恢复管理密钥

src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java

@@ -3,6 +3,8 @@ package com.cisd.tms.modules.mk.controller;
 import com.cisd.tms.common.api.ApiResponse;
 import com.cisd.tms.integration.crypto.pcie.service.PcieCryptoService;
 import com.cisd.tms.modules.mk.dto.LMK;
+import com.cisd.tms.modules.mk.dto.MasterKeyRestoreDTO;
+import com.cisd.tms.modules.mk.dto.RecoveryResult;
 import com.cisd.tms.modules.mk.dto.UKeySignDTO;
 import com.cisd.tms.modules.mk.dto.UKeySignEntity;
 import com.cisd.tms.modules.mk.dto.UKeySignResult;
@@ -15,6 +17,12 @@ import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
+import java.io.IOException;
+import java.io.StreamCorruptedException;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
 /**
  * @author liulu
  * @since 2026/3/4
@@ -60,4 +68,41 @@ public class LmkController {
         return ApiResponse.success(UKeySignResult.builder().sign(signValue).extra(components).build());
     }
 
+    /**
+     * 恢复主密钥
+     * @param masterKeyRestoreDTO
+     * @return
+     * @throws IOException
+     * @throws ClassNotFoundException
+     */
+    @PostMapping("/recoveryMasterKey")
+    public ApiResponse<RecoveryResult> recoveryMasterKey(@RequestBody MasterKeyRestoreDTO masterKeyRestoreDTO)
+            throws IOException, ClassNotFoundException {
+        RecoveryResult result;
+        String mac;
+        try {
+            Collection<String> keyComponents = masterKeyRestoreDTO.getComponents().values();
+            List<String> keyComponentsList = new ArrayList<>(keyComponents);
+            mac = lmkService.recoveryLMK(keyComponentsList);
+            result = RecoveryResult.getInstance(false, mac);
+        } catch (StreamCorruptedException streamCorruptedException) {
+            String masterKey = lmkService.masterKeyCompose(masterKeyRestoreDTO.getComponents());
+            mac = lmkService.recoveryLMKAndGenIK(masterKey);
+            result = RecoveryResult.getInstance(true, mac);
+        }
+        return ApiResponse.success(result);
+    }
+
+    /**
+     * 分量合成恢复主密钥
+     * @param masterKeyRestoreDTO
+     * @return
+     */
+    @PostMapping("/masterKeyRecovery")
+    public ApiResponse<LMK> masterKeyRecovery(@RequestBody MasterKeyRestoreDTO masterKeyRestoreDTO) {
+        String masterKey = lmkService.masterKeyCompose(masterKeyRestoreDTO.getComponents());
+        LMK lmk = lmkService.recoveryLMK1(LMK.getInstance(masterKey, masterKeyRestoreDTO));
+        return ApiResponse.success(lmk);
+    }
+
 }

src/main/java/com/cisd/tms/modules/mk/service/LmkService.java

@@ -10,12 +10,15 @@ import com.cisd.tms.integration.crypto.pcie.service.PcieCryptoService;
 import com.cisd.tms.modules.mk.common.LMKConstant;
 import com.cisd.tms.modules.mk.dto.KeyComponent;
 import com.cisd.tms.modules.mk.dto.LMK;
+import com.cisd.tms.modules.mk.dto.LMKAndIK;
 import com.cisd.tms.modules.mk.enums.IKEnums;
 import jakarta.annotation.Resource;
 import lombok.extern.slf4j.Slf4j;
 import org.bouncycastle.util.encoders.Hex;
 import org.springframework.stereotype.Service;
 
+import java.io.IOException;
+import java.io.StreamCorruptedException;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Base64;
@@ -143,4 +146,58 @@ public class LmkService {
         return keyComponentList.get(index);
     }
 
+    public String masterKeyCompose(Map<String, String> componentMap) {
+        StringBuilder lmk = new StringBuilder();
+        for (int i = 0; i < LMKConstant.COMPONENT_NUM; i++) {
+            lmk.append(componentMap.get(String.valueOf(LMKConstant.KEY_ORDER[i])));
+        }
+        return lmk.toString();
+    }
+
+    public String recoveryLMK(List<String> keyComponents) throws IOException, ClassNotFoundException {
+        List<KeyComponent> componentList = new ArrayList<>();
+        for (String component : keyComponents) {
+            byte[] raw;
+            try {
+                raw = Base64.getDecoder().decode(component);
+            } catch (IllegalArgumentException e) {
+                StreamCorruptedException ex = new StreamCorruptedException("invalid component encoding");
+                ex.initCause(e);
+                throw ex;
+            }
+            try {
+                Object obj = SerializationUtil.deserializationObject(raw);
+                componentList.add((KeyComponent) obj);
+            } catch (ClassCastException e) {
+                StreamCorruptedException ex = new StreamCorruptedException("invalid component payload");
+                ex.initCause(e);
+                throw ex;
+            } catch (StreamCorruptedException e) {
+                throw e;
+            }
+        }
+        LMKAndIK lmkAndIK = LMKAndIK.getInstance(componentList);
+        pcieCryptoService.recoverLmkEx(Hex.decode(lmkAndIK.getLmk()));
+        pcieCryptoService.loadLmk();
+        byte[] seedMac = pcieCryptoService.exportLmkSeedMac();
+        return Hex.toHexString(seedMac);
+    }
+
+    public String recoveryLMKAndGenIK(String lmkComponentHex) {
+        pcieCryptoService.recoverLmkEx(Hex.decode(lmkComponentHex));
+        pcieCryptoService.generateIk(IKEnums.KEY_TYPE_AUTH.getCode());
+        pcieCryptoService.generateIk(IKEnums.KEY_TYPE_DEVICE.getCode());
+        pcieCryptoService.loadLmk();
+        byte[] seedMac = pcieCryptoService.exportLmkSeedMac();
+        return Hex.toHexString(seedMac);
+    }
+
+    public LMK recoveryLMK1(LMK lmk) {
+        pcieCryptoService.recoverLmkEx(Hex.decode(lmk.getPcLmk()));
+        pcieCryptoService.loadLmk();
+        byte[] seedMac = pcieCryptoService.exportLmkSeedMac();
+        lmk.setUcSessionKey(Hex.toHexString(seedMac));
+        return lmk;
+    }
+
 }