TW201438450A - Method for storing and restoring generation of encryption key - Google Patents

Abstract

Disclosed is a method for storing and restoring the generation of encryption key, which treats the key information inside a CipherCube with a design of multiple backups, so that the key information could be stored in the CipherCube and a CertiTAG in the form of encryption. When a scenario such as damage, malfunction, stealing, or data loss over the CipherCube or the CertiTAG occurs, the key information in the CipherCube and the CertiTAG could be restored through a secured and simple procedure and then an authentication job could be completed. As a result, the process of file data storage and delivery passing in and out of the way from the CipherCube to a cloud system can be encrypted and decrypted normally.

Description

Encryption key output storage and recovery method

The invention relates to a method for storing and recovering an encryption key, in particular to designing a multiple backup of a key information in a gateway (CipherCube), when a gateway (CipherCube) or a chip (CertiTAG) occurs. In the case of damage, malfunction, theft or loss of data, the key information in the gateway or the chip can be restored in a safe and simple manner, and is applicable to the gateway or the like of the user-side information protection.

In recent years, the technology industry has developed towards the cloud service. Whether it is an individual or a corporate company, it can upload a large number of files and other information files and contents to the cloud for storage by subscribing to the cloud storage (or network disk) service. Accounts and passwords are used to set access rights, so that individuals or companies can download files from the mobile device anytime, anywhere via mobile devices (such as smart phones or tablets), desktop computers, and notebook computers.

However, setting up an account and password alone is not enough to prevent illegal access to various types of file information stored in the cloud (or network disk), such as browsing or stealing by hackers or unauthorized persons, because of the account number and password. It is easy to crack, and once stored in various files or files in the cloud space (or network disk), the data owner cannot control the protection measures, and the account or password is forgotten. On the other hand, if the data is protected by the user at the user end, once the key or related verification data is lost, the data cannot be recovered.

Therefore, the present inventors have proposed a method for storing and restoring the encryption key output in view of the above-mentioned deficiencies, which facilitates reading key information and recovery key information, taking into account the advantages of the current cloud storage data, and can provide use. For the storage and transmission of archives into and out of the gateway to the cloud, the initiative can take protective measures. It is a research and design system to provide a method that is safe for both key security and authentication.

The main purpose of the present invention is to provide a method for storing and restoring an encryption key, which is to design a multiple backup of a key information in a gateway (CipherCube) so that the key information can be separately stored in the gate in an encrypted manner. In the built-in memory and chip (CertiTAG), when the key information in the gateway or chip is damaged, disappeared, damaged or lost, the system owner can restore the storage in the gateway or the chip. Key information; on the other hand, when the gateway or chip is stolen, the thief cannot access or restore the key information stored in the gateway or the chip; however, the system owner can recover through several steps. The key information enables the active protection measures for storing and transmitting the archive data to and from the gateway to the cloud to operate normally, and the key or the authentication failure is not caused, thereby increasing the overall functionality and excellence of the present invention.

A second object of the present invention is to provide an insurance method for storing and recovering an encryption key, which can be stored in an encrypted manner in a backup certificate file (Certificate), when the gateway and the chip fail simultaneously or data. If the system fails to pass the authentication, the system will boot and read the key information in the backup certificate file. The system will issue a set of authentication passwords to the system owner's preset email address, and the system owner enters the authentication password in the system. After verification, the system begins to read the Hashed Parameter, the Hashed BOX ID, and the Hashed CertiTAG ID in the backup voucher file, and copies it to the gateway and the chip, and The gateway and the contents of the wafer are made consistent, so that the system can continue the original encryption and decryption service, thereby increasing the overall convenience and security.

