CN105227566A - Cipher key processing method, key handling device and key handling system - Google Patents

Abstract

The invention provides a key processing method, a key processing device and a key processing system, which belong to the technical field of communication and can solve the problem of low security of the existing key processing method. The key processing method of the present invention includes the following steps: receiving a key generation request, generating a pair of public key and private key, and dividing the private key into a primary fragment and N secondary fragments, and uploading one of the primary fragments To the local key server, upload N copies of auxiliary fragments to at least one cloud key server; N is an integer greater than or equal to 1, and the private key must have a primary fragment and at least one auxiliary fragment; Encrypt the data with the key to form a message ciphertext, and upload it to the cloud data server; receive a request for querying the message ciphertext, obtain the message ciphertext of the cloud data server, and obtain at least one secondary fragment from the cloud key server, from The local key server obtains the master fragment and reconstructs the private key to decrypt the message ciphertext.

Description

Key processing method, key processing device and key processing system

technical field

The invention belongs to the technical field of communication, and in particular relates to a key processing method, a key processing device and a key processing system.

Background technique

With the popularization of informatization and digitization, the issue of key security has attracted more and more attention. Ordinary business communication activities are all based on the security of the private key without exception, that is to say, the security of all online activities depends on the private key, so protecting the security of the private key is a crucial part of network security .

The following problems exist in the prior art: when the data owner uploads the data, the data is usually encrypted and decrypted by means of a single key stored in a centralized manner (the key is usually stored on a local server). At this time, the security of the key Depends on the security of the physical device. However, IoT nodes and cloud devices are vulnerable to physical attacks. Attackers implement physical damage to make nodes unable to work normally, or steal devices to obtain sensitive information. When an attacker intercepts, tampers, or forges data and signaling transmitted in the network, if he obtains the unique communication key stored in the device, he can further obtain sensitive user information or cause information transmission errors.

Contents of the invention

The present invention aims at the above-mentioned problems existing in the existing key processing method, and provides a highly secure key processing method and a key processing device, that is, a key processing system.

The technical scheme that the technical problem that the present invention solves adopts is a kind of key processing method, comprises the following steps:

Receive a key generation request, generate a pair of public key and private key, and divide the private key into a primary fragment and N secondary fragments, and upload one of the primary fragments to the local key server, and N secondary fragments The fragments are uploaded to at least one cloud key server; where, N is an integer greater than or equal to 1, and there must be a primary fragment and at least one secondary fragment to reconstruct the private key;

Encrypt the data with the public key to form message ciphertext and upload it to the cloud data server;

Receive the request for querying the message ciphertext, obtain the message ciphertext of the cloud data server, obtain at least one secondary fragment from the cloud key server, obtain the primary fragment from the local key server, and reconstruct the private key to process the message ciphertext. decrypt.

Preferably, the number of said cloud key servers is N, and a private key fragment is stored in each cloud key server.

Preferably, the request for receiving the ciphertext of the query message includes:

Receive message ciphertext query request in ciphertext retrieval mode.

Preferably, after encrypting the data with the public key, it also includes:

A step of destroying the public key, or storing the public key in a local key server.

Preferably, said generating a pair of public key and private key includes:

Use the key generation function to randomly generate public and private keys according to the set parameters;

The encryption of data through the public key includes:

Encryption function is used to encrypt data into message ciphertext;

The reconstructed private key includes:

Use the reconstruction function to reconstruct the private key according to the received at least one fragment stored in the cloud key server and one fragment stored in the local key server;

The decrypting of the message ciphertext includes:

Use the decryption function to decrypt the message ciphertext according to the reconstructed private key.

The technical solution adopted by the technical problem solved by the present invention is a kind of key processing device, comprising:

A key generation module, configured to generate a pair of public key and private key according to the key generation request;

The key management module is used to divide the private key into a primary fragment and N secondary fragments, upload one of the primary fragments to the local key server, and upload N secondary fragments to at least one cloud key server Among them, N is an integer greater than or equal to 1, and there must be a primary fragment and at least one secondary fragment to reconstruct the private key;

An encryption module, configured to encrypt data through the public key to form a message ciphertext, and upload the message ciphertext to a cloud data server;

The reconstruction module is used to obtain at least one secondary fragment from the cloud key server, obtain the primary fragment from the local key server, and reconstruct the private key;

The decryption module is configured to obtain the message ciphertext of the cloud data server according to the received request for querying the message ciphertext, and decrypt the message ciphertext through the reconstructed private key.

