WO2020042822A1 - 密码运算、创建工作密钥的方法、密码服务平台及设备 - Google Patents

密码运算、创建工作密钥的方法、密码服务平台及设备 Download PDF

Info

Publication number
WO2020042822A1
WO2020042822A1 PCT/CN2019/096662 CN2019096662W WO2020042822A1 WO 2020042822 A1 WO2020042822 A1 WO 2020042822A1 CN 2019096662 W CN2019096662 W CN 2019096662W WO 2020042822 A1 WO2020042822 A1 WO 2020042822A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
module
cryptographic
master
password
Prior art date
Application number
PCT/CN2019/096662
Other languages
English (en)
French (fr)
Inventor
肖淑婷
林孝旦
方海峰
谷胜才
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Priority to EP19853586.6A priority Critical patent/EP3780483A4/en
Priority to SG11202010748RA priority patent/SG11202010748RA/en
Publication of WO2020042822A1 publication Critical patent/WO2020042822A1/zh
Priority to US17/106,762 priority patent/US11128447B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0877—Generation of secret information including derivation or calculation of cryptographic keys or passwords using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/062—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying encryption of the keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Definitions

  • This specification relates to the field of cryptographic technology, and in particular, to cryptographic operations, methods for creating work keys, cryptographic service platforms, and equipment.
  • Cryptography technology is an important technical means to protect business systems such as banks, securities, or transactions in data storage, transmission, and access control to ensure data confidentiality, integrity, non-repudiation, and availability.
  • an enterprise can configure a password service platform.
  • the password service platform is a system platform that provides key management and password calculation services based on a cryptographic module.
  • the platform can provide business systems with message verification, data encryption and decryption, Application-level cryptographic services, such as signature verification, ensure the security of data during storage, transmission, and application, and prevent data from being stolen or maliciously tampered with. Based on this, how to provide a more stable password service platform has become an urgent technical issue.
  • this specification provides a method of cryptographic calculation, creation of a work key, a cryptographic service platform, and equipment.
  • a password service platform is provided.
  • the password service platform is connected to a master password module.
  • the password service platform includes:
  • a registration module configured to: call the primary password module to generate a primary key for the newly added secondary password module;
  • a work key creation module is configured to receive a work key creation request of a business system, call the master password module to generate a work key for the business system, and obtain the master password module return: The work key ciphertext encrypted by the master key, and the work key ciphertext encrypted by the master key of each connected secondary cryptographic module;
  • the cryptographic operation calling module is configured to: receive a cryptographic operation request of a business system, the cryptographic operation request carrying data to be calculated; determine a target cryptographic module that responds to the cryptographic operation request; and use a working key secret corresponding to the target cryptographic module
  • the text and the data to be operated are used as input, and the target cryptographic module is called to obtain the operation result of the target cryptographic module.
  • the operation result is used by the target cryptographic module to encrypt the work key by using the stored master key. After decrypting the text to obtain the work key, the decrypted work key is used to encrypt the data to be calculated.
  • the registration module is further configured to configure a primary key of the secondary password module in the following manner:
  • the master password module Taking the target public key as input, calling the master password module, the master password module generating a master key of the secondary password module, and using the target public key to encrypt the generated master key to obtain Master key ciphertext;
  • the registration module is further configured to:
  • the master cryptographic module With the target public key and the public key verification value as inputs, the master cryptographic module is called, and the master cryptographic module verifies the validity of the input target public key based on the public key verification value, and generates the The primary key of the secondary cryptographic module.
  • the registration module is further configured to configure a primary key of the secondary password module in the following manner:
  • the registration module is further configured to:
  • the primary key ciphertext is encrypted with the primary key of the primary cipher module.
  • a cryptographic calculation method including:
  • the target password module being one of a primary password module or at least one secondary password module, and a primary key of the secondary password module is generated by the primary password module;
  • the master password module uses the master key of the target password module to encrypt the work key, A work key created by the master password module for the business system;
  • the cryptographic module uses the stored master key to decrypt the work key ciphertext to obtain a work key, and then uses the decrypted work key to encrypt the data to be calculated.
  • the primary key of the secondary cryptographic module is obtained in the following manner:
  • the master password module Taking the target public key as input, calling the master password module, the master password module generating a master key of the secondary password module, and using the target public key to encrypt the generated master key to obtain Master key ciphertext;
  • using the target public key as an input to call the master password module, and the master password module generating a master key of the secondary password module includes:
  • the master cryptographic module With the target public key and the public key verification value as inputs, the master cryptographic module is called, and the master cryptographic module verifies the validity of the input target public key based on the public key verification value, and generates the The primary key of the secondary cryptographic module.
  • the primary key of the secondary cryptographic module is obtained in the following manner:
  • the method further includes:
  • the primary key ciphertext is encrypted with the primary key of the primary cipher module.
  • a cryptographic service device including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the program when the program is executed.
  • the target password module being one of a primary password module or at least one secondary password module, and a primary key of the secondary password module is generated by the primary password module;
  • the master password module uses the master key of the target password module to encrypt the work key, A work key created by the master password module for the business system;
  • the cryptographic module uses the stored master key to decrypt the work key ciphertext to obtain a work key, and then uses the decrypted work key to encrypt the data to be calculated.
  • a method for creating a work key including:
  • the master password module to generate a work key for the business system, and obtain the work key ciphertext encrypted by the master key of the master password module and the master secret of each connected secondary password module.
  • a cryptographic service device including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the program when the program is executed.
  • the master password module to generate a work key for the business system, and obtain the work key ciphertext encrypted by the master key of the master password module and the master secret of each connected secondary password module.
  • one of the cryptographic modules connected to the cryptographic service platform is used as the master cryptographic module.
  • the key management function of the cryptographic service platform is provided by the master cryptographic module.
  • the master cryptographic module is used to generate keys and the master cryptographic module.
  • other secondary cryptographic modules provide cryptographic computing functions required by cryptographic service platforms.
  • the master key of the secondary password module is generated by the master password module
  • the work key of the business system is also generated by the master password module
  • the password service platform stores the ciphertext of the work key encrypted by the master key of the master password module
  • the working key ciphertext is encrypted by the master key of each secondary cryptographic module. Therefore, in this embodiment, the master key is saved by the master cryptographic module.
  • the plaintext will not exceed the boundary of the cryptographic module and will not The security of the key is lost, so the security requirements of the key are met.
  • the cryptographic service platform can call any cryptographic module to respond to the cryptographic operation request of the business system. Therefore, the cryptographic service platform can be compatible with multiple cryptographic modules.
  • the cryptographic service platform will not be bound by a single cryptographic module vendor, which meets the requirements of using multiple cryptographic modules.
  • the demand also makes the password service platform able to provide more stable password services.
  • Fig. 1 is an application scenario diagram of a cryptographic service platform shown in this specification according to an exemplary embodiment.
  • Fig. 2A is a block diagram of a cryptographic service platform according to an exemplary embodiment of the present specification.
  • Fig. 2B is a schematic diagram illustrating a registration process of a secondary password module according to an exemplary embodiment of the present specification.
  • Fig. 2C is a schematic diagram illustrating a process of creating a work key according to an exemplary embodiment of the present specification.
  • Fig. 2D is a schematic diagram of a cryptographic operation according to an exemplary embodiment of the present specification.
  • FIG. 3 is a hardware structure diagram of a computer device where a cryptographic service platform according to an embodiment of the present specification is located.
  • Fig. 4 is a flow chart showing a cryptographic calculation method according to an exemplary embodiment of the present specification.
  • Fig. 5 is a flow chart showing a method for creating a work key according to an exemplary embodiment of the present specification.
  • first, second, third, etc. may be used in this specification to describe various information, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information.
  • word “if” as used herein can be interpreted as “at” or "when” or "in response to determination”.
  • FIG. 1 it is an application scenario diagram of a cryptographic service platform shown in this specification according to an exemplary embodiment.
  • the cryptographic service platform communicates with an application system host, and the application system host calls an interface provided by the cryptographic service platform.
  • the underlying password operation and other services are completed by the password service platform calling the password module.
  • a cryptographic module contains cryptographic algorithms and security functions. It is relatively independent software, hardware, firmware, or a combination thereof that can implement key management mechanisms, and is contained within cryptographic boundaries.
