CN116074049A - Communication method, system and server of trusted computing dual-architecture system - Google Patents
Communication method, system and server of trusted computing dual-architecture system Download PDFInfo
- Publication number
- CN116074049A CN116074049A CN202211644207.3A CN202211644207A CN116074049A CN 116074049 A CN116074049 A CN 116074049A CN 202211644207 A CN202211644207 A CN 202211644207A CN 116074049 A CN116074049 A CN 116074049A
- Authority
- CN
- China
- Prior art keywords
- component
- key
- computing
- random number
- ciphertext
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Storage Device Security (AREA)
Abstract
The invention provides a communication method, a system and a server of a trusted computing dual-architecture system, comprising the following steps: the sending end encrypts data to be sent based on a first secret key and a first encryption algorithm to obtain a ciphertext, and sends the ciphertext to the receiving end; the receiving end decrypts the ciphertext based on the first key and the first encryption algorithm to restore data; when the computing component is a transmitting end, the protecting component is a receiving end; when the protection component is a transmitting end, the calculation component is a receiving end; the first secret key of the protection component is generated by calling the trusted cryptographic module by the protection component to generate a random number and based on the random number and a secret key generation mechanism; the first key of the computing unit is generated by the computing unit based on the random number and the key generation mechanism, and receives the random number sent by the guard unit. The confidentiality and the effectiveness of data transmission between the computing component and the protection component are ensured, the safety communication is realized, and an effective safety support is provided for a trusted computing double-system architecture system.
Description
Technical Field
The present invention relates to the field of information security technologies, and in particular, to a communication method, a system, and a server for a trusted computing dual architecture system.
Background
The credibility 3.0 is active immunity credibility, and is a systematic method for realizing safety credibility, which is provided after long-term research in the field of network space safety in China, and the method is characterized in that the method is active immunity credibility under a double-system architecture, namely the design idea of 'calculation' + 'protection' separation. The method has universality and advancement and can provide effective support for network security in China. For example, a trusted 3.0 dual architecture implementation trusted 3.0 solution is implemented with a BMC (Baseboard Management Controller ). The BMC is used as a protection component of a trusted computing dual-system architecture, the trust chain is constructed to ensure the self trust, and then the active monitoring of the computing component by the protection component realizes the trust, the controllability and the manageability of the system flow.
In terms of the computing mode, after the trusted computing dual-architecture is realized, the safe and trusted system can be separated from the system. Starting from the bottom layer software and hardware, the operating system and the control point of the network, unified management is carried out through the trusted component, and a security management center is constructed. Based on the defense system, the security and credibility strategy of the system is customized according to the application security requirement and the system environment, the application behavior is monitored through the protection component, and corresponding measures are taken for the unreliable behavior according to the strategy to allow the credible behavior.
However, the existing trusted computing dual architecture ignores the security of the communication between the protection component and the computing component, and it is also important how to implement the secure communication between the protection component and the computing component, so that the protection component and the computing component perform secure and efficient data transmission.
Disclosure of Invention
The invention provides a communication method, a communication system and a communication server of a trusted computing dual-architecture system, which are used for realizing safe communication between a protection component and a computing component in the trusted computing dual-architecture system.
The invention provides a communication method of a trusted computing dual-architecture system, which comprises the following steps:
the method comprises the steps that a sending end encrypts data to be sent based on a first secret key and a first encryption algorithm to obtain a ciphertext, and sends the ciphertext to a receiving end;
the receiving end decrypts the ciphertext based on the first secret key and the first encryption algorithm, and restores the data;
when the computing component is the transmitting end, the protecting component is the receiving end; when the protection component is the transmitting end, the calculation component is the receiving end; the first secret key of the guard component is generated by the guard component by calling a trusted cryptographic module to generate a random number and based on the random number and a secret key generation mechanism; the first key of the computing component is generated by the computing component based on the random number and the key generation mechanism, and the random number sent by the guard component is received by the computing component.
