EA008186B1

EA008186B1 - Method and device for obtaining and storing personal digital certificate and method for protected exchange of digital information

Info

Publication number: EA008186B1
Application number: EA200501605A
Authority: EA
Inventors: Алексей Владимирович Домашев; Андрей Юрьевич ЩЕРБАКОВ; Евгений Александрович Дуйков; Сергей Вячеславович Сотский
Original assignee: Фонд Сопровождения Инвестиционных Проектов "Генкей"
Priority date: 2005-11-11
Filing date: 2005-11-11
Publication date: 2007-04-27
Also published as: EA200501605A1

Abstract

A method and device are disclosed for obtaining and storing a personal digital certificate and a method for protected exchange of digital information. Compared to prior art methods and devices of digital information storing, the disclosed invention is characterized by substantial increase of privacy level storing as generated personal secret key is unknown by its owner and verifying the personal digital certificate in the authorized body and increasing privacy level of information transmission via different communication channels, as well as for improving the authenticity of the information transmission due to the use of electronic digital signature.

Description

The invention relates to methods and devices for receiving, storing and exchanging digital information.

The present invention will find application for the secure storage of personal data, in particular electronic money.

It is well known that for storing meaningful personal information of users, such as account numbers or non-cash funds themselves, or personal installation data, such as home address, tax numbers, etc., use compact electronic media such as plastic and smart cards, or flash drives in the form of I8B devices.

Currently, the task of protecting the digital information stored in these devices is considered as protecting the electronic carrier itself from physical opening or penetration of the device.

So, for example, in the patent application of the Russian Federation No. 2003100843 a protection device of an electronic module is described, protecting against access to its in-circuit elements without changing the logical state of the latter, by hacking using any technically possible means and methods of the external design elements of the module, including its pins, containing at least one anisotropically electrically conductive casing, limiting on all sides the internal volume of the module, in which is located a printed or film board with intracircuit elements and functional interconnects of the module, as well as a protection circuit, or a separate protection circuit connected from the inside to the shell and reacting to changes in the electrical parameters of the shell in violation of the integrity of the latter as a result of breaking, characterized in that the shell is the envelope of the conclusions, At least, a two-layer winding with rigidly fixed coils, wound, at least in two parallel insulated wires, intertwined or intertwined with each other, randomly connected at the beginning and end of the winding to two contact groups of the protection circuit, which is made two-mode: the mode of activation of the one-time determining and storing table of paired connections by the wires of the winding of the contacts of both groups between themselves, and in the mode of operation with a given periodicity determining the current the state of these connections and preserving the unchanged logical state of the intracircuit elements of the module only when receiving a result that matches the one defined in the activation mode

Practice has shown that the protection of digital information is not confined to protection only from opening or penetration. For example, methods are known for contactless reading of digital information from carriers, as well as sending commands from the outside to issue internal information, or monitoring the exchange process between devices (for example, between a plastic card and an ATM).

On the other hand, the owner of the carrier to access it operates with a certain password or PIN code, which he can forget or which can be discovered by him with secretive methods (for example, video surveillance) or social engineering methods (pressure, blackmail).

The task should be considered more widely and formulate mathematically correct ways of storing information in devices and ways of exchanging information, guaranteed from interception.

The closest to the claimed invention is the patent application of the Russian Federation No. 2004135376 "METHOD FOR PROTECTED DATA TRANSFER BETWEEN TWO DEVICES" directly connected with each other, in particular between the protection module and the receiving device, the first device containing at least one first key (RAKU ) encryption from a pair of asymmetric keys, and the second device contains at least one second encryption key (PAKB) from the specified pair of asymmetric keys, and these keys are pre-initialized Collect in the first and second devices, characterized in that it includes the following steps: at least one first random number (A) is generated in the first device, at least one second random number (B) is generated in the second device, the first random number (A) encrypt with the specified first key (RACU) encryption, the second random number (B) encrypt with the specified second key (PAKB) encryption, the specified first encrypted random number (A ') is transmitted to the second, the specified second encrypted random number (B') is transmitted in the first the device, the first encrypted random number (A) is decrypted in the specified second device, the second encrypted random number (B ') is decrypted in the specified first device, the specified random numbers (A, B) generated and received by the devices are combined and the key is created on their basis (8K) communication session, session key (8K) is used to encrypt and decrypt all data exchanged between the first device and the second device, or portions of this data.

However, the method described in the patent application of the Russian Federation No. 2004135376, which does not use personal digital certificates, is vulnerable to the method of attack of the intermediary given below.

Further, in the course of the description, we will use the following special terms, by which we mean the following.

Encryption is the process of encrypting or decrypting. Schematically, the encryption process is shown in FIG. 1 attached to the description.

- 1 008186

Information encryption is a one-to-one mathematical (cryptographic) transformation, depending on the key (the secret transformation parameter), which assigns to the block of open information represented in some digital representation, the block of encrypted information also represented in digital representation. The term encryption combines two processes: encryption and decryption of information.

If encryption and decryption are performed using the same key, then this cryptographic transformation algorithm is called symmetric, otherwise asymmetric.

Only a user who has the same secret encryption key can read the encrypted message (information).

Encryption of digital information - the transformation of the form of the original (open) texts of digital messages in such a way that their meaning becomes incomprehensible to any person who does not possess the secret (key) of the inverse transformation.

Electronic digital signature - data added to a data block, obtained as a result of its cryptographic transformation, depending on the secret key and data block, which allow the data receiver to verify the integrity of the data block and the authenticity of the data source, as well as to provide protection against forgery by the receiver data.

Verification of an electronic digital signature (EDS) under the open information block is performed using a cryptographic transformation and a public key corresponding to the secret key that participated in the EDS installation process. Schematically, the process of setting and verifying the EDS is shown in FIG. 2 attached to the description.

Electronic digital signature ensures the integrity of messages (documents) transmitted over unprotected public telecommunication channels in information processing systems of various purposes, with guaranteed identification of its author (person who signed the document).

Electronic digital signature allows replacing traditional stamp and signature for paperless workflow. When constructing a digital signature, instead of the usual connection between a seal or a handwritten signature and a piece of paper, there is a complex mathematical relationship between an electronic document, a secret and a public key.

The practical impossibility of counterfeiting a digital signature relies on a very large amount of certain mathematical calculations.

Putting a signature on a document does not change the document itself, it only provides an opportunity to verify the authenticity and authorship of the information received.

Secret key - a cryptographic key that is kept secret by the user of the system. It is used to generate electronic digital signature and encryption.

Further, instead of a secret key, we will use the term “private key”, which emphasizes the permanent non-identifiable storage of this key in a device. To underline the ownership of this private key to its specific owner, we will use the term “private private key”.

The need to have two keys to perform cryptographic operations, one of which is kept secret, while the other is generally accessible, leads to the implementation of the so-called mediator attack. To describe the attack, we use the following notation:

P - plaintext,

C - encrypted text,

EC () is the encryption function,

Ek () is a decryption function.

From - the public key of the subscriber of the secure communication network M,

8t - the secret key, respectively.

Subscriber A wants to send to the subscriber an encrypted message. It performs the conversion using subscriber B's public key from a directory located in a publicly accessible place. The received message C, the subscriber B decrypts using his secret key 8b.

When a mediator attacks in the network, an attacker X appears with his key pair Oh, 8x. Having access to the directory of public keys, X performs the substitution of OU with its own key Oh, after which the attacker can freely read the correspondence C 'intended for the subscriber B. In order that the latter does not suspect anything, X can keep a local copy of OU to form original message C. The attack is based on the assumption that the data in the public directory can be changed.

- 2 008186

Mediator attack

To prevent the described attack, the digital certificate method is used. The certificate is an electronic document confirming the relationship between the public key and the identity of its owner through EDS using the secret key of a trusted third party.

Generally speaking, a certificate is some kind of certificate that allows authenticating its owner in the same way as a passport or driver's license. Adding additional information allows you to specify the scope of the certificate.

Thus, the personal digital certificate includes the user's personal public key, its identification data and is signed by the digital signature of some authorized body.

To verify the digital signature under the certificate, the public key of the authorized body is used, which all participants must have.

When generating public keys from private ones, it is advisable to use one-way functions. For example, there are two functions 1 (a, x) and § (a, x). The sender A of the message generates a random value x, calculates 1 = 1 (a, x), the recipient B also produces a random value y, calculates g = § (a, y). Then A gets r, and B -1.

We assume that 1 (r, x) = 1 (§ (a, y), x) coincides with § (1, y) = § (1 (a, x), y) (otherwise the correspondents will not get one and same key value).

From the most simple considerations, it follows that the property should be as follows: by the value of 1 (a, x) and § (a, x) without knowing x and y, it would be difficult to calculate K.

On the other hand, it is important that the functions Γ and a themselves be easily computable, and also the equality g (1 (a, x), y) = 1 (g (a, y), x) would hold for any x and y and at least for some a.

