WO2016078382A1 - Hsm加密信息同步实现方法、装置和系统 - Google Patents

Hsm加密信息同步实现方法、装置和系统 Download PDF

Info

Publication number
WO2016078382A1
WO2016078382A1 PCT/CN2015/080179 CN2015080179W WO2016078382A1 WO 2016078382 A1 WO2016078382 A1 WO 2016078382A1 CN 2015080179 W CN2015080179 W CN 2015080179W WO 2016078382 A1 WO2016078382 A1 WO 2016078382A1
Authority
WO
WIPO (PCT)
Prior art keywords
hsm
key
server
source
target
Prior art date
Application number
PCT/CN2015/080179
Other languages
English (en)
French (fr)
Inventor
文金亮
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016078382A1 publication Critical patent/WO2016078382A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/04—Switchboards

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method, an apparatus, and a system for synchronizing an encrypted information of a HSM (Hardware Security Module).
  • HSM Hardware Security Module
  • the key information in the user authentication information in the HLR network element is saved by software encryption.
  • This encryption method easily causes key leakage and cracking of encrypted data, and cannot meet the operator's higher requirements for data security.
  • HSM was introduced to modify the current soft encryption method to hard encryption.
  • HSM is used to protect critical keys and accelerate sensitive protection operations in security applications, and its equipment is certified by the international security organizations FIPS and CC. Compared with software encryption and decryption, HSM hardware encryption and decryption has the following advantages:
  • HSM uses dedicated internal memory to store confidential encryption and decryption keys. Intruders cannot access HSM internal memory.
  • Integrity ensures that the encryption and decryption module is installed on the tamper-resistant HSM.
  • the encryption and decryption module is installed on the tamper-proof HSM and cannot be accessed from outside.
  • HSM provides its own microcontroller and encryption and decryption processor.
  • the encryption and decryption module does not depend on operating system security.
  • HSM provides tamper-resistant space to manage keys. Key generation, key usage, key storage, and key destruction are all done within the HSM, and the keys cannot be accessed externally.
  • the HSM is equipped with a dedicated purpose encryption and decryption processor for all encryption and decryption operations.
  • the HSM key is the basis for HSM hardware encryption and decryption.
  • the key generation is completed by the HSM hardware itself. The user cannot know the specific content of the key, nor can it specify the key for generating a specific content.
  • HLR Home Location Register
  • the operator has high security requirements. When using HSM hardware encryption and decryption, it is necessary to purchase an HSM backup server for key synchronization, which increases the cost;
  • the connection operation between the HSM backup server and the PC server where the existing HSM is located needs to be operated on site and cannot be remotely processed.
  • Embodiments of the present invention provide a method, an apparatus, and a system for implementing HSM encryption information synchronization to solve at least one of the above problems.
  • a method for implementing HSM encryption information synchronization including:
  • the server to which the target HSM belongs generates a key K through the target HSM, and sends the key K to the server to which the source HSM belongs;
  • the server to which the target HSM belongs receives the key ciphertext sent by the server to which the source HSM belongs; the key ciphertext is the key obtained by the source HSM server indicating that the source HSM encrypts each key generated by the source HSM by using the key K.
  • the server to which the target HSM belongs sends the key ciphertext to the target HSM to decrypt the target HSM to obtain the key information of the source HSM.
  • the server to which the target HSM belongs generates the key K by using the target HSM, which specifically includes:
  • the server to which the target HSM belongs obtains the unique identification information of the source HSM, and instructs the target HSM to generate the key K by using the unique identification information of the source HSM and the hardware information of the target HSM.
  • the unique identification information, the key K and/or the key ciphertext of the source HSM are transmitted in the form of a file between the server to which the target HSM belongs and the server to which the source HSM belongs.
  • the unique identifier information of the source HSM includes: authentication information of the source HSM; and the key K is a symmetric key.
  • a method for implementing HSM encryption information synchronization including:
  • the server to which the source HSM belongs receives the key K sent by the server to which the target HSM belongs;
  • the source HSM server indicates that the source HSM encrypts each key generated by the source HSM by using the key K to obtain a key ciphertext
  • the server to which the source HSM belongs sends the key ciphertext to the server to which the target HSM belongs, so that the target HSM decrypts the key information of the source HSM.
  • the method before the server to which the source HSM belongs receives the key K sent by the server to which the target HSM belongs, the method further includes:
  • the server of the source HSM accesses the source HSM, obtains the unique identifier information of the source HSM, and sends the unique identifier information of the source HSM to the server to which the target HSM belongs, so that the server side to which the target HSM belongs generates a key based on the unique identifier information of the source HSM. K.
  • a server in which an HSM is installed, and the server includes:
  • a key generation module configured to generate a key K by the target HSM when the server is a server to which the target HSM belongs, and send the key K to a server to which the source HSM belongs;
  • the ciphertext generating module is configured to: when the server is the server to which the source HSM belongs, instruct the source HSM to encrypt the keys generated by the source HSM by using the key K sent by the server to which the target HSM belongs, to obtain the key ciphertext, and Sending the key ciphertext to the server to which the target HSM belongs;
  • the decryption module is configured to forward the key ciphertext sent by the server to which the source HSM belongs to the target HSM when the server is the server to which the target HSM belongs, so that the target HSM decrypts the key information of the source HSM.