  • a cryptographic boundary refers to a clearly defined continuous edge that establishes the physical and / or logical boundaries of a cryptographic module and includes all hardware, software, and / or firmware components of the cryptographic module.
  • each manufacturer has launched a cryptographic module, and the algorithm for generating the master key is different.
  • the cryptographic service platform in the embodiment of the present specification is based on a variety of passwords. Modules are built, so there are multiple password modules connected to the password service platform. In the case of access to multiple password modules, you need to consider how to be compatible with various password modules to provide unified password services for business systems, and also meet password services. Security.
  • the solution of the embodiment of the present specification is that one of the cryptographic modules connected to the cryptographic service platform serves as the master cryptographic module, and the key management function of the cryptographic service platform generates a key from the master cryptographic module, except for the master cryptographic module.
  • Other cryptographic modules are referred to as secondary cryptographic modules in the embodiments of this specification. Both the secondary cryptographic module and the primary cryptographic module can provide cryptographic computing functions required by the cryptographic service platform.
  • the master key of the secondary password module is generated by the master password module
  • the work key of the business system is also generated by the master password module
  • the password service platform stores the ciphertext of the work key encrypted by the master key of the master password module
  • the master key of each secondary password module is encrypted with the work key ciphertext. Therefore, in this embodiment, the master key is saved by the master password module, and the master key and working key plain text as sensitive security parameters will not exceed the password. The boundary of the module, so the security of the key will not be lost, and the security requirements of the key are met.
  • the cryptographic service platform can call any cryptographic module to respond to the cryptographic operation request of the business system. Therefore, the cryptographic service platform will not be bound by a single cryptographic module vendor, meeting the needs of using multiple cryptographic modules, and also enabling the cryptographic service platform to provide more Serving stable passwords.
  • the cryptographic service platform of the embodiment of the present specification may include a registration module 21, a work key creation module 22, and a cryptographic operation calling module 23, which are respectively used to register the secondary cryptographic module and create a business system. Key, and call the cryptographic module to respond to the cryptographic operation request of the business system.
  • the registration module 21 is configured to: call the primary password module to generate a primary key for the newly added secondary password module;
  • a work key creation module 22 is configured to receive a work key creation request of a business system, call the master password module to generate a work key for the business system, and obtain the master password module and return the master password module.
  • the cryptographic operation calling module 23 is configured to: receive a cryptographic operation request of a business system, the cryptographic operation request carrying data to be calculated; determine a target cryptographic module that responds to the cryptographic operation request; and use a working key corresponding to the target cryptographic module
  • the ciphertext and the data to be calculated are used as inputs, and the target cryptographic module is called to obtain the operation result of the target cryptographic module.
  • the operation result is used by the target cryptographic module to store the working key against the working key.
  • the decrypted work key is used to obtain the encrypted data.
  • the password module uses the master key to encrypt the protection key.
  • the cryptographic module itself will have a key derivation algorithm to generate a key.
  • the primary cryptographic module generates a primary key for the secondary cryptographic module.
  • the cryptographic service platform may call the key generation module interface of the main cryptographic module. After the main cryptographic module is called, it uses a key derivation algorithm to generate the primary key of the secondary cryptographic module.
  • the primary password module is used to generate a primary key for the secondary password module, so that the primary password module can obtain the primary key of each secondary password module, so that when creating the work key of the business system, the secondary password module can be used.
  • the master key encrypts the work key (this process is explained in detail later).
  • the primary password module is the primary key of the secondary password module
  • it can be transmitted to the secondary password module through an encryption method, etc.
  • the specific encryption transmission method can be flexibly configured according to actual needs to ensure the security of the transmission process.
  • the master password module after generating the master key, the master password module generates two or more key components based on the master key, and outputs each of the key components to each key management entity, and the keys
  • the management entity transmits them to the secondary cryptographic module, respectively, for the secondary cryptographic module to generate a master key according to the key component input by each key management entity.
  • the key management entity may be a key manager, and each key manager obtains one of the key components, and each key manager may input the key held by the secondary password module through a control input interface.
  • the secondary cryptographic module can generate a master key for work after obtaining all the key components.
  • key components are generated and transmitted to the secondary cryptographic module through multiple key management entities. Since each key management entity only has a key component, even if a key component is leaked, it is difficult to obtain all the key components. Larger, so it can reduce the risk of key leakage and attack, and improve the security of master key transmission.
  • asymmetric cryptography can be used to encrypt the master key for transmission.
  • the secondary cryptographic module may generate an asymmetric key including the target public key and the target private key, and the cryptographic service platform may obtain the target public key of the secondary cryptographic module.
  • the cryptographic service platform may call the master cryptographic module and transmit the target public key to the master cryptographic module. After the master cryptographic module generates the master key of the secondary cryptographic module, use the target public key to the generated master secret.
  • the key is encrypted to obtain the master key ciphertext; the master cryptographic module returns the master key ciphertext to the cryptographic module service platform, and the cryptographic service platform sends the master key ciphertext to the secondary cryptographic module, and the secondary cryptographic module uses the target private key to decrypt Get the master key.
  • this embodiment can further reduce the risk of the target public key being tampered during the transmission through the following embodiments, thereby ensuring the secure transmission of the primary key of the secondary cryptographic module.
  • the password service platform calls the master password module and transmits the target public key to the master password module, and the master public password module authenticates the target public key.
  • the authentication process is: the master password module uses its own master The key performs a message authentication code calculation on the target public key to obtain a message authentication code value (that is, a check value of the target public key). The master password module returns the calculated message authentication code value to the password service platform.
  • the password service platform calls the master password module and transmits the target public key and the message authentication code value to the master password module.
  • the primary cryptographic module checks the target public key based on the message authentication code value, determines that the target public key is valid (indicating that the target public key is secure, has not been tampered with, etc.) generates a primary key for the secondary cryptographic module for the secondary cryptographic module, and uses the target public key Encrypt the generated master key to obtain the master key ciphertext and return it to the cryptographic service platform.
  • FIG. 2B it is a registration process of the secondary password module shown in this specification according to an exemplary embodiment:
  • the password service platform administrator sends an operation instruction to the password service platform to register a secondary password module. After receiving the instruction, the password service platform performs the following operations:
  • the cryptographic service platform invokes the authentication public key service interface of the primary cryptographic module, and the primary cryptographic module authenticates the target public key of the secondary cryptographic module (the secondary cryptographic module has previously generated an asymmetric key including the target public key and the target private key) Yes, and provided to the password service platform).
  • the master cryptographic module uses its master key to perform message authentication code calculation on the target public key, obtains the public key check value, and returns it to the cryptographic service platform.
  • the cryptographic service platform calls the symmetric key generation instruction of the primary cryptographic module and transmits the target public key and public key check value of the secondary cryptographic module.
  • the master cryptographic module verifies the validity of the target public key based on the public key check value. After passing the verification, a symmetric key is generated, and the target public key is used to encrypt the symmetric key and return.
  • the cryptographic service platform calls the setting of the primary key control input interface of the secondary cryptographic module and transmits the symmetric key encrypted with the target public key in the previous step.
  • the secondary password module receives the above-mentioned set master key instruction, decrypts it with the target private key to obtain a symmetric key, and sets it as the working master key.
  • the master password module may save the master key of each secondary password module, or the master password module may use its own master key to encrypt the master key of the secondary password module to obtain the master key secret of the secondary password module. After the text is transmitted to the password service platform for storage.
  • the work key refers to a key that the cryptographic module provides a cryptographic operation function for the business system and is created for the business system.
  • the process of creating a work key can be:
  • Receiving a work key creation request of a business system calling the master password module to generate a work key for the business system, and obtaining feedback from the master password module: a work key encrypted by the master key of the master password module Text, and the work key cipher text encrypted separately by the master key of each connected secondary cryptographic module.