As functions ί and § it is advisable to use 1 (a, x) = § (a, x) = a ^x .

In this case, to obtain a private key from an open potential attacker, you will need to use the logarithm function (in this case discrete, since this is digital information), which is mathematically very laborious.

Thus we will denote:

x - personal private key, and ^x - private public key, [a ^x ] - personal digital certificate.

The present invention is based on the task of creating a method of obtaining and storing a personal digital certificate in such a way that the owner would not need to memorize and store any information for accessing the device, while the personal private key would not be known to anyone in principle and the properties of a personal digital certificate would be confirmed by an authorized body.

This task is solved by means of a method of obtaining and storing a personal digital certificate, which provides that a digital certificate containing an electronic digital signature is transferred from an authorized body to a memory device for long-term storage, a personal private key from a random number generator is transferred to a memory device for long-term storage, a personal the private key stored in the memory device for long-term storage is sent to the computing unit, the computing unit converts t personal private key to personal public key;

the personal public key from the computing unit is sent to the authorized body, the authorized digital authority forms a personal digital certificate containing the digital signature from the personal public key, and the personal digital certificate is transferred to the storage device for long-term storage.

By implementing the method of obtaining and storing a personal digital certificate declared by us, the following fundamental subtasks are solved:

-3008186 (a) the owner does not need to memorize and store any information to access the device, in other words, a user's personal private key is generated without user interaction using a random number generator;

(b) the personal private key is not known to anyone fundamentally, including the user, (c) the properties of the personal digital certificate are confirmed by the authorized body. This is very important, because ultimately the user cannot objectively, and even forcibly, change his personal digital certificate. In addition, it is possible to fix the legitimacy of the “personal private key - personal public key” pair with the help of the authorized body's EDS.

To control the authenticity of the received personal digital certificate, it would also be advisable to check that the personal digital certificate stored in the storage device for long-term storage is checked for authenticity by checking the digital signature contained therein.

Another objective of the present invention is to create a device that implements the above method of obtaining and storing personal digital certificate, containing:

a random number generator designed to obtain a personal private key, which is a random number, with output for digital information;

A computational unit for converting a private private key into a personal public key containing a first information input communicated with an output for digital information of a random number generator, a first output for digital information, a second input for digital information, a second output for digital information and a third input for digital information;

a memory device for long-term storage of information containing an input for digital information communicated with a first output for digital information of a computing unit, and an output for digital information communicated with a second input of a computing unit;

an interface unit for exchanging digital information between devices, containing a first input for digital information, communicated with a second output for digital information of a computing unit, a second input for receiving digital information from a device similar to a device for receiving and storing a personal digital certificate, a first output for digital information for transmitting digital information to a device similar to a device for receiving and storing a personal digital certificate, and a second output for qi status information through communication with a third input for digital information computing unit.

It is advisable when designing means for storing electronic money and cashless funds to use in its composition the described device for receiving and storing a personal digital certificate.

Another object of the present invention is to develop a method of securely exchanging digital information between devices for obtaining and storing a personal digital certificate not subject to passive listening and active distortion.

This problem is solved by the proposed method of exchanging digital information between devices for obtaining and storing a personal digital certificate, which consists in the fact that a personal digital certificate [a ^x1 ] stored in the storage device of the first device for storing a personal digital certificate is transferred to the memory device of the second device for receiving and storing a personal digital certificate;

personal digital certificate [a ^x2 ], stored in the storage device of the second device for receiving and storing a personal digital certificate, is transferred to the memory device of the first device for receiving and storing a personal digital certificate;

then, each of the devices for receiving and storing a personal digital certificate generates, using its own personal private key and the personal digital certificate received from the other device, the key of the primary exchange

Cr = (a ^x1 ) ^x2 = (a ^x2 ) ^x1 then each of the devices for receiving and storing a personal digital certificate, independently of one another, generates random numbers 51 and 52, respectively, using a random number generator, and encrypts these numbers on the received key of the primary exchange with obtaining encrypted random numbers ζ1 and ζ2 ζ1 = Ε (Κρ , 51) and ζ2 = Ε (Κρ, 52), then the devices for receiving and storing the personal digital certificate exchange encrypted random numbers ζ1 and ζ2, then each of the devices for obtaining and storing the personal digital certificate is decrypted enters the encrypted random number received by it on the key of the primary exchange with obtaining the decoded random numbers

51 = Ό (Κρ, ζ1) and 52 = Ό (Κρ, ζ2), then each device for receiving and storing a personal digital certificate generates the same value in a deterministic manner E from the decoded random numbers and the available random number, resulting in a session exchange key Kc

- 4 008186

KS = E (81,82) = E (82,81), then each device for receiving and storing a personal digital certificate exchanges digital information with another device, while one of the devices encrypts the digital information transmitted to the other device on the session exchange key Kc and the device receiving this encrypted digital information decrypts it on the session exchange key Kc.

