HK40016698A - Managing cryptographic keys based on identity information - Google Patents

Description

Managing encryption keys based on identity information

Technical Field

This document relates to identity authentication techniques and data security.

Background

Authentication techniques are commonly used in computer networks to verify user identity and ensure data security. Identity information may be represented by a data set, as well as other information digitally stored or transmitted in a computer network. The computer may identify and authenticate the user based on the user's digital identity. For data security, it is important to ensure that the digital identity belongs to an authorized user, or in other words that the digital identity matches the actual identity.

With the development of technology, decentralized systems such as blockchain networks and internet of things (IoT) networks have emerged. Under decentralized systems, individuals can safely store their own identity information themselves. For example, a user may hold a digital wallet that stores a private key that the user may use to add a digital signature to authorize transactions on a blockchain network or IoT device. The private key is typically stored on the computing device as a data string with cryptographic semantics and is intended to be accessible only to the user. As with other data strings, the private key can potentially be copied and shared. Any user having a private key can control the digital asset associated with the private key. Furthermore, if the private key is lost, the digital asset cannot be retrieved. Therefore, secure storage and efficient use of encryption keys can be important.

It is desirable to develop a key management technique that can securely manage a user's encryption key based on the user's true identity.

Disclosure of Invention

Techniques for managing encryption keys based on user identity information are described herein. These techniques generally involve: an identity encryption chip (ICC) receives biometric information and a request to store a user key pair in memory on the ICC, determines that the biometric information matches biometric information previously stored on the chip, and encrypts and stores the user key pair in memory of the ICC.

Also provided herein are one or more non-transitory computer-readable storage media coupled to one or more processors and having instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform operations in accordance with embodiments of the methods provided herein.

Also provided herein are systems for implementing the methods provided herein. The system includes one or more processors and a computer-readable storage medium coupled to the one or more processors and having instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform operations in accordance with embodiments of the methods provided herein.

It should be appreciated that methods in accordance with the present disclosure may include any combination of the aspects and features described herein. That is, methods according to the present disclosure are not limited to the combinations of aspects and features specifically described herein, but also include any combination of the aspects and features provided.

The details of one or more embodiments of the disclosure are set forth in the accompanying drawings and the description below. Other features and advantages will be apparent from the description and drawings, and from the claims.

Drawings

FIG. 1 is a diagram illustrating an example of an identity encryption chip that may be used to perform the processing of embodiments herein.

Fig. 2 is a flow diagram illustrating an example of an initialization process for an identity cryptographic chip according to embodiments herein.

Fig. 3 is a flow diagram illustrating an example of a process for inputting information to an identity cryptographic chip according to embodiments herein.

Fig. 4 is a flow diagram illustrating an example of a process for performing a cryptographic operation using an identity cryptographic chip according to embodiments herein.

Fig. 5 is a diagram illustrating an example of a key management device according to an embodiment herein.

Fig. 6 depicts an example of a method that may be performed in accordance with embodiments herein.

Fig. 7 depicts an example of modules of an apparatus according to embodiments herein.

Like reference numbers and designations in the various drawings indicate like elements.

Detailed Description

Techniques for managing encryption keys based on user identity information are described herein. These techniques generally involve: an identity encryption chip (ICC) receives biometric information and a request to store a user key pair into memory on the ICC, determines that the biometric information matches biometric information previously stored on the chip, and encrypts and stores the user key pair in memory of the ICC.

Fig. 1 is a diagram illustrating an example of an ICC100 for performing a process that may be used to perform embodiments herein. At a higher level, the ICC100 can be a computer chip that includes a memory 102 and a logic computation component 104. The ICC100 may be used to securely perform cryptographic operations. In some embodiments, ICC100 may be a chip set that includes one or more chip components. The memory 102 and the logic computation component 104 may be integrated into different chip components. In some embodiments, memory 102 may be used to provide persistent storage. In some examples, the memory 102 may be a programmable read-only memory (PROM) that is allowed to be written once and only read thereafter. In some examples, the memory 102 may be an Electrically Erasable Programmable Read Only Memory (EEPROM) or flash memory, which may be reformatted and reprogrammed. In some embodiments, the logic computation component may be an Application Specific Integrated Circuit (ASIC) or a Single Chip Microcomputer (SCM).