  • the master cryptographic module After the work key of the business system is generated by the master cryptographic module, the master cryptographic module generates multiple copies of the work key ciphertext and provides it to the cryptographic service platform for storage for subsequent cryptographic operation processing.
  • this is a process of creating a work key shown in this specification according to an exemplary embodiment:
  • the key administrator initiates an operation instruction to create a key. After the password service platform receives the operation instruction, it performs the following operations:
  • the cryptographic service platform calls the work key interface for creating the master cryptographic module, and simultaneously transmits the master key ciphertext of each secondary cryptographic module (the ciphertext is encrypted by the master key of the master cryptographic module).
  • the master password module After the master password module is called, use the key derivation module to generate the work key, and use the master password of the master password module to encrypt it, and the master key of each secondary password module to encrypt and return.
  • the private key and the secret key can be encrypted, and the public key can be returned in plain text without encryption.
  • the public key can also be encrypted as required, which can be flexibly configured in practical applications.
  • the cryptographic service platform After the execution is completed, the cryptographic service platform records multiple ciphertexts of the work key: the ciphertext encrypted by the master key of the primary cryptographic module, and the ciphertext content encrypted by the master key of each secondary cryptographic module.
  • the cryptographic service platform provides cryptographic operation services to the business system.
  • the cryptographic service platform may receive cryptographic operation requests from the business system, and the cryptographic operation request carries data to be calculated.
  • a cryptographic service platform may provide services to multiple business systems, and each business system may correspond to multiple working keys. Therefore, the cryptographic operation request also carries a key identifier for the cryptographic service platform to determine which working secret to use. Keys provide cryptographic computing services.
  • the cryptographic service platform can select one of the cryptographic modules to respond to the cryptographic computation request. In order to facilitate differentiation, this embodiment is called a target cryptographic module.
  • the selection method of the password service platform can be flexibly configured according to needs, for example, it can be based on the current processing capacity of each cryptographic module, the number of tasks being processed, and the like.
  • the cryptographic service platform can obtain the working key ciphertext corresponding to the target cryptographic module from the stored multiple working key ciphertexts.
  • the cryptographic service platform may use the working key ciphertext as input to call the target cryptographic module.
  • the target cryptographic module After the target cryptographic module is called, it can use its own stored master key to decrypt the work key ciphertext to obtain a work key, and then use the work key to perform calculations on the data to be calculated, and the operation result can be returned to
  • the password service platform is returned to the business system by the password service platform.
  • FIG. 2D it is a schematic diagram of a cryptographic operation shown in this specification according to an exemplary embodiment:
  • the cryptographic service platform After the cryptographic service platform receives the cryptographic computation request, it determines which cryptographic module should be selected for this computation.
  • the specific selection logic is not limited. The logic can be formulated according to the cryptographic service platform's requirements for traffic management of the cryptographic module.
  • the password service platform calls the password operation interface of the main password module, and the input data is the key content of the work password (encrypted by the main password module) and the data to be calculated.
  • the master cryptographic module uses the internal master key to decrypt to obtain the plaintext of the work key, perform cryptographic operations on the operation data, and return the operation results to the cryptographic service platform.
  • the cryptographic service platform invokes the password operation interface of the secondary password module, and the input data is the key content of the work password (encrypted by the secondary password module) and the data to be calculated.
  • the secondary cryptographic module uses the internal master key to decrypt to obtain the plaintext of the work key, performs cryptographic operations on the operation data, and returns the operation result to the cryptographic service platform.
  • this specification also provides embodiments of cryptographic computing methods and computer equipment applied to the cryptographic service platform.
  • the embodiments of the password service platform of this specification can be applied to computer equipment, such as a server and the like.
  • the device embodiments may be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory and running the processor. In terms of hardware, as shown in FIG.
  • the server on which the cryptographic service platform 331 is located in the embodiment may generally include other hardware according to the actual function of the computer device, and details are not described herein again.
  • FIG. 4 is a flowchart of a cryptographic calculation method according to an exemplary embodiment of the present specification, including the following steps:
  • step 402 a cryptographic operation request initiated by a service system is received, and the cryptographic operation request carries data to be calculated.
  • a target cryptographic module that responds to the cryptographic operation request is determined.
  • the target cryptographic module is one of a primary cryptographic module or at least one secondary cryptographic module, and a primary key of the secondary cryptographic module is the primary cryptographic module. generate.
  • step 406 a working key ciphertext with the target cryptographic module is obtained, where the working key ciphertext is: the master cryptographic module uses the master key of the target cryptographic module to encrypt the working key.
  • the work key is created by the master password module for the business system.
  • step 408 taking the work key ciphertext and the data to be operated as input, the target password module is called, the operation result returned by the target password module is obtained and sent to the business system, and the operation result is obtained.
  • the target cryptographic module uses the stored master key to decrypt the work key ciphertext to obtain a work key, the decrypted work key is used to encrypt the data to be calculated.
  • the primary key of the secondary cryptographic module is obtained in the following manner:
  • the master password module Taking the target public key as input, calling the master password module, the master password module generating a master key of the secondary password module, and using the target public key to encrypt the generated master key to obtain Master key ciphertext;
  • using the target public key as an input to call the master password module, and the master password module generating a master key of the secondary password module includes:
  • the master cryptographic module With the target public key and the public key verification value as inputs, the master cryptographic module is called, and the master cryptographic module verifies the validity of the input target public key based on the public key verification value, and generates the The primary key of the secondary cryptographic module.
  • the primary key of the secondary cryptographic module is obtained in the following manner:
  • the method further includes:
  • the primary key ciphertext is encrypted with the primary key of the primary cipher module.
  • FIG. 5 is a flowchart of creating a work key according to an exemplary embodiment of the present specification, and includes the following steps:
  • step 502 a work key creation request of a service system is received
  • step 504 the master password module is called to generate a work key for the service system, and the master password module returns the work key ciphertext encrypted by the master key of the master password module and each connected time.
  • the master key of the cryptographic module is separately encrypted with the work key ciphertext; wherein the master key of the secondary cryptographic module is generated by the master cryptographic module for the secondary cryptographic module by calling the master cryptographic module.
  • one of the cryptographic modules connected to the cryptographic service platform is used as the master cryptographic module.
  • the key management function of the cryptographic service platform is provided by the master cryptographic module.
  • the master cryptographic module is used to generate keys and the master cryptographic module.
  • other secondary cryptographic modules provide cryptographic computing functions required by cryptographic service platforms.
  • the master key of the secondary password module is generated by the master password module
  • the work key of the business system is also generated by the master password module
  • the password service platform stores the ciphertext of the work key encrypted by the master key of the master password module
  • the working key ciphertext is encrypted by the master key of each secondary cryptographic module. Therefore, in this embodiment, the master key is saved by the master cryptographic module. As the sensitive security parameter, the plaintext will not exceed the boundary of the cryptographic module and will not The security of the key is lost, so the security requirements of the key are met.
  • an embodiment of the present specification further provides a computer device including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the following method when the program is executed:
  • the target password module being one of a primary password module or at least one secondary password module, and a primary key of the secondary password module is generated by the primary password module;
  • the master password module uses the master key of the target password module to encrypt the work key, A work key created by the master password module for the business system;
  • the cryptographic module uses the stored master key to decrypt the work key ciphertext to obtain a work key, and then uses the decrypted work key to encrypt the data to be calculated.
  • an embodiment of the present specification further provides a cryptographic service device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the following method when the program is executed :
  • the master password module to generate a work key for the business system, and obtain the returned by the master password module: the work key ciphertext encrypted by the master key of the master password module, and the master secret of each connected secondary password module The work key ciphertext encrypted by the key respectively; wherein the primary key of the secondary password module is generated by the primary password module for the secondary password module by calling the primary password module.
  • the relevant part may refer to the description of the method embodiment.
  • the device embodiments described above are only schematic, and the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, which may be located in One place, or can be distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution in this specification. Those of ordinary skill in the art can understand and implement without creative efforts.