For the above purposes, the method for storing and restoring the encryption key of the present invention is mainly for active security protection of file data uploading encryption or downlink decryption between the gateway device and the cloud (or network disk). And the wiring chip is used for authentication, and the gateway and the chip are provided with a Hashed Parameter, a Hashed BOX ID, and a Hashed CertiTAG ID, and are hashed (Hashed). The main steps of the method include: specifying the mail address. When first enabled, the mail address of the gateway owner must be input and written to the gateway and the chip respectively; the gateway is activated: And after the gateway is turned on, it is compared with the contents of the wafer for authentication, and the Hashed Parameter, the Hashed BOX ID, and the wafer serial number (Hashed Cert) in both the gateway and the chip. TAG ID) If the three are the same, the service will start; if the gateway or the chip fails or the parameter information is damaged or disappears, the system can read and store it in another gate when the gateway and the wafer content are compared and the authentication cannot pass. Information about the device or chip, and send the authentication password to the address specified by the gateway owner. After verification, the system automatically inputs the unhacked or disappeared gateway or the manual input in the chip (Hashed Parameter), hardware number (Hashed BOX ID) and wafer serial number (Hashed CertiTAG ID) are copied to the failed chip or gateway to make the contents of the gateway and the key in the wafer consistent, which is easy to pass the certification. And began the active security protection actor of the file data upload encryption or downlink decryption between the gateway device and the cloud.

Other features and embodiments of the present invention will be further understood from the following detailed description taken in conjunction with the drawings.

10. . . Gateway (CiphefCube)

20. . . Wafer (CertiTAG)

30. . . Backup certificate file (Certificate)

50. . . Enter a random number (Parameter)

60. . . Time Stamp

70. . . Key

80. . . Cloud

90. . . Firewall

101. . . Manually enter the hash number (Hashed Parameter)

102. . . Hardware serial number (Hashed BOX ID)

103. . . Waser Serial Number (Hashed CertiTAG ID)

Step S1000. . . Specify mail address

Step S2000. . . Gateway device boot certification

Step S3000. . . Gateway failure or wafer failure

Step S4000. . . Read backup voucher file

Step S5000. . . Re-login authentication

Figure 1 is a schematic flow chart of the main steps of the present invention.
Figure 2 is a schematic view showing the state of use of the present invention.
Figure 3 is a schematic diagram of the encryption key information of the present invention.
Figure 4 is a schematic diagram of the encryption key output storage of the present invention.

Please refer to the figures 1 to 4 for a schematic diagram of the method for storing and restoring the encryption key of the present invention. The method for storing and restoring the encryption key of the present invention is mainly applied to the gateway (CipherCube) 10, and the connection chip (CertiTAG) 20 is used for authentication, and the gateway 10 and the chip 20 are provided. The Hashed Parameter 101, the Hashed BOX ID 102, and the Hashed Certi TAG ID 103 are manually input and the Hashed algorithm is used. The main steps of the method include: specifying the mail in step S1000. Address: When first enabled, the system owner's mail address must be entered; step S2000 gateway is turned on and authenticated: and after the gateway 10 is turned on, the wafer 20 is authenticated by the connection, when the gateway 10 and the chip 20 In the two, the manual input random number 101, the hardware serial number 102 and the wafer serial number 103 are the same, then the service is started; the step S3000 is faulty or the wafer is faulty: when If either the router 10 or the chip 20 fails and the authentication fails, the key information of the device 10 is destroyed, disappears, or the authentication fails to pass, and an authentication password is issued to the system owner's designated mail address, and then the operation is performed. The manual input random number 101, the hardware serial number 102, and the wafer serial number 103 in the gateway 10 or the chip 20 are copied to the other side of the fault so that the contents of the gateway 10 and the wafer 20 can be consistent. The authentication starts the active security protection actor who uploads the encryption or downlink decryption of the archive data between the gateway device 10 and the cloud terminal 80.

Wherein, after the step S3000 gateway failure or the wafer failure still fails to pass the authentication, the next step S4000 is performed to read the backup certificate: the system is re-logged in and the backup certificate file 30 is read, and the backup certificate file 30 is issued. An authentication password is sent to the system owner to specify the mail address, and then the manual input random number 101, the hardware serial number 102, and the wafer serial number 103 in the operation backup document file 30 are copied into the gateway 10 and the wafer 20 to The contents of the key of the gateway 10 and the chip 20 can be made consistent, so that the service can be started by the authentication. In addition, after the step S4000 reads the backup document file, the process cannot be verified, and the next step S5000 re-login authentication is performed: the system will Re-operation and again ask for a random number 50. After inputting a random number 50, the system reads the hardware serial number 102 of the gateway 10 and the wafer serial number 103 of the wafer 20, and then reads a time stamp 60. Miscellaneous (Hashed) a new Hash Manual Parameter, and the system will re-issue the authentication password to the system owner's designated email address. When the system owner obtains the new password authentication, the system obtains the hardware serial number 102 and The wafer serial number 103 is hashed and integrated to generate a key 70, and the manual input random number 101, the hardware serial number 102, and the wafer serial number 103 are written into the gateway 10 and the wafer 20 to allow the gate to be gated. The contents of the key of the tracker 10 and the chip 20 can be consistent, and the service can be started by the authentication. The gateway device 10 is further in a hard type and has a memory inside to store the manual input random number 101. The hardware serial number 102 and the chip serial number 103; in addition, when the authentication of both the gateway 10 and the wafer 20 in the step S4000 gateway power-on authentication step is inconsistent, the system owner can be notified.

