TWI662825B - Authorized key backup and recovery method of hardware password module - Google Patents

Abstract

The invention relates to an authorized key backup and recovery method for a hardware cryptographic module, which is mainly applied to the hardware cryptographic module to enable the encryption export procedure of the key backup and the decryption import of the key recovery. The procedures need to be authorized by the security administrator of the hardware cryptographic module to reduce the risk of key leakage or decryption, and are compatible with previous key backup and recovery mechanisms.

Description

   Authorized key backup and recovery method of hardware password module   

The invention relates to an authorized key backup and recovery method for a hardware cryptographic module, which is applied to a manager of a hardware cryptographic module. When the key is restored and restored, the security of the hardware cryptographic module is required. The administrator is authorized to reduce the risk of key leakage or decryption, and is compatible with the known key backup and recovery mechanism, which has both system security and convenience.

The present invention relates to an authorized key backup and recovery mechanism for a hardware cryptographic module. The hardware cryptographic module is planned in accordance with the US FIPS 140-2 standard, and is divided into security officers (Security Officer, SO) and security user (USER), the security administrator is responsible for configuring the hardware password module, and the user operates the hardware password module according to the security administrator ’s configuration responsibility, and according to the hardware password module configuration strategy, Can perform security tasks for security administrators or security users.

There is a Master key inside the hardware password module, which is the highest confidential control key. The Master key is stored in a secure area inside the module. Only the security administrator can operate and execute the keys in the secure area. Instruction; the security manager uses a module design strategy to share a group of keys or passcodes. Key sharing is usually stored in the IC card, and the key used by the application system is the Application Key (AP Key). ), Because the AP key can be imported from the outside, under the operation of a malicious user, a known operable AP key is imported from the outside as a key exchange key (KEK) for other AP keys. Export the keys and crack all the keys.

In the prior art of key backup and recovery, the Republic of China Patent Case No. I430643 proposes a secure key recovery system and method that establishes backup and recovery operations through a key recovery center and a management database; and another The Republic of China Patent Case No. 0427087 mentions a system that combines key recovery and public key certificates. Private keys can be recovered by a certificate authority. In US patent 8630421, a database and a higher-level management system are also used to combine multiple levels of gold. The key is processed in the hardware cryptographic module for backup operations. However, in the foregoing prior art, it can be found that although the overall architecture is high in security, the system is large and the communication protocols are complicated, which makes it difficult to implement and difficult to operate the application.

It can be seen that there are still many shortcomings in the above-mentioned customary methods. It is not a good design, and it needs to be improved.

In view of the various shortcomings derived from the above-mentioned conventional methods, the inventor of this case has been eager to improve and innovate. After painstaking research, he finally successfully developed an authorized key backup and recovery mechanism for this hardware cryptographic module. .

The invention proposes an authorized key backup and recovery method for a hardware cryptographic module, the purpose of which is to improve the security of the key backup of the hardware cryptographic module, and the key is exported to the outside of the hardware cryptographic module. The main purpose is to perform key exchange or key backup. The conventional key backup technology is performed using a key encryption output procedure. The master key or an AP key is used in the security area of the hardware cryptographic module. Output the key encryption backup to external storage. If the encrypted AP key is imported from outside, using it as the encryption key may cause the risk of cracking the exported key. Therefore, the present invention The risk of the key being cracked. When the key is backed up, the authorization mechanism of the security manager is added. Only the hardware password module managed by the security manager can recover the key to reduce the risk of key cracking.

The key backup and recovery method of the present invention is flexible and can be applied to the conventional key backup and recovery process. The present invention is based on a security administrator authorization method of a hardware cryptographic module to implement the key backup and recovery mechanism. And the process, it is mainly that when performing key backup, the authorization of the security manager must be obtained. The security manager needs to log in and combine the shared parts (share) to form the security manager key, and the backup is encrypted. The key exchange key (KEK) of the key is an XOR operation performed by the AP key and the security manager key to form an encrypted KEK key. The KEK key is then used to encrypt the AP key to be backed up. Finally, Encrypted output through the Master key into an encapsulated backup key.

When the key is returned, the encapsulated backup key is decrypted by the Master key. The security manager is also required to authorize the AP key and the security manager key to perform an XOR operation to unlock the backup key. , And stored in the security area of the hardware password module.