Abstract

本说明书提供一种密码运算、创建工作密钥的方法、密码服务平台及设备，密码服务平台所连接的密码模块中，密钥管理功能中由主密码模块提供，主密码模块用于生成密钥，主密码模块和次密码模块都可提供密码服务平台所需要的密码运算功能。次密码模块的主密钥由主密码模块生成，业务系统的工作密钥也由主密码模块生成，并且密码服务平台保存有主密码模块的主密钥加密的工作密钥密文，以及各个次密码模块的主密钥分别加密的工作密钥密文。作为敏感安全参数的主密钥、工作密钥明文均不会超出密码模块的边界，不会损失密钥的安全性，因此满足密钥的安全性要求，也能够兼容多种密码模块，使得密码服务平台能够提供更为稳定的密码服务。

Description

密码运算、创建工作密钥的方法、密码服务平台及设备 技术领域
本说明书涉及密码技术领域，尤其涉及密码运算、创建工作密钥的方法、密码服务平台及设备。
背景技术
随着互联网技术的发展，各类业务系统层出不穷，给人们的工作、生活带来了极大的便利，也促进了经济的增长和社会的进步。密码技术是保护银行、证券或交易等业务系统在数据存储、传输、访问控制中确保数据机密性、完整性、抗抵赖及可用性的重要技术手段。
例如，企业可配置密码服务平台，密码服务平台是基于密码模块提供密钥管理、密码运算服务的系统平台，该平台作为业务系统的服务端，能够为业务系统提供消息验证、数据加密与解密、签名验签等应用层密码服务，保障数据在存储、传输及应用过程中的安全性，防止数据被窃取或恶意篡改。基于此，如何提供一个更为稳定的密码服务平台成为亟待解决的技术问题。
发明内容
为克服相关技术中存在的问题，本说明书提供了密码运算、创建工作密钥的方法、密码服务平台及设备。
根据本说明书实施例的第一方面，提供一种密码服务平台，所述密码服务平台连接有主密码模块，所述密码服务平台包括：
注册模块，用于：调用所述主密码模块为新增的次密码模块生成主密钥；
工作密钥创建模块，用于：接收业务系统的工作密钥创建请求，调用所述主密码模块为所述业务系统生成工作密钥，获取所述主密码模块返回的：所述主密码模块的主密钥加密的工作密钥密文，以及各个已连接次密码模块的主密钥分别加密的工作密钥密文；
密码运算调用模块，用于：接收业务系统的密码运算请求，所述密码运算请求携带有待运算数据；确定响应所述密码运算请求的目标密码模块；以所述目标密码模块对应 的工作密钥密文和所述待运算数据作为输入，调用所述目标密码模块，获得所述目标密码模块的运算结果，所述运算结果由所述目标密码模块利用已存储主密钥对所述工作密钥密文解密得到工作密钥后，利用解密得到的工作密钥对所述待运算数据进行加密得到。
可选的，所述注册模块，还用于通过如下方式配置所述次密码模块的主密钥：
获取所述次密码模块生成的目标公钥；
以所述目标公钥作为输入，调用所述主密码模块，由所述主密码模块生成所述次密码模块的主密钥，利用所述目标公钥对所述生成的主密钥进行加密获得主密钥密文；
将所述主密钥密文发送给所述次密码模块，由所述次密码模块利用与所述目标公钥对应的目标私钥解密获得主密钥。
可选的，所述注册模块，还用于：
获取所述主密码模块对所述目标公钥进行消息鉴别码计算获得的公钥校验值；
以所述目标公钥和公钥校验值为输入，调用所述主密码模块，由所述主密码模块基于所述公钥校验值校验输入的目标公钥的合法性后，生成所述次密码模块的主密钥。
可选的，所述注册模块，还用于通过如下方式配置所述次密码模块的主密钥：
调用主密码模块，由主密码模块产生所述次密码模块的主密钥后，获取所述主密钥的两个或以上的密钥分量；
将所述两个或以上的密钥分量分别输出给各个密钥管理实体，由所述密钥管理实体分别传输给所述次密码模块，以供次密码模块根据各个密钥分量生成主密钥。
可选的，所述注册模块，还用于：
接收所述主密码模块返回的所述次密码模块的主密钥密文后并存储，所述主密钥密文以主密码模块的主密钥加密。
根据本说明书实施例的第二方面，提供一种密码运算方法，包括：
接收业务系统发起的密码运算请求，所述密码运算请求携带有待运算数据；
确定响应所述密码运算请求的目标密码模块，所述目标密码模块为主密码模块或至少一个次密码模块中的一个，所述次密码模块的主密钥由所述主密码模块生成；
获取与所述目标密码模块的工作密钥密文，所述工作密钥密文为：所述主密码模块利用所述目标密码模块的主密钥对工作密钥加密得到的密文，所述工作密钥由所述主密 码模块为所述业务系统创建；
以所述工作密钥密文和所述待运算数据为输入，调用所述目标密码模块，获取所述目标密码模块返回的运算结果并发送给所述业务系统，所述运算结果由所述目标密码模块利用已存储主密钥对所述工作密钥密文解密得到工作密钥后，利用解密得到的工作密钥对所述待运算数据进行加密得到。
可选的，所述次密码模块的主密钥通过如下方式获得：
获取所述次密码模块生成的目标公钥；
以所述目标公钥作为输入，调用所述主密码模块，由所述主密码模块生成所述次密码模块的主密钥，利用所述目标公钥对所述生成的主密钥进行加密获得主密钥密文；
将所述主密钥密文发送给所述次密码模块，由所述次密码模块利用与所述目标公钥对应的目标私钥解密获得主密钥。
可选的，所述以所述目标公钥作为输入，调用所述主密码模块，由所述主密码模块生成所述次密码模块的主密钥，包括：
获取所述主密码模块对所述目标公钥进行消息鉴别码计算获得的公钥校验值；
以所述目标公钥和公钥校验值为输入，调用所述主密码模块，由所述主密码模块基于所述公钥校验值校验输入的目标公钥的合法性后，生成所述次密码模块的主密钥。
可选的，所述次密码模块的主密钥通过如下方式获得：
调用主密码模块，由主密码模块产生所述次密码模块的主密钥后，获取所述主密钥的两个或以上的密钥分量；
将所述两个或以上的密钥分量分别输出给各个密钥管理实体，由所述密钥管理实体分别传输给所述次密码模块，以供次密码模块根据各个密钥分量生成主密钥。
可选的，所述方法还包括：
接收所述主密码模块返回的所述次密码模块的主密钥密文后并存储，所述主密钥密文以主密码模块的主密钥加密。
根据本说明书实施例的第三方面，提供一种密码服务设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，所述处理器执行所述程序时实现如下方法：
接收业务系统发起的密码运算请求，所述密码运算请求携带有待运算数据；
确定响应所述密码运算请求的目标密码模块，所述目标密码模块为主密码模块或至少一个次密码模块中的一个，所述次密码模块的主密钥由所述主密码模块生成；
获取与所述目标密码模块的工作密钥密文，所述工作密钥密文为：所述主密码模块利用所述目标密码模块的主密钥对工作密钥加密得到的密文，所述工作密钥由所述主密码模块为所述业务系统创建；
以所述工作密钥密文和所述待运算数据为输入，调用所述目标密码模块，获取所述目标密码模块返回的运算结果并发送给所述业务系统，所述运算结果由所述目标密码模块利用已存储主密钥对所述工作密钥密文解密得到工作密钥后，利用解密得到的工作密钥对所述待运算数据进行加密得到。
根据本说明书实施例的第四方面，提供一种创建工作密钥的方法，包括：
接收业务系统的工作密钥创建请求；
调用主密码模块为所述业务系统生成工作密钥，获取所述主密码模块返回的：所述主密码模块的主密钥加密的工作密钥密文，以及各个已连接次密码模块的主密钥分别加密的工作密钥密文；其中，所述次密码模块的主密钥通过调用所述主密码模块，由所述主密码模块为所述次密码模块生成。
根据本说明书实施例的第五方面，提供一种密码服务设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，所述处理器执行所述程序时实现如下方法：
接收业务系统的工作密钥创建请求；
调用主密码模块为所述业务系统生成工作密钥，获取所述主密码模块返回的：所述主密码模块的主密钥加密的工作密钥密文，以及各个已连接次密码模块的主密钥分别加密的工作密钥密文；其中，所述次密码模块的主密钥通过调用所述主密码模块，由所述主密码模块为所述次密码模块生成。
本说明书的实施例提供的技术方案可以包括以下有益效果：
本说明书实施例中，密码服务平台所连接的密码模块中，其中一个作为主密码模块，密码服务平台的密钥管理功能中由主密码模块提供，主密码模块用于生成密钥，主密码模块和其他次密码模块提供密码服务平台所需要的密码运算功能。
其中，次密码模块的主密钥由主密码模块生成，业务系统的工作密钥也由主密码模块生成，并且密码服务平台保存有主密码模块的主密钥加密的工作密钥密文，以及各个次密码模块的主密钥分别加密的工作密钥密文，因此，本实施例中主密钥由主密码模块保存，主密钥作为敏感安全参数明文不会超出密码模块的边界，不会损失密钥的安全性，因此满足密钥的安全性要求。而密码服务平台可调用任一密码模块响应业务系统的密码运算请求，因此密码服务平台能够兼容多种密码模块，密码服务平台不会被单一的密码模块厂商绑定，满足使用多种密码模块的需求，也使得密码服务平台能够提供更为稳定的密码服务。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本说明书。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本说明书的实施例，并与说明书一起用于解释本说明书的原理。
图1是本说明书根据一示例性实施例示出的一种密码服务平台的应用场景图。
图2A是本说明书根据一示例性实施例示出的密码服务平台的框图。
图2B是本说明书根据一示例性实施例示出的次密码模块的注册过程示意图。