Please refer to the figures 1 to 4 for a schematic diagram of the method for storing and restoring the encryption key of the present invention. The present invention is used in the gateway (CipherCube) 10 in front of the cloud 80 firewall 90 for uploading encryption or downloading and decrypting, and the gateway 10 is connected to the chip (CertiTAG) 20 for mutual authentication (eg, As shown in Fig. 2, the gateway 10 is of a hard type and has a memory (not shown) therein for storing key information, and the key used by the gateway 10 is not Pre-stored, but the system owner manually enters the Hashed Parameter 101, combined with the Hashed BOX ID 102 and the Hashed CertiTAG ID 103. The three are combined and hashed. Therefore, the key 70 used for data encryption is unique. In addition, the present invention adopts a design of multiple backups of the key information in the gateway, so that the key information can be stored in the gate by encryption. Tracker 10 and crystal In 20, the gateway 10 and the chip 20 are provided with a manual input random number 101, a hardware serial number 102, and a wafer serial number 103, and are hashed (as shown in the third figure), as a gateway. When the device 10 and the chip 20 are first enabled, the mail address must be specified in step S1000 (as shown in FIG. 1): when first enabled, the mail address of the system owner must be input; that is, in the gateway device ( When the CipherCube 10 and the chip (CertiTAG) 20 are first enabled, the system owner's email address must be entered first to combine the third party's email to perform the authentication mechanism to prevent the authorized agent or agent from arbitrarily stealing or copying. The key 70 destroys the security of the encryption key storage and recovery. After inputting the mail address of the system owner, the next step S2000 gateway is turned on and authenticated: and after the gateway 10 is powered on and the chip 20 Phase interconnects for authentication, manual input in both gateway 10 and wafer 20 101, the hardware serial number 102 and the wafer serial number 103 are the same, and the service is started; that is, the gateway 10 must be connected to the wafer 20 for authentication after being turned on, wherein both the gateway 10 and the wafer 20 are used. When the manual input random number 101, the hardware serial number 102, and the wafer serial number 103 are authenticated by the same, the gateway 10 starts to provide active security for uploading or encrypting the archive data between the gateway and the cloud. Protective action; further, when the authentication of both the gateway 10 and the chip 20 is inconsistent, an information notification is sent to let the system owner know that the authentication cannot be performed, so that the system owner can perform the problem of eliminating the inconsistency of the authentication; In addition, when there is inconsistency between the two, the next step S3000 gateway failure or wafer failure is performed: when one of the gateway 10 and the chip 20 fails, and the new product is replaced, the system will issue an authentication password to the system. The owner specifies the mail address, after passing the verification, the system operates again to operate the gateway 10 and the manual input random number 101, the hardware serial number 102, and the wafer serial number 103 in the chip 20 are copied to the other side so that the contents of the gateway 10 and the wafer 20 can be consistent, so that the service can be started by authentication; that is, when When the authentication of both the gateway 10 and the wafer 20 is inconsistent, there may be a failure of either the gateway 10 or the wafer 20. For example, if the wafer 20 has a manual input random number 101, a hardware serial number 102, and a wafer serial number. 103, if there is no gateway 101, an authentication password will be sent to the system owner's designated email address, and the system owner can pass the authentication of the received email to pass the system verification. That is, the manual input random number 101, the hardware serial number 102, and the wafer serial number 103 in the wafer 20 are copied into the gateway device 10, so that the information contents of the gateway 10 and the wafer 20 can be consistent. The tracker 10 and the chip 20 can be authenticated to start providing an operation for uploading encryption or downloading and decrypting. On the other hand, if there is a manual input random number 101, a hardware serial number 102, and a wafer serial number 103 in the gateway 10, and the chip 20 does not exist, the authentication password is issued to the system owner's designated mail address. The system owner can use the authentication password in the received email to pass the system verification, and the system operates to copy the manual input random number 101, the hardware serial number 102 and the wafer serial number 103 in the gateway 10 to the chip. In 20, the contents of the key information of the gateway 10 and the chip 20 can be made uniform, so that the gateway 10 and the chip 20 can be authenticated to start providing an operation for performing upload encryption or download decryption; thereby facilitating reading. The key information and the recovery key information enable the gateway 10 to function normally, and the operator cannot perform upload encryption or downlink decryption because the key information authentication does not match.