  • the key generation module is configured to obtain the unique identifier information of the source HSM, and instruct the target HSM to use the unique identifier information of the source HSM and the hardware information of the target HSM. Generate key K.
  • the unique identification information, the key K, and/or the key ciphertext of the source HSM are transmitted in the form of a file between the server to which the target HSM belongs and the server to which the source HSM belongs.
  • a system for implementing HSM encryption information synchronization includes: a server to which a source HSM belongs, and a server to which a plurality of target HSMs belong;
  • the server to which the target HSM belongs is configured to generate a key K through the target HSM, and send the key K to the server to which the source HSM belongs; and receive the key ciphertext sent by the server to which the source HSM belongs, and secret the key
  • the text is sent to the target HSM to decrypt the target HSM to obtain the key information of the source HSM;
  • the server to which the source HSM belongs is configured to instruct the source HSM to encrypt each key generated by the source HSM by using the key K to obtain a key ciphertext, and send the key ciphertext to the server to which the target HSM belongs.
  • the server to which the target HSM belongs is set to obtain the unique identification information of the source HSM, and instruct the target HSM to use the unique identifier information of the source HSM and the hardware information of the target HSM. And use the obtained information to generate a key K.
  • the solution of the invention realizes key synchronization between multiple HSM hardwares, which avoids purchasing dedicated backup devices and reduces procurement costs. At the same time, it is convenient to realize remote operation, improve engineering efficiency and reduce maintenance costs.
  • FIG. 1 is a flowchart of a method for synchronizing HSM encryption information according to Embodiment 1 of the present invention
  • FIG. 2 is a flowchart of a method for synchronizing HSM encryption information according to Embodiment 2 of the present invention
  • FIG. 3 is a system architecture diagram of a method applied according to an embodiment of the present invention.
  • FIG. 5 is a structural block diagram of a server according to an embodiment of the present invention.
  • FIG. 6 is a structural block diagram of a system for implementing HSM encryption information synchronization according to an embodiment of the present invention.
  • the present invention provides a method, an apparatus, and a system for synchronizing HSM encryption information, in order to solve the problem of increasing the procurement cost and operation complexity of the existing key synchronization scheme between multiple HSM hardware modules.
  • the technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.
  • the embodiment of the invention provides a method for synchronizing HSM encryption information, which illustrates the synchronization process from the server side to which the target HSM belongs, as shown in FIG. 1 , and includes the following steps:
  • Step S101 the server to which the target HSM belongs generates a key K through the target HSM, and sends the key K to the server to which the source HSM belongs;
  • the server to which the target HSM belongs acquires the unique identification information of the source HSM, and instructs the target HSM to generate the key K by using the unique identification information of the source HSM and the hardware information of the target HSM.
  • the unique identification information of the source HSM is preferably but not limited to the authentication information of the source HSM.
  • Step S102 The server to which the target HSM belongs receives the key ciphertext sent by the server to which the source HSM belongs;
  • the key ciphertext is that the source HSM belongs to the server, and the source HSM encrypts each key generated by the source HSM by using the key K.
  • Step S103 The server to which the target HSM belongs sends the key ciphertext to the target HSM, so that the target HSM decrypts the key information of the source HSM.
  • the unique identification information, the key K and/or the key ciphertext of the source HSM are transmitted in the form of a file between the server to which the target HSM belongs and the server to which the source HSM belongs.
  • the embodiment of the invention provides a method for synchronizing HSM encryption information, which illustrates the synchronization process from the server side to which the source HSM belongs, as shown in FIG. 2, including the following steps:
  • Step S201 the server to which the source HSM belongs receives the key K sent by the server to which the target HSM belongs;
  • the server to which the source HSM belongs Before the server to which the source HSM belongs receives the key K sent by the server to which the target HSM belongs, the server to which the source HSM belongs accesses the source HSM, obtains the unique identification information of the source HSM, and sends the unique identifier information of the source HSM to the target HSM.
  • the server generates the key K based on the unique identification information of the source HSM on the server side to which the target HSM belongs.
  • the unique identification information of the source HSM is preferably but not limited to the authentication information of the source HSM.
  • Step S202 The server to which the source HSM belongs indicates that the source HSM encrypts each key generated by the source HSM by using the key K to obtain a key ciphertext;
  • Step S203 The server to which the source HSM belongs sends the key ciphertext to the server to which the target HSM belongs, so that the target HSM decrypts the key information of the source HSM.
  • the unique identification information of the source HSM, the key K and/or the key ciphertext are transmitted in the form of a file between the server to which the target HSM belongs and the server to which the source HSM belongs.
  • the synchronization method described in this embodiment avoids the procurement of dedicated backup equipment and reduces the procurement cost. At the same time, it is convenient to realize remote operation, improve engineering efficiency and reduce maintenance costs.
  • This embodiment provides a method for synchronizing HSM encryption information, which is based on an open interface provided by an HSM hardware module, and performs key synchronization between HSM hardware through a file.