The present invention provides an authorized key backup and recovery method applied to a hardware cryptographic module. The key recovery and recovery procedure for a hardware cryptographic module includes the authorization of the security manager's M and N Shares. Can effectively reduce the chance of key leakage and avoid the risk of being decrypted.

The technology of the present invention has the following characteristics and advantages:

1. The present invention provides an authorized key backup and recovery method, which can be performed smoothly by the authorization of the security manager, which can reduce the risk of key leakage and decryption, and can be selected to be included in security according to the security level. The administrator's authorization function, combined with the security and convenience of the key backup and recovery mechanism, has advantages over the models provided by products on the market.

2. The present invention provides an authorized key backup and recovery method. The security manager adopts the authorization technology of taking N out of M shares, which can avoid the negligence or fraud of a single security manager. With such circumstances, the security level has been further strengthened.

3. The present invention provides an authorized key backup and recovery method, without the need for additional complicated systems such as a key recovery center, a backup database, or a certificate system. The hardware password module itself can be safely and concisely independent. Performing backup and recovery operations can improve management efficiency.

100‧‧‧hardware password module

101‧‧‧IC card reader module

102‧‧‧ Numeric keyboard input module

103‧‧‧Input Verification Module

104‧‧‧Security Control Module

105‧‧‧Key data import and export module

106‧‧‧Authorized Module

107‧‧‧Key Module

120‧‧‧IC card

140‧‧‧PIN

160‧‧‧I / O interface

S202 ~ S212‧‧‧Method steps

302‧‧‧AP Key

304‧‧‧Master Key

306‧‧‧Security Officer Key MAC

308‧‧‧ Password Seed

S310‧‧‧Key Gen & Write Command

S312‧‧‧MAC & Write Command

S314‧‧‧Key Gen instruction

316‧‧‧Security Administrator Key

S318‧‧‧Divide Shares (2/3)

320‧‧‧Security administrator key holding partial IC card

322‧‧‧Hardware Password Module

324‧‧‧safe area

400‧‧‧hardware password module

401‧‧‧safe area

402‧‧‧Master Key

404‧‧‧AP Key

406‧‧‧AP Key

408‧‧‧Security Officer Key MAC

S410‧‧‧XOR operation

412‧‧‧KEK key

S414‧‧‧Key Encapsulation Operation

418‧‧‧Wrapped Key

420‧‧‧Security administrator key holding partial IC card

S422‧‧‧Combination

424‧‧‧Security Administrator Key

426‧‧‧zero

S430‧‧‧MAC comparison operation

502‧‧‧field

504‧‧‧field

506‧‧‧field

508‧‧‧Hash function

510‧‧‧field

512‧‧‧Master Key

514‧‧‧cryptographic operation

516‧‧‧Wrapped Key

600‧‧‧Hardware Password Module

601‧‧‧safe area

602‧‧‧Master Key

604‧‧‧AP Key

608‧‧‧Security Officer Key MAC

S614‧‧‧Key decapsulation operation

618‧‧‧Wrapped Key

620‧‧‧Security administrator key holding partial IC card

S622‧‧‧Combination

624‧‧‧Security Administrator Key

S630‧‧‧MAC comparison operation

702‧‧‧Wrapped Key

704‧‧‧Master Key

706‧‧‧Decryption operation

708‧‧‧MAC Information

710‧‧‧Hash function

712‧‧‧field

714‧‧‧field

716‧‧‧field

718‧‧‧KEK key

720‧‧‧Decryption operation

722‧‧‧AP Key

S802 ~ S836‧‧‧Method steps

FIG. 1 is a schematic diagram of an exemplary system architecture of the present invention; FIG. 2 is a diagram of the key production and processing steps of a security manager of the present invention; FIG. 3 is a schematic diagram of a procedure of an initial key of a hardware cryptographic module of the present invention; The schematic diagram of the procedure for authorizing the backup key authorized by the security manager of the present invention; FIG. 5 is a schematic diagram of the key encapsulation operation of the present invention; A schematic diagram of the key decapsulation operation; FIG. 8 is an overall flowchart of the authorized key backup and recovery method of the present invention.

In the following, the present invention will be further described with reference to the embodiments and the drawings. The present invention is a method for improving the security of the key backup and recovery procedure of the hardware cryptographic module to ensure the authorized key backup and recovery procedure to ensure The key can only be recovered under the authorization of the security administrator. For a schematic diagram of the exemplary system architecture of the present invention, please refer to FIG. 1. The hardware password module 100 of this embodiment includes seven modules, respectively. For: IC card reader module 101, numeric keypad input module 102, input verification module 103, security control module 104, key data export and import module 105, authorization module 106, key module 107.