In some computer networks, cryptography is implemented to maintain privacy of data or transactions. For example, in a blockchain network, if two nodes want to maintain transaction privacy so that other nodes in the blockchain network cannot discern the details of the transaction, the nodes may encrypt the transaction data. Exemplary encryption operations include, but are not limited to, symmetric key encryption and asymmetric key encryption. Symmetric encryption refers to an encryption process that uses a single key to both encrypt (generate ciphertext from plaintext) and decrypt (generate plaintext from ciphertext).

Asymmetric encryption uses key pairs, each key pair comprising a private key and a public key, the private key being known only to the respective user, and the public key being publicly available. A user may encrypt data using a public key of another user, and the encrypted data may be decrypted using a private key of the other user.

The digital signature may be provided using asymmetric encryption, which enables a user in a transaction to confirm other users in the transaction and the validity of the transaction. For example, a user may digitally sign a message, while another user may confirm that the message was sent by the user based on the digital signature. Digital signatures may also be used to ensure that messages are not tampered with during transmission. For example, user a will send a message to user B. User a generates a hash value for the message and then encrypts the hash value using its private key to provide a digital signature that is the encrypted hash value. User a attaches a digital signature to the message and sends the message with the digital signature to user B. User B decrypts the digital signature using user a's public key and extracts the hash value. User B hashes the message and compares the hash values. If the hash values are the same, user B can confirm that the message is indeed from user A and has not been tampered with.

The ICC100 may be used to securely perform cryptographic operations based on verifying user identity information. The memory 102 may be used to store trusted user identity information and encryption key information. The memory 102 may also store an authentication algorithm (e.g., as computer executable code) and an encryption operation algorithm (e.g., as computer executable code). In some embodiments, the information and algorithms stored in the memory 102 are encrypted to prevent compromise even if the ICC100 is reverse engineered. When a request is received from a user to perform a cryptographic operation, the logical compute component 104 can use the identity information collected from the user and the trusted user identity information stored in the memory 102 to verify the identity of the user based on an authentication algorithm. For example, if the identity information is a fingerprint image of a user's fingerprint, the identity authentication algorithm may be a local authentication algorithm that compares the fingerprint image collected from the user with a stored fingerprint image. If the collected fingerprint image matches the stored fingerprint image, the identity of the user is successfully verified. The logical compute component 104 can then use the stored encryption key information to perform the requested encryption operation. After performing the encryption operation, the operation result may be output by the ICC 100. By using the ICC100, an encryption operation can be performed only after verifying or authenticating that the identity of the user is authentic. Thus, the authority of the user to execute the operation can be ensured. Further, since the encryption key is stored as a ciphertext in the ICC100, the encryption operation is performed inside the ICC 100. Only the operation result is output from the ICC 100. In this way, the security of the encryption key can be ensured.

At 110, authorization identity information is input to the ICC 100. The authorisation identity information may be input to the ICC100 during initialisation of the ICC 100. In some embodiments, the authorized identity information may be biometric information of the user, such as a fingerprint, voiceprint, heartbeat information, or iris information. In some embodiments, the authorization identity information may be input by the owner of the ICC 100. As will be discussed further in embodiments herein, a user entering the authorization identity information may use the authorization identity information to control the encryption key input to the ICC 100. The encryption key cannot be input to the ICC100 unless the user identity can be verified based on the authorization identity information.

The authorization identity information may be used to perform authentication to provide authorization for storing encryption keys or performing encryption operations. The identity information may be collected by a computing device communicatively coupled with the ICC 100. For example, the computing device may be a smart watch capable of detecting biometric information of a user.

At 112, the memory contents are cleared and authorization identity information is written to the memory 102. In some embodiments, memory 102 is a persistent memory. In some embodiments, to prevent tampering, the identity information can only be written to the memory location of memory 102 once. If the existing authorization key needs to be replaced with new identity information, the contents of the memory 102 may be erased before the new identity information is written. In some embodiments, the authorization identity information may be encrypted before being written to memory 102 to enhance security.

