CN111262694A - 一种基于tee的安全代理重加密方法 - Google Patents

一种基于tee的安全代理重加密方法 Download PDF

Info

Publication number
CN111262694A
CN111262694A CN202010026636.9A CN202010026636A CN111262694A CN 111262694 A CN111262694 A CN 111262694A CN 202010026636 A CN202010026636 A CN 202010026636A CN 111262694 A CN111262694 A CN 111262694A
Authority
CN
China
Prior art keywords
data
trusted server
information
sender
sends
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
CN202010026636.9A
Other languages
English (en)
Inventor
李伟
邱炜伟
尹可挺
匡立中
胡为
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hangzhou Qulian Technology Co Ltd
Original Assignee
Hangzhou Qulian Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou Qulian Technology Co Ltd filed Critical Hangzhou Qulian Technology Co Ltd
Priority to CN202010026636.9A priority Critical patent/CN111262694A/zh
Publication of CN111262694A publication Critical patent/CN111262694A/zh
Withdrawn legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0464—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种基于TEE的安全代理重加密方法，属于计算机安全和密码学技术领域，该方法具体为：信息传输双方各自生成非对称密钥对，并将各自的密钥对上传至载有可信执行环境的可信服务器中。信息发送方用自身的公钥加密信息后，发送至可信服务器；可信服务器先用发送方的私钥解密，再用接收方的公钥加密，然后将加密后的信息发送给接收方。接收方接收到解密的信息后，用自身的私钥解密即可。本方法中，载有TEE的可信服务器充当了代理人角色。该方法具有资源消耗小，成本低的特点。

Description

一种基于TEE的安全代理重加密方法
技术领域
本发明属于计算机安全和密码学技术领域，具体地涉及一种基于TEE的安全代理重加密方法。
背景技术
基于用户数据隐私性考虑，用户存放在云端的数据都是加密形式存在的。而云环境中存在着大量数据共享的场景。由于数据拥有者对云服务提供商并不完全信任，不能将解密密文的密钥发送给云端，由云端来解密并分享出去。数据拥有者自己下载密文解密后，再用数据接收方的公钥加密并分享，无疑给数据拥有者带来很大的麻烦，同时也失去了云端数据共享的意义。
发明内容
针对现有技术存在的问题，本发明提供了一种基于TEE的安全代理重加密方法。该方法基于TEE的代理重加密功能将用户的非对称密钥存储在TEE中，确保密钥不会被窃取，可以使代理重加密在***漏数据拥有者解密密钥的情况下，实现云端密文数据共享。
本发明的目的是通过如下技术方案实现的：一种基于TEE的安全代理重加密方法，具体包括以下步骤：
(1)数据发送方与数据接收方各自生成非对称密钥对，并将数据发送方ID、数据发送方的非对称密钥对、数据接收方ID和数据接收方的非对称密钥对上传至可信服务器安全存储；所述非对称密钥对包含一个公钥和一个私钥。
(2)数据发送方用其非对称密钥对中的公钥加密数据后，发送到可信服务器。
(3)数据发送方将数据发送方ID和数据接收方ID作为参数发送给可信服务器，发送基于HTTP或RPC协议的代理重加密请求到可信服务器；
(4)可信服务器收到代理重加密请求后，先用数据发送方的私钥解密，再用数据接收方的公钥加密，获得重加密数据。
(5)可信服务器将重加密数据发送给数据接收方。
(6)数据接收方用其私钥解密得到源数据。
与现有技术相比，本发明具有如下有益效果：基于可信硬件，减少了对计算资源的消耗，所需计算成本低。同时通过硬件增强了***的安全性，即使可信服务器被入侵，可信执行环境也能保证信息交换方的密钥安全，保证数据不会被窃取，降低了被攻击的可能性。
附图说明
图1为本发明安全代理重加密方法的流程图。
具体实施方式
如图1为本发明安全代理重加密方法的流程图，所述安全代理重加密方法具体包括以下步骤：
(1)数据发送方与数据接收方各自生成非对称密钥对，并将数据发送方ID、数据发送方的非对称密钥对、数据接收方ID和数据接收方的非对称密钥对上传至可信服务器安全存储；所述非对称密钥对包含一个公钥和一个私钥。此时，可信服务器拥有各方的ID和密钥对，可以代表各方进行可信加解密操作，充当了可信代理人的角色。
(2)数据发送方用其非对称密钥对中的公钥加密数据后，连同数据发送方ID和数据接收方ID作为参数，发送基于HTTP或RPC协议的代理重加密请求到可信服务器，调用代理重加密功能；
(3)可信服务器收到代理重加密请求后，先用数据发送方的私钥解密，获取源数据，再用数据接收方的公钥加密，获得重加密数据。由于加解密是在可信执行环境中执行的，保证了数据的安全性和隐私性。
(4)可信服务器将重加密数据发送给数据接收方。
(5)数据接收方用其私钥解密得到源数据。
本发明的方法能够减少了对计算资源的消耗，所需计算成本低。同时通过硬件增强了***的安全性，即使可信服务器被入侵，可信执行环境也能保证信息交换方的密钥安全，保证数据不会被窃取，降低了被攻击的可能性。

