HK1261951B - Data key protection method, device and system - Google Patents

Description

Data key protection method, device and system

Technical Field

The present invention relates to the field of trusted computing technology, and in particular to a method, device and system for protecting a data key.

Background Art

Trusted computing can provide security protection while performing calculations, so that the calculation results are always consistent with expectations, and the entire calculation process is measurable and controllable without interference.

Currently, trusted computing has two technical routes: the domestic Trusted Platform Control Module (TPCM) and the Trusted Platform Module (TPM) of the international Trusted Computing Group (TCG) standard organization.

The core elements of trusted computing are the trusted chain and the root of trust. The Trusted Platform Module (TPM), as defined in the TCG specification, is the hardware root of trust for the trusted computing platform. The TPM is a security chip that provides protected secure storage and cryptographic computing capabilities. The TPM is physically connected to the computing platform and to the CPU via an external bus. For example, on a PC, it is directly embedded in the motherboard and connected via the Linear Predictive Coding (LPC) bus.

The TCG specification defines trusted as: an entity that consistently operates in a predictable manner for a specific purpose. The core mechanism of trusted computing is to build a trusted computing environment through a trust chain mechanism. The trustworthiness of a currently operating entity is based on the trustworthiness of the system's previous operating processes. Based on this trust relationship, if the system starts from an initial root of trust, this trust can be maintained through a transitive process with each transition in the platform computing environment, thereby establishing a trust chain of verification and trust on the computing platform. This ensures that the computing environment remains trustworthy and can be trusted by local users or remote entities. Figure 1 shows the structure of the TCG trust chain.

The key technologies of trusted computing include trusted measurement, trusted reporting, trusted storage, and trusted network connections.

The Trusted Platform Control Module (TPCM) implements the basic functions of a Trusted Platform Module (TPM). Its functional components are essentially the same as those of a TPM. However, because the TPM's Core Root of Trust for Measurement (CRTM) resides in the Basic Input Output System (BIOS) and is not protected by the TPM, the TPCM proposes a new trusted measurement root design that addresses the starting measurement point of the trusted measurement root and changes the startup and measurement sequence. This establishes a trust chain measurement process with the chip as the trust root, enabling the chip to control the entire system's startup, I/O interface control, and system configuration, demonstrating its control over system trustworthiness.

During the computing platform's operational control transfer process, the trusted root (TPCM) determines whether the authenticity and integrity of its next-level execution code have been tampered with. If not, the system transfers operational control to the next-level trusted execution code, expanding the system's trusted scope to the next-level functional code. Similarly, this continuous transfer of system control enables the establishment and transfer of a trust chain, ultimately achieving system-wide trust. A complete system trust transfer process begins with the trusted root. System control is sequentially transferred from the trusted platform control module to the trusted BIOS, then to the trusted operating system loader, from the trusted operating system loader to the trusted operating system, and finally from the trusted operating system to the trusted application.

Among them, in the existing financial encryption machine data key protection method:

The banking industry uses the standard ANSI X9.17, which is a three-tiered key system. It places strict restrictions on the functions of different keys (especially working keys), and specifies that specific keys are used for specific purposes. Figure 2 shows a diagram of the key hierarchy.

The first layer is the encryption machine master key (Master Key, abbreviated as MK or LMK), the second layer is the bank master key (BankMaster Key, abbreviated as BMK or ZMK), and the third layer is the working key including the message integrity key (MAK), PIN protection key (PI K), and terminal key (TMK).

The first layer, MK, is the encryption machine master key. It consists of three components and uses a double standard 3DES key (up to 128 characters). It is stored in the hardware encryption machine. Its role is to protect the encryption keys of various keys and critical data stored outside the encryption machine.

The second layer, the BMK, is often called a key encryption key (Kev) or key exchange key. It encrypts the working key transmitted over the communication line using either a symmetric (DES) algorithm or an asymmetric (RSA) algorithm, thereby enabling automatic distribution of working keys. In a local or shared network, different communication nodes use different Kev encryption keys, thus achieving a division of labor for key management. When stored locally, the key is encrypted by the local MK or stored directly in a hardware encryption device.

The third layer, commonly referred to as working keys or data keys, includes PIK, MAK, TMK (including TPK and TAK), and other keys. Its function is to encrypt various data, thereby achieving data confidentiality, information authentication, and digital signatures. When these data keys are stored locally, they are encrypted by the BMK or directly stored in a hardware encryption device.

As shown in Figure 3, Figure 3 is a schematic diagram of the typical deployment structure of the encryption machine. The typical deployment includes the encryption machine, the user terminal, and the system application host. An application host can be used specifically to install the authorization system. When the user uses the data key, the certificate and password are uploaded from the client and transmitted to the authorization system in an encrypted form using the transmission key. Only after the authorization system identifies the user as a legitimate user will it allow the data key to be called from the encryption machine in plain text to the application host for data encryption and decryption services.

However, the drawback of this solution is that the encryption machine transmits the data key to the server connected to the encryption machine, and the data key is transmitted in plain text, which poses certain risks; the authentication method of the credential certificate and password requires the generation and management and maintenance costs of the certificate; an additional device is required to store the password. If this device is not available, and the password is memorized in the mind, there is a risk that the data key cannot be used due to amnesia.

In addition to the above schemes, the protection of keys in trusted computing also includes: the trusted chip protection data key method, in which the trusted chip protection data key method stores the user data key in the trusted chip. When the key is needed, the user password is used to obtain the permission to use the data key.

However, the drawback of this solution is that it requires an additional device dedicated to storing passwords. Without this device, if the password is memorized in the brain, there is a risk of amnesia, making the data key unusable.

With respect to the above-mentioned problem of easy leakage of keys in the prior art, no effective solution has been proposed yet.

Summary of the Invention

The embodiments of the present invention provide a method, device and system for protecting a data key, so as to at least solve the technical problem in the prior art that keys are easily leaked.

According to one aspect of an embodiment of the present invention, a method for protecting a data key is provided, including: a user identity management subsystem server receives a first key acquisition request sent by a user terminal, wherein the first key acquisition request includes the user's identity authentication information; the user identity management subsystem server returns voice information to be verified to the user terminal based on the first key acquisition request; the user identity management subsystem server receives the user voice uploaded by the user terminal based on the voice information to be verified; the user identity management subsystem server extracts the voiceprint features of the user voice, and generates a second key acquisition request based on the voiceprint features and the identity authentication information; the user identity management subsystem server sends the second key acquisition request to the trusted chip.

Optionally, when the authentication information includes an identity information identifier and a key handle, the user identity management subsystem server extracts the voiceprint features of the user's voice, and generates a second key acquisition request based on the voiceprint features and the authentication information, including: the user identity management subsystem server extracts the voiceprint features in the user's voice; the user identity management subsystem server encrypts the voiceprint features, identity information identifier and key handle through the public key of the trusted chip to generate a second key acquisition request.

Optionally, when the identity authentication information includes a trusted certificate, an identity information identifier and a key handle, the user identity management subsystem server returns the voice information to be verified to the user terminal based on the first key acquisition request, including: the user identity management subsystem server decrypts the first key acquisition request based on the user identity management subsystem private key, wherein the first key acquisition request is encrypted by the user identity management subsystem public key; the user identity management subsystem private key corresponds to the user identity management subsystem public key; the user identity management subsystem server parses the decrypted first key acquisition request and obtains the trusted certificate in the first key acquisition request; the user identity management subsystem server determines whether the trusted certificate meets the preset verification conditions; if the judgment result is yes, the user identity management subsystem server returns the voice information to be verified to the user terminal, wherein the voice information to be verified includes: the user identity management subsystem certificate and the voice to be verified.

Further, optionally, the user identity management subsystem server extracts the voiceprint features of the user's voice, and generates a second key acquisition request based on the voiceprint features and identity authentication information, including: the user identity management subsystem server decrypts the user's voice based on the user identity management subsystem private key to obtain a random number, data to be encrypted or decrypted, and a sound to be verified; the user identity management subsystem server extracts the voiceprint features of the sound to be verified; the user identity management subsystem server encrypts the voiceprint features, random numbers, data to be encrypted or decrypted, identity information identifier, and key handle through the public key of the trusted chip to generate a second key acquisition request.

According to one aspect of an embodiment of the present invention, another method for protecting data keys is provided, including: a trusted chip receiving a key acquisition request, wherein the key acquisition request includes: a voiceprint feature; wherein the trusted chip is a data processing chip that performs encryption or decryption calculations through a built-in independent processor and memory; the trusted chip parses the key acquisition request, and compares the voiceprint feature in the key acquisition request with a pre-stored voiceprint feature; if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip returns a key response information to the user terminal.

Optionally, when the key acquisition request includes voiceprint features, identity information identifier and key handle, the trusted chip parses the key acquisition request and compares the voiceprint features in the key acquisition request with the pre-stored voiceprint features, including: the trusted chip decrypts the key acquisition request through the private key of the trusted chip and extracts the voiceprint features, wherein the key acquisition request is encrypted through the public key of the trusted chip; the public key of the trusted chip corresponds to the private key of the trusted chip; the trusted chip compares the voiceprint features with the pre-stored voiceprint features to determine whether the voiceprint features are the same as the pre-stored voiceprint features.

Furthermore, optionally, if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip returns key response information to the user terminal, including: if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip extracts the corresponding data key based on the voiceprint feature; the trusted chip encrypts the data key through the public key of the user terminal to generate key response information; the trusted chip returns the key response information to the user terminal.

Optionally, when the key acquisition request includes voiceprint features, random numbers, data to be encrypted or decrypted, identity information identifier and key handle, the trusted chip parses the key acquisition request and compares the voiceprint features in the key acquisition request with pre-stored voiceprint features, including: the trusted chip decrypts the key acquisition request through the private key of the trusted chip to obtain the voiceprint features, wherein the key acquisition request is encrypted through the public key of the trusted chip; the public key of the trusted chip corresponds to the private key of the trusted chip; the trusted chip compares the voiceprint features with the pre-stored voiceprint features to determine whether the voiceprint features are the same as the pre-stored voiceprint features.

Further, optionally, if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip returns key response information to the user terminal, including: if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip extracts the corresponding data key based on the voiceprint feature; the trusted chip encrypts or decrypts the data to be encrypted or decrypted based on the data key to obtain encrypted information or decrypted information; the trusted chip performs a preset calculation on the random number and the encrypted information or decrypted information to obtain the calculation result; the trusted chip encrypts the calculation result through the public key of the user terminal to generate key response information; the trusted chip returns the key response information to the user terminal.

According to one aspect of an embodiment of the present invention, another method for protecting a data key is provided, including: a user terminal sends a key acquisition request to a user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information; the user terminal receives voice information to be verified returned by the user identity management subsystem server; the user terminal uploads user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; the user terminal receives key response information returned by the trusted chip, wherein the key response information corresponds to the user voice uploaded to the user identity management subsystem server.

Optionally, when the identity authentication information includes an identity information identifier and a key handle, the key acquisition request sent by the user terminal to the user identity management subsystem server includes: the user terminal generates a key acquisition request based on the identity information identifier and the key handle; the user terminal sends the key acquisition request to the user identity management subsystem server.

Further, optionally, after the user terminal receives the key response information returned by the trusted chip, the method also includes: the user terminal decrypts the key response information based on the user terminal's private key to obtain the data key carried by the key response information, wherein the key response information is encrypted by the user terminal's public key, and the user terminal's public key corresponds to the user terminal's private key; the user terminal encrypts or decrypts the data to be encrypted or decrypted based on the data key to obtain encrypted data information or decrypted information.

Optionally, when the identity authentication information includes a trusted certificate, an identity information identifier and a key handle, the key acquisition request sent by the user terminal to the user identity management subsystem server includes: the user terminal encrypts the trusted certificate, identity information identifier and key handle through the user identity management subsystem public key to generate a key acquisition request; the user terminal sends the key acquisition request to the user identity management subsystem server.

Further, optionally, after the user terminal receives the voice information to be verified returned by the user identity management subsystem server, the method also includes: the user terminal parses the voice information to be verified to obtain the user identity management subsystem certificate and the voice to be verified; the user terminal determines whether the user identity management subsystem certificate meets the preset verification conditions; if the judgment result is yes, the user terminal receives the sound signal of the voice to be verified read aloud by the user; the user terminal encrypts the random number, the sound signal and the data to be encrypted or decrypted using the user identity management subsystem public key to obtain the user voice; the user terminal uploads the user voice to the user identity management subsystem server.

Optionally, after the user terminal receives the key response information returned by the trusted chip, the method also includes: the user terminal decrypts the key response information using the user terminal's private key to obtain the calculation result in the key response information; the user terminal verifies the calculation result based on a random number combined with a preset algorithm to determine whether the transportation result meets the preset verification standard; if the judgment result is yes, the user terminal uses the calculation result.

According to one aspect of an embodiment of the present invention, another method for protecting a data key is provided, comprising: a user terminal sends a key acquisition request to a user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information; the user terminal receives the voice information to be verified returned by the user identity management subsystem server; the user terminal uploads the user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; the user terminal receives the voiceprint feature extracted from the user voice by the user identity management subsystem server; the trusted chip in the user terminal compares the voiceprint feature with the pre-stored voiceprint feature; if the voiceprint feature matches the pre-stored voiceprint feature, the trusted chip in the user terminal extracts the data key corresponding to the voiceprint feature; the user terminal performs corresponding operations based on the data key.

