CN115801232A - Private key protection method, device, equipment and storage medium - Google Patents

Abstract

The application discloses a private key protection method, a private key protection device, private key protection equipment and a storage medium, which relate to the technical field of information security and comprise the following steps: generating a pair of asymmetric keys in a trusted execution environment of a privacy computing platform to obtain a first private key and a first public key; generating a symmetric key in the trusted execution environment; acquiring a second public key sent by the USBKey, and encrypting the first private key by using the second public key to obtain an encrypted private key; encrypting the symmetric key by using the first public key to obtain an encrypted symmetric key; when target data sent by a user side is obtained, the encrypted private key and the encrypted symmetric key are sent to the user side, the encrypted private key is decrypted by using a second private key arranged in the USBKey to obtain a first private key, the encrypted symmetric key is decrypted by using the first private key to obtain a symmetric key, and then the target data is encrypted by using the symmetric key. The method and the device protect the safety of the private key in the transmission process through the public key produced by the USBKey, so that the transmission of the private key is safer.

Description

A private key protection method, device, equipment and storage medium

technical field

The present application relates to the technical field of information security, in particular to a private key protection method, device, equipment and storage medium.

Background technique

With the vigorous development of privacy computing, privacy computing technology has been widely used in various industries. There is a key technology in privacy computing technology, which is cryptography. Among them, the security of the private key determines the data security of each environment in the private computing process, especially in data transmission, data storage, and data operation verification. The carrying of the private key has become a new problem in the private computing process. Therefore, how to solve the security of carrying the private key, the security of the transmission of the private key, and the security of the verification of the private key has become a prominent problem that needs to be solved urgently.

However, the current private key carrying, transmission and signature verification have the following disadvantages: the private key is easy to be copied and deleted; the private key is easy to be stolen due to no protection measures during the transmission; the private key signature verification is too complicated and requires Execute the script manually.

Contents of the invention

In view of this, the purpose of this application is to provide a private key protection method, device, device, and storage medium, which can protect the security of the private key during transmission, and enable the data provider to protect its own private key to avoid private key The risk of being leaked and copied during transmission makes private key transmission more secure. The specific plan is as follows:

In the first aspect, this application discloses a private key protection method, which is applied to a privacy computing platform, including:

generating a pair of asymmetric keys in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key;

generating a symmetric key in said trusted execution environment;

Obtain the second public key embedded in the USBKey sent by the USBKey, and use the second public key to encrypt the first private key to obtain the encrypted private key;

Encrypting the symmetric key by using the first public key to obtain an encrypted symmetric key;

When the target data sent by the client is obtained, the encrypted private key and the encrypted symmetric key are sent to the client to use the second private key built in the USBKey to encrypt the Decrypt the private key to obtain the first private key, and use the first private key to decrypt the encrypted symmetric key to obtain the symmetric key, and then use the symmetric key to decrypt the target The data is encrypted to obtain the target ciphertext.

Optionally, the generating a pair of asymmetric keys in the trusted execution environment of the privacy computing platform to obtain the first private key and the first public key includes:

A pair of asymmetric keys are generated through a key management service system in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key.

Optionally, the obtaining the second public key sent by the USBKey and embedded in the USBKey includes:

Obtain the second public key embedded in the USBKey sent by the USBKey through user registration.

Optionally, after using the symmetric key to encrypt the target data to obtain the target ciphertext, the method further includes:

Sending the target ciphertext to the privacy computing platform through the user terminal, so as to store the target ciphertext through the privacy computing platform.

Optionally, before generating a pair of asymmetric keys in the trusted execution environment of the privacy computing platform, the method further includes:

A pair of public and private keys is randomly generated by the USBKey to obtain the second public key and the second private key, and the second public key and the second private key are embedded in the USBKey.

Optionally, after using the symmetric key to encrypt the target data to obtain the target ciphertext, the method further includes:

Using the symmetric key to decrypt the target ciphertext to obtain the target data.

Optionally, before sending the encrypted private key and the encrypted symmetric key to the client, the method further includes:

Using the built-in public key algorithm in the USBKey to authenticate the identity of the client, if the authentication is passed, execute the step of delivering the encrypted private key and the encrypted symmetric key to the client.