Claims (1)

1.一种基于TEE的安全代理重加密方法，其特征在于，具体包括以下步骤：
(1)数据发送方与数据接收方各自生成非对称密钥对，并将数据发送方ID、数据发送方的非对称密钥对、数据接收方ID和数据接收方的非对称密钥对上传至可信服务器安全存储；所述非对称密钥对包含一个公钥和一个私钥。
(2)数据发送方用其非对称密钥对中的公钥加密数据后，发送到可信服务器。
(3)数据发送方将数据发送方ID和数据接收方ID作为参数发送给可信服务器，发送基于HTTP或RPC协议的代理重加密请求到可信服务器；
(4)可信服务器收到代理重加密请求后，先用数据发送方的私钥解密，再用数据接收方的公钥加密，获得重加密数据。
(5)可信服务器将重加密数据发送给数据接收方。
(6)数据接收方用其私钥解密得到源数据。
CN202010026636.9A 2020-01-10 2020-01-10 一种基于tee的安全代理重加密方法 Withdrawn CN111262694A (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010026636.9A CN111262694A (zh) 2020-01-10 2020-01-10 一种基于tee的安全代理重加密方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010026636.9A CN111262694A (zh) 2020-01-10 2020-01-10 一种基于tee的安全代理重加密方法

Publications (1)

Publication Number Publication Date
CN111262694A true CN111262694A (zh) 2020-06-09

Family

ID=70952795

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010026636.9A Withdrawn CN111262694A (zh) 2020-01-10 2020-01-10 一种基于tee的安全代理重加密方法

Country Status (1)

Country Link
CN (1) CN111262694A (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112287364A (zh) * 2020-10-22 2021-01-29 同盾控股有限公司 数据共享方法、装置、***、介质及电子设备
CN112532385A (zh) * 2020-11-20 2021-03-19 天翼电子商务有限公司 一种基于可信执行环境的数据共享方法
CN112685763A (zh) * 2021-03-18 2021-04-20 上海众旦信息科技有限公司 一种基于密文授权访问的数据开放方法及***
US11934516B2 (en) 2021-09-06 2024-03-19 Axis Ab Method and system for enabling secure processing of data using untrusted processing application in a trusted execution environment

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112287364A (zh) * 2020-10-22 2021-01-29 同盾控股有限公司 数据共享方法、装置、***、介质及电子设备
CN112532385A (zh) * 2020-11-20 2021-03-19 天翼电子商务有限公司 一种基于可信执行环境的数据共享方法
CN112685763A (zh) * 2021-03-18 2021-04-20 上海众旦信息科技有限公司 一种基于密文授权访问的数据开放方法及***
US11934516B2 (en) 2021-09-06 2024-03-19 Axis Ab Method and system for enabling secure processing of data using untrusted processing application in a trusted execution environment

Similar Documents

Publication Publication Date Title
CN108600217B (zh) 一种云端基于代理重加密的数据授权确定性更新方法
CN111262694A (zh) 一种基于tee的安全代理重加密方法
US9635001B2 (en) Re-encryption system, re-encryption apparatus, and program
US9356994B2 (en) Method of operating a computing device, computing device and computer program
US10044509B1 (en) Method for encrypting and storing data
US9385996B2 (en) Method of operating a computing device, computing device and computer program
US9319219B2 (en) Method of operating a computing device, computing device and computer program
GB2583419A (en) Methods of secure communication
Agrawal et al. A trustworthy agent-based encrypted access control method for mobile cloud computing environment
CN105007254A (zh) 数据传输方法和***、终端
CN113992702B (zh) 一种ceph分布式文件***存储国密加固方法及***
CN114513327B (zh) 一种基于区块链的物联网隐私数据快速共享方法
CN103607278A (zh) 一种安全的数据云存储方法
CN112597523A (zh) 文件处理方法、文件转换加密机、终端、服务器及介质
CN112437044A (zh) 即时通讯方法和装置
CN115766066A (zh) 数据传输方法、装置、安全通信***及存储介质
CN111698264A (zh) 用于保持用户认证会话的方法和装置
Tung et al. Pandora messaging: An enhanced self-message-destructing secure instant messaging architecture for mobile devices
US20240154944A1 (en) Encrypted data communication and gateway device for encrypted data communication
CN116961893A (zh) 一种端到端的安全加密通信管理方法、***及可存储介质
CN114945170A (zh) 一种基于商用密码算法的移动端文件传输方法
CN113918971A (zh) 基于区块链的消息传输方法、装置、设备及可读存储介质
CN105791301A (zh) 一种面向多用户组群信密分离的密钥分发管理方法
KR20170107818A (ko) 사용자 단말 및 속성 재암호 기반의 사용자 단말 데이터 공유 방법
KR101657893B1 (ko) 클라우드 서비스를 위한 암호화 방법 및 사용자 장치에 기반한 암호화 방법을 제공하는 클라우드 시스템

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
WW01 Invention patent application withdrawn after publication

Application publication date: 20200609

WW01 Invention patent application withdrawn after publication