Optionally, before the user terminal sends a key acquisition request to the user identity management subsystem server, the method also includes: the trusted chip in the user terminal imports the pre-acquired identity information identifier and voiceprint feature; the trusted chip in the user terminal encrypts the voiceprint feature based on the trusted storage root key, and stores the encrypted voiceprint feature; the trusted chip in the user terminal generates a data key based on a preset encryption algorithm and identity information identifier, and returns the key handle of the data key to the user terminal; the trusted chip in the user terminal maps the data key, identity information identifier and voiceprint feature to obtain a mapping relationship among the data key, identity information identifier and voiceprint feature, and stores the mapping relationship and the data key.

According to an aspect of another embodiment of the present invention, a method for protecting a data key is provided, comprising: obtaining user login information and triggering a key acquisition request, wherein the key acquisition request includes the user's identity authentication information; obtaining corresponding voice information to be verified based on the key acquisition request; receiving user voice input by the user based on the voice information to be verified; extracting the user's voiceprint features based on the user voice; comparing the voiceprint features with pre-stored voiceprint features through a trusted chip; if the voiceprint features match the pre-stored voiceprint features, extracting the data key corresponding to the voiceprint features through the trusted chip; and performing corresponding operations based on the data key.

According to another aspect of an embodiment of the present invention, a data key protection device is also provided, including: a first receiving module for receiving a first key acquisition request sent by a user terminal, wherein the first key acquisition request includes the user's identity authentication information; a first sending module for returning voice information to be verified to the user terminal based on the first key acquisition request; a second receiving module for receiving the user voice uploaded by the user terminal based on the voice information to be verified; a request generating module for extracting the voiceprint features of the user voice, and generating a second key acquisition request based on the voiceprint features and the identity authentication information; a second sending module for sending the second key acquisition request to the trusted chip.

According to another aspect of an embodiment of the present invention, another data key protection device is provided, including: a third receiving module for receiving a key acquisition request, wherein the key acquisition request includes: a voiceprint feature; a parsing module for parsing the key acquisition request and comparing the voiceprint feature in the key acquisition request with the pre-stored voiceprint feature; a third sending module for returning key response information to the user terminal if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature.

According to another aspect of an embodiment of the present invention, another data key protection device is provided, including: a fourth sending module, used to send a key acquisition request to the user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information; a fourth receiving module, used to receive the voice information to be verified returned by the user identity management subsystem server; a fifth sending module, used to upload the user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; a fifth receiving module, used to receive the key response information returned by the trusted chip, wherein the key response information corresponds to the user voice uploaded to the user identity management subsystem server.

According to another aspect of an embodiment of the present invention, there is provided another data key protection device, including: a sixth sending module, used to send a key acquisition request to the user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information; a sixth receiving module, used to receive the voice information to be verified returned by the user identity management subsystem server; a seventh sending module, used to upload the user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; a seventh receiving module, used to receive the voiceprint features extracted from the user voice by the user identity management subsystem server; a feature comparison module, used to compare the voiceprint features with pre-stored voiceprint features; a key extraction module, used to extract the data key corresponding to the voiceprint features by the trusted chip in the user terminal if the voiceprint features match the pre-stored voiceprint features; and a data protection module, used to perform corresponding operations based on the data key.

According to one aspect of another embodiment of the present invention, a data key protection device is also provided, including: an information acquisition module, used to obtain user login information and trigger a key acquisition request, wherein the key acquisition request includes the user's identity authentication information; an information acquisition module to be verified, used to obtain corresponding voice information to be verified based on the key acquisition request; a receiving module, used to receive the user voice entered by the user based on the voice information to be verified; an extraction module, used to extract the user's voiceprint features based on the user voice; a feature comparison module, used to compare the voiceprint features with pre-stored voiceprint features through a trusted chip; a key extraction module, used to extract the data key corresponding to the voiceprint features through the trusted chip if the voiceprint features match the pre-stored voiceprint features; and a data protection module, used to perform corresponding operations based on the data key.

According to another aspect of an embodiment of the present invention, a data key protection system is also provided, including: a user voiceprint identity management subsystem and a trusted chip management subsystem, wherein the user voiceprint identity management subsystem is used to obtain each user's identity information and voiceprint characteristics; the trusted chip management subsystem is used to generate a corresponding key based on each user's identity information and voiceprint characteristics.

Optionally, the user voiceprint identity management subsystem includes: a user identity registration module, a voiceprint identity registration module, a voiceprint feature model establishment module and a voiceprint feature extraction module, wherein the user identity registration module is used to receive user identity information submitted by the user terminal, generate an identity information identifier based on the user identity information, and return the identity information identifier to the user terminal; the voiceprint identity registration module is used to receive a voiceprint registration request submitted by the user terminal, return voiceprint response information to the user terminal, and receive user voice uploaded by the user terminal based on the voiceprint response information; wherein the voiceprint response information includes text information to be verified, and the text information is used to instruct the user terminal to collect the user voice; the voiceprint feature extraction module is used to extract the voiceprint features of the user voice; and the voiceprint feature model establishment module is used to establish a voiceprint feature model based on the voiceprint features.

Furthermore, optionally, the trusted chip management subsystem includes: a user information import module, a voiceprint feature storage module, a user data key creation module, a user data key storage module, a voiceprint feature comparison module and a data key usage module, wherein the user information import module is used to import the identity information identifier and the voiceprint feature into the trusted chip when the user information includes the identity information identifier and the voiceprint feature; the voiceprint feature storage module is used to encrypt the voiceprint feature according to the trusted storage root key and store the encrypted voiceprint feature; the user data key creation module is used to generate a data key according to a preset encryption algorithm and the identity information identifier, and store the data key. The key handle of the key is returned to the user terminal; the user data key storage module is used to map the data key, identity information identifier and voiceprint feature, obtain the mapping relationship between the data key, identity information identifier and voiceprint feature, and store the mapping relationship and the data key; the voiceprint feature comparison module is used to extract the user voice uploaded by the user terminal when the user terminal requests to obtain the data key, and compare the extracted voiceprint features of the user voice with the voiceprint features in the mapping relationship in the user data key storage module; the data key usage module is used to feedback the data key to the user terminal after the comparison is passed, so that the user terminal performs encryption/decryption operations based on the data key.

According to another aspect of an embodiment of the present invention, a storage medium is provided. The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned data key protection method.

According to yet another aspect of an embodiment of the present invention, a processor is provided, which is configured to run a program, wherein the above-mentioned data key protection method is executed when the program is running.

According to another aspect of an embodiment of the present invention, a computing device is provided, including a processor and a memory, wherein a program is stored in the memory and the processor is used to run the program, wherein when the program is run, the processor is adapted to execute the above-mentioned data key protection method.

In an embodiment of the present invention, a first key acquisition request sent by a user terminal is received by a user identity management subsystem server, wherein the first key acquisition request includes the user's identity authentication information; the user identity management subsystem server returns the voice information to be verified to the user terminal based on the first key acquisition request; the user identity management subsystem server receives the user voice uploaded by the user terminal based on the voice information to be verified; the user identity management subsystem server extracts the voiceprint features of the user voice, and generates a second key acquisition request based on the voiceprint features and the identity authentication information; the user identity management subsystem server sends the second key acquisition request to the trusted chip, thereby achieving the purpose of securely obtaining the key, thereby realizing the technical effect of securely obtaining the key, and further solving the technical problem of easy leakage of the key in the existing technology.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

Figure 1 is a schematic diagram of the structure of the TCG trust chain;

Figure 2 is a diagram of the key system architecture;

Figure 3 is a schematic diagram of a typical deployment structure of an encryption machine;

FIG4 is a flow chart of a method for protecting a data key according to a first embodiment of the present invention;

FIG5 is a flow chart of a method for protecting a data key according to a second embodiment of the present invention;

6 is a hardware structure block diagram of a computer terminal of a data key protection method according to a third embodiment of the present invention;

FIG7 a is a flow chart of a method for protecting a data key according to a third embodiment of the present invention;

7b is a schematic diagram showing the connection between the embedded trusted chip in the user identity management subsystem server and the user terminal in the data key protection method according to the third embodiment of the present invention;

FIG8 is a flowchart of a method for protecting a data key according to a fourth embodiment of the present invention;

9a is a schematic diagram showing the connection between a user identity management subsystem server and a trusted chip embedded in a user terminal in a method for protecting a data key according to an embodiment of the present invention;

9b is a schematic diagram of the interaction between the user identity management subsystem server, the trusted chip, and the user terminal in a data key protection method according to an embodiment of the present invention;

10 is a schematic diagram of the interaction between the user identity management subsystem server, the trusted chip and the user terminal in another data key protection method according to an embodiment of the present invention;

FIG11a is a flow chart of a method for protecting a data key according to a fifth embodiment of the present invention;

FIG11b is a schematic diagram of a trusted chip embedded in a user terminal in a method for protecting a data key according to a fifth embodiment of the present invention;

FIG12 is a schematic structural diagram of a data key protection device according to Embodiment 6 of the present invention;

FIG13 is a schematic structural diagram of a data key protection device according to Embodiment 7 of the present invention;

FIG14 is a schematic structural diagram of a data key protection device according to Embodiment 8 of the present invention;

FIG15 is a schematic structural diagram of a data key protection device according to Embodiment 9 of the present invention;

FIG16 is a schematic structural diagram of a data key protection device according to Embodiment 10 of the present invention;

FIG17 is a schematic structural diagram of a data key protection system according to an eleventh embodiment of the present invention;

FIG18 is a schematic structural diagram of a data key protection system according to an eleventh embodiment of the present invention.

DETAILED DESCRIPTION

In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

Example 1

The present application provides a data key protection method as shown in Figure 4. On the user identity management subsystem server side, Figure 4 is a flow chart of a data key protection method according to embodiment 1 of the present invention.

According to one aspect of an embodiment of the present invention, a method for protecting a data key is provided, comprising:

Step S402: The user identity management subsystem server receives a first key acquisition request sent by a user terminal, wherein the first key acquisition request includes the user's identity authentication information;

In the above step S402 of the present application, the data key protection method provided in this embodiment can be applied to trusted computing, wherein the user identity management subsystem server can be used to interact with the mobile terminal used by the user, receive various requests from the user through the mobile terminal used by the user, and feedback responses based on the various requests to the user.

Specifically, the data key protection method provided in this embodiment can be specifically applied to Internet technology applications, especially the trusted computing required when users perform online identity authentication, information encryption and decryption. Taking online banking as an example, when a user conducts online transactions, the user identity management subsystem receives a first key acquisition request sent by the user terminal. The first key acquisition request can be used to guide the user to enter his or her own account and obtain the key required for online payment, avoiding the unreliability problem caused by manual key memorization or encryption machine storage in the existing technology. This unreliability problem can be reflected in: manual key memorization will lead to key forgetting; encryption machine transmission of key messages will cause key leakage.

At the beginning of verification, the user identity management subsystem server receives a first key acquisition request sent by the user terminal, which includes the user's identity authentication information. The user terminal may include: smartphones, laptops, tablets, desktop computers, handheld businesses, and smart wearable devices.

Step S404: The user identity management subsystem server returns the voice information to be verified to the user terminal according to the first key acquisition request;

In the above-mentioned step S404 of the present application, based on the first key acquisition request received by the user identity management subsystem server in step S402, the user identity management subsystem server parses the first key acquisition request and verifies the user's identity authentication information in the first key acquisition request. If the verification is successful, the voice information to be verified is fed back to the user terminal. The voice information to be verified may include: a series of numbers; or characters randomly composed of numbers and characters without deformation.

Step S406: The user identity management subsystem server receives the user voice uploaded by the user terminal based on the voice information to be verified;

In the above-mentioned step S406 of the present application, based on the voice information to be verified returned by the user identity management subsystem server to the user terminal in step S404, the user identity management subsystem server receives the user voice uploaded by the user terminal, wherein the user voice is the sound information generated when the user reads the voice information to be verified and obtained by the sound receiving device of the user terminal, and the sound information is uploaded to the user identity management subsystem server in the form of audio, wherein the uploading process can be to convert the analog signal into a digital signal through the user terminal, encode the digital signal and send it to the user identity management subsystem server in the form of a message, and then decode it on the user identity management subsystem server side to obtain the digital signal, which can correspond to the voiceprint of the user during the reading process.

Step S408: The user identity management subsystem server extracts the voiceprint features of the user's voice and generates a second key acquisition request based on the voiceprint features and the identity verification information;

In the above-mentioned step S408 of the present application, based on the user voice received by the user identity management subsystem server in step S406, the voiceprint feature of the user voice is extracted, and a second key acquisition request is generated based on the voiceprint feature and the user's identity authentication information obtained when the first key acquisition request is received in step S402.

In step S410 , the user identity management subsystem server sends a second key acquisition request to the trusted chip.

In the above step S410 of the present application, based on the second key acquisition request generated by the user identity management subsystem server in step S408, the user identity management subsystem server sends the second key acquisition request to the trusted chip.