图2C是本说明书根据一示例性实施例示出的创建工作密钥的过程示意图。
图2D是本说明书根据一示例性实施例示出的密码运算示意图。
图3是本说明书实施例密码服务平台所在计算机设备的一种硬件结构图。
图4是本说明书根据一示例性实施例示出的一种密码运算方法的流程图。
图5是本说明书根据一示例性实施例示出的一种创建工作密钥的方法的流程图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本说明书相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本说明书的一些方面相一致的装置和方法的例子。
在本说明书使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本说明书。在本说明书和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本说明书可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本说明书范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
如图1所示，是本说明书根据一示例性实施例示出的一种密码服务平台的应用场景图，图1中密码服务平台与应用系统主机通信，应用系统主机通过调用密码服务平台提供的接口来使用密码服务，底层的密码运算等服务由密码服务平台调用密码模块来完成。
密码模块(security module)含有密码算法和安全功能，是可实现密钥管理机制的相对独立的软件、硬件、固件或其组合，被包含在密码边界内。密码边界(cryptographic boundary)是指：明确定义的连续边线，该边线建立了密码模块的物理和/或逻辑边界，并包括了密码模块的所有硬件、软件、和/或固件部件。
目前，各家厂商都推出有密码模块，其主密钥的生成算法各不相同，为避免被单一厂商绑定、提高密码服务平台的健壮性，本说明书实施例的密码服务平台基于多种密码模块来建设，因此密码服务平台连接有多种密码模块，在接入有多种密码模块的情况下，需要考虑如何兼容各种密码模块以统一为业务系统提供密码服务，并且还要满足密码服务的安全性。
本说明书实施例的方案是，密码服务平台所连接的密码模块中，其中一个作为主密码模块，密码服务平台的密钥管理功能中由该主密码模块生成密钥，除了主密码模块之外的其他密码模块，本说明书实施例称为次密码模块，次密码模块和主密码模块都可提供密码服务平台所需要的密码运算功能。
其中，次密码模块的主密钥由主密码模块生成，业务系统的工作密钥也由主密码模块生成，并且密码服务平台保存有主密码模块的主密钥加密的工作密钥密文，以及各个次密码模块的主密钥分别加密的工作密钥密文，因此，本实施例中主密钥由主密码模块保存，作为敏感安全参数的主密钥、工作密钥明文均不会超出密码模块的边界，因此不 会损失密钥的安全性，满足密钥的安全性要求。而密码服务平台可调用任一密码模块响应业务系统的密码运算请求，因此密码服务平台不会被单一的密码模块厂商绑定，满足使用多种密码模块的需求，也使得密码服务平台能够提供更为稳定的密码服务。
作为例子，如图2A所示，本说明书实施例的密码服务平台可包含有注册模块21、工作密钥创建模块22和密码运算调用模块23，分别用于注册次密码模块、创建业务系统的工作密钥，以及调用密码模块响应业务系统的密码运算请求。
其中，注册模块21，用于：调用所述主密码模块为新增的次密码模块生成主密钥；
工作密钥创建模块22，用于：接收业务系统的工作密钥创建请求，调用所述主密码模块为所述业务系统生成工作密钥，获取所述主密码模块返回的：所述主密码模块的主密钥加密的工作密钥密文，以及各个已连接次密码模块的主密钥分别加密的工作密钥密文；
密码运算调用模块23，用于：接收业务系统的密码运算请求，所述密码运算请求携带有待运算数据；确定响应所述密码运算请求的目标密码模块；以所述目标密码模块对应的工作密钥密文和所述待运算数据作为输入，调用所述目标密码模块，获得所述目标密码模块的运算结果，所述运算结果由所述目标密码模块利用已存储主密钥对所述工作密钥密文解密得到工作密钥后，利用解密得到的工作密钥对所述待运算数据进行加密得到。
接下来进行详细说明。
(一)次密码模块的注册
密码模块在工作前需要设置工作用的主密钥，密码模块利用主密钥对待保护密钥进行加密。密码模块本身会有密钥派生算法生成密钥，而本实施例中，由主密码模块为次密码模块生成主密钥。具体的，可以是密码服务平台调用主密码模块的生成密钥接口，主密码模块在被调用后，利用密钥派生算法生成次密码模块的主密钥。本实施例采用主密码模块为次密码模块生成主密钥的方式，可以令主密码模块获得各个次密码模块的主密钥，以在创建业务系统的工作密钥时，可利用次密码模块的主密钥对工作密钥加密(此过程在后续进行详细说明)。
其中，主密码模块为次密码模块的主密钥后，可通过加密方式等传输给次密码模块，具体的加密传输方式可根据实际需要灵活配置，以保证传输过程的安全性。作为例子，主密码模块在生成主密钥后，基于主密钥生成两个或两个以上的密钥分量，将所述各个 密钥分量分别输出给各个密钥管理实体，由所述密钥管理实体分别传输给所述次密码模块，以供次密码模块根据各个密钥管理实体输入的密钥分量生成主密钥。其中，所述密钥管理实体可以是密钥管理员，每个密钥管理员分别获得其中一个密钥分量，各密钥管理员可通过次密码模块的控制输入接口输入其持有的密钥分量的方式，次密码模块在获取到所有密钥分量后可生成用于工作的主密钥。本实施例通过生成密钥分量、并通过多个密钥管理实体传输给次密码模块，由于各个密钥管理实体只拥有密钥分量，即使有密钥分量泄露，由于获取所有密钥分量的难度较大，因此可降低密钥泄露和攻击的风险，提升主密钥传输的安全性。
在另一些例子中，可利用非对称密码技术对主密钥进行加密传输。作为例子，次密码模块可生成包括目标公钥和目标私钥的非对称密钥，密码服务平台可获取到次密码模块的目标公钥。密码服务平台可调用主密码模块，并且向主密码模块传输该目标公钥，由所述主密码模块生成所述次密码模块的主密钥后，利用该目标公钥对所述生成的主密钥进行加密获得主密钥密文；主密码模块向密码模块服务平台返回该主密钥密文，密码服务平台接收后发送给所述次密码模块，由所述次密码模块利用目标私钥解密获得主密钥。
上述过程涉及目标公钥的传输，可选的，本实施例可进一步通过如下实施例降低目标公钥在传输过程中被篡改等风险，从而保证次密码模块的主密钥的安全传输。作为例子，可以是：密码服务平台调用主密码模块，并且向主密码模块传输该目标公钥，由主密码模块对所述目标公钥进行认证，认证的过程是：主密码模块利用自身的主密钥对该目标公钥进行消息鉴别码计算，获得消息鉴别码值(也即是目标公钥的校验值)。主密码模块将计算得到的消息鉴别码值返回给密码服务平台，密码服务平台调用主密码模块，并且向主密码模块传输该目标公钥和消息鉴别码值。主密码模块基于消息鉴别码值校验目标公钥，确定目标公钥合法(表示目标公钥安全，未被篡改等)后为次密码模块生成次密码模块的主密钥，利用该目标公钥对所述生成的主密钥进行加密获得主密钥密文返回给密码服务平台。
接下来结合图2B再次说明上述注册过程，如图2B所示，是本说明书根据一示例性实施例示出的次密码模块的注册过程：
1、密码服务平台管理员向密码服务平台发出注册一个次密码模块的操作指令，密码服务平台收到指令后，执行如下操作：
1.1、密码服务平台调用主密码模块的认证公钥服务接口，由主密码模块对次密码模 块的目标公钥进行认证(次密码模块预先生成了包括目标公钥和目标私钥的非对称密钥对，并提供给密码服务平台)。
1.2、主密码模块利用其主密钥对该目标公钥进行消息鉴别码计算，获得公钥校验值并返回给密码服务平台。
1.3、密码服务平台调用主密码模块的生成对称密钥指令，并且传输次密码模块的目标公钥和公钥校验值。
1.4、主密码模块基于公钥校验值校验目标公钥的合法性，在通过校验后，生成对称密钥，利用该目标公钥对对称密钥进行加密后返回。
1.5、密码服务平台调用次密码模块的设置主密钥控制输入接口，并且传输上一步的以目标公钥加密的对称密钥。
1.6、次密码模块接收上述设置主密钥指令，用目标私钥解密得到对称密钥，设置为工作主密钥。
可选的，可以由主密码模块保存各个次密码模块的主密钥，也可以是主密码模块利用自身主密钥对次密码模块的主密钥进行加密，获得次密码模块的主密钥密文后传输给密码服务平台进行保存。
(二)为业务系统创建工作密钥
本实施例中，工作密钥是指密码模块为业务系统提供密码运算功能、针对业务系统创建的密钥。创建工作密钥的过程可以是：
接收业务系统的工作密钥创建请求，调用所述主密码模块为所述业务系统生成工作密钥，获取所述主密码模块反馈的：所述主密码模块的主密钥加密的工作密钥密文，以及各个已连接次密码模块的主密钥分别加密的工作密钥密文。
本实施例中，业务系统的工作密钥由主密码模块生成后，由主密码模块生成多份工作密钥密文并提供给密码服务平台保存，以供后续的密码运算处理过程中使用。
作为例子，如图2C所示，是本说明书根据一示例性实施例示出的创建工作密钥的过程：
1、密钥管理员发起创建密钥的操作指令，密码服务平台收到操作指令后，执行如下操作：
1.1、密码服务平台调用主密码模块的创建工作密钥接口，同时传入各个次密码模块 的主密钥密文(该密文由主密码模块的主密钥加密)。
