Method and system for protecting data keys in trusted computing

1. A computer-implemented method for facilitating user access to encryption keys stored within a hardware module, the method comprising:

receiving, by a computer comprising or coupled to the hardware module, a key request from the user, wherein the key request comprises a user identifier and a key identifier;

receiving a voice message from the user;

extracting voice features from a voiceprint associated with the received voice message;

generating a voice-feature message based on the extracted voice features;

encrypting the voice-feature message using a public key associated with the hardware module;

sending the encrypted voice-feature message to the hardware module, which is configured to compare the extracted voice features included in the encrypted voice-feature message with corresponding voice features stored within the hardware module; and

in response to the extracted voice features matching the corresponding voice features stored within the hardware module, retrieving, from the hardware module, an encryption key based on the user identifier and the key identifier.

2. The computer-implemented method of claim 1 , further comprising transmitting the encryption key to the user, thereby allowing the user to perform encryption or decryption operations on user data using the encryption key.

3. The computer-implemented method of claim 1 , wherein the key request further comprises to-be-encrypted user data or to-be-decrypted ciphertext, and wherein the method further comprises performing an encryption or decryption operation on the to-be-encrypted user data or the to-be-decrypted ciphertext, respectively, using the retrieved encryption key.

4. The computer-implemented method of claim 3 , wherein the key request further comprises a nonce, and wherein the method further comprises:

encrypting, using a public key associated with the user, output of the encryption or decryption operation;

calculating a hash value based on the output of the encryption or decryption operation and the nonce; and

transmitting the encrypted output of the encryption or decryption operation and the hash value to the user, thereby allowing the user to verify integrity of the output of the encryption or decryption operation.

5. The computer-implemented method of claim 1 , wherein the hardware module comprises a Trusted Platform Module (TPM), a Trusted Platform Control Module (TPCM), or a hardware security module (HSM).

6. The computer-implemented method of claim 1 , further comprising:

receiving from the user a request to set up a user account;

displaying to the user a random alphanumeric string;

receiving a voice input from the user based on the displayed alphanumeric string;

extracting a second set of voice features from a voiceprint associated with the voice input; and

storing the extracted second set of voice features in the hardware module.

7. A computer system, comprising:

a processor;

a hardware module storing encryption keys; and

a storage device coupled to the processor and storing instructions, which when executed by the processor cause the processor to perform a method for facilitating user access to the encryption keys stored within the hardware module, the method comprising:

receiving a key request from the user, wherein the key request comprises a user identifier and a key identifier;

receiving a voice message from the user;

extracting voice features from a voiceprint associated with the received voice message;

generating a voice-feature message based on the extracted voice features;

encrypting the voice-feature message using a public key associated with the hardware module;

sending the encrypted voice-feature message to the hardware module, which is configured to compare the extracted voice features included in the encrypted voice-feature message with corresponding voice features stored within the hardware module; and

in response to the extracted voice features matching the corresponding voice features stored within the hardware module, retrieving, from the hardware module, an encryption key based on the user identifier and the key identifier.

8. The computer system of claim 7 , wherein the method further comprises transmitting the encryption key to the user, thereby allowing the user to perform encryption or decryption operations on user data using the encryption key.

9. The computer system of claim 7 , wherein the key request further comprises to-be-encrypted user data or to-be-decrypted ciphertext, and wherein the method further comprises performing an encryption or decryption operation on the to-be-encrypted user data or the to-be-decrypted ciphertext, respectively, using the retrieved encryption key.

10. The computer system of claim 9 , wherein the key request further comprises a nonce, and wherein the method further comprises:

encrypting, using a public key associated with the user, output of the encryption or decryption operation;

calculating a hash value based on the output of the encryption or decryption operation and the nonce; and

transmitting the encrypted output of the encryption or decryption operation and the hash value to the user, thereby allowing the user to verify integrity of the output of the encryption or decryption operation.

11. The computer system of claim 7 , wherein the hardware module comprises a Trusted Platform Module (TPM), a Trusted Platform Control Module (TPCM), or a hardware security module (HSM).

12. The computer system of claim 7 , wherein the method further comprises:

receiving from the user a request to set up a user account;

displaying to the user a random alphanumeric string;

receiving a voice input from the user based on the displayed alphanumeric string;

extracting a second set of voice features from a voiceprint associated with the voice input; and

storing the extracted second set of voice features in the hardware module.

13. A hardware module for facilitating communication and data security, wherein the hardware module comprises:

a key-management module for storing and managing user encryption keys;

a voice-feature-storage module configured to store voices features for users;

an information-receiving module configured to receive a key request, which comprises a user identifier and a key identifier, and voice features associated with a user corresponding to the user identifier, wherein the information-receiving module is configured to receive an encrypted form of the key request and a voice-feature message comprising the voice features, and wherein the key request and the voice-feature message are encrypted using a public key associated with the hardware module;

a voice-feature-comparison module configured to compare voice features corresponding to the user identifier stored within the voice-feature-storage module and the voice features included in the encrypted voice-feature message; and

a key-retrieving module configured to retrieve an encryption key corresponding to the key identifier and the user identifier in response to the voice-feature-comparison module outputting a positive comparison result.

14. The hardware module of claim 13 , further comprising an information-transmitting module configured to transmit the retrieved encryption key to the user, thereby allowing the user to perform encryption or decryption operations on user data using the encryption key.

15. The hardware module of claim 13 , wherein the key request further comprises to-be-encrypted user data or to-be-decrypted ciphertext, and wherein the hardware module further comprises an encryption/decryption module configured to perform an encryption or decryption operation on the to-be-encrypted user data or the to-be-decrypted ciphertext, respectively, using the retrieved encryption key.

16. The hardware module of claim 15 ,

wherein the key request further comprises a nonce, wherein the hardware module further comprises a hash-computation module configured to compute a hash value based on the output of the encryption or decryption operation and the nonce;

wherein the encryption/decryption module is further configured to encrypt, using a public key associated with the user, output of the encryption or decryption operation; and

wherein the hardware module further comprises an information-transmitting module configured to transmit the encrypted output of the encryption or decryption operation and the hash value to the user, thereby allowing the user to verify integrity of the output of the encryption or decryption operation.

17. The hardware module of claim 13 , wherein the hardware module is a Trusted Platform Module (TPM), a Trusted Platform Control Module (TPCM), or a hardware security module (HSM).