After receiving the session exchange key, it is advisable to monitor the uniformity of the session exchange keys of each device to obtain and store a personal digital certificate by decrypting a random number received from another device to receive and store a personal digital certificate and compare it with a random number that already exists in another device for obtaining and storing personal digital certificate.

To avoid repetition of already transmitted information, for example, for an attacker to re-withdraw money from an account by repeating a transmitted legal command, when exchanging information between devices to receive and store a personal digital certificate, it is advisable to sign the transmitted digital information with an electronic digital signature on the transmitting device’s private key and store a personal digital certificate and check using a personal digital certificate stored in p inimayuschem device for receiving and storing personal digital certificate.

In order to establish trust between owners, prior to the beginning of the exchange of digital information between devices for receiving and storing a personal digital certificate, each device checks an electronic digital signature on a personal digital certificate received from another device using an authorized body certificate.

To verify the validity of the powers of the owners after verifying the electronic digital signature under the personal digital certificate received from another device, it is advisable to check its validity period and the possibility of using this certificate.

It is technically justified to use the deterministic function P of coordinatewise coordinate modulo 2 of the decoded random number and the available random number to obtain the session exchange key.

To ensure security, after completing the exchange of digital information at the end of the exchange of digital information between devices for receiving and storing a personal digital certificate, all digital data, except for the personal private key, personal personal digital certificate and digital certificate of the authorized body, should be destroyed.

To ensure security in the process of exchanging digital information stored in the device for obtaining and storing a personal digital certificate, it is necessary to erase when trying to penetrate into the device.

The described methods of protection can be extended to the case when digital information exchanged between devices for receiving and storing a personal digital certificate is at least one of a group of objects, including electronic money, digitized objects of intellectual property, digitized documents confirming property rights , digitized speech, digitized audio information.

Hereinafter, the present invention will be described in more detail in the following detailed description of a mobile mobile radio communication telephone set including a device for receiving and storing a personal digital certificate, with reference to the attached schematic diagram of the system (see FIG. 3) implementing a telephony-protected telephone connection.

The telephone set contains a telephone transmitting antenna 1, a transceiver device 2, an interface unit 3, a computing unit 4, a memory device 5 for long-term storage, a random number generator 6, a speech recovery unit 7, a voice playback device 8, a telephone encryption unit 9, a vocoder 10 and microphone 11. Elements 3-6 of the telephone set form the claimed device for receiving and storing a personal digital certificate.

A telephone set containing a device for obtaining and storing a personal digital certificate in a closed communication network operates as follows. Digital Certificate [a ^x0 ] containing an electronic digital signature (EDS) and intended for verifying a digital signature under subscriber certificates, is transmitted from the authorized body via radio to the transceiver antenna 1 of a telephone with a network number ί, then through transceiver 2 to the interface unit 3 and to the storage device 5 for long-term storage. After that, the subscriber’s private private key ί x _one from the random number generator 6 is transferred to the storage device 5 for long-term storage, then the personal private key stored in the storage device 5 for long-term storage is sent to the computing unit 4, the computing unit 4 converts the personal private key into a personal public key ^x1 , places it in the storage device 5 for long-term storage and, via the interface unit 3, transmits it to the transceiver 2, which in turn transmits it to the transceiver antenna 1 of the phone and sends it to the authorized body via radio.

- 5 008186

In the authorized body using the personal private key of the authorized body x ₀ form a personal digital certificate from a private public key [a ^x1 ] containing an electronic digital signature, then a personal digital certificate containing an electronic digital signature from the authorized body is transmitted via radio to the transceiver antenna 1 of the telephone with network number 1, then through the transceiver 2 to the interface unit 3 and to the storage device 5 for long-term storage , while the personal digital key of the phone number Ц is extracted from the personal digital certificate after verifying the EDS in the computing unit 4 and compared in the computing unit 4 with the in the storage device 5 by the previously calculated private key. If the test is successful, the telephone with the number is registered in the communication network.