In the second aspect, the present application discloses a private key protection device applied to a privacy computing platform, including:

An asymmetric key generation module, configured to generate a pair of asymmetric keys in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key;

A symmetric key generating module, configured to generate a symmetric key in the trusted execution environment;

The public key obtaining module is used to obtain the second public key embedded in the USBKey sent by the USBKey;

A public key encryption module, configured to use the second public key to encrypt the first private key to obtain an encrypted private key;

A symmetric key encryption module, configured to use the first public key to encrypt the symmetric key to obtain an encrypted symmetric key;

A key delivery module, configured to deliver the encrypted private key and the encrypted symmetric key to the client when the target data sent by the client is acquired;

A decryption module, configured to use the second private key built in the USBKey to decrypt the encrypted private key to obtain the first private key, and use the first private key to decrypt the encrypted symmetric key Decrypt to obtain the symmetric key;

A data encryption module, configured to use the symmetric key to encrypt the target data to obtain target ciphertext.

In a third aspect, the present application discloses an electronic device, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, the aforementioned private key protection method is realized.

In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned private key protection method is implemented.

It can be seen that this application first generates a pair of asymmetric keys in the trusted execution environment of the privacy computing platform, obtains the first private key and the first public key, and then generates a symmetric key in the trusted execution environment , then obtain the second public key embedded in the USBKey sent by the USBKey, and use the second public key to encrypt the first private key to obtain the encrypted private key, and then use the first public key Encrypting the symmetric key to obtain the encrypted symmetric key, when the target data sent by the client is obtained, sending the encrypted private key and the encrypted symmetric key to the client to obtain Using the second private key built in the USBKey to decrypt the encrypted private key to obtain the first private key, and using the first private key to decrypt the encrypted symmetric key to obtain the the symmetric key, and then use the symmetric key to encrypt the target data to obtain the target ciphertext. This application protects the security of the private key during the transmission process through the public key of the public and private key produced by the USBKey at any time, realizes the data provider's protection of its own private key, and avoids the risk of the private key being leaked and copied during transmission , making private key transmission more secure.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present application, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

Fig. 1 is a flow chart of a private key protection method disclosed in the present application;

FIG. 2 is a flow chart of a specific private key protection method disclosed in the present application;

FIG. 3 is a block diagram of a specific private key protection method disclosed in the present application;

Fig. 4 is a kind of specific private key sign verification flow chart disclosed in this application;

FIG. 5 is a schematic structural diagram of a private key protection device disclosed in the present application;

FIG. 6 is a structural diagram of an electronic device disclosed in the present application.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the application with reference to the drawings in the embodiments of the application. Apparently, the described embodiments are only some of the embodiments of the application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

The embodiment of the present application discloses a private key protection method, which is applied to a privacy computing platform, as shown in Figure 1. The method includes:

Step S11: Generate a pair of asymmetric keys in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key.

In this embodiment, firstly, a pair of asymmetric keys are generated at any time in the Trusted Execution Environment (TEE, Trusted ExecutionEnvironment) of the privacy computing platform, and the corresponding first private key and first public key are obtained. Wherein, the trusted execution environment can make the underlying architecture of the inter-based hardware manufacturer credible, and the underlying architecture of the CPU (Central Processing Unit, central processing unit) guarantees the credibility of the trusted execution environment, and at the same time, the trusted execution of the inter Trusted authentication for access to the Trusted Execution Environment remotely by the Environment Service Center. For example, when a data participant needs to verify whether the trusted execution environment is credible, the random number r is generated locally at the participant at any time, and then the random number r is credibly authenticated through the trusted execution environment, and a credible authentication report is returned; When the data participant obtains the above-mentioned trusted certification report, it will be automatically forwarded to inter's trusted execution environment service center, and then the trusted execution environment service center will verify whether the parameters of the trusted execution environment in the trusted certification report have changed , if there is a change, it indicates that the trusted execution environment is not trusted; if there is no change, it indicates that the trusted execution environment is credible.

It should be pointed out that before generating a pair of asymmetric keys in the trusted execution environment of the privacy computing platform, it specifically further includes: randomly generating a pair of public and private keys through a USBKey, and obtaining the second public key and the second private key, and put the second public key and the second private key into the USBKey. That is, a pair of public and private keys is randomly generated through the USBKey in advance, and then stored in the USBKey.

Specifically, the generating a pair of asymmetric keys in the trusted execution environment of the privacy computing platform to obtain the first private key and the first public key may include: Generate a pair of asymmetric keys through the key management service system to obtain the first private key and the first public key. That is, a pair of asymmetric keys can be generated through a key management service (KMS, Key Management Service) system based on the trusted execution environment of the privacy computing platform.

Step S12: Generate a symmetric key in the trusted execution environment.