At 114, identity information of the user and a request to write an asymmetric key pair for the user are received. As described herein, the asymmetric key pair may be used to perform cryptographic operations on memory 102. It should be understood that other encryption keys may also be written to the ICC100 based on a particular encryption operation request. The identity information may be biometric information such as a fingerprint, voiceprint, heartbeat information, or iris information. The identity information may be collected by a computing device communicatively coupled with the ICC 100. At 116, the authorized identity information is read from the memory 102 to verify the identity of the user at 118. Authentication may be performed based on matching the identity information of the user received at 114 with authorized identity information. If the identity information matches, the verification is successful. As a result, the user is authenticated as an authorized user of the ICC100 to allow the asymmetric key pair to be input to the ICC 100. Otherwise, the request at 114 is denied. At 122, the asymmetric key pair is written to the memory 102 of the ICC 100. In some embodiments, the asymmetric key pair may be encrypted prior to writing the asymmetric key pair to memory 102 to enhance security. In some embodiments, the asymmetric key pair may be written to a memory location of memory 102 that is separate from the memory location that stores the authorization identity information.

At 124, identity information of the user and a request to perform an encryption operation are received. The identity information may be collected by a computing device communicatively coupled with the ICC 100. For example, the computing device may be a smart watch that may collect biometric information of the user, which is used as identity information to identify the user. After collecting the identity information, it may be sent to the ICC 100. In some embodiments, data to be subjected to an encryption operation may also be transmitted to the ICC 100. For example, if the encryption operation is encryption, the corresponding data may be a data file to be encrypted. At 126, the authorization identity information written to memory 102 at 122 is read from memory 102 to perform authentication at 128. Authentication may be performed based on a comparison of the identity information received at 124 with authorized identity information. If the identity information matches, the verification is successful and the corresponding asymmetric key information is read from memory 102 at 130 to perform the encryption operation. At 132, an encryption operation is performed using the appropriate encryption key. If the identity information does not match, the authentication is unsuccessful and the request to perform the cryptographic operation may be denied. In some embodiments, authentication may be performed at 128 using an authentication algorithm based on the particular type of identity information received. In some embodiments, the cryptographic operations may be performed based on a cryptographic operation algorithm. As described above, the encryption operation may be encryption, decryption, and/or the addition of a digital signature to the data. After the encryption operation is performed, the operation result may be output at 134.

As described above, the ICC100 can create a trusted environment within the hardware for a user to securely store encryption keys and use the keys to perform encryption operations. For example, a user of the ICC100 may store multiple asymmetric key pairs to the ICC 100. After verifying the identity of the user (e.g., biometric authentication) by the identity information, each asymmetric key pair is written to the memory of the ICC 100. The identity authentication may be performed based on comparing identity information collected from a user with identity information previously stored during initialization of the ICC 100. If the identity information matches, the corresponding identity information and asymmetric key pair may be allowed to be stored in the ICC 100.

When a user requests an encryption operation, the ICC100 can retrieve the biometric information and corresponding asymmetric key pair from memory. The biometric information may be used to verify the identity of the user, and the asymmetric key pair may be used to perform the requested cryptographic operation after verifying the identity of the user. The encryption operation may be performed for various actual scenarios. For example, the encryption operation may be an operation that adds a digital signature to a blockchain transaction. In this example, node a may be a computing device within a blockchain network that initiates a request to digitally sign blockchain transaction data with node B. The blockchain transaction data may be a hashed value of the transaction data between node a and node B. Node a may use the ICC100 to generate a digital signature over the hashed transaction data. To use the ICC100, the identity information provided from node a is collected and compared with the identity information stored in the ICC 100. If the collected identity information matches the stored identity information, it may be determined that node a is authorized to access and use the ICC 100. The private key assigned to node a and previously stored in the memory of the ICC100 can be retrieved to generate a digital signature of the hashed transaction data. Node a may then send the hashed transaction data with the digital signature to node B. Node B decrypts the digital signature using the public key assigned to node a and extracts the hash value. The node B hashes the messages and compares the hash values. If the hash values are the same, node B can confirm that the message did come from node A and has not been tampered with.

Fig. 2 is a flow diagram illustrating an example of a process 200 for ICC initialization according to embodiments herein. In some embodiments, the ICC is initialized by a user of the ICC. In some embodiments, a user may control an encryption key to be stored and used in the ICC to perform an encryption operation securely.