For the exchange of voice information between the telephone ί and the similarly arranged telephone with the number _) personal digital certificate [a ^x1 ] stored in the storage device of the first device for receiving and storing a personal digital certificate included in the telephone with a network number ί is transmitted to the storage device of the second device for receiving and store a personal digital certificate that is included in the telephone with a network number _), and personal digital certificate [a ^four ], stored in the storage device of the second device for receiving and storing a personal digital certificate, is transferred to the memory device of the first device for receiving and storing a personal digital certificate.

If desired, prior to the beginning of the exchange of digital information between devices for receiving and storing a personal digital certificate included in telephone sets, in each device check the digital signature of a personal digital certificate received from another device using an authorized body certificate, and after checking the electronic digital signature from a personal digital certificate received from another device, verify its validity period and the possibility of using it with rtifikata when implementing the exchange of digital information according to the claimed invention.

Then, each telephone set containing a device for receiving and storing a personal digital certificate generates in the computing unit 4 using the personal private private key and the primary exchange key received from another personal digital certificate device

Cr = = (a ^x ) ^x .

After that, each phone that contains a device for receiving and storing a personal digital certificate, independently of each other using a random number generator 6, generates random numbers 81 and 82, respectively, and encrypts these numbers on the received key of the primary exchange to receive encrypted random numbers ζ1 and 2 ζ1 = Ε (Κρ, 81) and ζ2 = Ε (Κρ, 82).

Then, phones with network numbers ί and _), containing devices for receiving and storing personal digital certificates, are exchanged over the radio channel with encrypted random numbers ζ1 and 2.

Then phones with network numbers ί and _), containing devices for receiving and storing a personal digital certificate, decrypt the encrypted random number they received on the primary exchange key to obtain the decoded random numbers

81 = Ό (Κρ, ζ1) and 82 = (Κρ, 2).

Then, each of the devices for receiving and storing a personal digital certificate, included in the phones with network numbers ί and _), forms the same value from the decoded random numbers and the available random number by modulo-2 summing up, resulting in the session exchange key Kc

Kc = (81 + 82) tob2 = (82 + 81) tob2.

Then each of the phones, containing a device for receiving and storing a personal digital certificate (blocks 3, 4, 5, 6), exchanges with another phone voice information inputted from microphone 11, converted into digital form by vocoder 10, transmitted to the encryption unit of the phone 9 and then to the transceiver 2, which in turn transmits it to the transceiver antenna 1 of the telephone and sends it to another telephone via radio. The encrypted digital information received from another telephone number _) is transmitted from the radio channel to the transceiver antenna 1 of the telephone ί, then to the transceiver device 2, transmitted to the encryption unit of the telephone 9, where it is decrypted using the key Kc, transmitted to the speech recovery unit 7 and transmitted to the device speech reproduction 8.

If necessary, at the end of the exchange of digital information between devices for obtaining and storing a personal digital certificate included in the described telephone sets, all digital data, except the personal private key, personal digital certificate and digital certificate of the authorized body, are destroyed, and if unauthorized entry is attempted inside the telephone, the digital information stored in the device for obtaining and storing a personal digital certificate is erased.

- 6 008186

Similarly, a means for storing electronic money or cashless funds can be arranged, containing the claimed device for receiving and storing a personal digital certificate and allowing money to be transferred from the “buyer” to the “seller”, where at least one bank is authorized in which subscriber accounts are opened, and the means for making payments can be, for example, the above described telephone set or a similarly arranged terminal for posting payments, in which there is no voice information transmission path, and a keyboard is used to enter digital information.

In addition, the applicant sees a great prospect in the use of the present invention for the storage and exchange of digitized intellectual property and digitized documents confirming property rights.

Compared to all digital information storage devices known to the applicant, the device disclosed in the present invention is characterized by a significant increase in the level of security of storage due to the unknownness of the private personal key developed by its owner and certification of a personal digital certificate in an authorized body and an increase in the level of security of information transmission , as well as improving the reliability of information transfer through the use of electronic digital signature.

Claims

CLAIM

1. The method of obtaining and storing a personal digital certificate, which consists in the fact that a digital certificate containing an electronic digital signature is transferred from an authorized body to a storage device for long-term storage;

the personal private key from the random number generator is transferred to a storage device for long-term storage;

personal private key stored in the storage device for long-term storage is sent to the computing unit;

a computing unit converts a private private key into a private public key; personal public key from the computing unit is sent to the authorized body;

in the authorized body form from a personal public key a personal digital certificate containing an electronic digital signature;

a personal digital certificate is transferred to a storage device for long-term storage.