1.2、主密码模块被调用后，利用密钥派生模块产生工作密钥，并分别使用主密码模块的主密码加密、各个次密码模块的主密钥分别加密后返回。(其中，工作密钥可能包括多个，私钥和秘密密钥可进行加密，而公钥可以不加密直接明文返回，当然，也可以根据需要对公钥加密，实际应用中可以灵活配置)
执行完成后，密码服务平台记录下多份工作密钥密文：由主密码模块主密钥加密的密文，以及由各个次密码模块的主密钥加密的密文内容。
(三)密码运算
本实施例中，密码服务平台向业务系统提供密码运算服务，密码服务平台可接收业务系统的密码运算请求，所述密码运算请求携带有待运算数据。通常，密码服务平台可能面向多个业务系统提供服务，每个业务系统也可能对应多个工作密钥，因此密码运算请求中还携带有密钥标识，以供密码服务平台确定该利用哪个工作密钥提供密码运算服务。
由于接入有多个密码模块，密码服务平台可以从中选取其中一个密码模块响应密码运算请求，为了便于区分，本实施例称为目标密码模块。可选的，密码服务平台的选取方式可以根据需要灵活配置，例如可以基于各个密码模块当前的处理能力、正在处理的任务数量等等方式。
在确定响应密码运算请求的目标密码模块后，密码服务平台可以从已存储多份工作密钥密文中，获取目标密码模块对应的工作密钥密文。密码服务平台可以以该工作密钥密文作为输入，调用所述目标密码模块。目标密码模块在被调用后，可以利用自身已存储主密钥对所述工作密钥密文解密得到工作密钥，进而利用该工作密钥对所述待运算数据进行运算，运算结果可返回给密码服务平台，由密码服务平台返回给业务系统。
作为例子，如图2D所示，是本说明书根据一示例性实施例示出的密码运算示意图：
1.1、密码服务平台接收到密码运算请求后，确定选择本次运算该使用哪一个密码模块，具体的选择逻辑不限，可以根据密码服务平台对密码模块进行流量管理的需求来制定该逻辑。
1.1.1、如果选择结果为主密码模块，密码服务平台调用主密码模块的密码运算接口，输入数据为工作密码的密钥内容(由主密码模块加密)和待运算数据。
1.1.2、主密码模块使用内部的主密钥解密得到工作密钥明文，对待运算数据进行密码运算，将运算结果返回给密码服务平台。
2.2.1、如果选择结果为次密码模块，密码服务平台调用次密码模块的密码运算接口，输入数据为工作密码的密钥内容(由次密码模块加密)和待运算数据。
2.2.2、次密码模块使用内部的主密钥解密得到工作密钥明文，对待运算数据进行密码运算，将运算结果返回给密码服务平台。
与前述密码服务平台的实施例相对应，本说明书还提供了密码运算方法及密码服务平台所应用的计算机设备的实施例。
本说明书密码服务平台的实施例可以应用在计算机设备上，例如服务器等。装置实施例可以通过软件实现，也可以通过硬件或者软硬件结合的方式实现。以软件实现为例，作为一个逻辑意义上的装置，是通过其所在的处理器将非易失性存储器中对应的计算机程序指令读取到内存中运行形成的。从硬件层面而言，如图3所示，为本说明书实施例密码服务平台所在计算机设备的一种硬件结构图，除了图3所示的处理器310、内存330、网络接口320、以及非易失性存储器340之外，实施例中密码服务平台331所在的服务器，通常根据该计算机设备的实际功能，还可以包括其他硬件，对此不再赘述。
如图4所示，图4是本说明书根据一示例性实施例示出的一种密码运算方法的流程图，包括以下步骤：
在步骤402、接收业务系统发起的密码运算请求，所述密码运算请求携带有待运算数据。
在步骤404、确定响应所述密码运算请求的目标密码模块，所述目标密码模块为主密码模块或至少一个次密码模块中的一个，所述次密码模块的主密钥由所述主密码模块生成。
在步骤406、获取与所述目标密码模块的工作密钥密文，所述工作密钥密文为：所述主密码模块利用所述目标密码模块的主密钥对工作密钥加密得到的密文，所述工作密钥由所述主密码模块为所述业务系统创建。
在步骤408、以所述工作密钥密文和所述待运算数据为输入，调用所述目标密码模块，获取所述目标密码模块返回的运算结果并发送给所述业务系统，所述运算结果由所述目标密码模块利用已存储主密钥对所述工作密钥密文解密得到工作密钥后，利用解 密得到的工作密钥对所述待运算数据进行加密得到。
可选的，所述次密码模块的主密钥通过如下方式获得：
获取所述次密码模块生成的目标公钥；
以所述目标公钥作为输入，调用所述主密码模块，由所述主密码模块生成所述次密码模块的主密钥，利用所述目标公钥对所述生成的主密钥进行加密获得主密钥密文；
将所述主密钥密文发送给所述次密码模块，由所述次密码模块利用与所述目标公钥对应的目标私钥解密获得主密钥。
可选的，所述以所述目标公钥作为输入，调用所述主密码模块，由所述主密码模块生成所述次密码模块的主密钥，包括：
获取所述主密码模块对所述目标公钥进行消息鉴别码计算获得的公钥校验值；
以所述目标公钥和公钥校验值为输入，调用所述主密码模块，由所述主密码模块基于所述公钥校验值校验输入的目标公钥的合法性后，生成所述次密码模块的主密钥。
可选的，所述次密码模块的主密钥通过如下方式获得：
调用主密码模块，由主密码模块产生所述次密码模块的主密钥后，获取所述主密钥的两个或以上的密钥分量；
将所述两个或以上的密钥分量分别传输给各个密钥管理实体，由所述密钥管理实体分别传输给所述次密码模块，以供次密码模块根据各个密钥分量生成主密钥。
可选的，所述方法还包括：
接收所述主密码模块返回的所述次密码模块的主密钥密文后并存储，所述主密钥密文以主密码模块的主密钥加密。
上述密码运算方法中各个步骤的实现过程可详见上述密码服务平台中各个模块的功能和作用的实现过程，在此不再赘述。
如图5所示，图5是本说明书根据一示例性实施例示出的一种创建工作密钥的流程图，包括以下步骤：
在步骤502中，接收业务系统的工作密钥创建请求；
在步骤504中，调用主密码模块为所述业务系统生成工作密钥，获取所述主密码模块返回的：所述主密码模块的主密钥加密的工作密钥密文，以及各个已连接次密码 模块的主密钥分别加密的工作密钥密文；其中，所述次密码模块的主密钥通过调用所述主密码模块，由所述主密码模块为所述次密码模块生成。
本说明书实施例中，密码服务平台所连接的密码模块中，其中一个作为主密码模块，密码服务平台的密钥管理功能中由主密码模块提供，主密码模块用于生成密钥，主密码模块和其他次密码模块提供密码服务平台所需要的密码运算功能。
其中，次密码模块的主密钥由主密码模块生成，业务系统的工作密钥也由主密码模块生成，并且密码服务平台保存有主密码模块的主密钥加密的工作密钥密文，以及各个次密码模块的主密钥分别加密的工作密钥密文，因此，本实施例中主密钥由主密码模块保存，主密钥作为敏感安全参数明文不会超出密码模块的边界，不会损失密钥的安全性，因此满足密钥的安全性要求。
相应的，本说明书实施例还提供一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，所述处理器执行所述程序时实现如下方法：
接收业务系统发起的密码运算请求，所述密码运算请求携带有待运算数据；
确定响应所述密码运算请求的目标密码模块，所述目标密码模块为主密码模块或至少一个次密码模块中的一个，所述次密码模块的主密钥由所述主密码模块生成；
获取与所述目标密码模块的工作密钥密文，所述工作密钥密文为：所述主密码模块利用所述目标密码模块的主密钥对工作密钥加密得到的密文，所述工作密钥由所述主密码模块为所述业务系统创建；
以所述工作密钥密文和所述待运算数据为输入，调用所述目标密码模块，获取所述目标密码模块返回的运算结果并发送给所述业务系统，所述运算结果由所述目标密码模块利用已存储主密钥对所述工作密钥密文解密得到工作密钥后，利用解密得到的工作密钥对所述待运算数据进行加密得到。
相应的，本说明书实施例还提供一种密码服务设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，所述处理器执行所述程序时实现如下方法：
接收业务系统的工作密钥创建请求；
调用主密码模块为所述业务系统生成工作密钥，获取所述主密码模块返回的： 所述主密码模块的主密钥加密的工作密钥密文，以及各个已连接次密码模块的主密钥分别加密的工作密钥密文；其中，所述次密码模块的主密钥通过调用所述主密码模块，由所述主密码模块为所述次密码模块生成。
对于装置实施例而言，由于其基本对应于方法实施例，所以相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理模块，即可以位于一个地方，或者也可以分布到多个网络模块上。可以根据实际的需要选择其中的部分或者全部模块来实现本说明书方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
本领域技术人员在考虑说明书及实践这里申请的发明后，将容易想到本说明书的其它实施方案。本说明书旨在涵盖本说明书的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本说明书的一般性原理并包括本说明书未申请的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本说明书的真正范围和精神由下面的权利要求指出。
应当理解的是，本说明书并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本说明书的范围仅由所附的权利要求来限制。
以上所述仅为本说明书的较佳实施例而已，并不用以限制本说明书，凡在本说明书的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本说明书保护的范围之内。