Preferably, the key processing device further includes: an index module,

The indexing module is used to index the message ciphertext uploaded to the cloud data server

Preferably, the key management module is also used to destroy the public key, or store the public key in a local key server.

Preferably, the key management module is configured to upload N private key secondary fragments to N cloud key servers, and each cloud key server stores a secondary fragment.

The technical solution adopted to solve the technical problem of the present invention is a key processing system, including the above-mentioned key processing device, a local data server, a local key server and at least one cloud key server.

The present invention has following beneficial effects:

The key processing method of the present invention divides the private key into multiple fragments, that is, one primary fragment and N auxiliary fragments, and uses a distributed storage method to store the private key in different servers to ensure the storage of the private key security. Moreover, storing the private key auxiliary fragments in the cloud key server can relieve the storage pressure of the local key server.

The key management module in the key processing device of the present invention will divide the private key into multiple fragments, that is, one primary fragment and N secondary fragments, and store the private key in different servers in a distributed storage manner, To ensure the security of the storage of the private key. Moreover, storing the private key auxiliary fragments in the cloud key server can relieve the storage pressure of the local key server.

The key processing system in the present invention includes the above-mentioned key processing device, so its security is relatively high.

Description of drawings

Fig. 1 is the flowchart of the key processing method of embodiment 1 of the present invention;

FIG. 2 is a schematic diagram of a key processing system according to Embodiment 3 of the present invention.

detailed description

In order to enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

Example 1:

As shown in Figure 1, the present embodiment provides a key processing method, which includes the following steps:

Step S1: Receive a key generation request, generate a key pair, that is, generate a pair of public key and private key, and divide the private key into a primary fragment and N secondary fragments, and upload one of the primary fragments to the local In the key server, upload N secondary fragments to at least one cloud key server; wherein, N is an integer greater than or equal to 1, and there must be a primary fragment and at least one secondary fragment to reconstruct the private key.

In this step, specifically when the local data owner wants to upload the data (message plaintext) to the cloud data server, the key generation module uses the key generation function G to randomly generate the public key pk and The private key sk is G(α)—>(pk, sk); among them, the public key pk is used for encryption, and the private key sk is used for decryption. Wherein, the key generation function uses the ElGamal algorithm, and of course other algorithms known to those skilled in the art may also be used.

Wherein, in step S1, it is preferable to upload N copies of auxiliary fragments to N cloud key servers, and store a copy of auxiliary fragments in each cloud key server. This storage method makes the storage of auxiliary fragments more secure. For example, when setting and reconstructing the private key, three secondary fragments and one primary fragment are required. If the three secondary fragments are stored in three cloud key servers, it is necessary to break three cloud key servers and one local key server. Only the private key server can reconstruct the private key. If the three secondary fragments are stored in a cloud key server, only one cloud key server and one local key server need to be broken to reconstruct the private key. Therefore, it is not ugly It is safer to store the secondary fragments in different cloud servers.

Among them, in step S1, there must be a primary fragment and at least one secondary fragment to reconstruct the private key refers to: obtaining at least one secondary fragment of the private key sk from multiple key servers, and obtaining the secondary fragment stored in the local key server The master fragment of a private key sk can be deduced and calculated from the complete private key sk; and if the master fragment of a private key cannot be obtained from the local key server and/or the key stored in the cloud cannot be obtained If the secondary fragment of the private key in the key server cannot reconstruct the complete private key sk to decrypt the message ciphertext.

Step S2, encrypt the data with the public key to form message ciphertext, and upload it to the cloud data server.

In this step, the specific encryption module uses the encryption function E to encrypt the data (message plaintext) m according to the public key pk generated by the key generation module to form a message ciphertext c, and the generated message ciphertext c is passed through The message storage module is stored in the cloud data server, where the encryption function uses the ElGamal algorithm, and of course other algorithms known to those skilled in the art can also be used.

Wherein, after the public key encrypts the data, the public key will be destroyed or stored in the local key server.