In addition, the key information in the gateway (CipherCube) 10 can also be designed with multiple backups, so that the key information can be stored in the backup certificate file 30 in an encrypted manner (as shown in FIG. 3), when step S3000 After the gateway failure or the wafer failure step, the certification cannot be passed. It is possible that one of the manual input random number 101, the hardware serial number 102, and the wafer serial number 103 stored in the gateway 10 or the wafer 20 causes a problem. Unable to pass the authentication, so proceed to the next step S4000 to read the backup credentials (as shown in Figure 1): re-login the system and read the backup voucher file 30, which will issue an authentication password to the system owner. After the authentication password is verified by the system, the system performs the operation of the manual input random number 101, the hardware serial number 102 and the wafer serial number 103 to be copied into the gateway 10 and the chip 20. In order to make the contents of the gateway 10 and the wafer 20 uniform, it is easy to pass the certification. The service is performed; that is, the ongoing system is logged out and re-logined, so that the gateway 10 can be connected to the backup credential file 30, and the backup credential file 30 will issue an authentication password to the system owner to specify the mail address. The system owner can copy the manual input random number 101, the hardware serial number 102 and the wafer serial number 103 in the backup document file 30 to the gateway 10 and the wafer 20 through the received mail. The contents of the gateway 10 and the wafer 20 can be identical, so that the gateway 10 and the chip 20 can be authenticated to start providing an active service for uploading encryption or downloading and decrypting. Moreover, if the step of reading the backup voucher after the step S4000 is still unable to pass the authentication, it may be that the manual input random number 101, the hardware serial number 102 and the chip serial number 103 in the backup voucher file 30 have expired or cannot be enabled, so That is, proceed to the next step, step S5000, to re-enter the authentication (as shown in FIG. 1): the system will re-operate and ask for a random number 50 again. After inputting a random number 50, the system reads the hardware serial number of the gateway 10 again. 102 and wafer 20 wafer serial number 103, and then read a time stamp (Time Stamp) 60 and Hashed a new Hash Manual Parameter (as shown in Figure 4), and the system will be re- After the new password is issued to the system owner's designated mail address, when the system owner obtains the new password authentication, the hardware serial number 101 and the wafer serial number 102 are obtained to perform a hash calculation integration to generate a key 70, and then manually input the mess. Number 101, The serial number 102 and the wafer serial number 103 are written into the gateway 10 and the wafer 20 so that the contents of the gateway 10 and the wafer 20 can be made uniform, so that the service can be started by authentication; that is, when the gateway 10 and the wafer are used. The manual input random number 101, the hardware serial number 102, and the chip serial number 103 in the backup voucher file 30 cannot be re-authenticated after the above steps, and the gateway 10, the chip 20, and the backup certificate 30 are also confirmed. When the key information stored in the user has expired, the system will re-create the key 70 and ask the system owner to re-enter a random number 50. After inputting a random number 50, the system reads the gateway 10 again. The hardware serial number 102 and the wafer serial number 103 of the wafer 20, and then a time stamp 60 is read and a new random number is hashed, and the system re-issues the new password to the system owner's designated mail address, and the system The owner obtains the new password and obtains the hardware serial number 102 and the wafer serial number 103 simultaneously after the authentication is passed. After the algorithm is integrated, a key 70 can be generated after the algorithm calculation, and the manual input random number 101, the hardware serial number 102 and the wafer serial number 103 are rewritten into the gateway 10 and the wafer 20 by the hash calculation. The contents of the gateway 10 and the chip 20 can be made consistent, and after the re-authentication, when the two authentications are consistent, it is convenient to start the uploading encryption or the downlink decryption after the authentication.