According to the communication method of the trusted computing dual-architecture system provided by the invention, the key generation mechanism comprises the following steps:
reading a second key in the configuration file;
calculating a digest value of the random number by using the second key and a second encryption algorithm;
the first key is generated based on the digest value.
According to the communication method of the trusted computing dual-architecture system provided by the invention, the generating the first key based on the digest value comprises the following steps:
acquiring a value of a preset length in the abstract value;
and determining the value of the preset length as the first key.
According to the communication method of the trusted computing dual-architecture system provided by the invention, the second encryption algorithm is an HMAC_SM3 algorithm.
According to the communication method of the trusted computing dual-architecture system provided by the invention, under the condition that the protection component and the computing component are started for the first time, the sending end encrypts data to be sent based on a first key and a first encryption algorithm to obtain ciphertext, and before the ciphertext is sent to the receiving end, the communication method comprises the following steps:
the computing component sends a connection request to the protection component;
the protection component responds to the connection request, calls the trusted cryptographic module to generate the random number, and generates the first key based on the random number and the key generation mechanism;
the protection component sends the random number and the key generation identification to the calculation component;
the computing component generates the first key based on the received random number and the key generation mechanism and returns the key generation identification to the guard component.
According to the communication method of the trusted computing dual-architecture system provided by the invention, the first secret key is updated by the protection component according to the preset time period, and/or the first secret key is updated by the protection component after the protection component is restarted and communication connection is established with the computing component.
According to the communication method of the trusted computing dual-architecture system provided by the invention, the second secret key is updated by the protection component according to the preset time period, and/or the second secret key is updated by the protection component after the second secret key is restarted and communication connection is established with the computing component.
According to the communication method of the trusted computing dual-architecture system provided by the invention, the first encryption algorithm is an SM4 algorithm.
The invention also provides a trusted computing dual architecture system comprising: a computing component and a protective component are provided,
the computing part encrypts first data to be transmitted based on a first secret key and a first encryption algorithm to obtain a first ciphertext, and transmits the first ciphertext to the protecting part; the protection component decrypts the first ciphertext based on the first key and the first encryption algorithm to restore the first data; and/or the number of the groups of groups,
the protection component encrypts second data to be transmitted based on the first key and the first encryption algorithm to obtain second ciphertext, and transmits the second ciphertext to the calculation component; the computing component decrypts the second ciphertext based on the first key and the first encryption algorithm, and restores the second data;
the first secret key of the protection component is generated by the protection component by calling a trusted cryptographic module to generate a random number and based on the random number and a secret key generation mechanism; the first key of the computing component is generated by the computing component based on the random number and the key generation mechanism, and the random number sent by the guard component is received by the computing component.
The invention also provides a server comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing a communication method of a trusted computing dual architecture system as described in any one of the above when executing the program.
According to the communication method, the communication system and the communication server of the trusted computing dual-architecture system, the protection component calls the trusted cryptographic module to generate a random number, the random number is generated based on the random number and the key generation mechanism, the protection component also sends the random number to the computing component, the computing component also generates the same first key based on the random number and the key generation mechanism, when the protection component and the computing component need to transmit data, one party can adopt the first key as a transmitting end to encrypt the data to be transmitted through a first encryption algorithm to obtain a ciphertext, and the other party adopts the same first key as a receiving end to decrypt the ciphertext through the first encryption algorithm to obtain original data. The random number generated by the trusted cryptography module is used for generating the secret key, so that the cryptographic security of the random number is ensured, the confidentiality and the effectiveness of data transmission between the computing component and the protection component are ensured, the secure communication between the computing component and the protection component is realized, and an effective secure support is provided for the trusted computing dual-system architecture system.
Drawings
In order to more clearly illustrate the invention or the technical solutions of the prior art, the following description will briefly explain the drawings used in the embodiments or the description of the prior art, and it is obvious that the drawings in the following description are some embodiments of the invention, and other drawings can be obtained according to the drawings without inventive effort for a person skilled in the art.