Step S3, receiving the request for querying the message ciphertext, obtaining the message ciphertext of the cloud data server, and obtaining the private key fragments from the local server storing the private key fragments and at least some cloud key servers, and reconstructing the private key to encrypt the message. The text is decrypted; among them,

When at least one secondary fragment is obtained from the cloud key server and the primary fragment is obtained from the local server, the reconstructed private key is used to decrypt the message ciphertext; otherwise, the reverse is true.

In this step, specifically, when an authenticated legal user needs to access cloud data, the index module sends a query request by means of ciphertext retrieval. At this time, the query request is received, and the message ciphertext c is obtained from the cloud data server; the key The reconstruction module sends at least some query requests to multiple cloud servers storing private key fragments, and at least some cloud servers return the key fragments they own to the reconstruction module after receiving the query requests. The reconstruction module adopts the reconstruction function R to regenerate the private key sk from the received t secondary fragments and a primary fragment stored locally, where 1≤t≤N, that is, R(t,1)—>sk; The decryption module decodes the message ciphertext c into the message plaintext m through the decryption function D, that is, D(c,sk)—>m; the user can obtain the message plaintext m that he wants to access, and the reconstruction function is to obtain the private key auxiliary The matrix change algorithm of the fragments; the decryption function uses the ElGamal algorithm, and of course other algorithms known to those skilled in the art can also be used. In this step, the value of t can be adjusted to increase the security of the method, and the larger the value of t, the higher the security.

To sum up, in the key processing method of this embodiment, the private key is divided into multiple fragments, that is, one primary fragment and N secondary fragments, and the private key is stored in different servers in a distributed storage manner In order to ensure the security of the storage of the private key; and it is well known to those skilled in the art that the data stored in the local key server is more secure than the cloud key server, and in this embodiment the primary fragment It is stored in the local server, and when the private key is finally reconstructed, it is necessary to find the primary fragment before it can be decrypted (of course, at least one secondary fragment stored in the cloud key server must be found), so that the method of this embodiment Higher safety performance. At the same time, the single key method is adopted in the prior art, that is to say, only one private key is included, so no matter whether the private key is stored in a local server or a cloud server, as long as one server is compromised, the private key can be found, so The security performance is low, and in the key processing method of this embodiment at least two or more servers must be broken to obtain a complete private key to decrypt the data ciphertext, thereby improving the security of the key, and can also Adjust the number of shards obtained from the cloud key server to increase key security. What needs to be explained here is that although it is safer to completely store the private key in the local key server in the prior art, completely storing the private key file in the local key server will cause the storage of the local key server However, in this embodiment, the storage pressure of the local key server can be well relieved by adopting the method of distributed storage of private keys.

Example 2:

As shown in Figure 2, this embodiment provides a key processing device, including: a key generation module, a key management module, an encryption module, a decryption module, and a reconstruction module; Key generation request, generate a pair of public key and private key; key management module, used to divide the private key into a primary fragment and N secondary fragments, and upload one of the primary fragments to the local key server, Upload N secondary fragments to at least one cloud key server; wherein, N is an integer greater than or equal to 1, and the private key must be reconstructed with primary fragments and at least one secondary fragment; the encryption module is used to pass all Encrypt the data with the public key to form a message ciphertext, and upload the message ciphertext to the cloud data server; the reconstruction module is used to obtain at least one secondary fragment from the cloud key server, and from the local key server Obtain the main fragment and reconstruct the private key; the decryption module is used to obtain the message ciphertext of the cloud data server according to the received request for querying the message ciphertext, and decrypt the message ciphertext through the reconstructed private key.

In the key processing device of this embodiment, the key management module divides the private key into a primary fragment and N secondary fragments, and uploads one of the primary fragments to the local key server, and the N secondary fragments Upload to at least one cloud key server; where N is an integer greater than or equal to 1, and there must be a primary fragment and at least one secondary fragment to reconstruct the private key. In short, the key management module divides the private key and the multiple fragments are stored in multiple servers, and multiple servers need to be broken when reconstructing the private key for decryption, so the security of the key processing device in this embodiment is relatively high. Moreover, in this embodiment, the key management module uploads the master fragment to the local key server, which can not only improve security but also reduce the storage pressure of the local key server.

Preferably, the key processing device in this embodiment further includes an indexing module, configured to index the message ciphertext uploaded to the cloud data server.

