Chinese Academy of Sciences

Jingqiang Lin

Jiwu Jing

Jing Wang

Le Guan

Qiongxiao Wang

Congwu Li

Wuqiong Pan

Bingyu Li

Wei Wang

Li Song

Zhan Wang

Bao Li

Quanwei Cai

Kaijie Zhu

Qiongqiao Wang

Yuewu Wang

Lingchen Zhang

Yuo Fu

Bo Luo

Luning Xia

The invention discloses a calculation method and device for elliptic curve digital signature to resist memory disclosure attacks aiming signing private keys, which belongs to the field of cryptography technology. The method described in the invention includes the following steps. During initialization phase happened in a trusted environment, the key of symmetric cryptographic algorithm is used to encrypt the random number k1 and the private key used for signing, the scalar multiplication k1×G is calculated. At each signing phase, the plaintext data used to calculate s is calculated based on the selected signature algorithm and the value of scalar multiplication k1×G. The plaintext data used to calculate s include r or the data calculated based on r. Inside registers, s is calculated based on the above plaintext data and the ciphertext of random number k1 and the ciphertext of the private key. The signature of the message is (r, s). The invention ensures that operations executed in memory will not expose any information related to the private key and the random number because calculations involve sensitive data are executed inside registers. The invention also reduces performance overhead, improves compatibility and scalability, and has a wide range of application.

Calculation method and device for elliptic curve digital signature to resist memory disclosure attacks

An embodiment of the present disclosure provide a key protection method, via setting that each core of the multi-core process may have one symmetric master key, dynamically obtaining the plaintext private key of the asymmetric algorithm via a decryption operation and using the Intel TSX, it may be ensured that the private key and the intermediate variables used in the computation process may be stored in the cache occupied by the operation core only in terms of the hardware level, which may prevent the attackers from stealing the private key from the physical memory and ensure the security of the implementation of the public-key cryptographic algorithm in the computer system.

Key protecting method and apparatus

A system and method for providing cryptographic operation service in a virtualization environment. In the system, a configuration subsystem provides an interface for an administrator and a common user to input information about a virtual cryptographic device. A key file storage subsystem stores a key file and protects it with the protection password. A virtual machine operating subsystem obtains a corresponding key file from the storage subsystem according to the input of the configuration subsystem, creates a virtual device for a guest virtual machine, and finally operates the guest virtual machine to provide cryptographic computing service for the guest virtual machine. Thus the administrator/the common user can specify a key file and input a protection password for a guest virtual machine via the corresponding interface to facilitate the creation of a virtual cryptographic device, and can manage the virtual cryptographic device in a user-friendly and centralized manner. The guest virtual machine on a virtualization management platform can request for a secure cryptographic operation service, thereby alleviating the key security problem in virtualization environment.

System and method for providing cryptographic operation service in virtualization environment

The present invention discloses a method and a system for checking revocation status of digital certificates in a virtualization environment. The method includes: 1) Setting up multiple virtual machines in a host computer; setting up a certificate revocation list manager within the virtual machine monitor of the host computer; 2) The certificates relying party in the virtual machines sends a service request for checking certificate revocation status to the certificate revocation list manager; 3) The certificate revocation list manager searches locally for the CRL file corresponding to the service request for checking certificate revocation status: a) If such a corresponding CRL file exists, the CRL file is returned to the certificate relying party in the virtual machines; or, the certificate revocation list manager checks whether the corresponding certificate serial number exists in the CRL file, then returns the result; b) if the corresponding CRL file does not exist, the corresponding CRL file is downloaded and verified according to the configuration file; then the CRL file is returned to the certificate relying party in the virtual machines; or, the certificate revocation list manager checks whether the corresponding certificate serial number exists in the CRL file, then returns the result. The present invention greatly improves the efficiency of checking revocation status of certificates.

Method and system for checking revocation status of digital certificates in a virtualization environment

A multi-core processor based key protection method and system is described. An Operating System (OS) supporting Symmetric Multi-Processing (SMP) is set up on a multi-core processor. One core of the multi-core processor is configured as a cryptographic operation core, which is prohibited from running other processes of the OS and dedicated to perform a public-key cryptographic operation. The private key and an intermediate variable in a process of the public-key cryptographic operation are stored in a cache exclusively occupied by the cryptographic operation core.

Multi-core processor based key protection method and system

The present invention discloses a method and a system for protecting root CA certificates in a virtualization environment. The method installs a root CA certificate security manager on a host computer. The root CA certificate security manager stores the lists of root CA certificates and provides certificate validation service to virtual machines via a read-only interface. When a virtual machine needs the verification of a certificate, it sends a certificate validation service request to the root CA security manager. The root CA certificate security manager provides certificate validation services to the virtual machine in response to the request. The virtual list of root CA certificates in the present invention has the following features: it isolates the list of the root CA certificates from the virtual machine; the virtual machine can only access the list of the root CA certificates in a read-only manner; modification or configuration of the lists of root CA certificates can only be made via an interface of the CA certificate security manager on the host computer; and the virtual machine can flexibly choose the way how a certificate is to be verified.

Method and system for protecting root CA certificate in a virtualization environment

Growing community of inventors

Beijing, China

Jingqiang Lin