In the data key protection method provided in the embodiment of the present application, a first key acquisition request sent by a user terminal is received by a user identity management subsystem server, wherein the first key acquisition request includes the user's identity authentication information; the user identity management subsystem server returns the voice information to be verified to the user terminal based on the first key acquisition request; the user identity management subsystem server receives the user voice uploaded by the user terminal based on the voice information to be verified; the user identity management subsystem server extracts the voiceprint features of the user voice, and generates a second key acquisition request based on the voiceprint features and the identity authentication information; the user identity management subsystem server sends the second key acquisition request to the trusted chip, thereby achieving the purpose of securely obtaining the key, thereby realizing the technical effect of securely obtaining the key, and thus solving the technical problem of easy leakage of the key in the existing technology.

Specifically, based on the above steps S402 to S410, the data key protection method provided in this embodiment has two implementation methods, which are specifically implemented as follows:

Method 1: Authentication information includes: identity information identifier and key handle.

Optionally, when the identity authentication information includes an identity information identifier and a key handle, the user identity management subsystem server extracts the voiceprint features of the user's voice in step S408, and generates a second key acquisition request based on the voiceprint features and the identity authentication information, including:

Step 1: The user identity management subsystem server extracts the voiceprint features from the user's voice;

In the above-mentioned Step 1 of the present application, when the identity authentication information includes an identity information identifier and a key handle, based on steps S402 to S406, the user identity management subsystem server receives a first key acquisition request carrying the identity information identifier and the key handle sent by the user terminal, and feeds back the voice information to be verified to the user terminal. The user identity management subsystem server receives the user voice uploaded by the user terminal based on the voice information to be verified, and the user identity management subsystem server extracts the voiceprint features in the user voice.

Step 2: The user identity management subsystem server encrypts the voiceprint feature, identity information identifier and key handle through the public key of the trusted chip to generate a second key acquisition request.

In the above Step 2 of the present application, based on the voiceprint features extracted in Step 1, the user identity management subsystem server encrypts the voiceprint features, identity information identifier and key handle according to the public key of the trusted chip obtained in advance, thereby generating a second key acquisition request.

Method 2: Authentication information includes: trusted certificate, identity information identifier and key handle.

Optionally, when the identity authentication information includes a trusted certificate, an identity information identifier, and a key handle, the user identity management subsystem server returns the voice information to be verified to the user terminal according to the first key acquisition request in step S404, including:

Step 1: The user identity management subsystem server decrypts the first key acquisition request using the user identity management subsystem private key, wherein the first key acquisition request is encrypted using the user identity management subsystem public key; the user identity management subsystem private key corresponds to the user identity management subsystem public key;

In the above Step 1 of the present application, different from the method of implementing the data key protection method provided in this embodiment in method 1, in method 2, after the user identity management subsystem server receives the first key acquisition request in step S402, the first key acquisition request is encrypted by the user identity management subsystem public key and carries a trusted certificate. It is different from method 1 in transmission. Since it is encrypted by the user identity management subsystem public key and carries a trusted certificate, it is guaranteed in transmission that even if the message is leaked, it will not be leaked, and it is more secure by verifying the trusted certificate.

Step 2: The user identity management subsystem server parses the decrypted first key acquisition request and obtains the trusted certificate in the first key acquisition request;

In the above-mentioned Step 2 of the present application, based on the decryption of the first key acquisition request by the user identity management subsystem server, the user identity management subsystem server obtains the trusted certificate in the first key acquisition request.

Step 3: The user identity management subsystem server determines whether the trusted certificate meets the preset verification conditions;

In Step 3 of the present application, based on the trusted certificate obtained in Step 2, the user identity management subsystem server determines whether the trusted certificate meets the preset verification conditions, that is, determines the authenticity of the trusted certificate. If it is not a trusted certificate stored by the user identity management subsystem server, it is determined that the trusted certificate is illegal and the key acquisition process for the user is stopped. If so, Step 4 is executed.

Step 4: If the judgment result is yes, the user identity management subsystem server returns the voice information to be verified to the user terminal, wherein the voice information to be verified includes: the user identity management subsystem certificate and the voice to be verified.

In the above Step 4 of the present application, if the judgment result is yes, that is, the trusted certificate meets the preset verification conditions, the user identity management subsystem server returns the sound information to be verified to the user terminal, wherein the sound information to be verified is different from method one. In addition to the voice to be verified, the user identity management subsystem certificate must also be added in method two.

Furthermore, optionally, in step S408, the user identity management subsystem server extracts the voiceprint features of the user's voice, and generates a second key acquisition request based on the voiceprint features and the identity verification information, including:

Step 1: The user identity management subsystem server decrypts the user's voice using the user identity management subsystem private key to obtain a random number, the data to be encrypted or decrypted, and the voice to be verified.

In the above-mentioned Step 1 of the present application, after the user identity management subsystem server returns the sound information to be verified to the user terminal, the user identity management subsystem server receives the user voice uploaded by the user terminal. The difference between this user voice and method one is that, in addition to the user's voice, it also carries a random number uploaded by the user terminal and data to be encrypted or decrypted.

Step 2: The user identity management subsystem server extracts the voiceprint features of the voice to be verified;

In the above Step 2 of the present application, based on the decryption of the user's voice in Step 1, the user identity management subsystem server extracts the voiceprint features of the sound to be verified.

Step 3: The user identity management subsystem server encrypts the voiceprint feature, random number, data to be encrypted or decrypted, identity information identifier and key handle through the public key of the trusted chip to generate a second key acquisition request.

In the above Step 3 of the present application, the user identity management subsystem server encrypts the voiceprint feature, random number, data to be encrypted or decrypted, identity information identifier and key handle based on the pre-acquired public key of the trusted chip to generate a second key acquisition request.

In summary, in the data key protection method provided in the embodiment of the present application, the user obtains the key from the trusted chip through the user terminal via the user identity management subsystem server. On the user identity management subsystem server side, this is the above-mentioned embodiment 1. It should be noted that in the process of implementing the above process, the user identity management subsystem server includes the following functions:

User identity registration: The user terminal submits user identity related information to the user voiceprint identity management system in the user identity management subsystem server, and the user voiceprint identity management system feeds back the user identity identifier UID to the user voiceprint identity management system.

Voiceprint identity registration: The user terminal submits an identity registration request to the voiceprint verification server using voiceprint feature login. The voiceprint verification server responds to the request and pushes a series of random numbers and letters without distortion.

Voiceprint feature model establishment: Based on the extracted user voiceprint features, a user voiceprint feature model is established;

Voiceprint feature extraction: The user terminal orally speaks the characters pushed by the voiceprint verification server, and the voiceprint verification server samples the user's voice and extracts its voiceprint features.

Example 2

The present application provides a data key protection method as shown in Figure 5. On the trusted chip side, Figure 5 is a flow chart of a data key protection method according to a second embodiment of the present invention.

Step S502: The trusted chip receives a key acquisition request, wherein the key acquisition request includes a voiceprint feature; wherein the trusted chip is a data processing chip that performs encryption or decryption calculations through a built-in independent processor and memory;

In the above S502 of the present application, different from Example 1, the data key protection method provided in this embodiment can be applied to a trusted chip, wherein the trusted chip can be located in the user identity management subsystem server, or can be independent of the user identity management subsystem server to establish an independent trusted chip voiceprint feature and data key management subsystem.

Specifically, when a user obtains a key from a trusted chip through a user terminal via a user identity management subsystem server, the trusted chip receives a key acquisition request sent by the user identity management subsystem server, so that the trusted chip determines whether to allocate a corresponding key to the user by verifying the information in the key acquisition request. In this embodiment, the trusted chip verifies the user's key request through voiceprint features. The specific steps are shown in steps S504 and S506.

Step S504: The trusted chip parses the key acquisition request and compares the voiceprint features in the key acquisition request with pre-stored voiceprint features;

In the above S504 of the present application, based on the key acquisition request received by the trusted chip in step S502, the trusted chip parses the key acquisition request to obtain the voiceprint features in the key acquisition request, and compares the voiceprint features in the key acquisition request with the pre-stored voiceprint features.

Specifically, each user who successfully registers on the user identity management subsystem server will have the identity information identifier and the voiceprint feature corresponding to the identity information identifier, as well as the corresponding key, stored in the trusted chip. Therefore, if the key is to be obtained, the user's identity needs to be verified. By comparing the identity information identifier and the voiceprint feature corresponding to the identity information identifier sent by the user with the pre-stored identity information identifier and the voiceprint feature corresponding to the identity information identifier, the trusted chip can determine whether to feed the key back to the user.

Step S506: If the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip returns key response information to the user terminal.

In the above S506 of the present application, if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip returns key response information to the user terminal.

In the data key protection method provided in the embodiment of the present application, a key acquisition request sent by a user identity management subsystem server is received through a trusted chip, wherein the key acquisition request includes: voiceprint features; the trusted chip parses the key acquisition request and compares the voiceprint features in the key acquisition request with the pre-stored voiceprint features; if the voiceprint features in the key acquisition request match the pre-stored voiceprint features, the trusted chip returns key response information to the user terminal, thereby achieving the purpose of secure key acquisition, thereby realizing the technical effect of secure key acquisition, and further solving the technical problem of easy key leakage in the existing technology.

Specifically, based on the above steps S502 to S506, the data key protection method provided in this embodiment has two implementation methods, which are specifically implemented as follows:

Method 1: The key acquisition request includes voiceprint features, identity information identifier and key handle.

Optionally, when the key acquisition request includes a voiceprint feature, an identity information identifier, and a key handle, the trusted chip in step S504 parses the key acquisition request and compares the voiceprint feature in the key acquisition request with a pre-stored voiceprint feature, including:

Step 1: The trusted chip decrypts the key acquisition request using its private key to extract the voiceprint feature. The key acquisition request is encrypted using the public key of the trusted chip; the public key of the trusted chip corresponds to the private key of the trusted chip.

The above-mentioned Step 1 of the present application corresponds to Step 1 and Step 2 of Step S408 in Method 1 of the user identity management subsystem server in Example 1. Since the user identity management subsystem server encrypts the key acquisition request using the public key of the trusted chip, corresponding to the public key of the trusted chip, the trusted chip decrypts the key acquisition request using the private key of the trusted chip, and extracts the voiceprint features in the key acquisition request.

In step 2, the trusted chip compares the voiceprint features with the pre-stored voiceprint features to determine whether the voiceprint features are the same as the pre-stored voiceprint features.

In the above-mentioned Step 2 of the present application, based on the decryption of the key acquisition request in Step 1, the identity information identifier in the key acquisition request is obtained, and a query is made based on the identity information identifier to determine whether it is the same as the identity information identifier pre-stored in the trusted chip. If they are the same, the corresponding voiceprint feature is obtained based on the pre-stored identity information identifier, and the voiceprint feature in the key acquisition request is compared with the pre-stored voiceprint feature to determine whether the voiceprint feature is the same as the pre-stored voiceprint feature. If the judgment result is yes, step S506 is executed; if the judgment result is no, the process of the user obtaining the key is terminated.

Furthermore, optionally, in step S506, if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip returns key response information to the user terminal including:

Step 1: If the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip extracts the corresponding data key based on the voiceprint feature;

In the above Step 1 of the present application, based on the judgment of step S504, if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip extracts the corresponding data key based on the voiceprint feature.

Step 2: The trusted chip encrypts the data key using the public key of the user terminal and generates a key response message.

In the above Step 2 of the present application, based on the data key obtained by the trusted chip in the above Step 1, the trusted chip encrypts the data key through the public key of the user terminal and generates key response information, wherein the key response information may include: the key assigned by the user requesting the trusted chip through the user terminal.

Step 3: The trusted chip returns the key response information to the user terminal.

Method 2: The key acquisition request includes voiceprint features, random numbers, data to be encrypted or decrypted, identity information identifier and key handle.

Optionally, when the key acquisition request includes a voiceprint feature, a random number, data to be encrypted or decrypted, an identity information identifier, and a key handle, the trusted chip parses the key acquisition request in step S504 and compares the voiceprint feature in the key acquisition request with a pre-stored voiceprint feature, including:

Step 1: The trusted chip decrypts the key acquisition request using its private key to obtain the voiceprint feature. The key acquisition request is encrypted using the public key of the trusted chip; the public key of the trusted chip corresponds to the private key of the trusted chip.

The above-mentioned Step 1 of the present application corresponds to Step 1 to Step 3 of Step S408 in the second method of the user identity management subsystem server in Example 1. Since the user identity management subsystem server encrypts the key acquisition request using the public key of the trusted chip, corresponding to the public key of the trusted chip, the trusted chip decrypts the key acquisition request using the private key of the trusted chip, and extracts the voiceprint features in the key acquisition request.

In step 2, the trusted chip compares the voiceprint features with the pre-stored voiceprint features to determine whether the voiceprint features are the same as the pre-stored voiceprint features.

In the above-mentioned Step 2 of the present application, based on the decryption of the key acquisition request in Step 1, the identity information identifier in the key acquisition request is obtained, and a query is made based on the identity information identifier to determine whether it is the same as the identity information identifier pre-stored in the trusted chip. If they are the same, the corresponding voiceprint feature is obtained based on the pre-stored identity information identifier, and the voiceprint feature in the key acquisition request is compared with the pre-stored voiceprint feature to determine whether the voiceprint feature is the same as the pre-stored voiceprint feature. If the judgment result is yes, step S506 is executed; if the judgment result is no, the process of the user obtaining the key is terminated.