The IC card reader module 101 in the hardware password module provides IC card 120 for input, and the numeric keypad input module 102 provides a PIN code 140. The authorization mechanism is performed by the authorization module 106, and The key export and import procedures are performed in the key data export and import module 105; wherein the input verification module 103 is used to receive information read from the IC card 120 and information entered by the PIN code 140, The authorization module 106 is connected to the input verification module 103. The authorization module 106 obtains the authority of the security manager based on the information of the IC card 120 and the PIN code 140. In addition, the key module 107 is used for secure storage. Areas of keys such as AP key, Master key, or security manager's key MAC; and the security control module is connected to the input verification module, key module, and authorization module. The security control module is According to the authorization policy of the security manager, the authorization module is notified to perform authorization, and then key backup and reply are performed.

Please refer to FIG. 2 again, which is a diagram of the key production and processing steps of the security manager, in order: step S202 generates a key seed, step S204 generates the security manager key, and step S206 calculates the security manager The MAC is written into the security zone in step S208, the security manager key is decomposed into three parts in step S210, and the security manager IC card is written in step S212.

Referring again to FIG. 3, which is a schematic diagram of the procedure of the initial key of the hardware cryptographic module. In the hardware cryptographic module 322 of this embodiment, the cryptographic seed 308 is produced through the instruction S310 of Key Gen & Write The key is written into the security area 324, which contains the AP key 302 and the master key 304. In addition, the security seed key 316 is produced by the crypto seed 308 via the Key Gen instruction in step S314, MAC & Write instruction to calculate the MAC (Message Authentication Code) 306 of the security manager key of the security manager key, and then write the security manager key MAC 306 into the security area 324; In this embodiment, the security manager key 316 is divided through the instruction Divide Shares (2/3) of step S318, which is a method of three by two. The key is divided by M and N. The security management officer key 316 is divided into three security management officer key holding parts (Share) and written into the three security management officer key holding part IC cards 320, and any two of them can be combined back. The security officer key 316.

Please refer to FIG. 4 again, which is a schematic diagram of a procedure for authorizing a backup key by a security administrator. In this embodiment, the security administrator of the hardware cryptographic module 400 of the present embodiment holds three IC card keys. Select any two of 420, and then perform step S422 combination to synthesize the security manager key 424. When the authorized key backup method of the present invention is performed, the security manager key 424 will be used and selected keys The XOR operation of step S410 is performed together at 406 to calculate the KEK key 412. If the normal mode is performed, the XOR operation of step S410 is performed at the same time through the zero value 426 and the selection key 406. The selection key 406 is from the AP The one selected from the key 404; finally, the master key 402 is used to perform the key encapsulation operation on the AP key 404 in step S414; and for backup, the MAC comparison operation in step S430 is used to compare with The security manager key MAC 408 is compared. If the MAC (message authentication code) comparison fails, the backup cannot be output. If the comparison is successful, the encapsulated Wrapped key 418 can be output.

Please refer to FIG. 5 again, which is a schematic diagram of a key encapsulation operation. Among them, the key backup in this embodiment records the authorization flag in the Auth_Flag field 502 according to the authorization mode, and in the subsequent field 504 Record the KEK key ID, and then record the backup key encrypted by the KEK key in the subsequent field 506. The three fields pass the hash function 508 together, and then the MAC is recorded in the field 510 to ensure the integrity of the data ; Finally, the entire data is encrypted 514 through the Master key 512, and the final result is an encapsulated Wrapped key 516.

Please refer to FIG. 6 again, which is a schematic diagram of a procedure for authorizing a security administrator to reply to a key. The security administrator of the hardware cryptographic module 600 of this embodiment uses three administrator keys to hold a part of the IC card. Randomly select two from 620 to perform the combination of step S622 to synthesize the management officer key 624. When the key is recovered, the MAC comparison operation of step S630 is first performed to authenticate the operation result with the information of the security management officer key. The calculation result of code 608 is compared. If successful, the input Wrapped key 618 is de-encapsulated through the key of step S614 to calculate the AP key 604 and write it into the secure area 640. However, if the comparison of step S630 fails When the key cannot be recovered.