In this embodiment, after generating a pair of asymmetric keys in the trusted execution environment of the private computing platform to obtain the first private key and the first public key, further generate A symmetric key.

Step S13: Obtain the second public key embedded in the USBKey sent by the USBKey, and use the second public key to encrypt the first private key to obtain an encrypted private key.

In this embodiment, after a symmetric key is generated in the trusted execution environment, the second public key sent by the USBKey and embedded in the above-mentioned USBKey is obtained first, and then the above-mentioned first The private key is encrypted to obtain the encrypted private key.

Step S14: Using the first public key to encrypt the symmetric key to obtain an encrypted symmetric key.

In this embodiment, after using the second public key to encrypt the first private key to obtain an encrypted private key, then use the first public key to encrypt the above-mentioned symmetric key to obtain the corresponding encrypted symmetric key. key.

Step S15: When the target data sent by the client is acquired, send the encrypted private key and the encrypted symmetric key to the client, so as to use the second private key pair built in the USBKey Decrypt the encrypted private key to obtain the first private key, and use the first private key to decrypt the encrypted symmetric key to obtain the symmetric key, and then use the symmetric key to The target data is encrypted to obtain target ciphertext.

In this embodiment, after using the first public key to encrypt the symmetric key to obtain the encrypted symmetric key, when the target data sent by the client is obtained, the above encrypted private key and the above encrypted Afterwards, the symmetric key is sent to the above-mentioned client, and then the script in the USBKey is automatically executed on the client side, and the second private key built in the above-mentioned USBKey is used to decrypt the above-mentioned encrypted private key, and then Obtain the above-mentioned first private key, then use the first private key obtained after decryption to decrypt the above-mentioned encrypted symmetric key to obtain the above-mentioned symmetric key, and further, use the above-mentioned symmetric key to encrypt the above-mentioned target data to obtain The corresponding target ciphertext.

In addition, before sending the encrypted private key and the encrypted symmetric key to the client, it specifically further includes: using the built-in public key algorithm in the USBKey to authenticate the identity of the client, If the authentication is passed, the step of sending the encrypted private key and the encrypted symmetric key to the client is executed. It should be pointed out that the USBKey is a hardware device with a USB interface, has a built-in single-chip microcomputer or a smart card chip, and has a certain storage space, which can store information such as the user's private key and digital certificate, and use the built-in public key of the USB Key to The algorithm can realize the authentication of the user's identity. Since the user's private key is stored in the combination lock, it cannot be read in any way in theory. Therefore, the use of USB Key can ensure the security of user authentication. In this embodiment, when sending the key information to the user terminal, in order to ensure the security of the information transmission, the identity of the user terminal can be authenticated through the built-in public key algorithm in the USBKey, and if the authentication is passed, the corresponding information delivery operation will be carried out .

It should be pointed out that, after encrypting the target data with the symmetric key to obtain the target ciphertext, it may also include: sending the target ciphertext to the privacy computing platform through the client, so that The target ciphertext is stored by the privacy computing platform. In this embodiment, in order to improve the security of target ciphertext storage, after the client generates the target ciphertext, it can be sent to the privacy computing platform for storage.

Further, after encrypting the target data with the symmetric key to obtain the target ciphertext, the method may further include: decrypting the target ciphertext with the symmetric key to obtain the target data. In this embodiment, in order to verify the signature of the private key, the encrypted private key can also be decrypted by using the above-mentioned second private key built in the USBKey to obtain the first private key, and then use the above-mentioned first private key to decrypt the encrypted private key. key to decrypt the encrypted symmetric key to obtain the symmetric key, and then use the symmetric key to decrypt the above-mentioned target ciphertext data to obtain plaintext information, that is, the target data. Signature verification of the private key.

It can be seen that in the embodiment of the present application, a pair of asymmetric keys is first generated in the trusted execution environment of the privacy computing platform to obtain the first private key and the first public key, and then a symmetric key is generated in the trusted execution environment. key, then obtain the second public key sent by the USBKey and built in the USBKey, and use the second public key to encrypt the first private key to obtain the encrypted private key, and then use the first The public key encrypts the symmetric key to obtain the encrypted symmetric key, and when the target data sent by the client is obtained, the encrypted private key and the encrypted symmetric key are sent to the client , to use the second private key built in the USBKey to decrypt the encrypted private key to obtain the first private key, and use the first private key to decrypt the encrypted symmetric key, Obtain the symmetric key, and then use the symmetric key to encrypt the target data to obtain target ciphertext. The embodiment of this application protects the security of the private key during the transmission process through the public key of the public and private keys produced by the USBKey at any time, and realizes that the data provider can protect its own private key, avoiding the private key from being leaked and copied during transmission risk, making private key transmission more secure.