Furthermore, optionally, in step S506, if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip returns key response information to the user terminal including:

Step 1: If the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip extracts the corresponding data key based on the voiceprint feature;

In the above Step 1 of the present application, based on the judgment of step S504, if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip extracts the corresponding data key based on the voiceprint feature.

Step 2: The trusted chip encrypts or decrypts the data to be encrypted or decrypted based on the data key to obtain the encrypted information or decrypted information;

In the above Step 2 of the present application, based on the data key extracted in Step 1, the trusted chip encrypts or decrypts the data to be encrypted or decrypted according to the data key to obtain encrypted information or decrypted information.

Step 3: The trusted chip performs a preset calculation on the random number and the encrypted or decrypted information to obtain the calculation result;

In the above-mentioned Step 3 of the present application, based on the encrypted information or decrypted information obtained by the trusted chip in step Step 2, when the key acquisition request includes a random number, the trusted chip performs a preset calculation on the encrypted information or decrypted information according to the random number to obtain the calculation result; wherein, in this embodiment, it is preferred that the trusted chip calculates the encrypted information or decrypted information according to the random number through a hash algorithm to obtain the calculation result.

Step 4: The trusted chip encrypts the result of the operation using the public key of the user terminal and generates a key response message.

In the above Step 4 of the present application, based on the calculation result obtained in the above Step 3, in order to ensure the security of the key during transmission, the calculation result after the data key processing is encrypted in an encrypted form, wherein the encryption form is: the trusted chip encrypts the calculation result through the public key of the user terminal to generate a key response information.

Step 5: The trusted chip returns the key response information to the user terminal.

Different from method one, in method two, the user terminal directly sends the data to be encrypted or decrypted to the trusted chip. After the trusted chip verifies the user's identity, it performs corresponding encryption or decryption operations on the data to be encrypted or decrypted based on the user's data key, and then obtains the encrypted or decrypted data, and returns the encrypted or decrypted data to the user terminal, omitting the user terminal's calculation process and reducing the user terminal's calculation pressure. Most importantly, the data key does not leave the trusted chip, avoiding the leakage of the key during message transmission and ensuring the security of the data key.

In summary, in the data key protection method provided in the embodiment of the present application, the process in which the user obtains the key from the trusted chip via the user identity management subsystem server through the user terminal is the above-mentioned embodiment 2. It should be noted that in the process of implementing the above-mentioned process, the trusted chip includes the following functions:

Importing user identity and voiceprint features: Importing the user UID and the user's voiceprint features from the user voiceprint management subsystem server into the non-volatile space of the trusted chip. During the import process, ensure that each user's voiceprint features are mapped one-to-one with their UID;

Voiceprint feature storage: The voiceprint features imported into the trusted chip are encrypted and stored using the trusted storage root key to ensure the security of the voiceprint feature data;

User data key creation: The trusted chip, in accordance with the TCG trust standard, can create a data key for each uniquely identified user to encrypt data, and feed the key handle keyID back to the user terminal. During the storage process, it ensures that each user UID, user voiceprint feature, and user data key are mapped one to one.

Storage of user data keys: User data keys can be encrypted and protected with the storage root key of the trusted chip;

Voiceprint feature comparison: The user's voiceprint features extracted in real time are compared with the previously initialized and stored user's voiceprint features;

Data key usage: Once the user's voiceprint feature comparison passes, the user has the right to use the data key to encrypt and decrypt the data.

The trusted chip in the data key protection method provided in this embodiment is used to perform trusted computing. Trusted computing includes five key technical concepts. The trusted chip will comply with the TCG (Trusted Computing Group) specifications:

Technology 1: Trusted Computing Endorsement Key

The endorsement key is a 2048-bit RSA public and private key pair that is randomly generated when the chip leaves the factory and cannot be changed. This private key is always in the chip, while the public key is used to authenticate and encrypt sensitive data sent to the chip.

That is, in this embodiment, the user terminal and the trusted chip use the public key of the trusted chip and the private key of the trusted chip in the encryption or decryption process.

Technology 2: Trusted Computing Secure input and output

Secure I/O refers to the protected paths between computer users and the software they interact with. Currently, malware on computer systems uses a variety of methods to intercept data transmitted between users and software processes, including keyboard sniffing and screenshot capture.

Due to the independent storage and computing capabilities of the trusted chip, in this application, if the trusted chip is embedded in the terminal used by the user, the privacy and security of the data can be protected.

Technology 3: Trusted Computing Memory Curtaining

Storage shielding extends conventional storage protection techniques by providing completely isolated storage areas, such as those containing encryption keys. Even the operating system itself doesn't have full access to shielded storage, so even if an intruder gains control of the operating system's information, it remains secure.

That is, based on the independent storage of the trusted chip mentioned in the above-mentioned technology 2, not only is the storage independent, but the stored data can also be saved in an encrypted manner, which adds a set of security guarantees while storing data.

Technology 4: Trusted Computing Sealed Storage

Sealed storage protects private information by tying it to the hardware and software platform configuration used. This means the data can only be read by users with the same hardware and software combination. For example, if a user saves a song to their computer and their computer doesn't have a license to play it, they can't play it.

That is, based on what is mentioned in Technology 3, the trusted certificate mentioned in this embodiment can be used for trusted chip verification. When the trusted certificate is legitimate, the trusted chip will match based on the voiceprint features and execute the subsequent process of extracting the data key.

Technology 5: Trusted Computing Remote Authentication

Remote authentication allows changes made to a user's computer to be visible to authorized parties. For example, software companies can prevent users from tampering with their software to circumvent technical protection measures. This works by having the hardware generate a certificate of the current software. The computer then transmits this certificate to the remote authorized party to show the software company that the software has not been tampered with (in an attempt to crack it).

That is, it can be the same as the trusted certificate mentioned in Technology 4, used to verify the terminal device or user.

Example 3

According to an embodiment of the present invention, an embodiment of a method for protecting a data key is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

The method embodiment provided in Example 3 of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking operation on a computer terminal as an example, Figure 6 is a hardware structure block diagram of a computer terminal of a data key protection method according to an embodiment of the present invention. As shown in Figure 6, the computer terminal 60 may include one or more (only one is shown in the figure) processors 602 (the processor 602 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 604 for storing data, and a transmission module 606 for communication functions. It can be understood by those skilled in the art that the structure shown in Figure 6 is only for illustration and does not limit the structure of the above-mentioned electronic device. For example, the computer terminal 60 may also include more or fewer components than those shown in Figure 6, or have a configuration different from that shown in Figure 6.

The memory 604 can be used to store software programs and modules of application software, such as the program instructions/modules corresponding to the data key protection method in the embodiment of the present invention. The processor 602 executes various functional applications and data processing by running the software programs and modules stored in the memory 604, that is, implementing the vulnerability detection method of the above-mentioned application. The memory 604 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 604 may further include a memory remotely located relative to the processor 602, and these remote memories may be connected to the computer terminal 60 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

The transmission module 606 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of the computer terminal 60. In one embodiment, the transmission module 606 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission module 606 may be a radio frequency (RF) module, which is configured to communicate with the Internet wirelessly.

In the above operating environment, the present application provides a data key protection method as shown in Figure 7. On the user terminal side, Figure 7a is a flow chart of a data key protection method according to embodiment 3 of the present invention.

Step S702: The user terminal sends a key acquisition request to the user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information;

In the above step S702 of the present application, different from Example 1 and Example 2, the data key protection method provided in this embodiment can be applied to user terminals, wherein the user terminals may include: smart phones, laptops, tablet computers, desktop computers, handheld businesses and smart wearable devices.

Specifically, when a user obtains a data key through a user terminal, the user terminal sends a key acquisition request to the user identity management subsystem server. The process can be performed as follows: logging into a web page associated with the user identity management subsystem server, and the user enters his or her own identity authentication information on the web page through the user terminal.

Step S704: The user terminal receives the voice information to be verified returned by the user identity management subsystem server;

In the above-mentioned step S704 of the present application, based on the key acquisition request sent in step S702, the user terminal receives the voice information to be verified returned by the user identity management subsystem server. After receiving the voice information to be verified returned by the user identity management subsystem server, the user terminal obtains the sound of the user reading the voice information to be verified through the audio receiving device. The voice information to be verified can be a series of characters randomly composed of numbers and characters without deformation processing.

Step S706: The user terminal uploads the user voice to the user identity management subsystem server, where the user voice corresponds to the voice information to be verified;

In the above step S706 of the present application, based on the voice information to be verified received in step S704, the user terminal uploads the user voice to the user identity management subsystem server.

Step S708: The user terminal receives the key response information returned by the trusted chip, wherein the key response information corresponds to the user voice uploaded to the user identity management subsystem server.

In the above step S708 of the present application, after the user terminal uploads the user voice to the user identity management subsystem server, the trusted chip will feedback the corresponding data key based on the voiceprint features in the user voice, wherein the data key is returned to the user terminal in the form of key response information during the transmission process.

In an embodiment of the present invention, a key acquisition request is sent by a user terminal to a user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information; the user terminal receives the voice information to be verified returned by the user identity management subsystem server; the user terminal uploads the user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; the user terminal receives the key response information returned by the trusted chip, wherein the key response information corresponds to the user voice uploaded to the user identity management subsystem server, thereby achieving the purpose of securely acquiring the key, thereby realizing the technical effect of securely acquiring the key, and further solving the technical problem of easy leakage of the key in the prior art.

Specifically, based on the above steps S702 to S708, the data key protection method provided in this embodiment has two implementation methods, which are specifically implemented as follows:

Method 1: Authentication information includes: identity information identifier and key handle.

Optionally, when the identity authentication information includes an identity information identifier and a key handle, the key acquisition request sent by the user terminal to the user identity management subsystem server in step S702 includes:

Step 1: The user terminal generates a key acquisition request based on the identity information identifier and key handle;

The above step 1 of the present application corresponds to the method 1 of the user identity management subsystem server in Example 1 and the method 1 of the trusted chip in Example 2. The user terminal encapsulates the user's identity information identifier and the key handle to obtain a key acquisition request.

Step 2: The user terminal sends a key acquisition request to the user identity management subsystem server.

Furthermore, optionally, after the user terminal receives the key response information returned by the trusted chip in step S708, the data key protection method provided in this embodiment further includes:

Step 1: The user terminal decrypts the key response message using its private key to obtain the data key carried in the key response message. The key response message is encrypted using the user terminal's public key, which corresponds to the user terminal's private key.

In the above-mentioned Step 1 of the present application, corresponding to Step 1 to Step 3 in Step S506 of the trusted chip method 1 in Example 2, since the trusted chip encrypts the data key through the public key of the user terminal, the key response information is decrypted through the private key of the user terminal on the user terminal side to obtain the data key carried by the key response information.

Step 2: The user terminal encrypts or decrypts the data to be encrypted or decrypted based on the data key to obtain encrypted data information or decrypted information.

In the above step 2 of the present application, based on the data key obtained in the above step 1, the user terminal encrypts or decrypts the data to be encrypted or decrypted according to the data key to obtain the encrypted data information or decrypted information.

Method 2: Authentication information includes: trusted certificate, identity information identifier and key handle.

Optionally, when the identity authentication information includes a trusted certificate, an identity information identifier, and a key handle, the key acquisition request sent by the user terminal to the user identity management subsystem server in step S702 includes:

Step 1: The user terminal encrypts the trusted certificate, identity information identifier, and key handle using the public key of the user identity management subsystem to generate a key acquisition request.

In the above-mentioned Step 1 of the present application, different from Method 1, Method 2 of this embodiment ensures the security of the user's identity authentication information by adding a trusted certificate and encrypting the trusted certificate, identity information identifier and key handle based on the public key of the user identity management subsystem during the process of generating a key acquisition request.

It should be noted that the trusted certificate can be used to verify whether the current user terminal has the authority to initiate the process of obtaining the data key, wherein the trusted certificate can be a data security certificate obtained by the user from a third party.

Step 2: The user terminal sends a key acquisition request to the user identity management subsystem server.

Furthermore, optionally, after the user terminal receives the voice information to be verified returned by the user identity management subsystem server in step S704, the data key protection method provided in this embodiment further includes:

Step 1: The user terminal parses the voice information to be verified and obtains the user identity management subsystem certificate and the voice information to be verified;

In the above-mentioned step Step 1 of the present application, in method 2, after the user terminal receives the voice information to be verified returned by the user identity management subsystem server, the voice information to be verified received by the user terminal includes the user identity management subsystem certificate and the voice to be verified. Before prompting the user to read the voice to be verified, the user identity management subsystem certificate needs to be verified, and the verification step executes Step 2. If the verification is successful, execute Step 3 to Step 5.

Step 2: The user terminal determines whether the user identity management subsystem certificate meets the preset verification conditions;

In the above step Step 2 of this application, during the process of verifying the user identity management subsystem certificate, it is necessary to determine whether the user identity management subsystem certificate can correspond to the verification conditions of the user terminal. If so, execute Step 3.

Step 3: If the judgment result is yes, the user terminal receives the sound signal of the voice to be verified read aloud by the user;

In the above-mentioned step Step 3 of the present application, based on the judgment of Step 2, if the judgment result is yes, the user terminal receives the sound signal of the voice to be verified read by the user through its own sound receiving device, wherein the sound receiving device can be a microphone interface on the mobile terminal, for example, a microphone in a smartphone.

Step 4: The user terminal encrypts the random number, the sound signal, and the data to be encrypted or decrypted using the public key of the user identity management subsystem to obtain the user's voice.

