# US 10,313,111 B2 · Key protecting method and apparatus

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,313,111 B2
- Document ID: US10313111B2
- Status: Granted
- Kind: B2
- Application number: 14/909,849
- Filed: 2014-08-27
- Published: 2016-12-08
- Granted: 2019-06-04
- Earliest claimed: 2014-02-27
- Assignees: Data Assurance and Communication Security Research Center, Chinese Academy of Sciences
- Applicants: Data Assurance and Communication Security Research Center, Chinese Academy of Sciences
- Inventors: Jingqiang Lin; Le Guan; Qiongxiao Wang; Jing Wang; Jiwu Jing
- Web page: https://patentgrep.com/patent/US10313111B2

## CPC

- H04L 9/0822: {using key encryption key}
- G06F 9/467: {Transactional memory (G06F9/528 takes precedence)}
- G06F 12/0806: Multiuser, multiprocessor or multiprocessing cache systems
- H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- G06F 2212/1052: Security improvement
- G06F 2212/402: Encrypted data
- G06F 2212/60: Details of cache memory
- G06F 2212/621: Coherency control relating to peripheral accessing, e.g. from DMA or I/O device
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An embodiment of the present disclosure provide a key protection method, via setting that each core of the multi-core process may have one symmetric master key, dynamically obtaining the plaintext private key of the asymmetric algorithm via a decryption operation and using the Intel TSX, it may be ensured that the private key and the intermediate variables used in the computation process may be stored in the cache occupied by the operation core only in terms of the hardware level, which may prevent the attackers from stealing the private key from the physical memory and ensure the security of the implementation of the public-key cryptographic algorithm in the computer system.

## Claims

### Claim 1

A key protection method, which is applied to a multi-core processor, comprising:
step A, setting a symmetric master key in each core of the multi-core processor;
step B, taking any core of the multi-core processor configured with the symmetric master key as an operation core, performing a decryption operation by the operation core to obtain a plaintext private key using the symmetric master key, performing an asymmetric cryptographic operation by the operation core using the plaintext private key; the plaintext private key and intermediate variables used in the asymmetric cryptographic operation being stored in a cache occupied by the operation core;
step C, clearing up the plaintext private key and the intermediate variables used in the asymmetric cryptographic operation in the cache occupied by the operation core,
wherein before the step B, the method further comprises: prohibiting OS process scheduling and disabling local interrupt, and
after the step C, the method further comprises: enabling the OS process scheduling and enabling the local interrupt; and
wherein the OS process scheduling is prohibited and the local interrupt is disabled via clearing up an Interrupt Flag (IF) bit of an EFLAGS register of the multi-core processor and the OS process scheduling and local interrupt is enabled via setting the IF bit of the EFLAGS register of the multi-core processor.

### Claim 2 (depends on 1)

The method according to claim 1,
wherein in a process of executing the step B and step C, when another core and the operation core of the multi-core processor try to access a same memory address and at least one write operation is executed, or when the cache occupied by the operation core is replaced due to insufficiency of space of the cache occupied by the operation core, all operations executed by the operation core are aborted and the step B and step C are re-executed.

### Claim 3 (depends on 2)

The method according to claim 2, further comprising:
recording all memory accesses dynamically in the process for executing the step B and step C when the step B and step C are executed;
determining whether another core and the operation core of the multi-core processor simultaneously access the same memory address and at least one write operation is executed according to all the recorded memory accesses; or
determining whether the space of the cache occupied by the operation core is sufficient according to all the recorded memory accesses.

### Claim 4 (depends on 3)

The method according to claim 3, further comprising:
specifying codes corresponding to the step B and step C as a transactional region via a transactional memory mechanism, so that the multi-core processor dynamically records all the memory accesses in the process for executing the step B and step C, aborts all the operations executed by the operation core and re-executes the step B and step C when another core and the operation core of the multi-core processor try to access the same memory address and at least one write operation is executed or when the cache occupied by the operation core is replaced due to insufficiency of the space of the cache occupied by the operation core.

### Claim 5 (depends on 4)

The method according to claim 4, wherein the transactional memory mechanism comprises: Intel Transactional Synchronization Extensions (TSX); the method further comprises:
entering the transactional region via begin instructions in a Restricted Transactional Memory (RTM) mechanism and specifying beginning of the step B as a fallback address when another core and the operation core of the multi-core processor try to access the same access memory address and at least one write operation is executed or specifying the beginning of the step B as the fallback address when the cache occupied by the operation core is replaced due to insufficiency of the cache occupied by the operation core, and exiting the transactional region via end instructions when execution of the step C is finished.

### Claim 6 (depends on 1)

The method according to claim 1, wherein setting the symmetric master key in the each core of the multi-core processor in the step A comprises:
popping up, by an Operating System (OS), a prompt interface and receiving a password input by a user in the prompt interface;
converting, by the OS, the password into the symmetric master key adopting a key generation algorithm; and
copying the symmetric master key to specified registers in the multi-core processor for storage.