The embodiment of this application discloses a specific private key protection method, which is applied to a privacy computing platform, as shown in Figure 2 and Figure 3, the method includes:

Step S21: Generate a pair of asymmetric keys through the key management service system in the trusted execution environment of the privacy computing platform, and obtain the first private key and the first public key.

In a specific implementation, as shown in Figure 3, a pair of public-private key pairs is generated at any time through the USBKey to obtain the private key UK1 and public key UK2, and then the key management service system is trusted to execute on the privacy computing platform A pair of asymmetric keys are generated in the environment, and a private key K1 and a public key K2 are obtained. It should be pointed out that the trusted execution environment uses hardware to generate keys, and the key management service system is used for full-lifecycle encryption in data circulation, provides independent and unified key management, and supports independent key management systems. Including functions such as encryption key generation, distribution, backup, recovery, key out of the device, etc. The encryption key is uniformly protected by the master key, which is generated and managed by the key management service system through the hardware cryptographic device. Keep the master key safe.

Step S22: Generate a symmetric key in the trusted execution environment.

Further, a symmetric key K is generated in the above-mentioned trusted execution environment through the above-mentioned key management service system.

Step S23: Obtain the second public key embedded in the USBKey sent by the USBKey through user registration, and use the second public key to encrypt the first private key to obtain an encrypted private key.

For example, after a symmetric key K is generated in the trusted execution environment, the public key UK2 in the above-mentioned USBKey is sent to the above-mentioned privacy computing platform through user registration, and the above-mentioned privacy computing platform receives the above-mentioned public key After UK2, use the above-mentioned public key UK2 to encrypt the private key K1 in the above-mentioned asymmetric key to obtain the encrypted private key UK12.

Step S24: Using the first public key to encrypt the symmetric key to obtain an encrypted symmetric key.

Further, the above-mentioned symmetric key K is encrypted by using the public key K2 in the above-mentioned asymmetric key to obtain the encrypted symmetric key KK2.

Step S25: When the target data sent by the client is acquired, send the encrypted private key and the encrypted symmetric key to the client, so as to use the second private key pair built in the USBKey Decrypt the encrypted private key to obtain the first private key, and use the first private key to decrypt the encrypted symmetric key to obtain the symmetric key, and then use the symmetric key to The target data is encrypted to obtain target ciphertext.

In a specific embodiment, when the target data sent by the client is acquired, the above-mentioned encrypted private key UK12 and the above-mentioned encrypted symmetric key KK2 are issued to the client through the privacy computing platform, and then the The client automatically executes the script in the above-mentioned USBkey, and uses the above-mentioned private key UK1 to decrypt the above-mentioned encrypted private key UK12 to obtain the above-mentioned private key K1, and then uses the above-mentioned private key K1 to decrypt the above-mentioned encrypted symmetric key KK2, Obtain the symmetric key K, and finally use the above-mentioned symmetric key K locally on the client side to encrypt the local file to obtain the ciphertext KM, and further upload the above-mentioned ciphertext KM to the above-mentioned privacy computing platform for further save. It is understandable that the private key signature verification can be automatically performed in the USBKey through the built-in script, which can authorize the data set more conveniently and safely.

In addition, refer to Figure 4, which shows a specific private key signature verification process, first insert the USBKey into the privacy computing platform, and then use the above-mentioned private key UK1 to decrypt the above-mentioned encrypted private key UK12 to obtain The above-mentioned private key K1, and then use the above-mentioned private key K1 to decrypt the above-mentioned encrypted symmetric key KK2 to obtain the above-mentioned symmetric key K, and then synchronize the above-mentioned ciphertext KM to enter the trusted execution environment of the privacy computing platform, And synchronously enter the above-mentioned symmetric key K into the above-mentioned trusted execution environment, so as to use the above-mentioned symmetric key K to decrypt the above-mentioned ciphertext KM to obtain the plaintext M.

It can be seen that the private key protection scheme proposed in this application encrypts the private key distributed by the privacy computing platform through the public key in the public and private keys produced by USBKey at any time, and performs private key signature verification through the local USBKey on the client side, which can realize data The provider protects its own private key to prevent data security risks due to private key leakage, simplifies the process of private key verification, improves user experience, and does not need to manually execute scripts, making private key verification more convenient and safer. While protecting the security of the private key during transmission, it can quickly verify the signature of the private key and confirm the authenticity of the user twice.