FIG. 1 is a schematic diagram of a trusted computing dual architecture system provided by the present invention;
FIG. 2 is a flow chart of a communication method of a trusted computing dual-architecture system according to the present invention;
FIG. 3 is a second flow chart of a communication method of the trusted computing dual-architecture system according to the present invention;
fig. 4 is a schematic structural diagram of a server provided by the present invention.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the present invention more apparent, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings, and it is apparent that the described embodiments are some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
It should be noted that in the description of embodiments of the present invention, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element. The orientation or positional relationship indicated by the terms "upper", "lower", etc. are based on the orientation or positional relationship shown in the drawings, are merely for convenience of description and to simplify the description, and are not indicative or implying that the apparatus or elements in question must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as limiting the present invention. Unless specifically stated or limited otherwise, the terms "mounted," "connected," and "coupled" are to be construed broadly, and may be, for example, fixedly connected, detachably connected, or integrally connected; can be mechanically or electrically connected; can be directly connected or indirectly connected through an intermediate medium, and can be communication between two elements. The specific meaning of the above terms in the present invention can be understood by those of ordinary skill in the art according to the specific circumstances.
The terms "first," "second," and the like in this specification are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged, as appropriate, such that embodiments of the present invention may be implemented in sequences other than those illustrated or described herein, and that the objects identified by "first," "second," etc. are generally of a type, and are not limited to the number of objects, such as the first object may be one or more. In addition, "and/or" indicates at least one of the connected objects, and the character "/", generally indicates that the associated object is an "or" relationship.
The trusted computing dual-architecture system and the communication method of the trusted computing dual-architecture system of the present invention are described below in conjunction with fig. 1-3.
Fig. 1 is a schematic structural diagram of a trusted computing dual-architecture system provided by the present invention, as shown in fig. 1, in the trusted 3.0 technology, the trusted computing dual-architecture system may be applied to a server, and specifically, the trusted computing dual-architecture system includes: the computing component and the protection component are in communication connection, a double-system active control mechanism is formed, and the protection component provides a supporting function for the computing component in an active monitoring mode. Specifically, the guard component is a logically independently operable trusted subsystem, and the computing component is a host information subsystem, including an operating system, applications, and system hardware.
Specifically, the process of realizing secure communication by the trusted computing dual-architecture system provided by the invention is as follows:
(1) In the case that the computing part is a transmitting end and the protecting part is a receiving end:
the computing part encrypts first data to be transmitted based on a first secret key and a first encryption algorithm to obtain a first ciphertext, and transmits the first ciphertext to the protecting part; the guard component decrypts the first ciphertext based on the first key and the first encryption algorithm, recovering the first data.
(2) In the case where the protection component is a transmitting end and the calculation component is a receiving end:
the protection component encrypts second data to be transmitted based on the first key and the first encryption algorithm to obtain second ciphertext, and transmits the second ciphertext to the calculation component; the computing component decrypts the second ciphertext based on the first key and the first encryption algorithm, recovering the second data.
Wherein the first key of the guard component is that the guard component calls a trusted cryptographic module to generate a random number, and generated based on the random number and a key generation mechanism; the first key of the computing component is generated by the computing component based on the random number and the key generation mechanism, and the random number sent by the guard component is received by the computing component.
The trusted computing dual-architecture system provided by the invention can be based on a server platform of a heterogeneous multi-core BMC firmware system, and BMC Soc (protection component) is connected with the server platform (computing component) through PCIe. The BMC Soc and the server platform can construct a pair of virtual network cards based on PCIe, the virtual network card in the BMC Soc is marked as Veth0, the virtual network card in the server platform is marked as Veth1, the pair of virtual network cards can carry out network communication, and the invention can realize safe communication based on the network communication and has universality.
Before describing the communication method of the trusted computing dual-architecture system provided by the invention, a simple description is made on how the BMC Soc (protection component) and the server platform (computing component) establish communication through the virtual network card.
