Key management method, security chip, service server and information system
AssigneeAdvanced New Technologies Co., Ltd.
InventorWuqiong Pan
Life of this patent
Estimating the term…
Abstract
A key management method includes: sending, by a security chip of a computer device, a request for obtaining a service key to a key management service; receiving, by the security chip, a service key ciphertext from the key management service, wherein the service key ciphertext is obtained by encrypting the service key by the key management service based on a migration key of the security chip; decrypting, by the security chip, the service key ciphertext based on the migration key to obtain the service key; storing, by the security chip, the service key in the security chip; and providing, by the security chip, the service key to an application program of the computer device when the application program needs to encrypt data based on the service key.
Claims20
A key management method, comprising:
- sending, by a security chip of a computer device, a request for obtaining a service key to a key management service;
- receiving, by the security chip, a service key ciphertext from the key management service, wherein the service key ciphertext is obtained by encrypting the service key by the key management service based on a migration key of the security chip;
- decrypting, by the security chip, the service key ciphertext based on the migration key to obtain the service key;
- storing, by the security chip, the service key in the security chip;
- providing, by the security chip, the service key to an application program of the computer device when the application program needs to encrypt data based on the service key;
- invalidating, by the security chip, the service key after a preset time period;
- and
- resending, by the security chip, a request for obtaining a new service key to the key management service to obtain the new service key from the key management service.
A security chip disposed in a computer device, wherein the security chip comprises one or more microprocessors and one or more memories configured with instructions that, when executed by the one or more microprocessors, cause the security chip to perform operations comprising:
- sending a request for obtaining a service key to a key management service;
- receiving a service key ciphertext from the key management service, wherein the service key ciphertext is obtained by encrypting the service key by the key management service based on a migration key of the security chip;
- decrypting the service key ciphertext based on the migration key to obtain the service key;
- storing the service key in the security chip;
- providing the service key to an application program of the computer device when the application program needs to encrypt data based on the service key;
- invalidating the service key after a preset time period;
- and
- resending a request for obtaining a new service key to the key management service to obtain the new service key from the key management service.
A security chip disposed in a computer device, wherein the security chip comprises one or more microprocessors and one or more memories configured with instructions that, when executed by the one or more microprocessors, cause the security chip to perform operations comprising:
- sending a request for obtaining a service key to a key management service;
- receiving a service key ciphertext from the key management service, wherein the service key ciphertext is obtained by encrypting the service key by the key management service based on a migration key of the security chip;
- decrypting the service key ciphertext based on the migration key to obtain the service key;
- storing the service key in the security chip;
- and
- providing the service key to an application program of the computer device when the application program needs to encrypt data based on the service key,
- wherein before the sending a request for obtaining a service key to the key management service, the operations further comprise:
- sending a migration certificate to the key management service, wherein the migration certificate is stored in the security chip and is configured for identity authentication of the security chip such that the key management service authenticates the migration certificate.
A non-transitory computer-readable storage medium storing instructions executable by a security chip of a computer device to cause the security chip to perform operations comprising:
- sending a request for obtaining a service key to a key management service;
- receiving a service key ciphertext from the key management service, wherein the service key ciphertext is obtained by encrypting the service key by the key management service based on a migration key of the security chip;
- decrypting the service key ciphertext based on the migration key to obtain the service key;
- storing the service key in the security chip;
- providing the service key to an application program of the computer device when the application program needs to encrypt data based on the service key;
- invalidating the service key after a preset time period;
- and
- resending a request for obtaining a new service key to the key management service to obtain the new service key from the key management service.
Dependencies are inferred from the claim text.