Referring to FIG. 7, which is a schematic diagram of a key de-encapsulation operation. In this embodiment, the imported Wrapped key 702 is decrypted by the Master key 704 and then the obtained MAC data is first 706 708 performs hash function verification 710, after confirming that the integrity is correct, then calculates the KEK key 718 by using the Auth_Flag in field 712 and the KEK key ID in field 714, and encrypting the preparation of field 716 through decryption operation 720 The key recovery is restored to obtain the AP key 720 and import it into the hardware password module.

Please refer to FIG. 8, which is an overall flowchart of the authorization key backup and recovery method of the present invention. In this embodiment, step S802 is to randomly select two of the three security manager IC cards, and then In step S804, insert the security manager IC card, enter the PIN code in step S806, and verify the PIN code in step S808. If the login fails, go to step S816 to report the error message, and the process ends.

If the login in step S808 is successful, the process proceeds to step S810 to combine the security manager key, followed by step S812 to create the security manager key MAC, and step S814 to compare the security manager key MAC result, and if it fails, proceed to step S816 error message. If the report is successful, the process will continue according to the settings of its management configuration. For example, if it is an authorized process, the process proceeds to step S818 to select the security manager key, and after step S820, the selected key and the security manager key are XORed. It is an unauthorized process, and then proceeds to step S822 to select a zero value, and then performs step S824 to calculate the selection key and the zero value. The steps subsequent to steps S820 and S824 are to create a KEK key for step 826.

Next, if it is in the key backup process, step S828 key encapsulation is performed, that is, the encapsulation operation is performed by using the Master key and the KEK key, and finally enter step S830 to output the backup Wrapped AP key; if it is In the key recovery process, the first step is to enter step S832 to enter the Wrapped AP key. The next step is to perform the key decapsulation operation in step S834, that is, the decapsulation operation is performed using the master key and the KEK key. Step S836 writes the AP key into the secure area.

Through the above-mentioned embodiments and illustrations, it should be understood that the present invention is technically innovative and possesses multiple effects that are inferior to the previous technology. It has fully met the statutory invention patent requirements for novelty and advancement, and filed a patent in accordance with the law. To apply, I urge your office to approve this invention patent application to encourage inventions.

Claims (5)

An authorized key backup and recovery method applied to a hardware password module is to add a Security Office (SO) authorization model when performing key backup and recovery through the hardware password module. The method for increasing the security strength includes the steps of: a. Using a hardware cryptographic module to perform the initial key configuration of the security manager; b. Using an encrypted export procedure authorized by the security manager to perform key backup; c. The decryption and import procedure authorized by the security manager performs key recovery; among them, the initial key configuration of the security manager is to produce the security manager key through the command Key Gen, and to share the key with the Divide Shares command The technology divides the security management officer key into several shares of the security management officer key and writes them into the IC card respectively; the security management officer's authority is authorized by using 3 out of 2 key shares. technology. The authorized key backup and recovery method applied to the hardware cryptographic module as described in item 1 of the scope of the patent application, wherein the encryption export procedure is after the security administrator logs in to obtain the authorization and combines the security administrator's key , And calculate the key exchange key (KEK) with the selected key through XOR operation, and then use the Master key to perform the key encapsulation process to export the encapsulated key to complete the key backup process. As described in item 2 of the scope of the patent application, the authorized key backup and recovery method applied to the hardware cryptographic module, wherein the steps of the key encapsulation process include: encrypting the authorization flag, the ID of the KEK key, and being encrypted The hash value of the backup key is calculated by the hash function, and then the authorization key, the ID of the KEK key, the encrypted backup key, and the hash value are encrypted and packaged as a backup using the master key. Key. The authorized key backup and recovery method applied to the hardware cryptographic module as described in item 1 of the scope of the patent application, wherein the decryption import procedure is after the security administrator logs in to obtain the authorization and combines the security administrator's key Then, the key exchange key (KEK) is calculated by XOR calculation with the selected key, and then the master key is used to perform the key decapsulation process, and the decapsulated key is then decrypted and imported to complete the key recovery process. The authorized key backup and recovery method applied to the hardware cryptographic module as described in item 4 of the scope of the patent application, wherein the steps of the key decapsulation procedure include: using the master key to perform a decryption operation and comparing the MAC hash Value, the authorization flag, the ID of the KEK key, and the encrypted backup key are obtained, and then the KEK decryption reply key is obtained according to the authorization mode.