Specifically, performing network configuration on a virtual network card Veth0 in the BMC Soc, modifying a network configuration file in the BMC Soc, and setting an IP address as an IPv4 protocol address; and carrying out network configuration on the virtual network card Veth1 of the server platform, modifying a network configuration file, setting an IP address as an IPv4 protocol address, and simultaneously requiring that the IP address of Veth1 and Veth0 are in the same network segment and have different addresses. Thus, veth0 and Veth1 can be located in the same LAN environment. Based on virtual network cards Veth0 and Veth1, socket communication connection is established between the BMC and the server platform, the BMC deploys software base, and the server platform deploys measurement proxy.
The following describes a communication method of the trusted computing dual-architecture system in detail.
Fig. 2 is a flow chart of a communication method of a trusted computing dual-architecture system provided by the present invention, as shown in fig. 2, where the method specifically includes:
in step 210, the transmitting end encrypts the data to be transmitted based on the first key and the first encryption algorithm to obtain a ciphertext, and transmits the ciphertext to the receiving end.
And 220, the receiving end decrypts the ciphertext based on the first key and the first encryption algorithm to restore the data.
Specifically, when the computing component is the transmitting end, the protecting component is the receiving end; when the protection component is the transmitting end, the calculating component is the receiving end.
Specifically, the first key of the guard component is generated by the guard component by calling a trusted cryptographic module to generate a random number and based on the random number and a key generation mechanism; the first key of the computing component is generated by the computing component based on the random number and the key generation mechanism, and the random number sent by the guard component is received by the computing component.
In one embodiment, the first encryption algorithm is an SM4 algorithm. The credibility 3.0 is active immunity credibility, and is a systematic method for realizing safety credibility, which is provided after long-term research in the field of network space safety in China. The SM4 algorithm is a commercial cryptographic algorithm in China. The SM4 algorithm can meet the national standard specification of the trusted computing technology, can be connected and compatible with the deployment of a third-party software base and a measurement agent, and has universality.
According to the communication method of the trusted computing dual-architecture system, the protection component calls the trusted cryptographic module to generate a random number, the random number is further sent to the computing component by the protection component based on the random number and the key generation mechanism, the computing component also generates the same first key based on the random number and the key generation mechanism, when the protection component and the computing component need to transmit data, one party can encrypt the data to be transmitted by adopting the first key through a first encryption algorithm to obtain a ciphertext by taking the protection component and the computing component as a transmitting end, and the other party can decrypt the ciphertext by adopting the same first key through the first encryption algorithm to obtain original data by taking the protection component and the computing component as a receiving end. The random number generated by the trusted cryptography module is used for generating the secret key, so that the cryptographic security of the random number is ensured, the confidentiality and the effectiveness of data transmission between the computing component and the protection component are ensured, the secure communication between the computing component and the protection component is realized, and an effective secure support is provided for the trusted computing dual-system architecture system. And the transmitting end and the receiving end adopt the same first secret key and a first encryption algorithm to encrypt and decrypt, namely adopt a symmetric encryption algorithm to encrypt and decrypt the transmitted data, thus aiming at the condition that the computing component and the protecting component communicate for a long time, the complexity of encrypting and decrypting the transmitted data can be greatly reduced, and the transmission efficiency is improved.
In one embodiment, the key generation mechanism comprises: reading a second key in the configuration file; calculating a digest value of the random number by using the second key and a second encryption algorithm; the first key is generated based on the digest value.
Specifically, a configuration file (such as a bk_config configuration file) is created at both ends of the protection component and the calculation component, and a second key may be stored in the configuration file, where the second key is used to generate the first key.
The protection component generates a random number by calling a random number interface provided by the trusted cryptography module, reads a second key from the configuration file, calculates a digest value of the random number in a second encryption algorithm by using the second key, and determines the first key based on the digest value.
And the calculating part reads the second key from the configuration file after receiving the same random number sent by the protecting part, calculates the digest value of the random number in the second encryption algorithm by using the second key, and determines the first key based on the digest value.
In one embodiment, the second encryption algorithm is an hmac_sm3 algorithm. The hmac_sm3 algorithm is also an encryption algorithm of the commercial cryptography of China, that is, the digest value of the random number in the hmac_sm3 algorithm is calculated by using the second key.