In the above step 4 of the present application, based on the sound signal obtained in Step 3, in order to ensure the security of information transmission, the user terminal encrypts the random number, sound signal and data to be encrypted or decrypted using the public key of the user identity management subsystem to obtain the user voice.

Step 5: The user terminal uploads the user voice to the user identity management subsystem server.

Optionally, after the user terminal receives the key response information returned by the trusted chip in step S708, the data key protection method provided in this embodiment further includes:

Step 1: The user terminal decrypts the key response information using the user terminal's private key to obtain the calculation result in the key response information;

The above-mentioned step 1 of the present application corresponds to Step 1 to Step 5 of step S506 in the second method in Example 2. After the user terminal receives the key response information returned by the trusted chip, since the trusted chip encrypts the key response information using the public key of the user terminal, the corresponding user terminal decrypts the key response information using the private key of the user terminal to obtain the operation result in the key response information.

Step 2: The user terminal verifies the calculation result based on the random number and the preset algorithm to determine whether the transportation result meets the preset verification standard;

In the above-mentioned step Step 2 of the present application, based on the calculation result obtained in Step 1, in order to ensure the integrity of the data, the calculation result needs to be verified before using the calculation result. The verification method is: the user terminal verifies the calculation result according to the random number and the preset algorithm to determine whether the transportation result meets the preset verification standard. Among them, in this embodiment, preferably, the preset algorithm is a hash algorithm, that is, the user terminal verifies the calculation result according to the random number combined with the hash algorithm to determine whether the transportation result meets the preset verification standard.

Step 3: If the judgment result is yes, the user terminal uses the calculation result.

In Step 3 of the present application, based on the judgment in Step 2, if the judgment result is yes, the user terminal uses the calculation result, where the calculation result can be data information encrypted with the data key or decrypted information decrypted with the data key. As shown in Figure 7b, Figure 7b is a schematic diagram of the connection between the embedded trusted chip in the user identity management subsystem server and the user terminal in the data key protection method according to Example 3 of the present invention.

Example 4

The present application provides a data key protection method as shown in Figure 8. On the user terminal side, Figure 8 is a flow chart of a data key protection method according to a fourth embodiment of the present invention.

Step S802: The user terminal sends a key acquisition request to the user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information;

Step S804: The user terminal receives the voice information to be verified returned by the user identity management subsystem server;

Step S806: The user terminal uploads the user voice to the user identity management subsystem server, where the user voice corresponds to the voice information to be verified;

Step S808: The user terminal receives the voiceprint feature extracted from the user's voice by the user identity management subsystem server;

Step S810: The trusted chip in the user terminal compares the voiceprint features with pre-stored voiceprint features;

Step S812: If the voiceprint feature matches the pre-stored voiceprint feature, the trusted chip in the user terminal extracts the data key corresponding to the voiceprint feature;

Step S814: The user terminal performs corresponding operations based on the data key.

In summary, in conjunction with steps S802 to S814, the data key protection method provided in this embodiment can be applied to the user terminal side. Unlike the user terminal provided in Example 3, the data key protection method provided in this embodiment can be applied to user terminals with embedded trusted chips. As shown in Figure 9a, Figure 9a is a schematic diagram of the connection between the user identity management subsystem server and the embedded trusted chip in the user terminal in a data key protection method according to an embodiment of the present invention.

Specifically, when the user terminal needs a data key, it sends a key acquisition request to the user identity management subsystem server, where the key acquisition request carries the user's identity authentication information. After successfully verifying the identity authentication information, the user identity management subsystem server returns a voice message to be verified to the user terminal. The user terminal collects the user's voice when the user reads the voice message to be verified through a sound receiving device, and uploads the user's voice to the user identity management subsystem server. After the user identity management subsystem server returns the voiceprint feature of the user's voice, the voiceprint feature is compared with the pre-stored voiceprint feature through the trusted chip in the user terminal. If the voiceprint feature matches the pre-stored voiceprint feature, the data key is extracted; then the user terminal can perform encryption or decryption during data transmission based on the data key.

Taking online banking as an example, when a user first registers an account, the online banking system generates a string of identity identifiers for the user, such as an account number. When registering for voiceprint verification based on this account number, a corresponding data key is generated on the user terminal side based on the user's voiceprint characteristics and identity identifier. This data key is stored in a trusted chip, where trusted computing and encryption are performed on the data key to enhance its security. When a user accesses online banking through a user terminal, the user terminal sends a key acquisition request to the online bank's user identity management subsystem server. After the user identity management subsystem server returns the voice information to be verified, the user terminal uses a sound receiving device to capture the user's voice reading the voice information to be verified and uploads the user's voice to the user identity management subsystem server. After receiving the voiceprint characteristics of the extracted user voice returned by the user identity management subsystem server, the trusted chip in the user terminal compares the voiceprint characteristics with pre-stored voiceprint characteristics. If the voiceprint characteristics match the pre-stored voiceprint characteristics, the data key is extracted.

It should be noted that when the trusted chip is embedded in the user terminal side, the signaling interaction between the user terminal and the user identity management subsystem server is reduced, thereby avoiding the leakage of data keys during the signaling interaction process; and since the trusted chip is located in the user terminal, the data key is always located in the user terminal during the process of obtaining the data key, which reduces the risk of data key leakage and solves the problem of difficult to remember password keys for obtaining data keys from the trusted chip.

In an embodiment of the present invention, a user terminal sends a key acquisition request to a user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information; the user terminal receives the voice information to be verified returned by the user identity management subsystem server; the user terminal uploads the user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; the user terminal receives the voiceprint features extracted from the user voice by the user identity management subsystem server; the trusted chip in the user terminal compares the voiceprint features with pre-stored voiceprint features; if the voiceprint features match the pre-stored voiceprint features, the trusted chip in the user terminal extracts the data key corresponding to the voiceprint features; and the user terminal performs corresponding operations based on the data key. This achieves the purpose of secure key acquisition, thereby achieving the technical effect of secure key acquisition and solving the technical problem of easy key leakage in the prior art.

Optionally, before the user terminal sends the key acquisition request to the user identity management subsystem server in step S802, the data key protection method provided in this embodiment further includes:

Step S797: The trusted chip in the user terminal imports the pre-acquired identity information and voiceprint features;

Step S798: The trusted chip in the user terminal encrypts the voiceprint feature according to the trusted storage root key and stores the encrypted voiceprint feature;

Step S799: The trusted chip in the user terminal generates a data key based on the preset encryption algorithm and the identity information identifier, and returns the key handle of the data key to the user terminal;

In step S800, the trusted chip in the user terminal maps the data key, the identity information identifier and the voiceprint feature to obtain a mapping relationship among the data key, the identity information identifier and the voiceprint feature, and stores the mapping relationship and the data key.

Specifically, in combination with step S797 to step S800, the trusted chip in the user terminal will first generate a corresponding data key for the user before the user obtains the data key. The process of generating the data key is as follows:

First, the user UID and the user's voiceprint features in the user voiceprint management subsystem server are imported into the non-volatile space of the trusted chip. During the import process, it is ensured that each user's voiceprint features are mapped one-to-one with their UID.

Second, the voiceprint features imported into the trusted chip are encrypted and stored using the trusted storage root key to ensure the security of the voiceprint feature data;

Third, the trusted chip, in accordance with the TCG trust standard, can create a data key for each uniquely identified user to encrypt data, and feed the key handle keyID back to the user terminal. During the storage process, it ensures that each user UID, user voiceprint feature, and user data key are in a one-to-one mapping relationship;

Fourth, the user's data key can be encrypted and protected with the storage root key of the trusted chip.

It should be noted that for the aforementioned method embodiments, for simplicity of description, they are all expressed as a series of action combinations. However, those skilled in the art should be aware that the present invention is not limited by the order of the actions described, because according to the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the data key protection method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

In summary, in combination with the above embodiments 1 to 4, based on the two implementation methods (method 1 and method 2) of the user identity management subsystem server, the trusted chip and the user terminal, the data key protection method provided in the embodiment of the present application is as follows:

Scenario 1:

Assume that the trusted chip has created the platform identity public-private key pair UPK and USK and the data key Data_Key for the user UID (i.e., the identity information identifier in this embodiment). The user's voiceprint characteristics and data key are securely stored in the trusted chip. Due to the limited computing power of the trusted chip, the user now wants to obtain the data key in the trusted chip to encrypt or decrypt certain sensitive data Data locally. During the interaction, the user terminal is authenticated. Figure 9b is a schematic diagram of the interaction between the user identity management subsystem server, the trusted chip, and the user terminal in a data key protection method according to an embodiment of the present invention. The process is shown in Figure 9b:

Step 1: The user terminal submits {U _ID , key _ID } (i.e., the first key acquisition request in this application) to the user identity management subsystem server;

Step 2: The user identity management subsystem server responds to the user terminal's request and requires the user terminal to transmit a voice message (i.e., the voice message to be verified in this application);

Step 3: The user terminal transmits a voice message (i.e., the user voice message in this application) via a voice communication device.

Step 4: The user identity management subsystem server extracts features from the voice transmitted by the user terminal and generates voiceprint feature information msg (i.e., the second key acquisition request in this application);

Step 5: The user identity management subsystem server encrypts the voiceprint feature information msg with the trusted chip voiceprint feature and the data key management subsystem public key M_PK to obtain {Msg, U _ID , key _ID }M_PK (i.e., the second key acquisition request in this application), and sends {Msg, U _ID , key _ID }M_PK back to the trusted chip voiceprint feature and data key management subsystem (i.e., the trusted chip in this application);

Step 6: After the trusted chip voiceprint feature and data key management subsystem receives the voiceprint feature ciphertext information (i.e., the second key acquisition request in this application), it first decrypts it with the user identity management subsystem private key M_SK, obtains the Msg plaintext, and compares it with the voiceprint feature information stored when the user registered. If the comparison passes, it proceeds to step (7), otherwise it stops;

Step 7: The trusted chip voiceprint feature system encrypts its data key with the user platform identity public key (i.e., the public key of the user terminal in this application) and sends it back to the user terminal. The returned information is {Data_Key}U_pk (i.e., the key response information in this application);

In step 8, after receiving the information, the user terminal uses its platform identity private key U_SK (i.e., the private key of the user terminal in this application) to decrypt it. After obtaining the data key Data_Key, the data key Data_Key can be used to encrypt sensitive data, or the Data_Key can be used to decrypt sensitive data ciphertext.

Scenario 2:

Assume that the trusted chip is the user UID (i.e., the identity information identifier in this embodiment) and has created its platform identity public-private key pair UPK and USK (i.e., the public key and private key of the user terminal in this application), and the data key Data_Key; the user obtains a trusted certificate Cert_U from a third party; the public key of the user identity management subsystem is I_PK, and the private key is I_SK; the public key of the voiceprint feature and number key management subsystem is M_PK, and the private key is M_SK (i.e., the public key and private key of the trusted chip in this application); the user's voiceprint feature and data key are securely stored in the trusted chip. Now the user wants to obtain the right to use the data key in the trusted chip. The voiceprint feature and data key management subsystem encrypts or decrypts the user's sensitive data Data inside the trusted chip and returns it to the user, and two-way identity authentication can be achieved during the interaction process. Figure 10 is a schematic diagram of the interaction between the user identity management subsystem server, the trusted chip and the user terminal in another data key protection method according to an embodiment of the present invention. The process is shown in Figure 10:

Step 1: The user terminal submits {Cert_U, U _ID , key _ID } I_PK (i.e., the first key acquisition request in this application) to the user identity management subsystem server, where I_PK is the user identity management subsystem public key, Cert_U is the trusted certificate obtained by the user from a third party; keyID represents the user data key handle (i.e., the key handle in this application), and {Cert_U, UID, keyID} I_PK indicates that the user identifier UID, the user data key handle identifier keyID, and the user Cert_U are encrypted using the public key of the user identity management subsystem;

Step 2: After receiving the information (i.e., the first key acquisition request in this application), the user identity management subsystem server first verifies the legitimacy of the trusted certificate. If it is illegal, the process terminates. Otherwise, it responds to the user terminal request and feedback information {Cert_I, please send back a voice message} (i.e., the voice information to be verified in this application). That is, the feedback information contains its own certificate (i.e., the user identity management subsystem certificate in this application) and requires the user terminal to send back a voice message (i.e., the user voice in this application);

Step 3. After the user terminal receives the information (i.e., the voice information to be verified in this application), it verifies the legitimacy of the user identity management subsystem certificate. If it is illegal, it terminates. Otherwise, it generates a random number N1, and uses the voice communication device (i.e., the voice device in this application) to return a voice message Sound, the original data to be encrypted Data, or the data cipher to be decrypted cipher, and encrypts it with the public key of the user identity management subsystem, that is, the transmitted information is {Sound, N1, Data/cipher}I_pk, where ("/" represents plaintext data, or ciphertext data, or both) (i.e., the data to be encrypted or decrypted in this application); wherein, N1 is used to verify the integrity of the returned data later.