  • the source HSM is installed in a PC server, hereinafter referred to as the “source HSM server”, and the key synchronization tool is installed in the server; the target HSM is installed in another PC server.
  • the server to which the target HSM belongs a key synchronization tool is also installed in the server.
  • the method in this embodiment specifically includes the following steps:
  • Step 1 The key synchronization tool in the PC server to which the source HSM belongs uses the interface CA_GetTokenCertificates to access the source HSM to obtain the authentication information of the source HSM.
  • Step 2 The key synchronization tool saves the authentication information of the source HSM as a file and transmits it to the PC server to which the target HSM belongs.
  • Step 3 The key synchronization tool in the PC server to which the target HSM belongs uses the interface CA_GenerateCloningKEV to access the target HSM, completes the synchronization operation initialization of the target HSM, and instructs the target HSM to generate a symmetric key using the source HSM authentication information and the target HSM hardware information. .
  • Step 4 The key synchronization tool saves the symmetric key as a file and transmits it to the PC server to which the source HSM belongs.
  • Step 5 The key synchronization tool in the PC server to which the source HSM belongs acquires a handle of all key data of the source HSM, and notifies the source HSM to encrypt each key in the source HSM to obtain a key ciphertext.
  • Step 6 The key synchronization tool saves the encrypted key ciphertext as a file, and after all the keys are processed, transfers the file to the PC server to which the target HSM belongs;
  • Step 7 The key synchronization tool in the PC server to which the target HSM belongs uses the interface CA_CloneAsTarget to access the target HSM, and sends the key ciphertext to the target HSM.
  • the target HSM decrypts the key ciphertext and restores the source HSM key to the target. In HSM.
  • An embodiment of the present invention provides a server, where the HSM is installed in the server, as shown in FIG. 5, including:
  • the key generation module 510 is configured to generate a key K by the target HSM when the server is the server to which the target HSM belongs, and send the key K to the server to which the source HSM belongs;
  • the ciphertext generating module 520 is configured to: when the server is the server to which the source HSM belongs, instruct the source HSM to encrypt each key generated by the source HSM by using the key K sent by the server to which the target HSM belongs, to obtain a key ciphertext, and Sending the key ciphertext to a server to which the target HSM belongs;
  • the decryption module 530 is configured to forward the key ciphertext sent by the server to which the source HSM belongs to the target HSM when the server is the server to which the target HSM belongs, so that the target HSM decrypts the key information of the source HSM.
  • the key generation module 510 is configured to obtain the unique identification information of the source HSM, and instruct the target HSM to generate the key K by using the unique identification information of the source HSM and the hardware information of the target HSM.
  • the unique identification information, the key K and/or the key ciphertext of the source HSM are transmitted in the form of a file between the server to which the target HSM belongs and the server to which the source HSM belongs.
  • the unique identification information of the source HSM is preferably but not limited to the authentication information of the source HSM.
  • the HSM-equipped server described in this embodiment performs function expansion on the original server, and implements key synchronization between multiple HSM hardwares.
  • This synchronization method avoids procurement of dedicated backup devices and reduces procurement costs. At the same time, it is convenient to realize remote operation, improve engineering efficiency and reduce maintenance costs.
  • An embodiment of the present invention provides a system for implementing HSM encryption information synchronization, as shown in FIG. 6, including: a server to which a source HSM belongs, and a server to which a plurality of target HSMs belong;
  • the server to which the target HSM belongs is configured to generate a key K through the target HSM, and send the key K to the server to which the source HSM belongs; and receive the key ciphertext sent by the server to which the source HSM belongs, and secret the key
  • the text is sent to the target HSM to decrypt the target HSM to obtain the key information of the source HSM;
  • the server to which the source HSM belongs is configured to instruct the source HSM to encrypt each key generated by the source HSM by using the key K to obtain a key ciphertext, and send the key ciphertext to the server to which the target HSM belongs.
  • the server to which the target HSM belongs acquires the unique identification information of the source HSM, and instructs the target HSM to utilize the unique identification information of the source HSM and the hardware information of the target HSM, and generates the key K by using the obtained information.
  • the unique identification information of the source HSM is preferably but not limited to the authentication information of the source HSM.
  • the system in this embodiment implements key synchronization between multiple HSM hardwares, which avoids the procurement of dedicated backup devices and reduces procurement costs. At the same time, it is convenient to realize remote operation, improve engineering efficiency and reduce maintenance costs.
  • the method, apparatus, and system for implementing HSM encryption information synchronization provided by the embodiments of the present invention have the following beneficial effects: key synchronization between multiple HSM hardware is implemented, and the synchronization method avoids procurement. Dedicated backup equipment reduces procurement costs. At the same time, it is convenient to realize remote operation, improve engineering efficiency and reduce maintenance costs.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种HSM加密信息同步实现方法、装置和系统，所述方法包括：目标HSM所属服务器通过目标HSM生成密钥K，并将所述密钥K发送至源HSM所属服务器；目标HSM所属服务器接收源HSM所属服务器发送的密钥密文；所述密钥密文为源HSM所属服务器指示源HSM利用所述密钥K对源HSM生成的各密钥进行加密得到的密钥密文；目标HSM所属服务器将所述密钥密文发送至目标HSM，以使目标HSM解密得到源HSM的密钥信息。本发明所述同步方案避免了采购专用的备份设备，降低了采购成本。同时可以方便的实现远程操作，提高工程效率和降低维护成本。

