Data processing device and data processing method

1. A data processing device, comprising:

a processor, configured to receive a symmetric wrapping key, when an application needs to use a user private key, the processor executes an encryption and decryption instruction in a hardware-acceleration instruction-set; the encryption and decryption instruction is configured to apply the symmetric wrapping key to decrypt a wrapped private key corresponding to the application to obtain the user private key;

wherein the symmetric wrapping key is stored in a model specific register of the processor;

wherein the processor applies the user private key to perform a specific operation, and when the specific operation ends, the processor clears the user private key;

wherein the application invokes a hardware-acceleration instruction-set driver by using a dynamic handle and the wrapped private key, when the processor executes the encryption and decryption instruction, the symmetric wrapping key is read from the model specific register represented by the dynamic handle, the processor applies the symmetric wrapping key to decrypt the wrapped private key to obtain the user private key.

2. The data processing device of claim 1 , wherein the processor receives the symmetric wrapping key from an external key server.

3. The data processing device of claim 2 , wherein the external key server is configured to generate the symmetric wrapping key, and use the symmetric wrapping key to encrypt the user private key using a symmetric encryption algorithm, so as to generate the wrapped private key stored in an application image of the application.

4. The data processing device of claim 2 , wherein the application invokes a hardware-acceleration instruction-set driver and uses a key import protocol to import the symmetric wrapping key from the external key server.

5. The data processing device of claim 1 , wherein only the processor is allowed to access the model specific register.

6. The data processing device of claim 1 , wherein the processor comprises a microcode, the microcode designates the model specific register for storing the symmetric wrapping key, and a hardware-acceleration instruction-set driver generates a dynamic handle and sends the dynamic handle to the application; wherein the dynamic handle is generated so that it corresponds to the designated model specific register.

7. The data processing device of claim 1 , wherein the application invokes a hardware-acceleration instruction-set driver by using a dynamic handle, a to-be-processed data address and the wrapped private key, the processor reads the symmetric wrapping key from the model specific register represented by the dynamic handle when executing the encryption and decryption instruction, and the processor decrypts the wrapped private key by using the symmetric wrapping key to obtain the user private key, and then encrypts and decrypts data stored in the to-be-processed data address by using the user private key.

8. The data processing device of claim 1 , wherein the processor executes the encryption and decryption instruction to apply the symmetric wrapping key to decrypt another wrapped private key to obtain another user private key.

9. The data processing device of claim 1 , wherein the application invokes a hardware-acceleration instruction-set driver to trigger the processor to read the symmetric wrapping key from the model specific register when executing the encryption and decryption instruction.

10. A data processing method, comprising:

receiving a symmetric wrapping key by a processor; and

when an application needs to use a user private key, executing an encryption and decryption instruction in a hardware-acceleration instruction-set by the processor; wherein the encryption and decryption instruction is configured to apply the symmetric wrapping key to decrypt a wrapped private key corresponding to the application to obtain the user private key; wherein the symmetric wrapping key is stored in a model specific register of the processor; and

applying the user private key to perform a specific operation by the processor; and

when the specific operation ends, clearing the user private key by the processor;

wherein the step of executing the encryption and decryption instruction in the hardware-acceleration instruction-set by the processor further comprises:

invoking a hardware-acceleration instruction-set driver by using a dynamic handle and the wrapped private key via the application,

reading the symmetric wrapping key from the model specific register represented by the dynamic handle; and

applying the symmetric wrapping key to decrypt the wrapped private key to obtain the user private key.

11. The data processing method of claim 10 , wherein the processor receives the symmetric wrapping key from an external key server.

12. The data processing method of claim 11 , wherein the external key server is configured to generate the symmetric wrapping key, and use the symmetric wrapping key to encrypt the user private key using a symmetric encryption algorithm, so as to generate the wrapped private key stored in an application image of the application.

13. The data processing method of claim 11 , wherein the application invokes a hardware-acceleration instruction-set driver and uses a key import protocol to import the symmetric wrapping key from the external key server.

14. The data processing method of claim 10 , wherein only the processor is allowed to access the model specific register.

15. The data processing method of claim 10 , wherein the processor comprises a microcode, the microcode designates the model specific register for storing the symmetric wrapping key, and a hardware-acceleration instruction-set driver generates a dynamic handle and sends the dynamic handle to the application; wherein the dynamic handle is generated so that it corresponds to the designated model specific register.

16. The data processing method of claim 10 , wherein the step of executing the encryption and decryption instruction in the hardware-acceleration instruction-set by the processor further comprises:

invoking a hardware-acceleration instruction-set driver by using a dynamic handle, a to-be-processed data address and the wrapped private key via the application;

reading the symmetric wrapping key from the model specific register represented by the dynamic handle;

decrypting the wrapped private key by using the symmetric wrapping key to obtain the user private key; and

using the user private key to encrypt and decrypt data stored in the to-be-processed data address.

17. The data processing method of claim 10 , further comprising:

executing the encryption and decryption instruction to apply the symmetric wrapping key to decrypt another wrapped private key to obtain another user private key by the processor.

18. The data processing method of claim 10 , wherein the application invokes a hardware-acceleration instruction-set driver to trigger the processor to read the symmetric wrapping key from the model specific register when executing the encryption and decryption instruction.