At 202, the ICC is reset. In some embodiments, the ICC is reset in response to receiving a request to enter authorization identity information. In some embodiments, resetting the ICC may include erasing, or reformatting, content stored in a memory of the ICC. In some embodiments, resetting the ICC may also include reconfiguring or resetting the settings of the logical compute component of the ICC to default values. By resetting the ICC it is ensured that one piece of authorization identity information is used to control the information input to the ICC. In addition, the encryption key previously stored in the ICC is erased to ensure data security. In some embodiments, the ICC is a new ICC and is the first-time-use ICC can be initialized to accept input of authorization identity information. If the ICC is new, the ICC can be initialized to accept the authorization identity information. In some embodiments, the authorized identity information may be biometric information, such as a fingerprint, a voiceprint, iris information, and heartbeat information.

At 204, the ICC receives a request to input an identity information input. At 206, an identity information input function is called to input authorized identity information into memory 202. At 208, it is determined whether the memory of the ICC is a one-time programmable (OTP) memory. OTP memory allows data to be written to memory only once. When a user inputs new authorisation identity information to the ICC, any previously stored identity information and encryption key may be erased to ensure that the new authorisation identity does not control the previously input encryption key. Thus, if the memory is an OTP, the authorization identity information may be encrypted and input to the memory at 212. Otherwise, the contents of the memory are cleared at 210 before the authorization identity information is encrypted and entered into the memory. After 212, process 200 ends at 214.

Fig. 3 is a flow diagram illustrating an example of a process 300 for inputting information to an ICC according to an embodiment herein. After initializing the ICC, the user can securely store the encryption key to the ICC based on verifying his identity information.

At 302, the ICC receives a request to store an asymmetric key pair. At 304, identity information of the user making the request is received. In some embodiments, the identity information may be collected by a computing device communicatively coupled with the ICC. An exemplary computing device may include: IoT devices, smart bracelets, smart watches, laptop computers (or desktop computers), and smartphones. In some embodiments, the identity information may be biometric information of the user, such as a fingerprint, voiceprint, heartbeat information, and iris information. The computing device may include a fingerprint sensor, microphone, heartbeat sensor, or iris scanner to collect corresponding biometric information. For example, the computing device may be a smart watch that may collect heartbeat information of a user that may be used as identity information. After collecting the identity information, it may be sent to the ICC along with the user's asymmetric key pair. In some embodiments, the ICC can communicate with the computing device wirelessly based on a wireless communication protocol, such as bluetooth, NFC, Wi-Fi, or cellular data. In some embodiments, the ICC may be inserted or integrated into a computing device to perform wired communications with the computing device.

At 306, the identity information is verified based on the authorization identity information pre-stored in the ICC. If the received identity information matches the authorization identity information, the asymmetric key pair is encrypted and stored to the memory of the ICC at 308. Thereafter, process 300 ends at 310. If the received identity information does not match the authorized identity information, the request to store the asymmetric key pair is denied and process 300 ends at 310. In some embodiments, process 300 may be repeated so that an authorized user may store multiple encryption keys to the ICC corresponding to different user accounts or applications. After inputting the user's encryption key to the ICC, the user can securely perform an encryption operation using the ICC.

Fig. 4 is a flow diagram illustrating an example of a process 400 for performing an encryption operation using ICC according to embodiments herein. At 402, a request to perform an encryption operation is received. Examples of encryption operations may include data encryption, data decryption, and adding a digital signature.

At 404, identity information of a user is received. As discussed in the description of fig. 3, identity information may be collected by a computing device and sent to the ICC. At 406, the identity information may be verified. In some embodiments, the identity information may be compared to identity information stored in a memory of the ICC. If the identity information matches the stored identity information, the authentication is successful and the requested encryption operation may then be performed at 408 using the user's encryption key stored in the memory of the ICC. For example, if the encryption key is an asymmetric key pair, the encryption operation may be an encryption operation based on a public key of the asymmetric key pair, a decryption operation based on a private key of the asymmetric key pair, or a digital signature generation operation. If the identity information does not match the stored identity information, process 400 ends at 412. After 408, process 400 proceeds to 410, where the operation results are returned. The result of the operation may depend on the encryption operation performed at 408. For example, if the encryption operation is file encryption, a file encrypted using the user's public key may be returned. Similarly, if the encryption operation is file decryption, a file decrypted using the user's private key may be returned. If the encryption operation is the addition of a digital signature, a file with a digital signature generated by the user's private key may be returned. After 410, processing ends at 412.

