en) | Method, system, equipment and readable storage medium for network access control | |
| CN113691530B (en) | Symmetric key generation management system, method, equipment and medium based on SGX | |
| Kurra et al. | Resilient cloud data storage services | |
| Raza et al. | A secure authentication protocol against the co-located app attack in ble | |
| KR101636802B1 (en) | File management method and system for preventing security incident by portable memory | |
| CN114785566B (en) | Data processing method, device and equipment | |
| CN107862209A (en) | A kind of file encryption-decryption method, mobile terminal and the device with store function | |
| CN110289954B (en) | Key processing method and device | |
| Kim et al. | An integrity-based mechanism for accessing keys in a mobile trusted module |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |