Method and system for key generation, backup, and migration based on trusted computing

A system for key generation based on trusted computing, comprising:

• a generation request receiving unit, configured to receive a key generation request input by a user;
• a first key generating unit, configured to control a trusted platform module to generate a platform migratable key, encrypt the platform migratable key by using a public key of a root key of the trusted platform module, and store a cipher-text key of the platform migratable key;
• a second key generating unit, configured to control the trusted platform module to generate a user migratable key of the user, encrypt the user migratable key by using a public key of the platform migratable key, and store a cipher-text key of the user migratable key;
• and
• a third key generating unit, configured to control the trusted platform module to generate a binding key of the user, encrypt the binding key by using a public key of the user migratable key, and store a cipher-text key of the binding key.

A method for key backup based on trusted computing, comprising the following steps:

• receiving a request for backing up a migratable key, wherein the request is input by a user, and the migratable key is a platform migratable key, a user migratable key, or a binding key;
• controlling a trusted platform module to acquire a private key of the migratable key, and performing OAEP encoding on the acquired private key of the migratable key;
• controlling the trusted platform module to generate a random number, and performing an exclusive-OR operation on the random number and the private key of the migratable key after the OAEP encoding;
• and
• encrypting result data of the exclusive-OR operation by using a public key provided by a backup server, so as to obtain backup data of the migratable key, and sending the backup data to the backup server.

A system for key backup based on trusted computing, comprising:

• a backup request receiving unit, configured to receive a request for backing up a migratable key, wherein the request is input by a user, and the migratable key is a platform migratable key, a user migratable key, or a binding key;
• a first encoding unit, configured to control a trusted platform module to acquire a private key of the migratable key, and perform Optimal Asymmetric Encryption Padding, OAEP encoding on the acquired private key of the migratable key;
• a first exclusive-OR operation unit, configured to control the trusted platform module to generate a random number, and perform an exclusive-OR operation on the random number and the private key of the migratable key after the OAEP encoding;
• and
• a backup data sending unit, configured to encrypt result data of the exclusive-OR operation by using a public key provided by a backup server, so as to obtain backup data of the migratable key, and send the backup data to the backup server.