Fig. 5 is a diagram illustrating an example of a key management device 500 according to an embodiment herein. In some embodiments, the encryption key used by the ICC to perform an encryption operation for a user may be managed by the key management device 500. The key management device 500 may perform key management 504 and algorithm management 514. Key management 504 may include storage 506, writing 508, random generation 510, and deletion 512 of encryption keys. The encryption keys may comprise a user key pair associated with a primary user of the ICC and an encryption key pair associated with an authorized user of the ICC to perform the encryption operation.

The algorithms managed by algorithm management 514 may include storing and managing authentication algorithms 516, digital signature verification algorithms 518, encryption and decryption algorithms 520, and token algorithms 522. Authentication algorithm 516 may be used to perform authentication as discussed in the description of step 406 of fig. 4. Digital signature verification algorithm 518 may be used to perform digital signature verification. As discussed in step 408 of fig. 4, an encryption and decryption algorithm 520 may be used to perform the requested encryption operation. For example, if the requested encryption operation is an encryption operation on a user file, encryption and decryption algorithm 520 may be performed to retrieve the user's public key from the memory of the ICC and encrypt the user file. The token algorithm 522 may be used to manage a token that indicates a time limit or a number limit for performing a requested cryptographic operation without verifying the user's identity. In some embodiments, tokens may be generated and temporarily stored in memory of the ICC. The token may provide the following authorization: the encryption operation is performed a plurality of times or within a predetermined period of time without verifying the user's identity. For example, a token may be generated to provide the following authorization to a user of the ICC: the digital signature is added to the next five files received or to the files received in the next three hours, whichever condition is first satisfied. In some embodiments, the token may be cleared and removed from the ICC when it expires or runs out.

In some embodiments, the key management device 500 may serve as a backup to the ICC. The encryption key and algorithm for performing the encryption operation can be retrieved from the key management device 500 even if the ICC is lost or corrupted.

In some embodiments, the key management device 500 may also perform input management 524. The key management device 500 may be communicatively coupled to the ICC to manage algorithm input 526, identity information input 528, encryption key input 530, digital signature generation 532, and identity verification 534.

Fig. 6 depicts an example of a method 600 that may be performed in accordance with embodiments herein. For clarity of presentation, the following description generally describes method 600 in the context of other figures herein. However, it should be understood that the method 600 may be performed, for example, by any suitable system, environment, software, and hardware, or combination of systems, environments, software, and hardware. In some embodiments, the various steps of method 600 may be performed in parallel, combined, in a loop, or in any order. In some embodiments, method 600 may be performed by an ICC as described according to embodiments herein.

At 602, biometric information associated with the user and a request to store the user key pair into memory on the ICC. In some embodiments, pre-stored biometric information is stored into memory during initialization of the ICC. The public and private authorization keys are asymmetric key pairs assigned to the primary user of the ICC. In some embodiments, the initialization of the ICC includes: storing an authentication code executable to authenticate a user based on pre-stored biometric information. In some embodiments, the initialization of the ICC further comprises: storing a first cryptographic operation code executable to add a digital signature based on a user key pair; and storing a second encryption operation code executable to encrypt or decrypt the execution file based on the user key.

In some embodiments, the request to store the user key pair is a first request, the biometric information is first biometric information, and the method 600 further comprises: receiving second biometric information and a second request to add a digital signature to the file; authenticating the second request as authentic based on the second biometric information matching the pre-stored biometric information; and adding a digital signature to the file based on the first cryptographic operation code and a private key of the user key pair. In some embodiments, the identity information is biometric information associated with the user. In some embodiments, method 600 further comprises: receiving third biometric information and a third request to encrypt or decrypt the file; authenticating the user as authentic based on the third biometric information matching the pre-stored biometric information; and performing encryption or decryption based on the third request, the second encryption operation code, and the public or private key of the user key pair.

In some embodiments, biometric information associated with the user is compared to pre-stored biometric information based on biometric identification; and the biometric identification includes one or more of fingerprint identification, voiceprint identification, iris scan, facial identification, and heartbeat identification.

At 604, biometric information associated with the user is compared to biometric information pre-stored in memory as pre-stored biometric information. In some embodiments, the memory is a programmable read-only memory (PROM), electrically erasable PROM, or flash memory, and the identity information and user key pair are stored in separate memory locations of the memory.

At 606, the user key pair is encrypted to provide an encrypted user key pair in response to determining that the biometric information associated with the user matches the pre-stored biometric information.

At 608, the encrypted user key pair is stored to memory.

Fig. 7 depicts an example of modules of an apparatus 700 according to embodiments herein. The apparatus 700 may be an example of an embodiment of an ICC. The apparatus 700 may correspond to the embodiments described above, and the apparatus 700 comprises the following:

a request receiving module 702 to receive biometric information associated with a user and a request to store a user key pair to memory on the ICC. An identity information comparison module 704 for comparing biometric information associated with the user with biometric information pre-stored in memory as pre-stored biometric information. An encryption module 706 to encrypt the user key pair to provide an encrypted user key pair in response to determining that the biometric information associated with the user matches pre-stored biometric information. A storage module 708 for storing the identity information and the user key pair to a memory.

In an alternative embodiment, the pre-stored biometric information is stored in a memory during initialization of the ICC. In an alternative embodiment, the initialization of the ICC comprises: storing an authentication code executable to authenticate a user based on pre-stored biometric information. In an alternative embodiment, the initialization of the ICC comprises: storing a first cryptographic operation code executable to add a digital signature based on a user key pair; and storing a second encryption operation code executable to encrypt or decrypt the execution file based on the user key.

In an alternative embodiment, the memory is a programmable read-only memory (PROM), electrically erasable PROM, or flash memory, and the biometric information and user key pair are stored in separate memory locations of the memory.

The systems, apparatuses, modules or units shown in the foregoing embodiments may be implemented by using a computer chip or entity, or may be implemented by using an article having a specific function. A typical implementation device is a computer, and the computer may be a personal computer, laptop computer, cellular telephone, camera phone, smart phone, personal digital assistant, media player, navigation device, email transceiver, game console, tablet, wearable device, or any combination of these devices.

For the implementation of the functions and roles of each module in the device, reference may be made to the implementation of the corresponding steps in the previous method. Details are omitted here for simplicity.

Since the device implementation substantially corresponds to the method implementation, reference may be made to the relevant description in the method implementation for the relevant components. The previously described device implementations are merely examples. Modules described as separate parts may or may not be physically separate, and parts shown as modules may or may not be physical modules, may be located in one location, or may be distributed over multiple network modules. Some or all of the modules may be selected based on actual needs to achieve the goals addressed herein. Those of ordinary skill in the art will understand and appreciate the embodiments of the present application without inventive effort.

The techniques described herein produce several technical effects. For example, embodiments of the subject matter allow a user of the ICC to store multiple encryption keys to securely perform an encryption operation. The encryption key may be stored to the ICC based on verifying the identity information of the user. If the authentication of the identity information fails, the ICC will reject the input of the encryption key information.

In order to request the ICC to perform an encryption operation, it is necessary to collect the identity information of the user, and this collected identity information needs to be verified as authentic by the identity information previously authenticated and stored in the ICC. In this way, it can be ensured that the user requesting the encryption operation is the user of the encryption key.

Furthermore, the identity information and encryption key may be encrypted before being stored to the memory of the ICC. This information is only decrypted in the ICC to perform the corresponding authentication and encryption operations. The encryption operation is performed inside the ICC, and only the operation result is output from the ICC. Thus, the identity information and encryption keys of the users of the ICC are secure and will not be revealed even if the ICC is hacked or reverse engineered. In some embodiments, the key management device may be used to store the identity information and encryption key in ciphertext to provide backup to the ICC and further enhance data security.

The computing device may be operable to collect user identity information and initiate a request for an encryption operation. The ICC can communicate wirelessly with the computing device through various communication protocols or it can be integrated or plugged into the computing device to be readily used for secure cryptographic operations.

Embodiments of the subject matter, the acts, and the operations described herein may be implemented in digital electronic circuitry, tangibly embodied computer software or firmware, computer hardware, including the structures disclosed herein and structural equivalents thereof, or combinations of one or more of them. Embodiments of the subject matter described herein may be implemented as one or more computer programs, e.g., one or more modules of computer program instructions, encoded on a computer program carrier for execution by, or to control the operation of, data processing apparatus. The carrier may be a tangible, non-transitory computer storage medium. For example, a computer program carrier may include one or more computer-readable storage media having instructions encoded or stored thereon. The carrier may be a tangible, non-transitory computer-readable medium such as a magnetic, magneto-optical disk or optical disk, a solid state drive, Random Access Memory (RAM), Read Only Memory (ROM), or other media types. Alternatively or additionally, the carrier may be an artificially generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal, that is generated to encode information for transmission to suitable receiver apparatus for execution by the data processing apparatus. The computer storage medium may be or be partially a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them. Computer storage media is not a propagated signal.

A computer program can also be referred to or described as a program, software application, app, module, software module, engine, script, or code and can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages; it can be deployed in any form, including as a stand-alone program or as a module, component, engine, subroutine, or other unit suitable for execution in a computing environment, which may include one or more computers interconnected by a communications data network at one or more locations.

A computer program may, but need not, correspond to a file in a file system. The computer program may be stored in: a portion of a file that holds other programs or data, e.g., one or more scripts stored in a markup language document; a single file dedicated to the program in question; or multiple coordinated files, such as files that store one or more modules, sub programs, or portions of code.

Processors for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any kind of digital computer. Generally, a processor will receive instructions and data of a computer program for execution from a non-transitory computer-readable medium coupled to the processor.

The term "data processing apparatus" includes all types of apparatus, devices, and machines for processing data, including by way of example a programmable processor, a computer, or multiple processors or computers. The data processing apparatus may comprise special purpose logic circuitry, e.g., an FPGA (field programmable gate array), an ASIC (application-specific integrated circuit), or a GPU (graphics processing unit). In addition to hardware, the apparatus can include code that creates an execution environment for the computer program, e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them.

The processes and logic flows described herein can be performed by one or more computers or processors executing one or more computer programs to perform operations by operating on input data and generating output. The processes and logic flows can also be performed by, and in combination with, special purpose logic circuitry, e.g., an FPGA, an ASIC, a GPU, etc., and one or more programmed computers.

A computer suitable for executing a computer program may be based on a general and/or special purpose microprocessor, or any other kind of central processing unit. Generally, a central processing unit will receive instructions and data from a read-only memory and/or a random access memory. Elements of a computer may include a central processing unit for executing instructions and one or more memory devices for storing instructions and data. The central processing unit and the memory can be supplemented by, or integrated in, special purpose logic circuitry.

Typically, a computer will also include, or be operatively coupled to receive data from or transfer data to, one or more mass storage devices. The mass storage device may be, for example, a magnetic, magneto-optical disk or optical disk, a solid state drive, or any other type of non-transitory computer readable medium. However, a computer need not have such devices. Thus, a computer may be coupled to one or more mass storage devices, e.g., one or more memories, both local and/or remote. For example, the computer may include one or more local memories as components of the computer, or the computer may be coupled to one or more remote memories in a cloud network. Moreover, a computer may be embedded in another device, e.g., a mobile telephone, a Personal Digital Assistant (PDA), a mobile audio or video player, a game console, a Global Positioning System (GPS) receiver, or a portable storage device, e.g., a Universal Serial Bus (USB) flash drive, to name a few.

Components may be "coupled" to one another by being connected to one another directly or through one or more intermediaries, e.g., interchangeably electrically or optically. Components may also be "coupled" to one another if one of the components is integrated into another component. For example, a storage component integrated into a processor (e.g., an L2 cache component) is "coupled" to the processor.

To provide for interaction with a user, embodiments of the subject matter described herein can be implemented on or configured to communicate with a computer having: a display device, e.g., an LCD (liquid crystal display) monitor, for displaying information to a user; and input devices through which a user may provide input to the computer, such as a keyboard and a pointing device, such as a mouse, trackball or touch pad. Other types of devices may also be used to provide for interaction with a user; for example, feedback provided to the user can be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and may receive any form of input from the user, including acoustic, speech, or tactile input. Further, the computer may interact with the user by sending and receiving documents to and from the device used by the user; for example, by sending a web page to a web browser on the user device in response to a request received from the web browser, or by interacting with an application (app) running on the user device, such as a smartphone or electronic tablet. In addition, the computer may interact with the user by sending text messages or other forms of messages in turn to a personal device (e.g., a smartphone running a messaging application) and receiving response messages from the user.