Step 4: The user identity management subsystem server extracts features from the voice transmitted by the user terminal and generates voiceprint feature information Msg (i.e., the second key acquisition request in this application);

Step 5: The user identity management subsystem server uses the trusted chip voiceprint feature and the data key management subsystem public key M_PK (i.e., the public key of the trusted chip in this application) to encrypt the voiceprint feature information msg (i.e., the second key acquisition request in this application), the random number N1, Data/Cipher, the user UID, and the user data key handle keyID to obtain {N1, Msg, Data/Cipher, UID, keyID}M_PK, and returns {Msg, UID, keyID}M_PK to the trusted chip voiceprint feature and data key management subsystem;

Step 6: After receiving the information, the trusted chip voiceprint feature and data key management subsystem performs the following tasks:

a. First decrypt using its private key M_SK (i.e., the private key of the trusted chip in this application);

b. Compare the decrypted Msg information with the voiceprint feature information stored during user registration. If the comparison passes, continue to step (c), otherwise stop;

c. Find the corresponding data key Data_Key based on the decrypted UID, keyID;

d. Encrypt or decrypt the decrypted information Data/Cipher using the data key Data_Key to obtain the information Cipher/Data (i.e., the calculation result in this embodiment);

Step 7: The trusted chip voiceprint feature system encrypts the data plaintext or ciphertext with the user platform identity public key, performs a hash operation on the plaintext or ciphertext with a random number, and then sends this information back to the user terminal. The returned information is {hash(cipher/Data, N1), {cipher/Data}U_pk} (i.e., the key response information in this application);

Step 8: After receiving the information, the user terminal decrypts it with its platform identity private key U_SK (i.e., the user terminal's private key) to obtain the information cipher/Data, and then performs a hash operation on it using the locally stored N1. If it is legal, it means that the transmitted data is complete.

This embodiment proposes a method for protecting data keys, which uses voiceprint features as credentials to obtain permission to use data keys. It does not require additional password protection equipment, thus avoiding the risk of password forgetting that makes the data key unusable.

It should be noted that in the data key protection method provided in the embodiment of the present application, the location of the trusted chip includes at least the following two options: embedded in the user terminal or embedded in the server, wherein the trusted chip can be located on the same server as the user identity management subsystem; corresponding to the above two implementation methods, when the trusted chip is located in different device locations, the only difference between the above implementation methods one and two is that, when the trusted chip is embedded in the user terminal, after the user terminal uploads the user voice to the user identity management subsystem server, the user identity management subsystem server returns the voiceprint features of the user voice, and the trusted chip in the user terminal pre-stores the voiceprint features based on the voiceprint features and extracts the data key if a match is successful;

When the trusted chip is embedded in the service, the trusted chip can be considered to be located on the same server as the user identity management subsystem server. After the user terminal issues a first key acquisition request, the user identity management subsystem server interacts with the user terminal to obtain the user voice uploaded by the user terminal, extracts the voiceprint features of the user voice, and sends the voiceprint features to the trusted chip located on the same server in the form of a second key acquisition request. The trusted chip verifies the voiceprint features and, upon successful verification, extracts the data key corresponding to the voiceprint features and returns the data key to the user terminal. Alternatively, based on the data to be encrypted/decrypted carried by the user terminal when sending the first key acquisition request, the trusted chip performs corresponding encryption/decryption operations on the encrypted/decrypted data using the data key. For specific implementation methods, see Example 1, or Methods 1 and 2 of the aforementioned implementation methods.

Example 5

The present application provides a data key protection method as shown in Figure 11a. On the user terminal side, Figure 11a is a flow chart of a data key protection method according to embodiment 5 of the present invention.

Step S1101: Obtain user login information and trigger a key acquisition request, wherein the key acquisition request includes the user's identity authentication information;

Step S1102: obtaining the corresponding voice information to be verified according to the key acquisition request;

Step S1103, receiving the user's voice input based on the voice information to be verified;

Step S1104, extracting the user's voiceprint features based on the user's voice;

Step S1105: Compare the voiceprint features with pre-stored voiceprint features through the trusted chip;

Step S1106: If the voiceprint feature matches the pre-stored voiceprint feature, the data key corresponding to the voiceprint feature is extracted through the trusted chip;

Step S1107, perform corresponding operations based on the data key.

In summary, combined with steps S1101 to S1107, unlike the user terminal in Example 4, in this embodiment, the user terminal has a built-in trusted chip and integrates the user identity management subsystem server to provide voice information to be verified and voiceprint feature extraction functions, thereby strengthening the data processing function of the user terminal. Moreover, since all data processing based on key extraction is completed on the user terminal side, the user's private information is guaranteed not to be leaked to the outside world through the user terminal, thereby ensuring the user's information security. As shown in Figure 11b, Figure 11b is a schematic diagram of the user terminal embedded with a trusted chip in the data key protection method according to Example 5 of the present invention.

In an embodiment of the present invention, user login information is obtained and a key acquisition request is triggered, wherein the key acquisition request includes the user's identity authentication information; corresponding voice information to be verified is obtained based on the key acquisition request; user voice input based on the voice information to be verified is received; the user's voiceprint features are extracted based on the user voice; the voiceprint features are compared with pre-stored voiceprint features via a trusted chip; if the voiceprint features match the pre-stored voiceprint features, the data key corresponding to the voiceprint features is extracted via the trusted chip; and corresponding operations are performed based on the data key. The purpose of secure key acquisition is achieved, thereby realizing the technical effect of secure key acquisition and solving the technical problem of easy key leakage in the prior art.

Example 6

According to an embodiment of the present invention, a device for implementing the above-mentioned data key protection method is also provided. On the user identity management subsystem server side, as shown in FIG12 , the device includes:

FIG12 is a schematic structural diagram of a data key protection device according to a sixth embodiment of the present invention.

As shown in FIG12 , the data key protection device may include: a first receiving module 1201 , a first sending module 1202 , a second receiving module 1203 , a request generating module 1204 and a second sending module 1205 .

Among them, the first receiving module 1201 is used to receive a first key acquisition request sent by a user terminal, wherein the first key acquisition request includes the user's identity authentication information; the first sending module 1202 is used to return the voice information to be verified to the user terminal based on the first key acquisition request; the second receiving module 1203 is used to receive the user voice uploaded by the user terminal based on the voice information to be verified; the request generating module 1204 is used to extract the voiceprint features of the user voice, and generate a second key acquisition request based on the voiceprint features and the identity authentication information; the second sending module 1205 is used to send the second key acquisition request to the trusted chip.

In an embodiment of the present invention, a first key acquisition request sent by a user terminal is received by a user identity management subsystem server, wherein the first key acquisition request includes the user's identity authentication information; the user identity management subsystem server returns the voice information to be verified to the user terminal based on the first key acquisition request; the user identity management subsystem server receives the user voice uploaded by the user terminal based on the voice information to be verified; the user identity management subsystem server extracts the voiceprint features of the user voice, and generates a second key acquisition request based on the voiceprint features and the identity authentication information; the user identity management subsystem server sends the second key acquisition request to the trusted chip, thereby achieving the purpose of securely obtaining the key, thereby realizing the technical effect of securely obtaining the key, and further solving the technical problem of easy leakage of the key in the existing technology.

It should be noted that the first receiving module 1201, the first sending module 1202, the second receiving module 1203, the request generating module 1204, and the second sending module 1205 described above correspond to steps S402 to S410 in Example 1. The examples and application scenarios implemented by the five modules and the corresponding steps are the same, but are not limited to the contents disclosed in Example 1. It should be noted that the above modules, as part of the device, can run in the user identity management subsystem server provided in Example 1 and can be implemented via software or hardware.

Example 7

According to an embodiment of the present invention, a device for implementing the above-mentioned data key protection method is also provided. On the trusted chip side, as shown in FIG13 , the device includes:

FIG13 is a schematic structural diagram of a data key protection device according to a seventh embodiment of the present invention.

As shown in FIG. 13 , the data key protection device may include: a third receiving module 1302 , a parsing module 1304 and a third sending module 1306 .

Among them, the third receiving module 1302 is used to receive a key acquisition request, wherein the key acquisition request includes: voiceprint features; the parsing module 1304 is used to parse the key acquisition request and compare the voiceprint features in the key acquisition request with the pre-stored voiceprint features; the third sending module 1306 is used to return key response information to the user terminal if the voiceprint features in the key acquisition request match the pre-stored voiceprint features.

In an embodiment of the present invention, a key acquisition request sent by a user identity management subsystem server is received through a trusted chip, wherein the key acquisition request includes: a voiceprint feature; the trusted chip parses the key acquisition request and compares the voiceprint feature in the key acquisition request with the pre-stored voiceprint feature; if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip returns a key response message to the user terminal, thereby achieving the purpose of securely acquiring the key, thereby realizing the technical effect of securely acquiring the key, and further solving the technical problem of easy leakage of the key in the prior art.

It should be noted that the third receiving module 1302, parsing module 1304, and third sending module 1306 correspond to steps S502 to S506 in Example 1. The examples and application scenarios implemented by the three modules and the corresponding steps are the same, but are not limited to the contents disclosed in Example 2. It should be noted that the above modules, as part of the device, can run in the trusted chip provided in Example 2 and can be implemented through software or hardware.

Example 8

According to an embodiment of the present invention, a device for implementing the above-mentioned data key protection method is also provided. On the user terminal side, as shown in FIG14 , the device includes:

FIG14 is a schematic structural diagram of a data key protection device according to an eighth embodiment of the present invention.

As shown in FIG. 14 , the data key protection device may include: a fourth sending module 1402 , a fourth receiving module 1404 , a fifth sending module 1406 and a fifth receiving module 1408 .

Among them, the fourth sending module 1402 is used to send a key acquisition request to the user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information; the fourth receiving module 1404 is used to receive the voice information to be verified returned by the user identity management subsystem server; the fifth sending module 1406 is used to upload the user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; the fifth receiving module 1408 is used to receive the key response information returned by the trusted chip, wherein the key response information corresponds to the user voice uploaded to the user identity management subsystem server.

In an embodiment of the present invention, a key acquisition request is sent by a user terminal to a user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information; the user terminal receives the voice information to be verified returned by the user identity management subsystem server; the user terminal uploads the user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; the user terminal receives the key response information returned by the trusted chip, wherein the key response information corresponds to the user voice uploaded to the user identity management subsystem server, thereby achieving the purpose of securely acquiring the key, thereby realizing the technical effect of securely acquiring the key, and further solving the technical problem of easy leakage of the key in the prior art.

It should be noted that the fourth sending module 1402, the fourth receiving module 1404, the fifth sending module 1406, and the fifth receiving module 1408 correspond to steps S702 to S708 in Example 3. The examples and application scenarios implemented by the four modules and the corresponding steps are the same, but are not limited to the contents disclosed in Example 3. It should be noted that the above modules, as part of the device, can run in the user terminal provided in Example 3 and can be implemented by software or hardware.

Example 9

According to an embodiment of the present invention, a device for implementing the above-mentioned data key protection method is also provided. On the user terminal side, as shown in FIG15 , the device includes:

FIG15 is a schematic structural diagram of a data key protection device according to a ninth embodiment of the present invention.

As shown in FIG15 , the data key protection device may include: a sixth sending module 1502 , a sixth receiving module 1504 , a seventh sending module 1506 , a seventh receiving module 1508 , a feature comparison module 1510 , a key extraction module 1512 and a data protection module 1514 .

Among them, the sixth sending module 1502 is used to send a key acquisition request to the user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information; the sixth receiving module 1504 is used to receive the voice information to be verified returned by the user identity management subsystem server; the seventh sending module 1506 is used to upload the user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; the seventh receiving module 1508 is used to receive the voiceprint features extracted from the user voice by the user identity management subsystem server; the feature comparison module 1510 is used to compare the voiceprint features with the pre-stored voiceprint features; the key extraction module 1512 is used to extract the data key corresponding to the voiceprint features by the trusted chip in the user terminal if the voiceprint features match the pre-stored voiceprint features; the data protection module 1514 is used to perform corresponding operations based on the data key.

In an embodiment of the present invention, a user terminal sends a key acquisition request to a user identity management subsystem server, wherein the key acquisition request includes the user's identity authentication information; the user terminal receives the voice information to be verified returned by the user identity management subsystem server; the user terminal uploads the user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; the user terminal receives the voiceprint features extracted from the user voice by the user identity management subsystem server; the trusted chip in the user terminal compares the voiceprint features with pre-stored voiceprint features; if the voiceprint features match the pre-stored voiceprint features, the trusted chip in the user terminal extracts the data key corresponding to the voiceprint features; and the user terminal performs corresponding operations based on the data key. This achieves the purpose of secure key acquisition, thereby achieving the technical effect of secure key acquisition and solving the technical problem of easy key leakage in the prior art.

It should be noted that the sixth sending module 1502, the sixth receiving module 1504, the seventh sending module 1506, the seventh receiving module 1508, the feature comparison module 1510, the key extraction module 1512, and the data protection module 1514 correspond to steps S802 to S814 in the fourth embodiment. The examples and application scenarios implemented by these seven modules and the corresponding steps are the same, but are not limited to the contents disclosed in the fourth embodiment. It should be noted that the above modules, as part of the apparatus, can run in the user terminal provided in the fourth embodiment and can be implemented via software or hardware.

Example 10

According to an embodiment of the present invention, a device for implementing the above-mentioned data key protection method is also provided. On the user terminal side, as shown in FIG16 , the device includes:

FIG16 is a schematic structural diagram of a data key protection device according to a tenth embodiment of the present invention.