In one embodiment, the generating the first key based on the digest value includes: obtaining the digest value a value of a preset length; and determining the value of the preset length as the first key.
Specifically, the random number is 32B in length at the digest value of the hmac_sm3 algorithm, and in one example, the first 16B of the digest value is used as the first key.
It should be appreciated that since the protection component sends the random number to the calculation component as a plaintext transmission, the security is lower if the random number is directly used as the first key. In order to further improve the security of the secret key, the method does not directly use the random number as the first secret key, but calculates the digest value of the random number by adopting an HMAC_SM3 algorithm, and selects a value with a preset length from the digest value as the first secret key, so that the security of the secret key is further improved, and the secure communication is realized.
In one embodiment, the configuration file may be encrypted and stored in the protection component or the computing component, and when the configuration file needs to be read, the configuration file is decrypted by using a corresponding encryption algorithm, so as to read the data in the configuration file. In this way, the security and confidentiality of data storage can be further improved.
In one embodiment, the configuration file may be stored encrypted using an SM2 algorithm. Specifically, the SM2 algorithm is also an encryption algorithm of the commercial cryptosystem in China, and is an asymmetric encryption algorithm, that is, a public key is used for encrypting and storing the configuration file, and a private key is used for decrypting when the configuration file is read.
It is to be understood that, because the protection component actively monitors the computing component, in the monitoring process, the communication continuity of the protection component and the computing component is higher, so that the first secret key used by encrypting and decrypting the protection component and the computing component can be continuously used, thereby reducing the complexity of the communication between the protection component and the computing component.
To further increase the security of the communication, in one embodiment, the first key is updated by the guard component according to a preset time period. That is, the first key may be updated periodically. In another embodiment, the first key is updated by the guard component after restarting and establishing a communication connection with the computing component. That is, the first key may be updated each time the guard component, the computing component reboot and the communication connection is established.
It should be appreciated that the two key update mechanisms described above may be used either alone or in combination.
Similarly, in one embodiment, the second key is updated by the guard component according to a preset period of time, and/or the second key is updated by the guard component after restarting and establishing a communication connection with the computing component.
It should be appreciated that when the first key is updated, the guard invokes the trusted cryptography module to generate a new random number, uses the second key to calculate a new digest value of the random number in the HMAC SM3 algorithm, and obtains the new first key based on the new digest value. The guard component may encrypt the new first key using the original first key, the ciphertext is sent to the computing component, and the computing component decrypts the new first key using the original first key.
In one embodiment, the guard component may concurrently transmit the first key update identification to cause the computing component to update the first key in response based on the first key update identification. The first key update identifier may be transmitted in plaintext, or may be encrypted together with the new first key and transmitted in ciphertext.
And if the second key is updated, the protection component can generate a new second key, encrypt the second key by using the first key and send the second key to the calculation component, and the calculation component adopts the first key to decrypt and acquire the new second key.
In one embodiment, the guard component may concurrently transmit the second key update identification to cause the computing component to update the second key in response based on the second key update identification. The second key update identifier may be transmitted in plaintext, or may be encrypted together with the new second key and transmitted in ciphertext.
It will be appreciated that since secure, secure communications have been established between the guard and the computing components, the computing components may obtain updated first and second keys directly from the guard, and the computing components may not need to perform the computing.
When the protection unit and the calculation unit are started for the first time, secure and secret communication is not established yet, that is, only plaintext communication can be adopted, so that the protection unit and the calculation unit are required to calculate the first key by themselves based on a key generation mechanism.
In one embodiment, in case the guard component and the computing component are first started, the second key is imported by the user into the configuration file of the guard component and the configuration file of the computing component, respectively. It will be appreciated that at this point no secure, secret communication has been established yet, and that the second key is manually introduced by the user in order to avoid information leakage.