Claims (13)

  1. 一种密码服务平台，所述密码服务平台连接有主密码模块，所述密码服务平台包括：
    注册模块，用于：调用所述主密码模块为新增的次密码模块生成主密钥；
    工作密钥创建模块，用于：接收业务系统的工作密钥创建请求，调用所述主密码模块为所述业务系统生成工作密钥，获取所述主密码模块返回的：所述主密码模块的主密钥加密的工作密钥密文，以及各个已连接次密码模块的主密钥分别加密的工作密钥密文；
    密码运算调用模块，用于：接收业务系统的密码运算请求，所述密码运算请求携带有待运算数据；确定响应所述密码运算请求的目标密码模块；以所述目标密码模块对应的工作密钥密文和所述待运算数据作为输入，调用所述目标密码模块，获得所述目标密码模块的运算结果，所述运算结果由所述目标密码模块利用已存储主密钥对所述工作密钥密文解密得到工作密钥后，利用解密得到的工作密钥对所述待运算数据进行加密得到。
  2. 根据权利要求1所述的密码服务平台，所述注册模块，还用于通过如下方式配置所述次密码模块的主密钥：
    获取所述次密码模块生成的目标公钥；
    以所述目标公钥作为输入，调用所述主密码模块，由所述主密码模块生成所述次密码模块的主密钥，利用所述目标公钥对所述生成的主密钥进行加密获得主密钥密文；
    将所述主密钥密文发送给所述次密码模块，由所述次密码模块利用与所述目标公钥对应的目标私钥解密获得主密钥。
  3. 根据权利要求2所述的密码服务平台，所述注册模块，还用于：
    获取所述主密码模块对所述目标公钥进行消息鉴别码计算获得的公钥校验值；
    以所述目标公钥和公钥校验值为输入，调用所述主密码模块，由所述主密码模块基于所述公钥校验值校验输入的目标公钥的合法性后，生成所述次密码模块的主密钥。
  4. 根据权利要求1所述的密码服务平台，所述注册模块，还用于通过如下方式配置所述次密码模块的主密钥：
    调用主密码模块，由主密码模块产生所述次密码模块的主密钥后，获取所述主密钥的两个或以上的密钥分量；
    将所述两个或以上的密钥分量分别输出给各个密钥管理实体，由所述密钥管理实体分别传输给所述次密码模块，以供次密码模块根据各个密钥分量生成主密钥。
  5. 根据权利要求1所述的密码服务平台，所述注册模块还用于：
    接收所述主密码模块返回的所述次密码模块的主密钥密文后并存储，所述主密钥密 文以主密码模块的主密钥加密。
  6. 一种密码运算方法，包括：
    接收业务系统发起的密码运算请求，所述密码运算请求携带有待运算数据；
    确定响应所述密码运算请求的目标密码模块，所述目标密码模块为主密码模块或至少一个次密码模块中的一个，所述次密码模块的主密钥由所述主密码模块生成；
    获取与所述目标密码模块的工作密钥密文，所述工作密钥密文为：所述主密码模块利用所述目标密码模块的主密钥对工作密钥加密得到的密文，所述工作密钥由所述主密码模块为所述业务系统创建；
    以所述工作密钥密文和所述待运算数据为输入，调用所述目标密码模块，获取所述目标密码模块返回的运算结果并发送给所述业务系统，所述运算结果由所述目标密码模块利用已存储主密钥对所述工作密钥密文解密得到工作密钥后，利用解密得到的工作密钥对所述待运算数据进行加密得到。
  7. 根据权利要求6所述的方法，所述次密码模块的主密钥通过如下方式获得：
    获取所述次密码模块生成的目标公钥；
    以所述目标公钥作为输入，调用所述主密码模块，由所述主密码模块生成所述次密码模块的主密钥，利用所述目标公钥对所述生成的主密钥进行加密获得主密钥密文；
    将所述主密钥密文发送给所述次密码模块，由所述次密码模块利用与所述目标公钥对应的目标私钥解密获得主密钥。
  8. 根据权利要求7所述的方法，所述以所述目标公钥作为输入，调用所述主密码模块，由所述主密码模块生成所述次密码模块的主密钥，包括：
    获取所述主密码模块对所述目标公钥进行消息鉴别码计算获得的公钥校验值；
    以所述目标公钥和公钥校验值为输入，调用所述主密码模块，由所述主密码模块基于所述公钥校验值校验输入的目标公钥的合法性后，生成所述次密码模块的主密钥。
  9. 根据权利要求6所述的方法，所述次密码模块的主密钥通过如下方式获得：
    调用主密码模块，由主密码模块产生所述次密码模块的主密钥后，获取所述主密钥的两个或以上的密钥分量；
    将所述两个或以上的密钥分量分别传输给各个密钥管理实体，由所述密钥管理实体分别传输给所述次密码模块，以供次密码模块根据各个密钥分量生成主密钥。
  10. 根据权利要求6所述的方法，所述方法还包括：
    接收所述主密码模块返回的所述次密码模块的主密钥密文后并存储，所述主密钥密文以主密码模块的主密钥加密。
  11. 一种密码服务设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，所述处理器执行所述程序时实现如下方法：
    接收业务系统发起的密码运算请求，所述密码运算请求携带有待运算数据；
    确定响应所述密码运算请求的目标密码模块，所述目标密码模块为主密码模块或至少一个次密码模块中的一个，所述次密码模块的主密钥由所述主密码模块生成；
    获取与所述目标密码模块的工作密钥密文，所述工作密钥密文为：所述主密码模块利用所述目标密码模块的主密钥对工作密钥加密得到的密文，所述工作密钥由所述主密码模块为所述业务系统创建；
    以所述工作密钥密文和所述待运算数据为输入，调用所述目标密码模块，获取所述目标密码模块返回的运算结果并发送给所述业务系统，所述运算结果由所述目标密码模块利用已存储主密钥对所述工作密钥密文解密得到工作密钥后，利用解密得到的工作密钥对所述待运算数据进行加密得到。
  12. 一种创建工作密钥的方法，包括：
    接收业务系统的工作密钥创建请求；
    调用主密码模块为所述业务系统生成工作密钥，获取所述主密码模块返回的：所述主密码模块的主密钥加密的工作密钥密文，以及各个已连接次密码模块的主密钥分别加密的工作密钥密文；其中，所述次密码模块的主密钥通过调用所述主密码模块，由所述主密码模块为所述次密码模块生成。
  13. 一种密码服务设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，所述处理器执行所述程序时实现如下方法：
    接收业务系统的工作密钥创建请求；
    调用主密码模块为所述业务系统生成工作密钥，获取所述主密码模块返回的：所述主密码模块的主密钥加密的工作密钥密文，以及各个已连接次密码模块的主密钥分别加密的工作密钥密文；其中，所述次密码模块的主密钥通过调用所述主密码模块，由所述主密码模块为所述次密码模块生成。
PCT/CN2019/096662 2018-08-31 2019-07-19 密码运算、创建工作密钥的方法、密码服务平台及设备 WO2020042822A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP19853586.6A EP3780483A4 (en) 2018-08-31 2019-07-19 PROCESS FOR CRYPTOGRAPHIC OPERATION, PROCESS FOR GENERATING A WORKING KEY AND PLATFORM AND DEVICE FOR CRYPTOGRAPHIC SERVICE
SG11202010748RA SG11202010748RA (en) 2018-08-31 2019-07-19 Cryptographic Operation Method, Working Key Creation Method, Cryptographic Service Platform, and Cryptographic Service Device
US17/106,762 US11128447B2 (en) 2018-08-31 2020-11-30 Cryptographic operation method, working key creation method, cryptographic service platform, and cryptographic service device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811012441.8A CN109067528B (zh) 2018-08-31 2018-08-31 密码运算、创建工作密钥的方法、密码服务平台及设备
CN201811012441.8 2018-08-31

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/106,762 Continuation US11128447B2 (en) 2018-08-31 2020-11-30 Cryptographic operation method, working key creation method, cryptographic service platform, and cryptographic service device

Publications (1)

Publication Number Publication Date
WO2020042822A1 true WO2020042822A1 (zh) 2020-03-05

Family

ID=64758178

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/096662 WO2020042822A1 (zh) 2018-08-31 2019-07-19 密码运算、创建工作密钥的方法、密码服务平台及设备

Country Status (6)

Country Link
US (1) US11128447B2 (zh)
EP (1) EP3780483A4 (zh)
CN (2) CN109067528B (zh)
SG (1) SG11202010748RA (zh)
TW (1) TWI701929B (zh)
WO (1) WO2020042822A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4016339A1 (de) * 2020-12-21 2022-06-22 Bundesdruckerei GmbH Provisionieren eines sicherheitsapplets auf einem mobilen endgerät

