Chinese Academy of Sciences

Jiwu Jing

Jing Wang

Yuan Ma

Jingqiang Lin

Le Guan

Qiongxiao Wang

Congwu Li

Wuqiong Pan

Bingyu Li

Zhan Wang

Bao Li

Quanwei Cai

Yuewu Wang

Dengguo Feng

Bo Luo

Lingchen Zhang

Luning Xia

Kaijie Zhu

Qiongqiao Wang

Chenyang Tu

Zongbin Liu

Neng Gao

An embodiment of the present disclosure provide a key protection method, via setting that each core of the multi-core process may have one symmetric master key, dynamically obtaining the plaintext private key of the asymmetric algorithm via a decryption operation and using the Intel TSX, it may be ensured that the private key and the intermediate variables used in the computation process may be stored in the cache occupied by the operation core only in terms of the hardware level, which may prevent the attackers from stealing the private key from the physical memory and ensure the security of the implementation of the public-key cryptographic algorithm in the computer system.

Key protecting method and apparatus

A system and method for providing cryptographic operation service in a virtualization environment. In the system, a configuration subsystem provides an interface for an administrator and a common user to input information about a virtual cryptographic device. A key file storage subsystem stores a key file and protects it with the protection password. A virtual machine operating subsystem obtains a corresponding key file from the storage subsystem according to the input of the configuration subsystem, creates a virtual device for a guest virtual machine, and finally operates the guest virtual machine to provide cryptographic computing service for the guest virtual machine. Thus the administrator/the common user can specify a key file and input a protection password for a guest virtual machine via the corresponding interface to facilitate the creation of a virtual cryptographic device, and can manage the virtual cryptographic device in a user-friendly and centralized manner. The guest virtual machine on a virtualization management platform can request for a secure cryptographic operation service, thereby alleviating the key security problem in virtualization environment.

System and method for providing cryptographic operation service in virtualization environment

The present invention discloses a method and a system for checking revocation status of digital certificates in a virtualization environment. The method includes: 1) Setting up multiple virtual machines in a host computer; setting up a certificate revocation list manager within the virtual machine monitor of the host computer; 2) The certificates relying party in the virtual machines sends a service request for checking certificate revocation status to the certificate revocation list manager; 3) The certificate revocation list manager searches locally for the CRL file corresponding to the service request for checking certificate revocation status: a) If such a corresponding CRL file exists, the CRL file is returned to the certificate relying party in the virtual machines; or, the certificate revocation list manager checks whether the corresponding certificate serial number exists in the CRL file, then returns the result; b) if the corresponding CRL file does not exist, the corresponding CRL file is downloaded and verified according to the configuration file; then the CRL file is returned to the certificate relying party in the virtual machines; or, the certificate revocation list manager checks whether the corresponding certificate serial number exists in the CRL file, then returns the result. The present invention greatly improves the efficiency of checking revocation status of certificates.

Method and system for checking revocation status of digital certificates in a virtualization environment

A multi-core processor based key protection method and system is described. An Operating System (OS) supporting Symmetric Multi-Processing (SMP) is set up on a multi-core processor. One core of the multi-core processor is configured as a cryptographic operation core, which is prohibited from running other processes of the OS and dedicated to perform a public-key cryptographic operation. The private key and an intermediate variable in a process of the public-key cryptographic operation are stored in a cache exclusively occupied by the cryptographic operation core.

Multi-core processor based key protection method and system

The present invention discloses a method and a system for protecting root CA certificates in a virtualization environment. The method installs a root CA certificate security manager on a host computer. The root CA certificate security manager stores the lists of root CA certificates and provides certificate validation service to virtual machines via a read-only interface. When a virtual machine needs the verification of a certificate, it sends a certificate validation service request to the root CA security manager. The root CA certificate security manager provides certificate validation services to the virtual machine in response to the request. The virtual list of root CA certificates in the present invention has the following features: it isolates the list of the root CA certificates from the virtual machine; the virtual machine can only access the list of the root CA certificates in a read-only manner; modification or configuration of the lists of root CA certificates can only be made via an interface of the CA certificate security manager on the host computer; and the virtual machine can flexibly choose the way how a certificate is to be verified.

Method and system for protecting root CA certificate in a virtualization environment

A digital certificate issuing system with intrusion tolerance ability and the issuing method thereof are disclosed. The system comprises an offline secret key distributor, at least one online task distributor, k online secret share calculators and m online secret share combiners. And the method includes: splitting a private key into multiple first sub-secret-keys and multiple second sub-secret-keys, wherein the multiple first sub-secret-keys are divided into k groups, and the private key is constructed by one second sub-secret-key and t first sub-secret-keys, the second sub-secret-key corresponds to the t first sub-secret-keys according to an equation combination representation including t items of j and i, j is sequence number of the group which has the first sub-secret-key, and i is number of the first sub-secret-key in the jth group, each of j in one equation combination representation is different, j, i, k, and t are positive integers, and t is less than k; calculating t first calculation results according to a certificate to be signed and the t first sub-secret-keys in the multiple first sub-secret-keys upon receiving the certificate to be signed; obtaining the second sub-secret-key corresponding to the t first sub-secret-keys according to the equation combination representation; calculating a second calculation result according to the second sub-secret-key obtained and the certificate to be signed; generating a digital signature according to the t first calculation results and the second calculation result; generating a digital certificate according to the digital signature and contents of the certificate to be signed.

Tolerant digital certificate distribute system and distribute method

Growing community of inventors

Beijing, China

Jiwu Jing