It can be seen from the above that the method for storing and restoring the encryption key of the present invention has the following advantages:
1. The system owner can design the multiple key backups of the key information in the gateway 10 so that the key information can be stored in the memory built in the gateway 10 and the chip 20 thereof in an encrypted manner. It is convenient to read the key information and the recovery key information, and the memory stored in the gateway 10 and the key content in the chip 20 can be consistent, and the cloud service upload encryption or downlink decryption action is performed. By.
2. The system owner can further store the key information in the gateway 10 in the backup certificate file 30 in an encrypted manner. When both the gateway device 10 and the chip 20 cannot complete the authentication for any reason, the backup certificate is The key information in the file 30 is copied into the built-in memory and the chip 20 of the gateway device 10, so that the contents of the key information of the gateway (CipherCube) 10 and the chip (CertiTAG) 20 can be consistently uploaded and encrypted or The next act of decryption.

From the above detailed description, those skilled in the art can understand that the present invention can achieve the foregoing objects, and has met the requirements of the patent law and filed a patent application.

The above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited thereto; therefore, the simple equivalent changes and modifications made by the scope of the present invention and the contents of the specification, All should remain within the scope of the invention patent.

Step S1000. . . Specify mail address

Step S2000. . . Gateway device boot certification

Step S3000. . . Gateway failure or wafer failure

Step S4000. . . Read backup voucher file

Step S5000. . . Re-login authentication

Claims (5)

A method for storing and restoring an encryption key is mainly used in a gateway (CipherCube) and a connection chip (CertiTAG) for authentication, and a manual input random number is provided in the gateway and the chip ( Hashed Parameter, Hashed BOX ID and Hashed CertiTAG ID are calculated by Hashed. The main steps of the method include:
Specify the mail address: When first enabled, you must enter the email address of the system owner;
The gateway is activated and authenticated: and after the gateway is turned on, it is connected to the chip for authentication. When the manual input random number, the hardware serial number and the chip serial number in the gateway and the chip are the same, the process starts. service;
Gateway failure or wafer failure: When the gateway or chip fails or the data is lost or replaced, an authentication password will be sent to the system owner's designated email address. After the authentication password passes the system verification, The system operates to copy the manual input random number, hardware serial number and chip serial number in the gateway and the chip to the other side, so that the gateway and the wafer key content can be consistent, and it is convenient for the server to start the authentication. . The method for storing and recovering an encryption key according to claim 1, wherein the gateway fails to perform the next step after the gateway failure or the chip failure step, and the next step is to read the backup document file: Log in and read the backup certificate file (Certificate), the backup certificate will issue an authentication password to the system owner's designated mail address, and then manually copy the random number, hardware serial number and chip serial number in the operation backup certificate. In the gateway and the chip, the contents of the gateway and the key of the wafer can be made consistent, so that it is convenient to start the service through authentication. The method for storing and restoring the encryption key output according to item 2 of the patent application scope, wherein the step of reading the backup document file still fails to pass the authentication, and the next step is to re-login the authentication: the system will be re-operated and requested again. Input a random number, input a random number, then the system reads the hardware serial number of the gateway and the wafer serial number of the chip, and then reads a time stamp (Time Stamp) and hashes out new random numbers, and the system will Re-issue the new password to the system owner's designated mail address. When the system owner obtains the new password authentication, the hardware serial number and the wafer serial number are obtained, and the hash calculation is integrated to generate a key, and then the manual input is random. The hardware serial number and the wafer serial number are written into the gateway and the chip so that the content of the gateway and the wafer key can be consistent, and it is convenient to start the service by the authentication. The method for storing and restoring an encryption key according to claim 1, 2 or 3, wherein the gateway device is further in a hard type and has a memory inside to store manual input disorder. Number, hardware serial number and wafer serial number. The method for storing and recovering an encryption key according to claim 1, wherein the gateway and the chip system in the gateway startup authentication step further issue a message notifier when the two authentications fail to pass. .