### Claim 7 (depends on 6)

The method according to claim 6, wherein the asymmetric cryptographic operation comprises: a plaintext private key obtaining operation and a private-key computation operation;
the plaintext private key obtaining operation comprises: reading, by the operation core, a private key encrypted with the symmetric master key from a hard disk, copying the private key to a memory, decrypting, by the operation core, the private key encrypted by the symmetric master key in the specified registers in the multi-core processor to obtain the plaintext private key and storing the plaintext private key in the cache occupied by the operation core;
the private-key computation operation comprises: a digital signature and/or decryption step, wherein the digital signature and/or decryption operation is executed with the plaintext private key, the method further comprises: storing intermediate variables generated in the private-key computation operation and a computation result in the cache occupied by the operation core.

### Claim 8 (depends on 7)

The method according to claim 7, wherein plaintext private key obtaining operation decrypts the private key encrypted with the symmetric master key using a Streaming Single Instruction Multiple Data (SIMD) Extension (SSE) register via calling Advanced Encryption Standard-New Instruction (AES-NI) instructions and copies the plaintext private key to the cache occupied by the operation core.

### Claim 9

A key protection device, comprising a processor and a non-transitory storage, wherein the non-transitory storage is configured to store one or more instructions to be executed by the processor, and the one or more instructions comprise a setting instruction and an operation instruction; wherein
the setting instruction is to execute step A of setting a symmetric master key in each core of the multi-core processor;
the operation instruction is to execute step B of taking any core of the multi-core processor configured with the symmetric master key as an operation core, performing a decryption operation by the operation core to obtain a plaintext private key using the symmetric master key, performing an asymmetric cryptographic operation by the operation core using the plaintext private key; the plaintext private key and intermediate variables used in the asymmetric cryptographic operation being stored in a cache occupied by the operation core and further execute step C of clearing up the plaintext private key and the intermediate variables in the cache occupied by the operation core,
wherein the setting instruction is further to prohibit OS process scheduling and disable local interrupts before the operation instruction executes the step B and enable the OS process scheduling and the local interrupt after the operation instruction finishes execution of step C; and
wherein the setting instruction is to prohibit the OS process scheduling and disable the local interrupts via clearing up an Interrupt Flag (IF) bit of an EFLAGS register of the multi-core processor and enable the OS process scheduling and local interrupt via setting the IF bit of the EFLAGS register of the multi-core processor.

### Claim 10 (depends on 9)

The device according to claim 9, wherein the one or more instructions further comprise an execution-abort instruction, wherein
the execution-abort instruction is to enable, in a process of executing the step B and step C, the operation instruction to abort all executed operations and to re-execute the step B and step C when another core and the operation core of the multi-core processor try to access a same memory address and at least one write operation is executed, or when the cache occupied by the operation core is replaced due to insufficiency of space of the cache occupied by the operation core.

### Claim 11 (depends on 9)

The device according to claim 9 wherein the one or more instructions further comprise: a recording instruction;
the recording instruction is to record all memory accesses dynamically in the process for executing the step B and step C when the operation instruction executes the step B and step C;
the operation instruction is further to determine whether another core and the operation core of the multi-core processor simultaneously access the same memory address and at least one write operation is executed according to all the memory accesses recorded by the recording instruction; or determine whether the space of the cache occupied by the operation core is sufficient according to all the memory accesses recorded by the recording instruction.

### Claim 12 (depends on 11)

The device according to claim 11, wherein the execution-abort instruction is to enable the operation instruction to abort all the executed operations and to enable the operation instruction to re-execute the step B and step C via a Transactional memory mechanism when another core and the operation core of the multi-core processor try to access the same memory address and at least one write operation is executed or when the cache occupied by the operation core is replaced due to insufficiency of the space of the cache occupied by the operation core.

### Claim 13 (depends on 12)

The device according to claim 12, wherein the transactional memory mechanism comprises: an Intel Transactional Synchronization Extensions (TSX);
the execution-abort instruction is to enter the transactional region via begin instructions in a Restricted Transactional Memory (RTM) mechanism of the Intel TSX and specify beginning of the step B executed by the operation instruction as a fallback address when another core and the operation core of the multi-core processor try to access the same memory address and at least one write operation is executed or specify the beginning of the step B executed by the operation instruction as the fallback address when the cache occupied by the operation core is replaced due to insufficiency of the cache occupied by the operation core, and exit the transactional region via end instructions when execution of the step C is finished by the operation instruction.

### Claim 14 (depends on 9)

The device according to claim 9, wherein the setting instruction comprises: a popping up instruction, a receiving instruction, a conversion instruction and a copying instruction;
the popping up instruction is to pop up a prompt interface when an OS boots;
the receiving instruction is to receive a password input by a user in the prompt interface popped up by the popping up instruction;
the conversion instruction is to convert the password received by the receiving instruction into the symmetric master key via the OS adopting a key generation algorithm; and
the copying instruction is to copy the symmetric master key converted by the conversion instruction to specified registers in the multi-core processor for storage.