Specifically, when an authenticated legitimate user needs to access cloud data, the user can send a query request through the index module by means of ciphertext retrieval to obtain message ciphertext from the cloud data server.

Preferably, the key management module in this embodiment is also used to destroy the public key, or store the public key in a local key server. Among them, destroying the public key is the safest way.

Preferably, the key management module of this embodiment is used to upload N private key secondary fragments to N cloud key servers, and each cloud key server stores a secondary fragment, so that the secondary fragments Storage is more secure.

Example 3:

As shown in FIG. 2 , this embodiment provides a key processing system, which includes the key processing device in Embodiment 2, a local data server, a local key server, and at least one cloud key server. Among them, the local data server is used to store the message ciphertext, the cloud key server is used to store the secondary fragment of the private key, and the local key server is used to store the primary fragment and the public key of the private key.

Since the key processing system in this embodiment includes the key processing device in Embodiment 2, its security is better.

It can be understood that, the above embodiments are only exemplary embodiments adopted for illustrating the principle of the present invention, but the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also regarded as the protection scope of the present invention.

Claims (10)

1. A method of key processing, comprising the steps of:

receiving a key generation request, generating a pair of a public key and a private key, dividing the private key into a main fragment and N auxiliary fragments, uploading one of the main fragments and the N auxiliary fragments to a local key server, and uploading the N auxiliary fragments to at least one cloud key server; wherein N is an integer greater than or equal to 1, and the private key can be reconstructed only by the main fragment and at least one auxiliary fragment;

encrypting data through a public key to form a message ciphertext, and uploading the message ciphertext to a cloud data server;

the method comprises the steps of receiving a request for inquiring a message ciphertext, obtaining the message ciphertext of a cloud data server, obtaining at least one auxiliary fragment from a cloud key server, obtaining a main fragment from a local key server, and reconstructing a private key to decrypt the message ciphertext.

2. The key processing method of claim 1, wherein the number of the cloud key servers is N, and each cloud key server stores a piece of private key fragment.

3. The key processing method of claim 1, wherein the receiving a request for query message ciphertext comprises:

and receiving a message ciphertext query request in a ciphertext retrieval mode.

4. The key processing method according to claim 1, further comprising, after encrypting the data by the public key:

and destroying the public key, or storing the public key into a local key server.

5. The key processing method of claim 1, wherein the generating a pair of a public key and a private key comprises:

a key generation function is adopted to randomly generate a public key and a private key according to set parameters;

the encrypting data by the public key includes:

encrypting the data into a message ciphertext by adopting an encryption function;

the reconstruction private key comprises:

reconstructing a private key according to at least one received fragment stored in a cloud key server and one received fragment stored in a local key server by adopting a reconstruction function; the decrypting the message ciphertext comprises:

and decrypting the message ciphertext according to the reconstructed private key by adopting a decryption function.

6. A key processing apparatus, comprising:

the key generation module is used for generating a pair of public key and private key according to the key generation request;

the key management module is used for dividing the private key into a main fragment and N auxiliary fragments, uploading one of the main fragments to a local key server, and uploading the N auxiliary fragments to at least one cloud key server; wherein N is an integer greater than or equal to 1, and the private key can be reconstructed only by the main fragment and at least one auxiliary fragment;

the encryption module is used for encrypting data through the public key to form a message ciphertext and uploading the message ciphertext to the cloud data server;

the reconstruction module is used for acquiring at least one auxiliary fragment from the cloud key server, acquiring a main fragment from the local key server and reconstructing a private key;

and the decryption module is used for acquiring the message ciphertext of the cloud data server according to the received request for inquiring the message ciphertext and decrypting the message ciphertext through the reconstructed private key.

7. The key processing apparatus according to claim 6, wherein the key processing apparatus further comprises: an index module for the index module, wherein the index module is used for indexing the index module,

and the index module is used for indexing the message ciphertext uploaded to the cloud end data server.

8. The key processing apparatus of claim 6, wherein the key management module is further configured to destroy the public key or store the public key in a local key server.

9. The key processing apparatus of claim 6, wherein the key management module is configured to upload the shards of the N private keys to N cloud key servers, and each cloud key server stores one shard.

10. A key processing system comprising the key processing apparatus of any one of claims 6 to 9, and a local data server, a local key server, and at least one cloud key server.