In one embodiment, when the protection component and the calculation component are started for the first time, before the sending end encrypts the data to be sent based on the first key and the first encryption algorithm to obtain the ciphertext, and sends the ciphertext to the receiving end, the method further includes:
(1) The computing component sends a connection request to the guard component.
Specifically, the computing component may first read the configuration file, and determine whether to start for the first time according to whether the configuration file is empty. If the configuration file is empty, for the first start, the computing component can output a prompt message to prompt the user to import the second key and store the second key into the configuration file, and then the computing component sends a connection request CONNECT_REQ to the protection component; if the configuration file is not empty, the computing component sends a connection request connect_req directly to the guard component for non-first boot.
In one example, the connection request may have a first start flag bit f_s. In one example, f_s=1 represents a first start and f_s=0 represents a non-first start.
(2) The guard component invokes the trusted cryptographic module to generate the random number in response to the connection request and generates the first key based on the random number and the key generation mechanism.
Specifically, after the protection component receives the connect_req request, the first start flag bit f_s may be parsed, if 1, the protection component may output a prompt message, prompt the user to import the same second key, store the same second key in the configuration file, invoke the trusted cryptography module to generate a random number, calculate a digest value of the random number in the hmac_sm3 algorithm using the second key, and determine the first key based on the digest value; if the value is 0, the trusted cryptography module is directly called to generate a random number, the digest value of the random number in the HMAC_SM3 algorithm is calculated by using the second key, and the first key is determined based on the digest value.
(3) The guard component sends the random number and key generation identification to the computing component.
Specifically, the guard component also transmits the generated random number and the key generation identification to the computing component.
(4) The computing component generates the first key based on the received random number and the key generation mechanism and returns the key generation identification to the guard component.
Specifically, the computing component receives the random number and the key generation identifier, uses the second key in the configuration file to calculate the digest value of the random number in the hmac_sm3 algorithm in response to the key generation identifier, determines the first key based on the digest value, and returns the key generation identifier to the guard component, so that the guard component knows that the computing component also generates the first key, and thus, the two parties can perform secure encrypted communication.
Fig. 3 is a second flowchart of a communication method of a trusted computing dual-architecture system provided by the present invention, and fig. 3 illustrates a process of establishing secure communication between a protection component and a computing component after a first start, a process of secure communication between a protection component and a computing component, and a process of updating a first key in an exemplary embodiment.
Fig. 4 illustrates a physical structure diagram of a server, as shown in fig. 4, which may include: processor 410, communication interface (Communications Interface) 420, memory 430 and communication bus 440, wherein processor 410, communication interface 420 and memory 430 communicate with each other via communication bus 440. The processor 410 may invoke logic instructions in the memory 430 to execute a communication method of the trusted computing dual architecture system, where the method includes a transmitting end encrypting data to be transmitted based on a first key and a first encryption algorithm to obtain a ciphertext, and transmitting the ciphertext to a receiving end; the receiving end decrypts the ciphertext based on the first secret key and the first encryption algorithm, and restores the data; when the computing component is the transmitting end, the protecting component is the receiving end; when the protection component is the transmitting end, the calculation component is the receiving end; the first secret key of the guard component is generated by the guard component by calling a trusted cryptographic module to generate a random number and based on the random number and a secret key generation mechanism; the first key of the computing component is generated by the computing component based on the random number and the key generation mechanism, and the random number sent by the guard component is received by the computing component.
Further, the logic instructions in the memory 430 described above may be implemented in the form of software functional units and may be stored in a computer-readable storage medium when sold or used as a stand-alone product. Based on this understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
In another aspect, the present invention further provides a computer program product, where the computer program product includes a computer program, where the computer program can be stored on a non-transitory computer readable storage medium, and when the computer program is executed by a processor, the computer can execute a communication method of the trusted computing dual architecture system provided by the above methods, where the method includes a sending end encrypting data to be sent based on a first key and a first encryption algorithm to obtain ciphertext, and sending the ciphertext to a receiving end; the receiving end decrypts the ciphertext based on the first secret key and the first encryption algorithm, and restores the data; when the computing component is the transmitting end, the protecting component is the receiving end; when the protection component is the transmitting end, the calculation component is the receiving end; the first secret key of the guard component is generated by the guard component by calling a trusted cryptographic module to generate a random number and based on the random number and a secret key generation mechanism; the first key of the computing component is generated by the computing component based on the random number and the key generation mechanism, and the random number sent by the guard component is received by the computing component.