2. The method according to claim 1, characterized in that the personal digital certificate stored in the storage device for long-term storage is checked for authenticity by verifying the digital signature contained therein.

3. A device for obtaining and storing a personal digital certificate, containing a random number generator, designed to receive a personal private key, which is a random number, with an output for digital information;

a computing unit for converting a private private key into a private public key containing a first input for information communicated with an output for digital information of a random number generator, a first output for digital information, a second input for digital information, a second output for digital information and a third input for digital information;

a storage device for long-term storage of information, comprising an input for digital information communicated with a first output for digital information of a computing unit, and an output for digital information communicated with a second input of a computing unit;

an interface unit for exchanging digital information between devices, comprising a first input for digital information communicated with a second output for digital information of the computing unit, a second input for receiving digital information from a device similar to a device for receiving and storing a personal digital certificate, the first output for digital information for transmitting digital information to a device similar to the device for receiving and storing a personal digital certificate, and a second output for qi status information through communication with a third input for digital information computing unit.

4. A tool for storing electronic money, containing a device for receiving and storing a personal digital certificate according to claim 3.

5. A means for storing non-cash financial assets, comprising a device for receiving and storing a personal digital certificate according to claim 3.

6. A method for exchanging digital information between devices for receiving and storing a personal digital certificate, each of which is performed in accordance with clause 3, namely that a personal digital certificate obtained in accordance with claim 1 and stored in the storage device of the first device to obtain and store a personal digital certificate, transmit to the storage device of the second device for receiving and storing a personal digital certificate;

- 7 008186 personal digital certificate obtained according to claim 1 and stored in the storage device of the second device for receiving and storing a personal digital certificate, is transferred to the storage device of the first device for receiving and storing a personal digital certificate;

then each of the devices for receiving and storing a personal digital certificate generates a primary exchange key using its own personal private key and a personal digital certificate received from another device;

then each of the devices for receiving and storing a personal digital certificate independently from each other using a random number generator generates random numbers and encrypts these numbers on the received primary exchange key to obtain encrypted random numbers;

then devices for receiving and storing a personal digital certificate exchange encrypted random numbers;

then each of the devices for receiving and storing a personal digital certificate decrypts the encrypted random number received by it on the primary exchange key to obtain decrypted random numbers;

then each of the devices for receiving and storing a personal digital certificate generates the same value in a deterministic manner from the decrypted random numbers and the available random number, resulting in a session exchange key;

then each of the devices for receiving and storing a personal digital certificate exchanges digital information with another device, while one of the devices encrypts the digital information transmitted to the other device on the session exchange key, and the device that receives this encrypted digital information decrypts it on the session exchange key.

7. The method according to claim 6, characterized in that after receiving the session-exchange key, the identity of the session-exchange keys of each device is checked to obtain and store a personal digital certificate by decrypting a random number received from another device to receive and store a personal digital certificate and comparing it with a random number that is already on another device to receive and store a personal digital certificate.

8. The method according to claim 6, characterized in that when exchanging information between devices for receiving and storing a personal digital certificate, the transmitted digital information is signed by electronic digital signature on the personal private key of the transmitting device for receiving and storing a personal digital certificate and verified using a personal digital A certificate stored in the receiving device to receive and store a personal digital certificate.

9. The method according to claim 6, characterized in that prior to the exchange of digital information between devices for receiving and storing a personal digital certificate in each of the devices, an electronic digital signature is verified under a personal digital certificate received from another device using a certificate of an authorized body.

10. The method according to claim 6, characterized in that after checking the electronic digital signature on a personal digital certificate received from another device, they check its validity and the possibility of using this certificate when implementing the method according to claim 6.

11. The method according to claim 6, characterized in that when forming the primary exchange key, the Diffie-Hellman algorithm is used.

12. The method according to claim 6, characterized in that to obtain the session exchange key, use the deterministic coordinate-wise summation modulo 2 of the decrypted random number and the available random number.

13. The method according to claim 6, characterized in that at the end of the exchange of digital information between devices for receiving and storing a personal digital certificate, all digital data, except for a private private key, own personal digital certificate and digital certificate of an authorized body, is destroyed.

14. The method according to claim 6, characterized in that the digital information stored in the device for receiving and storing a personal digital certificate is erased when attempting to enter the device made according to claim 3.

15. The method according to claim 6, characterized in that the digital information exchanged between devices for obtaining and storing a personal digital certificate is at least one of a group of objects including electronic money, digitized intellectual property objects, digitized documents confirming rights on property, digitized speech, digitized audio information.