As shown in Figure 16, the data key protection device may include: an information acquisition module 1601, a verification information acquisition module 1602, a receiving module 1603, an extraction module 1604, a feature comparison module 1605, a key extraction module 1606 and a data protection module 1607.

Among them, the information acquisition module 1601 is used to obtain user login information and trigger a key acquisition request, wherein the key acquisition request includes the user's identity authentication information; the information acquisition module 1602 to be verified is used to obtain the corresponding voice information to be verified based on the key acquisition request; the receiving module 1603 is used to receive the user voice entered by the user based on the voice information to be verified; the extraction module 1604 is used to extract the user's voiceprint features based on the user voice; the feature comparison module 1605 is used to compare the voiceprint features with the pre-stored voiceprint features through the trusted chip; the key extraction module 1606 is used to extract the data key corresponding to the voiceprint features through the trusted chip if the voiceprint features match the pre-stored voiceprint features; the data protection module 1607 is used to perform corresponding operations based on the data key.

In an embodiment of the present invention, user login information is obtained and a key acquisition request is triggered, wherein the key acquisition request includes the user's identity authentication information; corresponding voice information to be verified is obtained based on the key acquisition request; user voice input based on the voice information to be verified is received; the user's voiceprint features are extracted based on the user voice; the voiceprint features are compared with pre-stored voiceprint features via a trusted chip; if the voiceprint features match the pre-stored voiceprint features, the data key corresponding to the voiceprint features is extracted via the trusted chip; and corresponding operations are performed based on the data key. The purpose of secure key acquisition is achieved, thereby realizing the technical effect of secure key acquisition and solving the technical problem of easy key leakage in the prior art.

It should be noted that the information acquisition module 1601, the information to be verified acquisition module 1602, the receiving module 1603, the extraction module 1604, the feature comparison module 1605, the key extraction module 1606, and the data protection module 1607 correspond to steps S1101 to S1107 in Example 5. The examples and application scenarios implemented by these seven modules and the corresponding steps are the same, but are not limited to the contents disclosed in Example 5. It should be noted that the above modules, as part of the device, can run in the user terminal provided in Example 5 and can be implemented via software or hardware.

Example 11

According to an embodiment of the present invention, a data key protection system is also provided, as shown in FIG17 , and the data key protection system includes:

FIG17 is a schematic structural diagram of a data key protection system according to an eleventh embodiment of the present invention.

As shown in FIG17 , the data key protection system may include: a user voiceprint identity management subsystem 171 and a trusted chip management subsystem 172 .

Among them, the user voiceprint identity management subsystem 171 is used to obtain each user's identity information and voiceprint characteristics; the trusted chip management subsystem 172 is used to generate a corresponding key based on each user's identity information and voiceprint characteristics.

Among them, the user voiceprint identity management subsystem 171 in the data key protection system provided in the embodiment of the present application can be the user identity management subsystem server mentioned in Example 1 and Implementation 4; the trusted chip management subsystem 172 can be the trusted chip mentioned in Example 2 and Implementation 5.

Specifically, FIG18 is a schematic diagram of the structure of a data key protection system according to an eleventh embodiment of the present invention. As shown in FIG18 , the voiceprint feature and data key management subsystem in the trusted chip in FIG18 (i.e., the trusted chip management subsystem 172 in this application) and the data key protection system provided by this embodiment of the present application are specifically as follows:

Optionally, the user voiceprint identity management subsystem 171 includes: a user identity registration module 1711, a voiceprint identity registration module 1712, a voiceprint feature model establishment module 1713 and a voiceprint feature extraction module 1714, wherein the user identity registration module 1711 is used to receive the user identity information submitted by the user terminal, generate an identity information identifier based on the user identity information, and return the identity information identifier to the user terminal; the voiceprint identity registration module 1712 is used to receive the voiceprint registration request submitted by the user terminal, return the voiceprint response information to the user terminal, and receive the user voice uploaded by the user terminal based on the voiceprint response information; wherein the voiceprint response information includes text information to be verified, and the text information is used to instruct the user terminal to collect the user voice; the voiceprint feature extraction module 1714 is used to extract the voiceprint features of the user voice; the voiceprint feature model establishment module 1713 is used to establish a voiceprint feature model based on the voiceprint features.

Furthermore, optionally, the trusted chip management subsystem 172 includes: a user information import module 1721, a voiceprint feature storage module 1722, a user data key creation module 1723, a user data key storage module 1724, a voiceprint feature comparison module 1725 and a data key usage module 1726, wherein the user information import module 1721 is used to import the identity information identifier and the voiceprint feature into the trusted chip when the user information includes the identity information identifier and the voiceprint feature; the voiceprint feature storage module 1722 is used to encrypt the voiceprint feature according to the trusted storage root key and store the encrypted voiceprint feature; the user data key creation module 1723 is used to generate a data key according to a preset encryption algorithm and the identity information identifier, and store the data key The key handle is returned to the user terminal; the user data key storage module 1724 is used to map the data key, identity information identifier and voiceprint feature to obtain a mapping relationship between the data key, identity information identifier and voiceprint feature, and store the mapping relationship and the data key, wherein the data key is a key used to encrypt the data key based on the trusted storage root key; the voiceprint feature comparison module 1725 is used to extract the user voice uploaded by the user terminal when the user terminal requests to obtain the data key, and compare the extracted voiceprint features of the user voice with the voiceprint features in the mapping relationship in the user data key storage module; the data key use module 1726 is used to feedback the data key to the user terminal after the comparison is passed, so that the user terminal performs encryption/decryption operations based on the data key.

In summary, the data key protection methods provided in Examples 1 to 5 can be applied to the data key protection system provided in the embodiments of the present application.

Example 12

According to another aspect of an embodiment of the present invention, a storage medium is further provided, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the data key protection method in the above-mentioned embodiments 1 to 5.

Example 13

According to another aspect of an embodiment of the present invention, a processor is provided, which is used to run a program, wherein the data key protection method in the above-mentioned embodiments 1 to 5 is executed when the program is running.

Example 14

According to another aspect of an embodiment of the present invention, a computing device is provided, including a processor and a memory, wherein a program is stored on the memory, and the processor is used to run the program, wherein when the program is running, it is suitable for the processor to execute the data key protection method in the above-mentioned embodiments 1 to 5.

Example 15

The embodiment of the present invention further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the data key protection method provided in the first embodiment.

Optionally, in this embodiment, the above-mentioned storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

Optionally, in this embodiment, the storage medium is configured to store program code for executing the following steps: the user identity management subsystem server receives a first key acquisition request sent by the user terminal, wherein the first key acquisition request includes the user's identity authentication information; the user identity management subsystem server returns the voice information to be verified to the user terminal based on the first key acquisition request; the user identity management subsystem server receives the user voice uploaded by the user terminal based on the voice information to be verified; the user identity management subsystem server extracts the voiceprint features of the user voice, and generates a second key acquisition request based on the voiceprint features and the identity authentication information; the user identity management subsystem server sends the second key acquisition request to the trusted chip.

Optionally, in this embodiment, the storage medium is configured to store program code for executing the following steps: when the identity authentication information includes an identity information identifier and a key handle, the user identity management subsystem server extracts the voiceprint features of the user's voice, and generates a second key acquisition request based on the voiceprint features and the identity authentication information, including: the user identity management subsystem server extracts the voiceprint features in the user's voice; the user identity management subsystem server encrypts the voiceprint features, identity information identifier and key handle through the public key of the trusted chip to generate a second key acquisition request.

Optionally, in this embodiment, the storage medium is configured to store program code for executing the following steps: when the identity authentication information includes a trusted certificate, an identity information identifier and a key handle, the user identity management subsystem server returns the voice information to be verified to the user terminal based on the first key acquisition request, including: the user identity management subsystem server decrypts the first key acquisition request based on the user identity management subsystem private key, wherein the first key acquisition request is encrypted by the user identity management subsystem public key; the user identity management subsystem private key corresponds to the user identity management subsystem public key; the user identity management subsystem server parses the decrypted first key acquisition request and obtains the trusted certificate in the first key acquisition request; the user identity management subsystem server determines whether the trusted certificate meets the preset verification conditions; if the judgment result is yes, the user identity management subsystem server returns the voice information to be verified to the user terminal, wherein the voice information to be verified includes: the user identity management subsystem certificate and the voice to be verified.

Further, optionally, in this embodiment, the storage medium is configured to store program code for executing the following steps: the user identity management subsystem server extracts the voiceprint features of the user's voice, and generates a second key acquisition request based on the voiceprint features and the identity authentication information, including: the user identity management subsystem server decrypts the user's voice based on the user identity management subsystem private key to obtain a random number, data to be encrypted or decrypted, and a sound to be verified; the user identity management subsystem server extracts the voiceprint features of the sound to be verified; the user identity management subsystem server encrypts the voiceprint features, random numbers, data to be encrypted or decrypted, identity information identifier, and key handle through the public key of the trusted chip to generate a second key acquisition request.

The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims (23)