Correspondingly, the embodiment of the present application also discloses a private key protection device, which is applied to a privacy computing platform, as shown in Figure 5, the device includes:

An asymmetric key generation module 11, configured to generate a pair of asymmetric keys in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key;

A symmetric key generation module 12, configured to generate a symmetric key in the trusted execution environment;

A public key acquisition module 13, configured to acquire the second public key sent by the USBKey and embedded in the USBKey;

A public key encryption module 14, configured to encrypt the first private key with the second public key to obtain the encrypted private key;

A symmetric key encryption module 15, configured to use the first public key to encrypt the symmetric key to obtain an encrypted symmetric key;

A key delivery module 16, configured to deliver the encrypted private key and the encrypted symmetric key to the client when the target data sent by the client is acquired;

Decryption module 17, configured to use the second private key built in the USBKey to decrypt the encrypted private key to obtain the first private key, and use the first private key to decrypt the encrypted symmetric key key to decrypt to obtain the symmetric key;

A data encryption module 18, configured to use the symmetric key to encrypt the target data to obtain target ciphertext.

For the specific work flow of each of the above modules, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

It can be seen that in the embodiment of the present application, a pair of asymmetric keys is first generated in the trusted execution environment of the privacy computing platform, and the first private key and the first public key are obtained, and then generated in the trusted execution environment A symmetric key, then obtain the second public key sent by the USBKey and built in the USBKey, and use the second public key to encrypt the first private key to obtain the encrypted private key, and then use the The first public key encrypts the symmetric key to obtain the encrypted symmetric key. When the target data sent by the client is obtained, the encrypted private key and the encrypted symmetric key are sent to the client. key, to use the second private key built in the USBKey to decrypt the encrypted private key to obtain the first private key, and use the first private key to decrypt the encrypted symmetric key decrypt to obtain the symmetric key, and then use the symmetric key to encrypt the target data to obtain target ciphertext. The embodiment of this application protects the security of the private key during the transmission process through the public key of the public and private keys produced by the USBKey at any time, and realizes that the data provider can protect its own private key, avoiding the private key from being leaked and copied during transmission risk, making private key transmission more secure.

In some specific embodiments, the asymmetric key generation module 11 may specifically include:

The first asymmetric key generation unit is configured to generate a pair of asymmetric keys through the key management service system in the trusted execution environment of the privacy computing platform to obtain a first private key and a first public key.

In some specific embodiments, the public key acquisition module 13 may specifically include:

The public key acquiring unit is configured to acquire the second public key embedded in the USBKey sent by the USBKey through user registration.

In some specific embodiments, after the data encryption module 18, it may also include:

a ciphertext sending unit, configured to send the target ciphertext to the privacy computing platform through the client;

A ciphertext storage unit, configured to store the target ciphertext through the privacy computing platform.

In some specific embodiments, before the asymmetric key generation module 11, it may also include:

A second asymmetric key generating unit, configured to randomly generate a pair of public and private keys through the USBKey, to obtain the second public key and the second private key;

A storage unit, configured to store the second public key and the second private key in the USBKey.

In some specific embodiments, after the data encryption module 18, it may also include:

A ciphertext decryption unit, configured to use the symmetric key to decrypt the target ciphertext to obtain the target data.

In some specific embodiments, before the key issuing module 16, it may also include:

An identity authentication unit, configured to use the built-in public key algorithm in the USBKey to authenticate the identity of the client, and if the authentication is passed, execute the sending of the encrypted private key and the encrypted private key to the client. Symmetric key steps.

Further, the embodiment of the present application also discloses an electronic device. FIG. 6 is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the figure should not be regarded as any limitation on the application scope of the present application.

FIG. 6 is a schematic structural diagram of an electronic device 20 provided by an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21 , at least one memory 22 , a power supply 23 , a communication interface 24 , an input/output interface 25 and a communication bus 26 . Wherein, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the private key protection method disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows is applicable Any communication protocol in the technical solution of the present application is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the external, and its specific interface type can be selected according to specific application needs, here Not specifically limited.

In addition, the memory 22, as a resource storage carrier, can be a read-only memory, random access memory, magnetic disk or optical disk, etc., and the resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage. .

Wherein, the operating system 221 is used to manage and control various hardware devices and computer programs 222 on the electronic device 20 , which may be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program 222 that can be used to complete the private key protection method performed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

Further, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned private key protection method is implemented. Regarding the specific steps of the method, reference may be made to the corresponding content disclosed in the foregoing embodiments, and details are not repeated here.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related information, please refer to the description of the method part.