In still another aspect, the present invention further provides a non-transitory computer readable storage medium, on which a computer program is stored, where the computer program is implemented when executed by a processor to perform a communication method of the trusted computing dual architecture system provided by the foregoing methods, where the method includes a transmitting end encrypting data to be transmitted based on a first key and a first encryption algorithm to obtain a ciphertext, and transmitting the ciphertext to a receiving end; the receiving end decrypts the ciphertext based on the first secret key and the first encryption algorithm, and restores the data; when the computing component is the transmitting end, the protecting component is the receiving end; when the protection component is the transmitting end, the calculation component is the receiving end; the first secret key of the guard component is generated by the guard component by calling a trusted cryptographic module to generate a random number and based on the random number and a secret key generation mechanism; the first key of the computing component is generated by the computing component based on the random number and the key generation mechanism, and the random number sent by the guard component is received by the computing component.
The apparatus embodiments described above are merely illustrative, wherein the elements illustrated as separate elements may or may not be physically separate, and the elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art will understand and implement the present invention without undue burden.
From the above description of the embodiments, it will be apparent to those skilled in the art that the embodiments may be implemented by means of software plus necessary general hardware platforms, or of course may be implemented by means of hardware. Based on this understanding, the foregoing technical solution may be embodied essentially or in a part contributing to the prior art in the form of a software product, which may be stored in a computer readable storage medium, such as ROM/RAM, a magnetic disk, an optical disk, etc., including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the method described in the respective embodiments or some parts of the embodiments.
Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present invention, and are not limiting; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims (10)
1. A method of communication for a trusted computing dual architecture system, comprising:
the method comprises the steps that a sending end encrypts data to be sent based on a first secret key and a first encryption algorithm to obtain a ciphertext, and sends the ciphertext to a receiving end;
the receiving end decrypts the ciphertext based on the first secret key and the first encryption algorithm, and restores the data;
when the computing component is the transmitting end, the protecting component is the receiving end; when the protection component is the transmitting end, the calculation component is the receiving end; the first secret key of the guard component is generated by the guard component by calling a trusted cryptographic module to generate a random number and based on the random number and a secret key generation mechanism; the first key of the computing component is generated by the computing component based on the random number and the key generation mechanism, and the random number sent by the guard component is received by the computing component.
2. A method of communicating a trusted computing dual architecture system as claimed in claim 1, wherein said key generation mechanism comprises:
reading a second key in the configuration file;
calculating a digest value of the random number by using the second key and a second encryption algorithm;
the first key is generated based on the digest value.
3. The method of communicating a trusted computing dual architecture system of claim 2, wherein the generating the first key based on the digest value comprises:
acquiring a value of a preset length in the abstract value;
and determining the value of the preset length as the first key.
4. The method of claim 2, wherein the second encryption algorithm is hmac_sm3 algorithm.
5. The communication method of a trusted computing dual-architecture system according to claim 1, wherein, in the case that the protection component and the computing component are started for the first time, before the sending end encrypts the data to be sent based on the first key and the first encryption algorithm to obtain a ciphertext, and sends the ciphertext to the receiving end, the communication method comprises:
the computing component sends a connection request to the protection component;
the protection component responds to the connection request, calls the trusted cryptographic module to generate the random number, and generates the first key based on the random number and the key generation mechanism;
the protection component sends the random number and the key generation identification to the calculation component;
the computing component generates the first key based on the received random number and the key generation mechanism and returns the key generation identification to the guard component.
6. A method of communication of a trusted computing dual architecture system as claimed in claim 1, wherein said first key is updated by said guard according to a preset period of time and/or said first key is updated by said guard after restarting and establishing a communication connection with said computing device.