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109067528B (zh) * 2018-08-31 2020-05-12 阿里巴巴集团控股有限公司 密码运算、创建工作密钥的方法、密码服务平台及设备
CN109347625B (zh) * 2018-08-31 2020-04-24 阿里巴巴集团控股有限公司 密码运算、创建工作密钥的方法、密码服务平台及设备
US11595201B2 (en) * 2020-02-21 2023-02-28 Cyber Armor Ltd. System and method for generation of a disposable software module for cryptographic material protection
CN114095152A (zh) * 2020-08-03 2022-02-25 天翼电子商务有限公司 密钥更新及数据加解密方法、系统、介质及装置
WO2022264170A1 (en) * 2021-06-17 2022-12-22 Jupitice Justice Technologies Pvt Ltd A method and a device for securing access to an application
CN114157448B (zh) * 2021-10-26 2023-06-16 苏州浪潮智能科技有限公司 密码服务平台的搭建部署方法、装置、终端及存储介质
CN114285561A (zh) * 2021-12-27 2022-04-05 中国电信股份有限公司 请求消息的处理方法和装置、存储介质及电子装置
CN114944960B (zh) * 2022-06-20 2023-07-25 成都卫士通信息产业股份有限公司 一种密码应用方法、装置、设备及存储介质
US11924179B2 (en) * 2022-08-08 2024-03-05 International Business Machines Corporation API based distribution of private session key to network communication device for secured communications
US11916890B1 (en) * 2022-08-08 2024-02-27 International Business Machines Corporation Distribution of a cryptographic service provided private session key to network communication device for secured communications
US11765142B1 (en) 2022-08-08 2023-09-19 International Business Machines Corporation Distribution of private session key to network communication device for secured communications

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102148799A (zh) * 2010-02-05 2011-08-10 中国银联股份有限公司 密钥下载方法及系统
CN103051446A (zh) * 2012-12-26 2013-04-17 公安部第一研究所 一种密钥加密存储方法
US20140112470A1 (en) * 2011-07-21 2014-04-24 Peking University Method and system for key generation, backup, and migration based on trusted computing
CN107070642A (zh) * 2016-12-26 2017-08-18 贵州银行股份有限公司 多品牌密码机异构资源池复用技术
CN109067528A (zh) * 2018-08-31 2018-12-21 阿里巴巴集团控股有限公司 密码运算、创建工作密钥的方法、密码服务平台及设备

Family Cites Families (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3637869B2 (ja) * 2000-11-22 2005-04-13 日本電気株式会社 連鎖鍵放送受信システム及び連鎖鍵放送受信方法
WO2005119606A1 (en) * 2004-05-28 2005-12-15 International Business Machines Corporation Smart card data transaction system and methods for providing storage and transmission security
KR20060133760A (ko) * 2005-06-21 2006-12-27 삼성전자주식회사 네트워크 시스템에서의 데이터 관리 방법 및 네트워크시스템
CN101141250A (zh) * 2007-10-10 2008-03-12 北京握奇数据系统有限公司 仪表设备、数据安全存取方法、装置和系统
CN101488969A (zh) * 2008-01-15 2009-07-22 中国移动通信集团公司 一种更换消费子密钥的方法、装置及系统
JP5018558B2 (ja) * 2008-02-29 2012-09-05 富士通株式会社 記憶領域割当方法および情報処理装置
US20100235626A1 (en) * 2009-03-10 2010-09-16 Kwon Eun Jung Apparatus and method for mutual authentication in downloadable conditional access system
EP3029592B1 (en) * 2010-08-18 2018-07-25 Security First Corp. Systems and methods for securing virtual machine computing environments
CN103269480A (zh) * 2010-09-06 2013-08-28 苏州国芯科技有限公司 无线局域网用高速加解密方法
JP5618881B2 (ja) * 2011-03-25 2014-11-05 三菱電機株式会社 暗号処理システム、鍵生成装置、暗号化装置、復号装置、暗号処理方法及び暗号処理プログラム
CN103237005A (zh) * 2013-03-15 2013-08-07 福建联迪商用设备有限公司 密钥管理方法及系统
CN103220270A (zh) * 2013-03-15 2013-07-24 福建联迪商用设备有限公司 密钥下载方法、管理方法、下载管理方法及装置和系统
CN103220271A (zh) * 2013-03-15 2013-07-24 福建联迪商用设备有限公司 密钥下载方法、管理方法、下载管理方法及装置和系统
CN103237004A (zh) * 2013-03-15 2013-08-07 福建联迪商用设备有限公司 密钥下载方法、管理方法、下载管理方法及装置和系统
US9819661B2 (en) * 2013-09-12 2017-11-14 The Boeing Company Method of authorizing an operation to be performed on a targeted computing device
US8966267B1 (en) * 2014-04-08 2015-02-24 Cloudflare, Inc. Secure session capability using public-key cryptography without access to the private key
US9141814B1 (en) * 2014-06-03 2015-09-22 Zettaset, Inc. Methods and computer systems with provisions for high availability of cryptographic keys
JP6363032B2 (ja) * 2015-02-26 2018-07-25 株式会社日立情報通信エンジニアリング 鍵付替え方向制御システムおよび鍵付替え方向制御方法
KR102460096B1 (ko) * 2015-05-27 2022-10-27 삼성에스디에스 주식회사 클라우드 서비스를 위한 암호화 키 관리 방법 및 그 장치
GB201519612D0 (en) * 2015-11-06 2015-12-23 Nagravision Sa Key sequence generation for cryptographic operations
CN107230081A (zh) * 2016-03-25 2017-10-03 深圳三信通金融信息服务有限公司 一种安全支付加密系统
CN106027235B (zh) * 2016-05-13 2019-05-17 北京三未信安科技发展有限公司 一种pci密码卡和海量密钥密码运算方法及系统
JP2018032907A (ja) * 2016-08-22 2018-03-01 日本電信電話株式会社 コンテンツ作成装置、コンテンツ作成方法及びプログラム
CN106453612B (zh) * 2016-11-10 2019-03-05 华中科技大学 一种数据存储与共享系统
CN107301545B (zh) * 2017-04-14 2020-09-01 广州羊城通有限公司 一种基于时间戳的交易验证方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102148799A (zh) * 2010-02-05 2011-08-10 中国银联股份有限公司 密钥下载方法及系统
US20140112470A1 (en) * 2011-07-21 2014-04-24 Peking University Method and system for key generation, backup, and migration based on trusted computing
CN103051446A (zh) * 2012-12-26 2013-04-17 公安部第一研究所 一种密钥加密存储方法
CN107070642A (zh) * 2016-12-26 2017-08-18 贵州银行股份有限公司 多品牌密码机异构资源池复用技术
CN109067528A (zh) * 2018-08-31 2018-12-21 阿里巴巴集团控股有限公司 密码运算、创建工作密钥的方法、密码服务平台及设备

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4016339A1 (de) * 2020-12-21 2022-06-22 Bundesdruckerei GmbH Provisionieren eines sicherheitsapplets auf einem mobilen endgerät

Also Published As

Publication number Publication date
US20210099286A1 (en) 2021-04-01
SG11202010748RA (en) 2020-11-27
EP3780483A1 (en) 2021-02-17
EP3780483A4 (en) 2021-09-22
TW202015378A (zh) 2020-04-16
TWI701929B (zh) 2020-08-11
US11128447B2 (en) 2021-09-21
CN109067528B (zh) 2020-05-12
CN111654367A (zh) 2020-09-11
CN109067528A (zh) 2018-12-21
CN111654367B (zh) 2023-05-12

Similar Documents

Publication Publication Date Title
WO2020042822A1 (zh) 密码运算、创建工作密钥的方法、密码服务平台及设备
WO2021184975A1 (zh) 链上数据的链下隐私计算方法及装置
KR102263325B1 (ko) 신뢰 실행 환경에서 스마트 계약 동작을 안전하게 실행하는 방법
CN110580414B (zh) 基于区块链账户的隐私数据查询方法及装置
WO2021184961A1 (zh) 部署合约的方法及装置
TWI706658B (zh) 密碼運算、創建工作密鑰的方法、密碼服務平台及設備
CN110580418B (zh) 基于区块链账户的隐私数据查询方法及装置
WO2021184970A1 (zh) 调用合约的方法及装置
CN110580262B (zh) 基于智能合约的隐私数据查询方法及装置
US9846778B1 (en) Encrypted boot volume access in resource-on-demand environments
JP6370722B2 (ja) データセンタへのプラットフォームの内包検証
CN110580412B (zh) 基于链代码的权限查询配置方法及装置
CN111475827A (zh) 基于链下授权的隐私数据查询方法及装置
WO2021129003A1 (zh) 一种密码管理方法及相关装置
CN111475850A (zh) 基于智能合约的隐私数据查询方法及装置
CN115495768A (zh) 基于区块链及多方安全计算的涉密信息处理方法及系统
US10516655B1 (en) Encrypted boot volume access in resource-on-demand environments
WO2023019964A1 (zh) 一种数据安全处理方法和装置
TWM585941U (zh) 帳戶資料處理系統
Chavan et al. Efficient Attribute Based Encryption Outsourcing in Cloud Storage with User Revocation
CN117708381A (zh) 保护隐私的图数据查询方法和装置
CN117335963A (zh) 密码资源池的密钥管理方法、系统及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19853586

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019853586

Country of ref document: EP

Effective date: 20201030

NENP Non-entry into the national phase

Ref country code: DE