Description

HSM加密信息同步实现方法、装置和系统 技术领域
本发明涉及通信技术领域，尤其涉及一种HSM(Hardware Security Module，硬件安全模块)加密信息同步实现方法、装置和系统。
背景技术
目前HLR网元中对于用户鉴权信息中的关键信息是通过软件加密方式保存的，这种加密方式容易造成密钥的泄漏以及加密数据的破解，无法满足运营商对数据安全性更高的要求，为此，引入了HSM，将目前的软加密方式修改为硬加密方式。
HSM用于在安全应用中保护关键性的密钥并且对敏感保护操作进行加速，其设备通过国际安全组织FIPS和CC的标准认证。HSM硬件加解密相比于软件加解密存在如下优势：
1.内存保护：HSM使用专用的内部内存来保存机密的加解密密钥。入侵者无法访问HSM内部内存。
2.完整性确保：加解密模块安装在防篡改HSM上。
3.反向工程：加解密模块安装在防篡改HSM上，无法从外部访问。
4.依赖操作系统安全性：HSM提供自己的微控制器和加解密处理器。加解密模块不依赖于操作系统安全性。
5.密钥存储：HSM提供防篡改空间来管理密钥。密钥产生、密钥使用、密钥存储和密钥销毁全部在HSM内完成，密钥无法从外部访问。
6.性能：HSM配备专用目的加解密处理器来进行所有加解密操作。
HSM密钥是进行HSM硬件加解密的基础，密钥生成由HSM硬件自身完成，用户无法知悉密钥的具体内容，也无法指定生成某一特定内容的密钥。
在实际工程实施过程中同一个HLR(Home Location Register，归属位置寄存器)局点需要部署多个HSM硬件模块，如果该HLR局点存在容灾局的话，也需要在对应的容灾局点部署HSM硬件模块。用户在访问HSM进行加解密时是随机选择一个可用 的HSM硬件模块的，为了实现同一用户数据在不同的HSM硬件中加解密数据都相同，需要这些HSM硬件中存储的密钥一致。目前的实现方法是：
1.首先选择一个HSM硬件模块来生成用于加解密的密钥数据；
2.将上述生成的密钥数据备份到一个特定的HSM备份服务器中；
3.将HSM备份服务器中的密钥数据恢复到其他HSM模块中。
该方法存在如下两个不足：
1.运营商对安全性要求高，需要使用HSM硬件加解密时，需采购用于密钥同步的HSM备份服务器，增加了成本；
2.执行密钥的同步操作时，涉及到HSM备份服务器与现有HSM所在PC服务器的连接操作，需要现场操作，无法远程处理。
发明内容
本发明实施例提供了一种HSM加密信息同步实现方法、装置和系统，以至少解决上述问题之一。
依据本发明实施例的一个方面，提供了一种HSM加密信息同步实现方法，包括：
目标HSM所属服务器通过目标HSM生成密钥K，并将所述密钥K发送至源HSM所属服务器；
目标HSM所属服务器接收源HSM所属服务器发送的密钥密文；所述密钥密文为源HSM所属服务器指示源HSM利用所述密钥K对源HSM生成的各密钥进行加密得到的密钥密文；
目标HSM所属服务器将所述密钥密文发送至目标HSM，以使目标HSM解密得到源HSM的密钥信息。
可选地，本发明实施例所述方法中，所述目标HSM所属服务器通过目标HSM生成密钥K，具体包括：
所述目标HSM所属服务器获取源HSM的唯一标识信息，并指示目标HSM利用所述源HSM的唯一标识信息和目标HSM的硬件信息，生成密钥K。
可选地，本发明实施例所述方法中，所述源HSM的唯一标识信息、密钥K和/或密钥密文以文件的形式在目标HSM所属服务器和源HSM所属服务器间传递。
可选地，本发明实施例所述方法中，所述源HSM的唯一标识信息包括：源HSM的认证信息；所述密钥K为对称密钥。
依据本发明实施例的另一个方面，提供了一种HSM加密信息同步实现方法，包括：
源HSM所属服务器接收目标HSM所属服务器发送的密钥K；
源HSM所属服务器指示源HSM利用所述密钥K对源HSM生成的各密钥进行加密得到密钥密文；
源HSM所属服务器将所述密钥密文发送至目标HSM所属服务器，以使目标HSM解密得到源HSM的密钥信息。
可选地，本发明实施例所述方法中，源HSM所属服务器接收目标HSM所属服务器发送的密钥K前还包括：
源HSM所属服务器访问源HSM，获取源HSM的唯一标识信息，并将所述源HSM的唯一标识信息发送至目标HSM所属服务器，以使目标HSM所属服务器侧基于源HSM的唯一标识信息生成密钥K。
依据本发明实施例的第三个方面，提供了一种服务器，所述服务器内安装有HSM，所述服务器包括：
密钥生成模块，设置为在所述服务器为目标HSM所属服务器时，通过目标HSM生成密钥K，并将所述密钥K发送至源HSM所属服务器；