7. A method of communication of a trusted computing dual architecture system as claimed in claim 2, characterized in that said second key is updated by said guard means according to a preset time period and/or said second key is updated by said guard means after restarting and establishing a communication connection with said computing means.
8. A method of communication of a trusted computing dual-architecture system as claimed in any one of claims 1 to 7, wherein said first encryption algorithm is the SM4 algorithm.
9. A trusted computing dual architecture system, comprising: a computing component and a protective component are provided,
the computing part encrypts first data to be transmitted based on a first secret key and a first encryption algorithm to obtain a first ciphertext, and transmits the first ciphertext to the protecting part; the protection component decrypts the first ciphertext based on the first key and the first encryption algorithm to restore the first data; and/or the number of the groups of groups,
the protection component encrypts second data to be transmitted based on the first key and the first encryption algorithm to obtain second ciphertext, and transmits the second ciphertext to the calculation component; the computing component decrypts the second ciphertext based on the first key and the first encryption algorithm, and restores the second data;
the first secret key of the protection component is generated by the protection component by calling a trusted cryptographic module to generate a random number and based on the random number and a secret key generation mechanism; the first key of the computing component is generated by the computing component based on the random number and the key generation mechanism, and the random number sent by the guard component is received by the computing component.
10. A server comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements a method of communication of a trusted computing dual architecture system as claimed in any one of claims 1 to 8 when the program is executed.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211644207.3A CN116074049A (en) | 2022-12-20 | 2022-12-20 | Communication method, system and server of trusted computing dual-architecture system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211644207.3A CN116074049A (en) | 2022-12-20 | 2022-12-20 | Communication method, system and server of trusted computing dual-architecture system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116074049A true CN116074049A (en) | 2023-05-05 |
Family
ID=86177874
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211644207.3A Pending CN116074049A (en) | 2022-12-20 | 2022-12-20 | Communication method, system and server of trusted computing dual-architecture system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116074049A (en) |
-
2022
- 2022-12-20 CN CN202211644207.3A patent/CN116074049A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10785019B2 (en) | Data transmission method and apparatus | |
| CN113099443B (en) | Equipment authentication method, device, equipment and system | |
| EP3972293B1 (en) | Bluetooth device connection methods and bluetooth devices | |
| JP2016532363A (en) | Adaptive traffic encryption for optical networks | |
| AU1924600A (en) | Public key cryptosystem with roaming user capability | |
| CN111935712A (en) | Data transmission method, system and medium based on NB-IoT communication | |
| CN102685739B (en) | Authentication method and system for Android enterprise applications | |
| US10630466B1 (en) | Apparatus and method for exchanging cryptographic information with reduced overhead and latency | |
| US20220417015A1 (en) | Key update method and related apparatus | |
| JP2016111660A (en) | Authentication server, terminal and authentication method | |
| CN114531239B (en) | Data transmission method and system for multiple encryption keys | |
| CN111079158B (en) | Data storage and reading method and device | |
| JP5102701B2 (en) | Secret key distribution method and secret key distribution system | |
| KR20210126319A (en) | Apparatus and method for managing key | |
| CN107733929B (en) | Authentication method and authentication system | |
| CN114285557B (en) | Communication decryption method, system and device | |
| CN116074049A (en) | Communication method, system and server of trusted computing dual-architecture system | |
| CN114143198B (en) | Firmware upgrading method | |
| TWI761243B (en) | Encryption system and encryption method for group instant massaging | |
| CN113316138B (en) | Application layer encryption implementation method and implementation device thereof | |
| EP2243082A1 (en) | Method and apparatus for authenticating service application processes in high availability clusters | |
| CN116340954B (en) | Data security channel establishment method, system control processor and starting firmware | |
| JP2002247023A (en) | Method for sharing session sharing key, method for certifying network terminal, network, terminal, and repeater | |
| CN111147344B (en) | Virtual private network implementation method, device, equipment and medium | |
| WO2024027602A1 (en) | Global quantum security device, data sending method and data receiving method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |