WO2022178890A1 - 一种密钥的传输方法和装置 - Google Patents

一种密钥的传输方法和装置 Download PDF

Info

Publication number
WO2022178890A1
WO2022178890A1 PCT/CN2021/078330 CN2021078330W WO2022178890A1 WO 2022178890 A1 WO2022178890 A1 WO 2022178890A1 CN 2021078330 W CN2021078330 W CN 2021078330W WO 2022178890 A1 WO2022178890 A1 WO 2022178890A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
client
signature
management entity
information
Prior art date
Application number
PCT/CN2021/078330
Other languages
English (en)
French (fr)
Inventor
李�泳
耿峰
段立
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2021/078330 priority Critical patent/WO2022178890A1/zh
Priority to CN202180003014.7A priority patent/CN113796058B/zh
Publication of WO2022178890A1 publication Critical patent/WO2022178890A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a method and device for transmitting a key.
  • the auto parts foundry (Original Equipment Manufacturer, OEM) needs to transfer some of the stored target keys to the car's first-tier parts supplier (Tier One, TIER1), so that the parts Foundries further fill these target keys into auto parts.
  • TIER1 Tier One
  • the transmission security of the target key will directly affect the security of the in-vehicle components.
  • the present application provides a key transmission method and device, which are used to improve the security of key transmission between a key management entity and a client.
  • an embodiment of the present invention provides a method for transmitting a key.
  • the method is described as being executed by a client.
  • the steps of the method include: a client sends a request message to a key management entity, wherein the request message is used to request a target key, and the request message includes the client's encryption public key, the signature of the encryption public key, and the signature authentication information of the client; the client receives a response message from the key management entity, and the response message includes the ciphertext, the key management entity's response to the encryption The signature of the text and the signature authentication information of the key management entity; wherein, the cipher text is obtained by encrypting the target key according to the encryption public key of the client; the client uses the encryption The signature authentication information of the key management entity determines that the signature of the ciphertext is correct; the client decrypts the ciphertext using the client's encrypted private key to obtain the target key; the client sends the The key management entity sends a confirmation message, where the
  • the client sends a request message to the key management entity to request the target key.
  • the request message includes the client's encryption public key, the client's signature on the encryption public key, and the client's signature authentication information.
  • the client receives the response message sent by the key management entity, and after verifying that the ciphertext in the response message is correct, the client decrypts the ciphertext using the client's encrypted private key to obtain the target key. Finally, the client returns confirmation information to the key management entity.
  • This scheme can not only ensure that the client can obtain the target key accurately, but also ensure the transmission security of the target key.
  • the method before the client sends confirmation information to the key management entity, the method further includes: the client transmits process information according to the target key and the target key And the confirmation result of the target key generates a confirmation key; the client obtains the verification information according to the confirmation key.
  • the confirmation key is generated according to the target key, the target key transmission process information and the confirmation result of the target key, and the verification information is obtained according to the confirmation key, so as to ensure
  • the confirmation key and verification information obtained by the client are closely related to the target key process and its transmission result, which makes the confirmation information returned by the client more legal and effective.
  • the confirmation information includes: the verification information, and the client's signature on the verification information and the target key transmission process information.
  • the client informs the key management entity that the target key has been received through the confirmation information, and the verification information included in the confirmation information can be used to prevent the client from denying the fact that the target key has been obtained.
  • the target key transmission process information includes one or more of the following: the client's signature on the encryption public key, the key management entity's signature on the target key , the signature of the key management entity to the ciphertext, the ciphertext, and the encryption public key.
  • the target key transmission process information involves any one or more of various signatures, ciphertexts and encryption public keys generated by the client and the key management entity, so that the client can ensure that the key
  • the confirmation information returned by the management entity is more legitimate and valid.
  • the signature authentication information of the client includes: a digital signature certificate of the client.
  • the key management entity can implement the client's identity authentication according to the client's signature authentication information.
  • the signature authentication information of the client includes: an initial authentication signature and a signature authentication public key of the client; before the client sends the request message to the key management entity, the The method further includes: the client sends an authentication request to the key management entity, wherein the authentication request includes: the signature authentication public key of the client and the identity of the client; the client receives the The initial authentication signature of the key management entity, wherein the initial authentication signature is obtained by signing the signature authentication public key of the client according to the signature authentication private key of the key management entity.
  • the client's signature authentication information includes the initial authentication signature and the client's signature authentication public key
  • the client needs to send an authentication request to the key management entity before sending a request message to the key management entity, so as to realize its own Identity authentication and obtain the initial authentication signature sent by the key management entity, thereby ensuring that the target key can be obtained effectively and safely in the future.
  • the authentication information of the key management entity includes: a digital signature certificate of the key management system.
  • the authentication information of the key management entity includes the digital signature certificate of the key management system.
  • the client After the client receives the response message sent by the key management entity, it can implement the key management system according to the digital signature certificate of the key management system. Entity authentication.
  • the response message further includes the signature of the key management entity on the target key
  • the method includes: the client authenticates information according to the signature of the key management entity , it is determined that the signature of the key management entity to the target key is correct.
  • the client when the response message received by the client also includes the signature of the key management entity on the target key, the client can determine that the signature of the key management entity on the target key is correct according to the signature authentication information of the key management entity , so that the integrity of the obtained target key can be guaranteed.
  • the target key transmission process information further includes a signature of the target key by the key management entity.
  • the target key transmission process information also includes the key management entity's signature on the target key, thereby further ensuring the validity of the confirmation information returned by the client, and by verifying the key management entity's signature on the target key , which can ensure the integrity of the target key during transmission.
  • an embodiment of the present invention provides a method for transmitting a key, which is described in this application as being executed by a key management entity.
  • the steps of the method include: a key management entity receives a request message sent by a client, wherein the request message is used to request a target key, and the request message includes the encryption public key of the client, the client pair The signature of the encryption public key, and the signature authentication information of the client; the key management entity determines that the client's signature to the encryption public key is correct according to the signature authentication information of the client; the key The management entity uses the encryption public key of the client to encrypt the target key and the signature of the target key to obtain ciphertext; the key management entity sends a response message to the client, the response message including the ciphertext, the signature of the key management entity to the target key, the signature of the key management entity to the ciphertext, and the signature authentication information of the key management entity; the The key management entity receives confirmation information sent by the client, where the confirmation information is used to
  • the key management entity receives the request message sent by the client, and the key management entity first confirms that the client's signature on the encryption public key in the request message is correct. Further, the key management entity uses the encryption public key of the client to encrypt the target key and the signature of the target key to obtain the ciphertext. Then the key management entity sends a response message to the client, the response message includes not only the ciphertext, but also the signature of the key management entity to the target key, the signature of the key management entity to the ciphertext, and the signature of the key management entity to the ciphertext. The signature authentication information can ensure the accuracy and integrity of the target key obtained by the client after receiving the response message. Finally, the key management entity also receives the confirmation information sent by the client, so as to confirm that the client has received the target key according to the confirmation information.
  • the confirmation message includes: the verification information, and the client's signature on the verification information and the target key transmission process information; wherein the verification information is the
  • the client obtains the confirmation key according to the confirmation key, and the confirmation key is obtained by the client according to the target key, the target key transmission process information, and the confirmation result of the target key.
  • the key management entity receives the confirmation information of the client, and the confirmation information includes the verification information, the client's signature on the verification information and the target key transmission process information. Therefore, according to the confirmation information, the key management entity can not only confirm that the client has received the target key, but also can prevent the client from acknowledging the fact that the target key has been received based on the client's signature on the verification information and the target key transmission process information. deny.
  • the target key transmission process information includes one or more of the following: the client's signature on the encryption public key, the key management entity's signature on the target key Signature, the key management entity's signature on the ciphertext, the ciphertext, and the encryption public key.
  • the signature of the target key transmission process information includes the client's signature on the encryption public key , any one or more of the signature of the key management entity to the target key, the signature of the key management entity to the ciphertext, the ciphertext, and the encryption public key. Therefore, it can be ensured that the confirmation information received by the key management entity from the client is valid and legal.
  • the signature authentication information of the client includes: a digital signature certificate of the client.
  • the client's signature authentication information in the request message sent by the client includes: the client's digital signature certificate, so that the key management entity can use the client's digital signature certificate to authenticate the client's signature on the encryption public key, so that the encryption can be guaranteed.
  • the key management entity uses the client's encryption public key as correct.
  • the signature authentication information of the client includes: an initial authentication signature and a signature authentication public key of the client; before the key management entity receives the request message sent by the client, the method It also includes: the key management entity receives an authentication request sent by the client, wherein the authentication request includes: the signature authentication public key of the client and the identity of the client; the key management entity according to The authentication request is to perform identity authentication on the client; after the client identity authentication is passed, the key management entity uses the key management entity's signature authentication private key to authenticate the client's signature authentication public. The key is signed to obtain an initial authentication signature; the key management entity sends the initial authentication signature to the client.
  • the client's signature authentication information includes: the initial authentication signature and the client's signature authentication public key
  • the key management entity needs to receive the client's authentication request before receiving the client's request message, so as to authenticate the client according to the authentication request end identity.
  • the signature authentication public key of the client is signed with the signature authentication private key of the key management entity, and an initial authentication signature is obtained and sent to the client.
  • the client can perform identity authentication according to the initial authentication signature, so as to obtain the target key from the key management entity.
  • the key management entity encrypts the target key and the signature of the target key by using the encryption public key of the client, and before obtaining the ciphertext, the method further includes: The key management entity uses the client's signature authentication public key to determine that the initial authentication signature is correct.
  • the key management entity uses the client's encryption public key to encrypt the target key and the signature of the target key. Before obtaining the ciphertext, the key management entity uses the client's signature to authenticate the public key to determine that the initial authentication signature is correct. Ensure that the identity of the client is correct, thereby ensuring the security of the target key transmission.
  • the authentication information of the key management entity includes: a digital signature certificate of the key management system.
  • the authentication information of the key management entity includes: when the digital signature certificate of the key management system; after receiving the response message from the key management entity, the client can use the digital signature certificate of the key management system to authenticate the response The signature of the ciphertext in the message. Therefore, the transmission security of the target key can be guaranteed, and the accuracy of the target key obtained by the client can also be guaranteed.
  • an embodiment of the present invention provides a method for transmitting a key.
  • the method is described as being executed by a client.
  • the steps of the method include: a client sends a request message to a key management entity; the request message is used to request a target key, and the request message includes first key exchange information, the client's response to the first key The signature of the key exchange information, and the signature authentication information of the client; the client receives a response message from the key management entity, and the response message includes the ciphertext and the second password of the key management entity.
  • the ciphertext is the key management entity according to the key management
  • the encryption/decryption key of the entity is obtained by encrypting the target key
  • the encryption/decryption key of the key management entity is obtained by the key management entity according to the first key exchange information of the client, the key The second key exchange information of the management entity and the client's signature on the first key exchange information
  • the first transmission process information includes one or more of the following: the ciphertext, the the first key exchange information and the second key exchange information
  • the client determines that the signature of the key management entity on the first transmission process information is correct according to the signature authentication information of the key management entity;
  • the The client uses the encryption and decryption key of the client to decrypt the ciphertext to obtain the target key
  • the encryption and decryption key of the client is exchanged by the client according to the first key of the client information, the second key exchange information of the key management entity,
  • the client sends a request message to the key management entity, and the request message includes the first key exchange information, the client's signature on the first key exchange information, and the client's signature authentication information. Then, the key management entity can encrypt the target key according to the encryption/decryption key obtained by itself to obtain the ciphertext.
  • the client determines that the signature of the key management entity on the first transmission process information is correct according to the signature authentication information of the key management entity in the response message. Further, the client uses the client's encryption/decryption key to decrypt the ciphertext in the response message to obtain the target key.
  • This scheme can ensure the security of the key transmission between the client and the key management entity, so that the client can obtain the target key accurately and effectively.
  • the client also returns confirmation information to the key management entity to inform the client that the target key has been received.
  • the method before the client sends the confirmation message to the key management entity, the method further includes: the client according to the target key, the second transmission process information and the target The confirmation result of the key generates a confirmation key; the client obtains third verification information according to the confirmation key and the target key transmission process information; wherein the second transmission process information includes one or more of the following Items: the client's signature on the first key exchange information, the key management entity's signature on the first transmission process information, the first key exchange information, and the second key exchange information ; the target key transmission process information includes one or more of the following: the client's signature on the first key exchange information, the key management entity's signature on the first transmission process information, the The first key exchange information, the second key exchange information, and the ciphertext.
  • the client before the client sends the confirmation message to the key management entity, the client generates the confirmation key according to the target key, the second transmission process information and the confirmation result of the target key, and further generates the confirmation key according to the confirmation key and the target key.
  • the third verification information is obtained from the key transmission process information. This solution can ensure the validity of the third verification information.
  • the confirmation message includes: the third verification information, and the client's signature on the third verification information and the target key transmission process information.
  • the confirmation information not only includes the third verification information, but also includes the client's signature on the third verification information and the target key transmission process information. Therefore, the confirmation information can not only be used to confirm that the client has received the target key , and can also be used as the evidence for the transmission of the target key between the client and the key management entity to prevent both parties from denying the fact of the transmission of the target key.
  • the signature authentication information of the client includes: a digital signature certificate of the client.
  • the key management entity can authenticate the client's signature on the first key exchange information according to the client's digital signature certificate, thereby ensuring that the key management entity receives The validity and validity of the first key exchange information.
  • the signature authentication information of the client includes: an initial authentication signature and a signature authentication public key of the client; before the client sends the request message to the key management entity, the The method further includes: the client sends an authentication request to the key management entity, wherein the authentication request includes: the signature authentication public key of the client and the identity of the client; the client receives the The initial authentication signature of the key management entity, wherein the initial authentication signature is obtained by signing the signature authentication public key of the client according to the signature authentication private key of the key management entity.
  • the client's signature authentication information includes the initial authentication signature and the client's signature authentication public key
  • the client before the client sends a request message to the key management entity, it also needs to send an authentication request to the key management entity to realize its own authentication Identity authentication, and obtain the initial authentication signature returned by the key management entity, thereby ensuring that the client can effectively obtain the target key in the future.
  • the authentication information of the key management entity includes: a digital signature certificate of the key management system.
  • the authentication information of the key management entity includes the digital signature certificate of the key management system, and the client can authenticate the signature of the key management entity on the first transmission process information according to the authentication information of the key management entity, so as to ensure that the client The terminal receives the first transmission process information sent by the key management entity, and it is correct.
  • the response message further includes: first verification information; wherein the first verification information is the key management entity according to the first verification key, the client's verification of the first verification A signature of key exchange information, the first key exchange information, and the second key exchange information; the first verification key is obtained by the key management entity according to the client's first key key exchange information, the second key exchange information of the key management entity, and the client's signature on the first key exchange information; the first transmission process information further includes: the first key exchange information verify message.
  • the response message received by the client from the key management entity also includes the first verification information, which can further ensure the security of the transmission of the target key.
  • the first transmission process information sent by the key management entity also includes the first verification information, which can further ensure that the client receives the first transmission process information sent by the key management entity to be correct.
  • the client uses the client's encryption and decryption key to decrypt the ciphertext, and before obtaining the target key, the method further includes: the client according to the first The second verification key determines that the first verification information is correct; wherein, the second verification key is the client's first key exchange information according to the client's first key exchange information and the second key of the key management entity. Exchange information and the client's signature on the first key exchange information.
  • the client uses the second verification key obtained by itself to verify that the first verification information in the response message is correct, thereby ensuring the legitimacy and validity of the target key obtained by the client.
  • the target key transmission process information further includes: the first verification information.
  • the target key transmission process information also includes the first verification information, which can further ensure the validity of the response message returned by the client.
  • an embodiment of the present invention provides a method for transmitting a key, which is described in this application as being executed by a key management entity.
  • the steps of the method include: a key management entity receives a request message sent by a client; wherein, the request message is used to request a target key, and the request message includes first key exchange information, the client's exchange of the signature of the first key exchange information and the signature authentication information of the client; the key management entity determines that the signature of the client on the first key exchange information is correct according to the signature authentication information of the client ;
  • the key management entity uses the encryption and decryption keys of the key management entity to encrypt the target key to obtain ciphertext; the key management entity sends a response message to the client, the response
  • the message includes the ciphertext, the second key exchange information of the key management entity, the signature of the key management entity on the first transmission process information, and the signature authentication information of the key management entity; wherein , the first transmission process information includes one or more of the following: the
  • the key management entity receives the request message sent by the client, and the request message includes the first key exchange information, the client's signature on the first key exchange information, and the client's signature authentication information. Then, the key management entity determines that the client's signature on the first key exchange information is correct according to the signature authentication information of the client. Further, the key management entity encrypts the target key using the encryption/decryption key of the key management entity to obtain the ciphertext, and the key management entity returns a response message including the ciphertext to the client.
  • the scheme can ensure the secure transmission of the key between the client and the key management entity, so that the client can obtain the target key accurately and effectively. Finally, the key management entity receives the confirmation message sent by the client to know that the client has received the target key.
  • the confirmation message includes: third verification information, and the client's signature on the third verification information and the target key transmission process information; the third verification information is Obtained by the client according to the confirmation key and the transmission process information of the target key; the confirmation key is the confirmation of the client according to the target key, the second transmission process information and the target key result obtained.
  • the second transmission process information includes one or more of the following: the client's signature on the first key exchange information, the key management entity's signature on the first transmission process information, the the first key exchange information, the second key exchange information;
  • the target key transmission process information includes one or more of the following: the client's signature on the first key exchange information, the The signature of the key management entity on the first transmission process information, the first key exchange information, the second key exchange information, and the ciphertext.
  • the confirmation information received by the key management entity includes the third verification information, and the client's signature on the third verification information and the target key transmission process information. Therefore, the validity of the confirmation information in this scheme is higher, and the confirmation information can not only be used to confirm that the client has received the target key, but also can prevent both parties from denying the fact of transmitting the target key.
  • the signature authentication information of the client includes: a digital signature certificate of the client.
  • the client's signature authentication information in the request message sent by the client includes the client's digital signature certificate, so that the key management entity can use the client's digital signature certificate to authenticate the signature of the first key exchange information, thereby ensuring that The key management entity uses the first key exchange information to be correct.
  • the signature authentication information of the client includes: an initial authentication signature and a signature authentication public key of the client; before the key management entity receives the request message sent by the client, the The method further includes: receiving, by the key management entity, an authentication request from the client, wherein the authentication request includes: a signature authentication public key of the client and an identity of the client; The authentication request is to perform identity authentication on the client; after the client identity authentication is passed, the key management entity uses the key management entity's signature authentication private key to authenticate the client's signature authentication public. The key is signed to obtain an initial authentication signature; the key management entity sends the initial authentication signature to the client.
  • the client's signature authentication information includes: the initial authentication signature and the client's signature authentication public key; the key management entity receives the client's authentication request before receiving the client's request message, so as to authenticate the client's After the identity authentication of the client is passed, use the signature authentication private key of the key management entity to sign the signature authentication public key of the client to obtain the initial authentication signature and send it to the client, so that the client can use the initial authentication signature.
  • the authentication signature authenticates its own identity, so that the target key can be effectively obtained.
  • the authentication information of the key management entity includes: a digital signature certificate of the key management entity.
  • the authentication information of the key management entity includes: when the digital signature certificate of the key management entity; after receiving the response message of the key management entity, the client can use the digital signature certificate of the key management entity to authenticate the key management entity.
  • the signature of the key management entity to the first transmission process information.
  • the solution can ensure the accuracy of the first transmission process information of the key management entity received by the client, and further ensure the transmission security of the target key.
  • the key management entity encrypts the target key by using the encryption/decryption key of the key management entity to obtain ciphertext
  • the method further includes: the key The management entity obtains the first verification key according to the first key exchange information of the client, the second key exchange information of the key management entity and the signature of the client on the first key exchange information;
  • the key management entity obtains, according to the first verification key, the client's signature on the first key exchange information, the first key exchange information, and the second key exchange information The first verification information.
  • the first verification information obtained by the key management entity can be made more effective and accurate.
  • the response message further includes: the first verification information; the first transmission process information further includes: the first verification information.
  • the response message sent by the key management entity also includes the first verification information
  • the first transmission process information also includes the first verification information, which can further ensure that the client can receive the response message accurately and effectively. to get the target key.