密文生成模块，设置为在所述服务器为源HSM所属服务器时，指示源HSM利用目标HSM所属服务器发送的密钥K对源HSM生成的各密钥进行加密得到密钥密文，并将所述密钥密文发送至目标HSM所属服务器；
解密模块，设置为当所述服务器为目标HSM所属服务器时，将源HSM所属服务器发送的密钥密文转发至目标HSM，以使目标HSM解密得到源HSM的密钥信息。
可选地，本发明实施例所述服务器中，所述密钥生成模块，设置为获取源HSM的唯一标识信息，并指示目标HSM利用所述源HSM的唯一标识信息和目标HSM的硬件信息，生成密钥K。
可选地，本发明实施例所述服务器中，所述源HSM的唯一标识信息、密钥K和/或密钥密文以文件的形式在目标HSM所属服务器和源HSM所属服务器间传递。
依据本发明实施例的第四个方面，提供一种HSM加密信息同步实现系统，包括：源HSM所属服务器，以及若干目标HSM所属服务器；
所述目标HSM所属服务器，设置为通过目标HSM生成密钥K，并将所述密钥K发送至源HSM所属服务器；以及接收源HSM所属服务器发送的密钥密文，将所述密钥密文发送至目标HSM，以使目标HSM解密得到源HSM的密钥信息；
所述源HSM所属服务器，设置为指示源HSM利用所述密钥K对源HSM生成的各密钥进行加密得到密钥密文，并将所述密钥密文发送至目标HSM所属服务器。
可选地，本发明实施例所述系统中，所述目标HSM所属服务器，设置为获取源HSM的唯一标识信息，并指示目标HSM利用所述源HSM的唯一标识信息和目标HSM的硬件信息，并利用获取的信息生成密钥K。
本发明实施例的有益效果如下：
本发明所述方案实现了多个HSM硬件之间的密钥同步，该同步方式避免了采购专用的备份设备，降低了采购成本。同时可以方便的实现远程操作，提高工程效率和降低维护成本。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例一提供的HSM加密信息同步实现方法的流程图；
图2为本发明实施例二提供的HSM加密信息同步实现方法的流程图；
图3为本发明实施例所述方法应用的系统架构图；
图4为本发明实施例实现密钥同步的具体协作流程图；
图5为本发明实施例提供的一种服务器的结构框图；
图6为本发明实施例提供的HSM加密信息同步实现系统的结构框图。
具体实施方式
针对已有的多个HSM硬件模块之间的密钥同步方案存在增加运营商采购成本和操作复杂性的问题，本发明提供一种HSM加密信息同步实现方法、装置和系统。下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
实施例一
本发明实施例提供一种HSM加密信息同步实现方法，该方法从目标HSM所属服务器侧阐述同步过程，如图1所示，包括如下步骤：
步骤S101，目标HSM所属服务器通过目标HSM生成密钥K，并将所述密钥K发送至源HSM所属服务器；
优选地，本实施例中，目标HSM所属服务器获取源HSM的唯一标识信息，并指示目标HSM利用所述源HSM的唯一标识信息和目标HSM的硬件信息，生成密钥K。
其中，源HSM的唯一标识信息优选但不限于为源HSM的认证信息。
步骤S102，目标HSM所属服务器接收源HSM所属服务器发送的密钥密文；所述密钥密文为源HSM所属服务器指示源HSM利用所述密钥K对源HSM生成的各密钥进行加密得到的密钥密文；
步骤S103，目标HSM所属服务器将所述密钥密文发送至目标HSM，以使目标HSM解密得到源HSM的密钥信息。
优选地，本实施例中，源HSM的唯一标识信息、密钥K和/或密钥密文以文件的形式在目标HSM所属服务器和源HSM所属服务器间传递。
实施例二
本发明实施例提供一种HSM加密信息同步实现方法，该方法从源HSM所属服务器侧阐述同步过程，如图2所示，包括如下步骤：
步骤S201，源HSM所属服务器接收目标HSM所属服务器发送的密钥K；
优选地，源HSM所属服务器接收目标HSM所属服务器发送的密钥K前，源HSM所属服务器访问源HSM，获取源HSM的唯一标识信息，并将所述源HSM的唯一标识信息发送至目标HSM所属服务器，以使目标HSM所属服务器侧基于源HSM的唯一标识信息生成密钥K。
其中，源HSM的唯一标识信息优选但不限于为源HSM的认证信息。
步骤S202，源HSM所属服务器指示源HSM利用所述密钥K对源HSM生成的各密钥进行加密得到密钥密文；
步骤S203，源HSM所属服务器将所述密钥密文发送至目标HSM所属服务器，以使目标HSM解密得到源HSM的密钥信息。
本实施例所述方法中，源HSM的唯一标识信息、密钥K和/或密钥密文以文件的形式在目标HSM所属服务器和源HSM所属服务器间传递。
综上所述，可知，本实施例所述的同步方式避免了采购专用的备份设备，降低了采购成本。同时可以方便的实现远程操作，提高工程效率和降低维护成本。