Professionals can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of the two. In order to clearly illustrate the possible For interchangeability, in the above description, the composition and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.

The steps of the methods or algorithms described in connection with the embodiments disclosed herein may be directly implemented by hardware, software modules executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other Any other known storage medium.

Finally, it should also be noted that in this text, relational terms such as first and second etc. are only used to distinguish one entity or operation from another, and do not necessarily require or imply that these entities or operations, any such actual relationship or order exists. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

A private key protection method, device, device, and storage medium provided by this application have been described above in detail. In this article, specific examples are used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for To help understand the method and its core idea of this application; at the same time, for those of ordinary skill in the art, according to the idea of this application, there will be changes in the specific implementation and application scope. In summary, the content of this specification It should not be construed as a limitation of the application.

Claims (10)

1. A private key protection method applied to a private computing platform comprises the following steps:

generating a pair of asymmetric keys in a trusted execution environment of the privacy computing platform to obtain a first private key and a first public key;

generating a symmetric key in said trusted execution environment;

acquiring a second public key which is sent by the USBKey and is arranged in the USBKey, and encrypting the first private key by utilizing the second public key to obtain an encrypted private key;

encrypting the symmetric key by using the first public key to obtain an encrypted symmetric key;

when target data sent by a user side is obtained, the encrypted private key and the encrypted symmetric key are issued to the user side, so that the encrypted private key is decrypted by using a second private key arranged in the USBKey to obtain a first private key, the encrypted symmetric key is decrypted by using the first private key to obtain the symmetric key, and then the target data is encrypted by using the symmetric key to obtain a target ciphertext.

2. The method of claim 1, wherein generating an asymmetric pair of keys in a trusted execution environment of the private computing platform, resulting in a first private key and a first public key, comprises:

and generating a pair of asymmetric keys through a key management service system in a trusted execution environment of the privacy computing platform to obtain a first private key and a first public key.

3. The method for protecting the private key according to claim 1, wherein the obtaining the second public key sent by the USBKey and built in the USBKey comprises:

and acquiring a second public key which is sent by the USBKey through a user registration mode and is arranged in the USBKey.

4. The method for protecting a private key according to claim 1, wherein after encrypting the target data with the symmetric key to obtain a target ciphertext, the method further comprises:

and sending the target ciphertext to the privacy computing platform through the user side so as to store the target ciphertext through the privacy computing platform.

5. The method of claim 1, wherein prior to generating the pair of asymmetric keys in the trusted execution environment of the private computing platform, further comprising:

and randomly generating a pair of public and private keys through the USBKey to obtain the second public key and the second private key, and placing the second public key and the second private key in the USBKey.

6. The method of claim 1, wherein after encrypting the target data with the symmetric key to obtain a target ciphertext, the method further comprises:

and decrypting the target ciphertext by using the symmetric key to obtain the target data.

7. The method according to any one of claims 1 to 6, wherein before the sending the encrypted private key and the encrypted symmetric key to the user side, the method further comprises:

and authenticating the identity of the user side by using a public key algorithm built in the USBKey, and if the authentication is passed, executing the step of issuing the encrypted private key and the encrypted symmetric key to the user side.

8. A private key protection device applied to a private computing platform, comprising:

the asymmetric key generation module is used for generating a pair of asymmetric keys in a trusted execution environment of the privacy computing platform to obtain a first private key and a first public key;

a symmetric key generation module, configured to generate a symmetric key in the trusted execution environment;

the public key acquisition module is used for acquiring a second public key which is sent by the USBKey and is arranged in the USBKey;

the public key encryption module is used for encrypting the first private key by using the second public key to obtain an encrypted private key;

the symmetric key encryption module is used for encrypting the symmetric key by using the first public key to obtain an encrypted symmetric key;

the key issuing module is used for issuing the encrypted private key and the encrypted symmetric key to the user side when target data sent by the user side is acquired;

the decryption module is used for decrypting the encrypted private key by using a second private key arranged in the USBKey to obtain the first private key, and decrypting the encrypted symmetric key by using the first private key to obtain the symmetric key;

and the data encryption module is used for encrypting the target data by using the symmetric key to obtain a target ciphertext.

9. An electronic device comprising a processor and a memory; wherein the processor, when executing the computer program stored in the memory, implements the private key protection method of any of claims 1 to 7.

10. A computer-readable storage medium for storing a computer program; wherein the computer program when executed by a processor implements the private key protection method of any one of claims 1 to 7.

Images