Cryptographic operation method, working key creation method, cryptographic service platform, and cryptographic service device

Patent metadata

Field	Value
Publication number	US-11128447-B2
Application number	US-202017106762-A
Country	US
Kind code	B2
Filing date	Nov 30, 2020
Priority date	Aug 31, 2018
Publication date	Sep 21, 2021
Grant date	Sep 21, 2021

Abstract

A cryptographic service device includes: a processor; and a memory storing instructions executable by the processor, wherein the processor is configured to execute the instructions to operate as a registration module, a working key creation module, and a cryptographic operation calling module. The registration module is configured to call a primary security module to generate a master key for a newly added secondary security module. The working key creation module is configured to receive a working key creation request of a business system, call the primary security module to generate a working key for the business system, and acquire a working key ciphertext. The cryptographic operation calling module is configured to receive a cryptographic operation request of the business system; call a target security module, and obtain an operation result of the target security module.

First claim

The invention claimed is:

1. A cryptographic operation method, comprising:
receiving a cryptographic operation request initiated by a business system, the cryptographic operation request carrying data to be operated;
determining a target security module responding to the cryptographic operation request, the target security module being one of a primary security module or at least one secondary security module, and a master key of the secondary security module being generated by the primary security module;
acquiring a working key ciphertext corresponding to the target security module, the working key ciphertext being obtained when the primary security module encrypts a working key using a master key of the target security module, the working key being created by the primary security module for the business system; and
calling the target security module using the working key ciphertext and the data to be operated as input, acquiring an operation result returned by the target security module and sending the operation result to the business system, the operation result being obtained by the target security module by decrypting the working key ciphertext to obtain the working key using the master key of the target security module, and encrypting the data to be operated using the decrypted working key.

2. The method according to claim 1 , wherein the master key of the secondary security module is obtained by:
acquiring a target public key generated by the secondary security module;
calling the primary security module using the target public key as input, generating, by the primary security module, the master key of the secondary security module, and encrypting the generated master key using the target public key to obtain a master key ciphertext; and
sending the master key ciphertext to the secondary security module, and decrypting, by the secondary security module, the master key ciphertext using a target private key corresponding to the target public key to obtain the master key.

3. The method according to claim 2 , wherein calling the primary security module using the target public key as input, and generating, by the primary security module, the master key of the secondary security module comprises:
acquiring a public key check value obtained when the primary security module performs message authentication code calculation on the target public key; and
calling the primary security module using the target public key and the public key check value as input, and generating the master key of the secondary security module after the primary security module checks validity of the input target public key based on the public key check value.

4. The method according to claim 1 , wherein the master key of the secondary security module is obtained by:
calling the primary security module, and acquiring two or more key components of the master key of the secondary security module after the primary security module generates the master key; and
transmitting the two or more key components to key management entities, respectively, and transmitting, by the key management entities, the key components to the secondary security module respectively to generate the master key according to each key component.

5. The method according to claim 1 , further comprising:
receiving and storing a master key ciphertext of the secondary security module returned by the primary security module, the master key ciphertext being encrypted by the master key of the primary security module.

6. A cryptographic service device, the cryptographic service device being connected to a primary security module, and comprising:
a processor; and
a memory storing instructions executable by the processor,
wherein the processor is configured to execute the instructions to operate as a registration module, a working key creation module, and a cryptographic operation calling module, wherein:
the registration module is configured to call the primary security module to generate a master key for a newly added secondary security module;
the working key creation module is configured to receive a working key creation request of a business system, call the primary security module to generate a working key for the business system, and acquire a working key ciphertext encrypted by a master key of the primary security module and a working key ciphertext encrypted by a master key of each secondary security module connected with the cryptographic service device; and
the cryptographic operation calling module is configured to receive a cryptographic operation request of the business system, the cryptographic operation request carrying data to be operated; determine a target security module responding to the cryptographic operation request; call the target security module using a working key ciphertext corresponding to the target security module and the data to be operated as input, and obtain an operation result of the target security module, the operation result being obtained by the target security module by decrypting the working key ciphertext to obtain the working key using a stored master key, and encrypting the data to be operated using the working key.

7. The cryptographic service device according to claim 6 , wherein the registration module is further configured to configure a master key of a secondary security module by:
acquiring a target public key generated by the secondary security module;
calling the primary security module using the target public key as input, generating, by the primary security module, the master key of the secondary security module, and encrypting the generated master key using the target public key to obtain a master key ciphertext; and
sending the master key ciphertext to the secondary security module, and decrypting, by the secondary security module, the master key ciphertext using a target private key corresponding to the target public key to obtain the master key.

8. The cryptographic service device according to claim 7 , wherein the registration module is further configured to:
acquire a public key check value obtained when the primary security module performs message authentication code calculation on the target public key; and
call the primary security module using the target public key and the public key check value as input, and generate the master key of the secondary security module after the primary security module verifies validity of the input target public key based on the public key check value.

9. The cryptographic service device according to claim 6 , wherein the registration module is further configured to configure a master key of a secondary security module by:
calling the primary security module, and acquiring two or more key components of the master key of the secondary security module after the primary security module generates the master key; and
outputting the two or more key components to key management entities, respectively, and transmitting, by the key management entities, the key components to the secondary security module to generate the master key according to each key component.

10. The cryptographic service device according to claim 6 , wherein the registration module is further configured to:
receive and store a master key ciphertext of a secondary security module returned by the primary security module, the master key ciphertext being encrypted by the master key of the primary security module.

11. A non-transitory computer-readable storage medium having stored therein instructions that, when executed by a processor of a device, cause the device to perform a cryptographic operation method, the method comprising:
receiving a cryptographic operation request initiated by a

Assignees

• Advanced New Technologies Co Ltd

Inventors

• Xiao Shuting
• Lin Xiaodan
• Fang Haifeng
• Gu Shengcai

Classifications

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L9/083 Primary

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title