为了更清楚的阐述本发明，下面结合图3～4给出本发明一个较佳的实施例，并结合对实施例的描述，进一步给出本发明的技术细节，使其能够更好地说明本发明提供的方法的具体实现过程。
本实施例提供一种HSM加密信息同步实现方法，该方法基于HSM硬件模块提供的开放接口，通过文件的方式来进行HSM硬件之间的密钥同步。如图3所示，本实施例中，源HSM安装在一台PC服务器中，以下简称“源HSM所属服务器”，该服务器内安装有密钥同步工具；目标HSM安装在另外一个PC服务器中，以下简称“目标HSM所属服务器”，该服务器内也安装有密钥同步工具。
如图4所示，本实施例所述方法具体包括如下步骤：
步骤1：源HSM所属PC服务器中的密钥同步工具使用接口CA_GetTokenCertificates访问源HSM，获取源HSM的认证信息。
步骤2：密钥同步工具将源HSM的认证信息保存为文件，传送到目标HSM所属PC服务器中。
步骤3：目标HSM所属PC服务器中的密钥同步工具使用接口CA_GenerateCloningKEV访问目标HSM，完成目标HSM的同步操作初始化，并指示目标HSM使用源HSM的认证信息和目标HSM的硬件信息生成一个对称密钥。
步骤4：密钥同步工具将该对称密钥保存为文件，传送到源HSM所属PC服务器中。
步骤5：源HSM所属PC服务器中的密钥同步工具获取源HSM的所有密钥数据的句柄，并通知源HSM对源HSM中每个密钥进行加密，得到密钥密文。
步骤6：密钥同步工具将加密得到的密钥密文保存为文件，待所有密钥处理完后将文件传送到目标HSM所属PC服务器中；
步骤7：目标HSM所属PC服务器中的密钥同步工具使用接口CA_CloneAsTarget访问目标HSM，将密钥密文发送给目标HSM，由目标HSM对密钥密文进行解密，恢复源HSM的密钥到目标HSM中。
实施例三
本发明实施例提供一种服务器，所述服务器内安装有HSM，如图5所示，包括：
密钥生成模块510，设置为在所述服务器为目标HSM所属服务器时，通过目标HSM生成密钥K，并将所述密钥K发送至源HSM所属服务器；
密文生成模块520，设置为在所述服务器为源HSM所属服务器时，指示源HSM利用目标HSM所属服务器发送的密钥K对源HSM生成的各密钥进行加密得到密钥密文，并将所述密钥密文发送至目标HSM所属服务器；
解密模块530，设置为当所述服务器为目标HSM所属服务器时，将源HSM所属服务器发送的密钥密文转发至目标HSM，以使目标HSM解密得到源HSM的密钥信息。
优选地，本实施例中，密钥生成模块510，设置为获取源HSM的唯一标识信息，并指示目标HSM利用所述源HSM的唯一标识信息和目标HSM的硬件信息，生成密钥K。
优选地，本实施例中，源HSM的唯一标识信息、密钥K和/或密钥密文以文件的形式在目标HSM所属服务器和源HSM所属服务器间传递。
其中，源HSM的唯一标识信息优选但不限于为源HSM的认证信息。
本实施例所述的安装有HSM的服务器对原有服务器做了功能扩展，实现了多个HSM硬件之间的密钥同步，该同步方式避免了采购专用的备份设备，降低了采购成本。同时可以方便的实现远程操作，提高工程效率和降低维护成本。
实施例四
本发明实施例提供一种HSM加密信息同步实现系统，如图6所示，包括：源HSM所属服务器，以及若干目标HSM所属服务器；
所述目标HSM所属服务器，设置为通过目标HSM生成密钥K，并将所述密钥K发送至源HSM所属服务器；以及接收源HSM所属服务器发送的密钥密文，将所述密钥密文发送至目标HSM，以使目标HSM解密得到源HSM的密钥信息；
所述源HSM所属服务器，设置为指示源HSM利用所述密钥K对源HSM生成的各密钥进行加密得到密钥密文，并将所述密钥密文发送至目标HSM所属服务器。
优选地，目标HSM所属服务器获取源HSM的唯一标识信息，并指示目标HSM利用所述源HSM的唯一标识信息和目标HSM的硬件信息，并利用获取的信息生成密钥K。
其中，源HSM的唯一标识信息优选但不限于为源HSM的认证信息。
本实施例所述系统实现了多个HSM硬件之间的密钥同步，该同步方式避免了采购专用的备份设备，降低了采购成本。同时可以方便的实现远程操作，提高工程效率和降低维护成本。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。
工业实用性
如上所述，本发明实施例提供的一种HSM加密信息同步实现方法、装置和系统具有以下有益效果：实现了多个HSM硬件之间的密钥同步，该同步方式避免了采购 专用的备份设备，降低了采购成本。同时可以方便的实现远程操作，提高工程效率和降低维护成本。