The term "configured" is used herein in relation to systems, apparatuses, and computer program components. For a system of one or more computers configured to perform particular operations or actions, it is meant that the system has installed thereon software, firmware, hardware, or a combination thereof that, when executed, causes the system to perform the operations or actions. For one or more computer programs configured to perform specific operations or actions, it is meant that the one or more programs include instructions, which when executed by a data processing apparatus, cause the apparatus to perform the operations or actions. By dedicated logic circuitry configured to perform a particular operation or action is meant that the circuitry has electronic logic to perform the operation or action.

While this document contains many specific implementation details, these should not be construed as limitations on the scope of what is claimed, as defined by the claims themselves, but rather as descriptions of specific features of particular embodiments. Certain features that are described herein in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination. Furthermore, although features may be described above as acting in certain combinations and even initially claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claimed combination may be directed to a subcombination or variation of a subcombination.

Similarly, while operations are depicted in the drawings and recited in the claims in a particular order, this should not be understood as: it may be desirable to perform the operations in the particular order shown, or in sequence, or to perform all of the operations shown, in order to achieve desirable results. In some cases, multitasking and parallel processing may be advantageous. Moreover, the division of the various system modules and components in the embodiments described above should not be understood as requiring such division in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

Specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. For example, the actions recited in the claims can be performed in a different order and still achieve desirable results. As one example, the processes depicted in the accompanying figures do not require the particular order shown, or sequence, to achieve desirable results. In some cases, multitasking and parallel processing may be advantageous.

Claims (10)

1. A computer-implemented method for managing user key pairs, the method comprising:

receiving biometric information associated with a user and a request to store a user key pair in memory on an identity encryption chip ICC;

comparing biometric information associated with the user with biometric information pre-stored in a memory as pre-stored biometric information;

in response to determining that the biometric information associated with the user matches the pre-stored biometric information, encrypting the user key pair to provide an encrypted user key pair; and

storing the encrypted user key pair in the memory.

2. The computer-implemented method of claim 1, wherein the pre-stored biometric information is stored into the memory during initialization of the ICC.

3. The computer-implemented method of claim 2, wherein the initialization of the ICC comprises:

storing an authentication code executable to authenticate the user based on the pre-stored biometric information.

4. The computer-implemented method of claim 2 or 3, wherein the initialization of the ICC comprises:

storing a first cryptographic operation code executable to add a digital signature based on the user key pair; and

storing a second encryption operation code executable to perform file encryption or file decryption based on the user key pair.

5. The computer-implemented method of claim 4, wherein the request to store the user key pair is a first request, the biometric information is first biometric information, and the computer-implemented method further comprises:

receiving second biometric information and a second request to add a digital signature to the file;

authenticating the second request as authentic based on the second biometric information matching the pre-stored biometric information; and

adding the digital signature to the file based on the first cryptographic operation code and a private key of the user key pair.

6. The computer-implemented method of claim 5, further comprising:

receiving third biometric information and a third request to encrypt or decrypt the file;

authenticating the user as authentic based on the third biometric information matching the pre-stored biometric information; and

performing encryption or decryption based on the third request, the second encryption operation code, and the public key or the private key of the user key pair.

7. The computer-implemented method of any of the preceding claims, wherein:

comparing biometric information associated with the user with the pre-stored biometric information based on biometric identification; and

the biometric identification includes one or more of fingerprint identification, voiceprint identification, iris scan, facial identification, and heartbeat identification.

8. The computer-implemented method of any of the preceding claims, wherein the memory is a programmable read-only memory (PROM), an electrically erasable PROM, or a flash memory, and the biometric information and the user key pair are stored in separate storage units of the memory.

9. A system for managing user key pairs, comprising:

one or more processors; and

one or more computer-readable memories coupled to the one or more processors and having instructions stored thereon that are executable by the one or more processors to perform the method of any of claims 1-8.

10. An apparatus for managing user key pairs, the apparatus comprising a plurality of modules for performing the method of any of claims 1-8.