1. A method for protecting a data key, characterized in that it comprises: The user identity management subsystem server receives a first key acquisition request sent by a user terminal, wherein the first key acquisition request includes the user's authentication information; The user identity management subsystem server returns voice information to be verified to the user terminal based on the first key acquisition request; The user identity management subsystem server receives the user's voice uploaded by the user terminal based on the voice information to be verified. The user identity management subsystem server extracts the voiceprint features of the user's voice and generates a second key acquisition request based on the voiceprint features and the authentication information; The user identity management subsystem server sends the second key acquisition request to the trusted chip; When the authentication information includes a trusted certificate, an identity information identifier, and a key handle, the user identity management subsystem server returns voice information to be verified to the user terminal based on the first key acquisition request, including: the user identity management subsystem server decrypting the first key acquisition request using the user identity management subsystem private key, wherein the first key acquisition request is encrypted using the user identity management subsystem public key; the user identity management subsystem private key corresponds to the user identity management subsystem public key; the user identity management subsystem server parses the decrypted first key acquisition request to obtain the trusted certificate in the first key acquisition request; the user identity management subsystem server determines whether the trusted certificate meets preset verification conditions; if the determination result is yes, the user identity management subsystem server returns the voice information to be verified to the user terminal, wherein the voice information to be verified includes: the user identity management subsystem certificate and the voice to be verified. 2. The data key protection method according to claim 1, characterized in that, when the authentication information includes an identity information identifier and a key handle, the user identity management subsystem server extracts the voiceprint features of the user's voice and generates a second key acquisition request based on the voiceprint features and the authentication information, including: The user identity management subsystem server extracts the voiceprint features from the user's voice. The user identity management subsystem server encrypts the voiceprint feature, the identity information identifier, and the key handle using the public key of the trusted chip, and generates a second key acquisition request. 3. The data key protection method according to claim 1, characterized in that, the user identity management subsystem server extracts the voiceprint features of the user's voice and generates a second key acquisition request based on the voiceprint features and the authentication information, including: The user identity management subsystem server decrypts the user's voice based on the user identity management subsystem private key to obtain a random number, data to be encrypted or decrypted, and sound to be verified. The user identity management subsystem server extracts the voiceprint features of the voice to be verified; The user identity management subsystem server encrypts the voiceprint feature, the random number, the data to be encrypted or decrypted, the identity information identifier, and the key handle using the public key of the trusted chip, and generates the second key acquisition request. 4. A method for protecting a data key, characterized in that it includes: A trusted chip receives a key acquisition request, wherein the key acquisition request includes: voiceprint features; wherein the trusted chip is a data processing chip that performs encryption or decryption calculations through a built-in independent processor and memory; The trusted chip parses the key acquisition request and compares the voiceprint features in the key acquisition request with the pre-stored voiceprint features; If the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip returns key response information to the user terminal; The step of the trusted chip returning key response information to the user terminal if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature includes: if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip extracts the corresponding data key based on the voiceprint feature; the trusted chip encrypts or decrypts the data to be encrypted or decrypted based on the data key to obtain encrypted information or decrypted information; the trusted chip performs a preset calculation on a random number and the encrypted information or decrypted information to obtain a calculation result; the trusted chip encrypts the calculation result using the public key of the user terminal to generate the key response information; and the trusted chip returns the key response information to the user terminal. 5. The data key protection method according to claim 4, characterized in that, when the key acquisition request includes the voiceprint feature, identity information identifier, and key handle, the trusted chip parses the key acquisition request and compares the voiceprint feature in the key acquisition request with the pre-stored voiceprint feature, including: The trusted chip decrypts the key acquisition request using its private key and extracts the voiceprint feature, wherein the key acquisition request is encrypted using the trusted chip's public key; the trusted chip's public key corresponds to its private key. The trusted chip compares the voiceprint feature with the pre-stored voiceprint feature to determine whether the voiceprint feature is the same as the pre-stored voiceprint feature. 6. The data key protection method according to claim 5, characterized in that, if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip returns key response information to the user terminal including: If the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature, the trusted chip extracts the corresponding data key based on the voiceprint feature. The trusted chip encrypts the data key using the public key of the user terminal and generates the key response information; The trusted chip returns the key response information to the user terminal. 7. The data key protection method according to claim 4, characterized in that, when the key acquisition request includes the voiceprint feature, random number, data to be encrypted or decrypted, identity information identifier, and key handle, the trusted chip parses the key acquisition request and compares the voiceprint feature in the key acquisition request with the pre-stored voiceprint feature, including: The trusted chip decrypts the key acquisition request using its private key to obtain the voiceprint feature, wherein the key acquisition request is encrypted using the trusted chip's public key; the trusted chip's public key corresponds to its private key. The trusted chip compares the voiceprint feature with the pre-stored voiceprint feature to determine whether the voiceprint feature is the same as the pre-stored voiceprint feature. 8. A method for protecting a data key, characterized in that it includes: A key acquisition request sent by a user terminal to the user identity management subsystem server, wherein the key acquisition request includes the user's authentication information; The user terminal receives the voice information to be verified returned by the user identity management subsystem server; The user terminal uploads user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; The user terminal receives key response information returned by the trusted chip, wherein the key response information corresponds to the user's voice uploaded to the user identity management subsystem server; After the user terminal receives the voice information to be verified returned by the user identity management subsystem server, the method further includes: the user terminal parsing the voice information to be verified to obtain the user identity management subsystem certificate and the voice to be verified; the user terminal determining whether the user identity management subsystem certificate meets preset verification conditions; if the determination result is yes, the user terminal receiving the sound signal of the voice to be verified read aloud by the user; the user terminal encrypting the random number, the sound signal, and the data to be encrypted or decrypted using the public key of the user identity management subsystem to obtain the user voice; and the user terminal uploading the user voice to the user identity management subsystem server. 9. The data key protection method according to claim 8, characterized in that, when the authentication information includes an identity information identifier and a key handle, the key acquisition request sent by the user terminal to the user identity management subsystem server includes: The user terminal generates the key acquisition request based on the identity information identifier and the key handle; The user terminal sends the key acquisition request to the user identity management subsystem server. 10. The data key protection method according to claim 9, characterized in that, after the user terminal receives the key response information returned by the trusted chip, the method further includes: The user terminal decrypts the key response information based on its private key to obtain the data key carried in the key response information. The key response information is encrypted using the user terminal's public key, and the user terminal's public key corresponds to its private key. The user terminal encrypts or decrypts the data to be encrypted or decrypted based on the data key to obtain encrypted data information or decrypted information. 11. The data key protection method according to claim 8, characterized in that, when the authentication information includes a trusted certificate, an identity information identifier, and a key handle, the first key acquisition request sent by the user terminal to the user identity management subsystem server includes: The user terminal encrypts the trusted certificate, the identity information identifier, and the key handle using the public key of the user identity management subsystem, and generates the key acquisition request; The user terminal sends the key acquisition request to the user identity management subsystem server. 12. The data key protection method according to claim 8, characterized in that, after the user terminal receives the key response information returned by the trusted chip, the method further includes: The user terminal decrypts the key response information using its private key to obtain the calculation result in the key response information; The user terminal verifies the calculation result based on the random number and a preset algorithm, and determines whether the calculation result meets the preset verification standard. If the determination result is yes, the user terminal uses the calculation result. 13. A method for protecting a data key, characterized in that it includes: A key acquisition request sent by a user terminal to the user identity management subsystem server, wherein the key acquisition request includes the user's authentication information; The user terminal receives the voice information to be verified returned by the user identity management subsystem server; The user terminal uploads user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; The user terminal receives the voiceprint features extracted from the user's voice by the user identity management subsystem server; The trusted chip in the user terminal compares the voiceprint features with pre-stored voiceprint features; If the voiceprint feature matches the pre-stored voiceprint feature, the trusted chip in the user terminal extracts the data key corresponding to the voiceprint feature; The user terminal performs a corresponding operation based on the data key. Before the user terminal sends a key acquisition request to the user identity management subsystem server, the method further includes: The trusted chip in the user terminal imports pre-acquired identity information and voiceprint features; The trusted chip in the user terminal encrypts the voiceprint feature based on the trusted storage root key and stores the encrypted voiceprint feature. The trusted chip in the user terminal generates a data key based on a preset encryption algorithm and the identity information identifier, and returns the key handle of the data key to the user terminal. The trusted chip in the user terminal maps the data key, the identity information identifier, and the voiceprint feature to obtain the mapping relationship between the data key, the identity information identifier, and the voiceprint feature, and stores the mapping relationship and the data key. 14. A method for protecting a data key, characterized in that it includes: Obtain user login information and trigger a key acquisition request, wherein the key acquisition request includes the user's authentication information; Obtain the corresponding voice information to be verified based on the key acquisition request; Receive user voice input by the user based on the voice information to be verified; Extract the user's voiceprint features based on the user's speech; The voiceprint features are compared with pre-stored voiceprint features using a trusted chip; If the voiceprint feature matches the pre-stored voiceprint feature, the data key corresponding to the voiceprint feature is extracted through the trusted chip; Perform the corresponding operation based on the data key; When the authentication information includes a trusted certificate, an identity information identifier, and a key handle, obtaining the corresponding voice information to be verified based on the key acquisition request includes: decrypting the key acquisition request using the private key of the user identity management subsystem, wherein the key acquisition request is encrypted using the public key of the user identity management subsystem; the private key of the user identity management subsystem corresponds to the public key of the user identity management subsystem; parsing the decrypted key acquisition request to obtain the trusted certificate in the key acquisition request; determining whether the trusted certificate meets the preset verification conditions; and if the determination result is yes, obtaining the voice information to be verified, wherein the voice information to be verified includes: the user identity management subsystem certificate and the voice to be verified. 15. A data key protection device, characterized in that it comprises: The first receiving module is configured to receive a first key acquisition request sent by a user terminal, wherein the first key acquisition request includes the user's authentication information; The first sending module is used to return voice information to be verified to the user terminal based on the first key acquisition request. The second receiving module is used to receive user voice uploaded by the user terminal based on the voice information to be verified. The request generation module is used to extract the voiceprint features of the user's voice and generate a second key acquisition request based on the voiceprint features and the authentication information. The second sending module is used to send the second key acquisition request to the trusted chip; When the authentication information includes a trusted certificate, an identity information identifier, and a key handle, returning the voice information to be verified to the user terminal based on the first key acquisition request includes: decrypting the first key acquisition request using the private key of the user identity management subsystem, wherein the first key acquisition request is encrypted using the public key of the user identity management subsystem; the private key of the user identity management subsystem corresponds to the public key of the user identity management subsystem; parsing the decrypted first key acquisition request to obtain the trusted certificate in the first key acquisition request; determining whether the trusted certificate meets the preset verification conditions; and if the determination result is yes, returning the voice information to be verified to the user terminal, wherein the voice information to be verified includes: the user identity management subsystem certificate and the voice to be verified. 16. A data key protection device, characterized in that it comprises: The third receiving module is used to receive a key acquisition request, wherein the key acquisition request includes: voiceprint features; The parsing module is used to parse the key acquisition request and compare the voiceprint features in the key acquisition request with the pre-stored voiceprint features; The third sending module is used to return key response information to the user terminal if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature; The step of returning key response information to the user terminal if the voiceprint feature in the key acquisition request matches the pre-stored voiceprint feature includes: extracting the corresponding data key based on the voiceprint feature; encrypting or decrypting the data to be encrypted or decrypted based on the data key to obtain encrypted or decrypted information; performing a preset calculation on the random number and the encrypted or decrypted information to obtain a calculation result; encrypting the calculation result using the public key of the user terminal to generate the key response information; and returning the key response information to the user terminal. 17. A data key protection device, characterized in that it comprises: The fourth sending module is used to send a key acquisition request to the user identity management subsystem server, wherein the key acquisition request includes the user's authentication information; The fourth receiving module is used to receive the voice information to be verified returned by the user identity management subsystem server; The fifth sending module is used to upload user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; The fifth receiving module is used to receive key response information returned by the trusted chip, wherein the key response information corresponds to the user voice uploaded to the user identity management subsystem server; After receiving the voice information to be verified returned by the user identity management subsystem server, the system parses the voice information to obtain the user identity management subsystem certificate and the voice to be verified; it determines whether the user identity management subsystem certificate meets the preset verification conditions; if the determination result is yes, it receives the sound signal of the voice to be verified read by the user; it encrypts the random number, the sound signal, and the data to be encrypted or decrypted using the public key of the user identity management subsystem to obtain the user's voice; and it uploads the user's voice to the user identity management subsystem server. 18. A data key protection device, characterized in that it comprises: The sixth sending module is used to send a key acquisition request to the user identity management subsystem server, wherein the key acquisition request includes the user's authentication information; The sixth receiving module is used to receive the voice information to be verified returned by the user identity management subsystem server; The seventh sending module is used to upload user voice to the user identity management subsystem server, wherein the user voice corresponds to the voice information to be verified; The seventh receiving module is used to receive the voiceprint features extracted from the user's voice by the user identity management subsystem server; The feature comparison module is used to compare the voiceprint features with pre-stored voiceprint features; A key extraction module is used to extract the data key corresponding to the voiceprint feature if the voiceprint feature matches the pre-stored voiceprint feature; The data protection module is used to perform corresponding operations based on the data key; Before sending a key acquisition request to the user identity management subsystem server, the trusted chip in the user terminal imports pre-acquired identity information identifiers and voiceprint features; the trusted chip in the user terminal encrypts the voiceprint features according to the trusted storage root key and stores the encrypted voiceprint features; the trusted chip in the user terminal generates a data key according to a preset encryption algorithm and the identity information identifiers, and returns the key handle of the data key to the user terminal; the trusted chip in the user terminal maps the data key, the identity information identifiers, and the voiceprint features to obtain a mapping relationship between the data key, the identity information identifiers, and the voiceprint features, and stores the mapping relationship and the data key. 19. A data key protection device, characterized in that it comprises: The information acquisition module is used to acquire user login information and trigger a key acquisition request, wherein the key acquisition request includes the user's authentication information; The verification information acquisition module is used to acquire the corresponding voice information to be verified based on the key acquisition request; The receiving module is used to receive user voice input by the user based on the voice information to be verified; The extraction module is used to extract the user's voiceprint features based on the user's voice. The feature comparison module is used to compare the voiceprint features with pre-stored voiceprint features through a trusted chip; A key extraction module is used to extract the data key corresponding to the voiceprint feature through the trusted chip if the voiceprint feature matches the pre-stored voiceprint feature. The data protection module is used to perform corresponding operations based on the data key; When the authentication information includes a trusted certificate, an identity information identifier, and a key handle, obtaining the corresponding voice information to be verified based on the key acquisition request includes: decrypting the key acquisition request using the private key of the user identity management subsystem, wherein the key acquisition request is encrypted using the public key of the user identity management subsystem; the private key of the user identity management subsystem corresponds to the public key of the user identity management subsystem; parsing the decrypted key acquisition request to obtain the trusted certificate in the key acquisition request; determining whether the trusted certificate meets the preset verification conditions; and if the determination result is yes, obtaining the voice information to be verified, wherein the voice information to be verified includes: the user identity management subsystem certificate and the voice to be verified. 20. A data key protection system, characterized in that it comprises: a user voiceprint identity management subsystem and a trusted chip management subsystem, wherein, The user voiceprint identity management subsystem is used to obtain each user's identity information and voiceprint features; The trusted chip management subsystem is used to generate a corresponding key based on each user's identity information and the voiceprint feature; The user voiceprint identity management subsystem includes: a user identity registration module, a voiceprint identity registration module, a voiceprint feature model establishment module, and a voiceprint feature extraction module. The user identity registration module is used to receive user identity information submitted by the user terminal, generate an identity information identifier based on the user identity information, and return the identity information identifier to the user terminal. The voiceprint identity registration module is used to receive a voiceprint registration request submitted by the user terminal, return voiceprint response information to the user terminal, and receive user voice uploaded by the user terminal based on the voiceprint response information; wherein, the voiceprint response information includes text information to be verified, and the text information is used to instruct the user terminal to record the user voice. The voiceprint feature extraction module is used to extract the voiceprint features of the user's speech; The voiceprint feature model building module is used to build a voiceprint feature model based on the voiceprint features. 21. The data key protection system according to claim 20, characterized in that the trusted chip management subsystem comprises: a user information import module, a voiceprint feature storage module, a user data key creation module, a user data key storage module, a voiceprint feature comparison module, and a data key usage module, wherein, The user information import module is used to import the identity information identifier and the voiceprint feature into the trusted chip when the user information includes the identity information identifier and the voiceprint feature; The voiceprint feature storage module is used to encrypt the voiceprint feature according to the trusted storage root key and store the encrypted voiceprint feature. The user data key creation module is used to generate a data key based on a preset encryption algorithm and the identity information identifier, and return the key handle of the data key to the user terminal; The user data key storage module is used to map the data key, the identity information identifier, and the voiceprint feature to obtain the mapping relationship between the data key, the identity information identifier, and the voiceprint feature, and to store the mapping relationship and the data key. The voiceprint feature comparison module is used to extract the user's voice uploaded by the user terminal when the user terminal requests to obtain the data key, and compare the voiceprint features of the extracted user voice with the voiceprint features in the mapping relationship in the user data key storage module. The data key usage module is used to feed back the data key to the user terminal after the comparison is successful, so that the user terminal can perform encryption/decryption operations based on the data key. 22. A storage medium, characterized in that the storage medium includes a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to perform the data key protection method according to any one of claims 1 to 14. 23. A computing device, characterized in that it comprises a processor and a memory, wherein the memory stores a program, and the processor is configured to run the program, wherein the program, when running, is adapted to cause the processor to perform the data key protection method according to any one of claims 1 to 14.