Claims (10)

  1. 一种硬件安全模块HSM加密信息同步实现方法，包括：
    目标HSM所属服务器通过目标HSM生成密钥K，并将所述密钥K发送至源HSM所属服务器；
    目标HSM所属服务器接收源HSM所属服务器发送的密钥密文；所述密钥密文为源HSM所属服务器指示源HSM利用所述密钥K对源HSM生成的各密钥进行加密得到的密钥密文；
    目标HSM所属服务器将所述密钥密文发送至目标HSM，以使目标HSM解密得到源HSM的密钥信息。
  2. 如权利要求1所述的方法，其中，所述目标HSM所属服务器通过目标HSM生成密钥K，具体包括：
    所述目标HSM所属服务器获取源HSM的唯一标识信息，并指示目标HSM利用所述源HSM的唯一标识信息和目标HSM的硬件信息，生成密钥K。
  3. 如权利要求2所述的方法，其中，所述源HSM的唯一标识信息、密钥K和/或密钥密文以文件的形式在目标HSM所属服务器和源HSM所属服务器间传递。
  4. 如权利要求2或3所述的方法，其中，
    所述源HSM的唯一标识信息包括：源HSM的认证信息；
    所述密钥K为对称密钥。
  5. 一种硬件安全模块HSM加密信息同步实现方法，包括：
    源HSM所属服务器接收目标HSM所属服务器发送的密钥K；
    源HSM所属服务器指示源HSM利用所述密钥K对源HSM生成的各密钥进行加密得到密钥密文；
    源HSM所属服务器将所述密钥密文发送至目标HSM所属服务器，以使目标HSM解密得到源HSM的密钥信息。
  6. 如权利要求5所述的方法，其中，源HSM所属服务器接收目标HSM所属服务器发送的密钥K前还包括：
    源HSM所属服务器访问源HSM，获取源HSM的唯一标识信息，并将所述源HSM的唯一标识信息发送至目标HSM所属服务器，以使目标HSM所属服务器侧基于源HSM的唯一标识信息生成密钥K。
  7. 一种服务器，所述服务器内安装有HSM，包括：
    密钥生成模块，设置为在所述服务器为目标HSM所属服务器时，通过目标HSM生成密钥K，并将所述密钥K发送至源HSM所属服务器；
    密文生成模块，设置为在所述服务器为源HSM所属服务器时，指示源HSM利用目标HSM所属服务器发送的密钥K对源HSM生成的各密钥进行加密得到密钥密文，并将所述密钥密文发送至目标HSM所属服务器；
    解密模块，设置为当所述服务器为目标HSM所属服务器时，将源HSM所属服务器发送的密钥密文转发至目标HSM，以使目标HSM解密得到源HSM的密钥信息。
  8. 如权利要求7所述的服务器，其中，所述密钥生成模块，设置为获取源HSM的唯一标识信息，并指示目标HSM利用所述源HSM的唯一标识信息和目标HSM的硬件信息，生成密钥K。
  9. 一种HSM加密信息同步实现系统，包括：源HSM所属服务器，以及若干目标HSM所属服务器；
    所述目标HSM所属服务器，设置为通过目标HSM生成密钥K，并将所述密钥K发送至源HSM所属服务器；以及接收源HSM所属服务器发送的密钥密文，将所述密钥密文发送至目标HSM，以使目标HSM解密得到源HSM的密钥信息；
    所述源HSM所属服务器，设置为指示源HSM利用所述密钥K对源HSM生成的各密钥进行加密得到密钥密文，并将所述密钥密文发送至目标HSM所属服务器。
  10. 如权利要求9所述的系统，所述目标HSM所属服务器，设置为获取源HSM的唯一标识信息，并指示目标HSM利用所述源HSM的唯一标识信息和目标HSM的硬件信息，并利用获取的信息生成密钥K。
PCT/CN2015/080179 2014-11-20 2015-05-29 Hsm加密信息同步实现方法、装置和系统 WO2016078382A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410668244.7A CN105681027A (zh) 2014-11-20 2014-11-20 Hsm加密信息同步实现方法、装置和系统
CN201410668244.7 2014-11-20

Publications (1)

Publication Number Publication Date
WO2016078382A1 true WO2016078382A1 (zh) 2016-05-26

Family

ID=56013218

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/080179 WO2016078382A1 (zh) 2014-11-20 2015-05-29 Hsm加密信息同步实现方法、装置和系统

Country Status (2)

Country Link
CN (1) CN105681027A (zh)
WO (1) WO2016078382A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111988260A (zh) * 2019-05-21 2020-11-24 科大国盾量子技术股份有限公司 一种对称密钥管理系统、传输方法及装置

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3632035A4 (en) 2017-05-31 2021-03-10 Entrust Datacard Corporation MANAGEMENT OF CRYPTOGRAPHIC OBJECTS FROM MULTIPLE REMOTE LOCATIONS
CN109802885A (zh) * 2019-01-17 2019-05-24 安徽云探索网络科技有限公司 基于云存储的即时消息通信方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030217258A1 (en) * 2002-05-16 2003-11-20 International Business Machines Corporation Apparatus and method of using ephemeral asymmetric keys to exchange security data between hardware security modules
US20080080708A1 (en) * 2006-09-29 2008-04-03 Mcalister Donald Kent Key wrapping system and method using encryption
CN103546427A (zh) * 2012-07-11 2014-01-29 中国银联股份有限公司 一种实现加密机应用的高可用性的方法和系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7634659B2 (en) * 2002-09-20 2009-12-15 Cable Television Laboratories, Inc. Roaming hardware paired encryption key generation
US20090262926A1 (en) * 2008-04-16 2009-10-22 Infineon Technologies Ag Method and apparatus for generating a cryptographic key

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030217258A1 (en) * 2002-05-16 2003-11-20 International Business Machines Corporation Apparatus and method of using ephemeral asymmetric keys to exchange security data between hardware security modules
US20080080708A1 (en) * 2006-09-29 2008-04-03 Mcalister Donald Kent Key wrapping system and method using encryption
CN103546427A (zh) * 2012-07-11 2014-01-29 中国银联股份有限公司 一种实现加密机应用的高可用性的方法和系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111988260A (zh) * 2019-05-21 2020-11-24 科大国盾量子技术股份有限公司 一种对称密钥管理系统、传输方法及装置
CN111988260B (zh) * 2019-05-21 2023-01-31 科大国盾量子技术股份有限公司 一种对称密钥管理系统、传输方法及装置

Also Published As

Publication number Publication date
CN105681027A (zh) 2016-06-15

Similar Documents

Publication Publication Date Title
US9152805B2 (en) Security device
CN105681031B (zh) 一种存储加密网关密钥管理系统及方法
CN110535641B (zh) 密钥管理方法和装置、计算机设备和存储介质
JP2008533882A (ja) 暗号化キーをバックアップ及び復元する方法
CN105550600A (zh) 针对经加密的数据的基于社区的重复删除
US11140547B2 (en) Method for securely controlling smart home, and terminal device
CN105245328A (zh) 一种基于第三方的用户及文件的密钥产生管理方法
CN104994068A (zh) 一种云环境下多媒体内容保护和安全分发方法
CN106411504B (zh) 数据加密系统、方法及装置
US20160323100A1 (en) Key generation device, terminal device, and data signature and encryption method
CN103036880A (zh) 网络信息传输方法、设备及系统
US20160253516A1 (en) Content encryption to produce multiply encrypted content
CN104735070A (zh) 一种通用的异构加密云间的数据共享方法
TW201435641A (zh) 資料加密系統及方法
CN103607278A (zh) 一种安全的数据云存储方法
CN101539977B (zh) 一种计算机软件保护方法
CN104866784A (zh) 一种基于bios加密的安全硬盘、数据加密及解密方法
WO2022126972A1 (zh) 数据通信方法、密钥管理系统、设备及存储介质
WO2016078382A1 (zh) Hsm加密信息同步实现方法、装置和系统
CN114189337A (zh) 一种固件烧录方法、装置、设备以及存储介质
US9473471B2 (en) Method, apparatus and system for performing proxy transformation
CN107229874B (zh) 一种实现VR-Key的方法、装置和服务器
CN109726584B (zh) 云数据库密钥管理系统
JP2006279269A (ja) 情報管理装置、情報管理システム、ネットワークシステム、ユーザ端末、及びこれらのプログラム
JP4995667B2 (ja) 情報処理装置、サーバ装置、情報処理プログラム及び方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15860629

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15860629

Country of ref document: EP

Kind code of ref document: A1