  • the present application provides a key transmission device, which can be applied to a client and has the function of implementing the first solution in the first aspect or any possible design of the first aspect, or The function of the second solution in the above third aspect or any possible design of the above third aspect is realized.
  • This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more units corresponding to the above-mentioned functions. For example, it includes a communication unit and a processing unit.
  • the present application provides a key transmission device, which can be applied to a key management entity and has the function of implementing the first solution in the second aspect or any possible design of the second aspect. , or has the function of implementing the second solution in the fourth aspect or any of the possible designs of the fourth aspect.
  • This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more units corresponding to the above-mentioned functions. For example, it includes a communication unit and a processing unit.
  • the embodiments of the present application further provide a computer storage medium, where a software program is stored in the storage medium, and the software program can implement the first aspect or any one of them when read and executed by one or more processors
  • the first solution provided by the first design, or the second aspect or the first solution provided by any of the designs can be realized, or the third aspect or the second solution provided by any of the designs can be realized, or the first solution can be realized.
  • the embodiments of the present application further provide a computer program product including instructions, which, when run on a computer, causes the first aspect or the first solution provided by any of the designs to be executed, or causes the above-mentioned first solution to be executed.
  • the first solution provided by the second aspect or any of the designs is executed, so that the second solution provided by the third aspect or any of the designs is executed, or the fourth aspect or the first solution provided by any of the designs is performed.
  • the second plan was implemented.
  • an embodiment of the present application provides a chip system, where the chip system includes a processor for supporting a client to implement the functions involved in the first aspect or the functions involved in the third aspect.
  • an embodiment of the present application provides a chip system, where the chip system includes a processor for supporting a key management entity to implement the functions involved in the second aspect above, or implement the functions involved in the fourth aspect above. Function.
  • the chip system further includes a memory for storing necessary program instructions and data of the communication device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • an embodiment of the present application further provides a key transmission system, where the key transmission system includes a client for executing the method provided in the first aspect or any of the designs, and a client for executing The key management entity of the method provided by the above second aspect or any one of the designs, and a transmission channel for implementing communication between the client and the key management entity.
  • an embodiment of the present application further provides a key transmission system, where the key transmission system includes a client for executing the method provided in the third aspect or any one of the designs, and a client for executing The key management entity of the method provided by the fourth aspect or any one of the designs, and a transmission channel for implementing communication between the client and the key management entity.
  • FIG. 1 is a schematic diagram of a suitable key transmission system provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a first key transmission method provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of an example of a first key transmission provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of an example of a second key transmission provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a method for transmitting a second key according to an embodiment of the present application
  • FIG. 6 is a schematic flowchart of an example of a third key transmission provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of an example of a fourth key transmission provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a key transmission apparatus provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a key transmission device according to an embodiment of the present application.
  • Embodiments of the present application provide a method and device for transmitting a key.
  • the method and device are based on the same inventive concept. Since the principles of the method and device for solving problems are similar, the implementation of the device and the method can be referred to each other, and the repetition will not be repeated. Repeat.
  • "and/or" describes the association relationship of the associated objects, indicating that there may be three kinds of relationships, for example, A and/or B may indicate that A exists alone, A and B exist simultaneously, and a single relationship exists. There are three cases of B.
  • the character "/" generally indicates that the associated objects are an "or” relationship. In this application, at least one refers to one or more; multiple refers to two or more.
  • the key transmission method provided in this embodiment of the present application can be used to transmit keys between a client and a key management system.
  • the client may be a software entity, a virtual function entity, or a hardware device, and the key management system may also be a software entity, virtual function entity, or hardware device, etc.
  • the client can be set on the TIER1 equipment of the first-level parts supplier of the automobile, and the corresponding key management system can be set on the OEM equipment of the automobile parts foundry.
  • Some important keys inside the car are stored in the key management system, the key management system can manage and maintain these keys, and the client can request the key management system to obtain the required target key, and put The obtained target key is filled into the interior parts of the car.
  • the client and the key management system can communicate through a mobile communication network, wireless fidelity (WiFi), or other connection methods, so as to realize the transmission of keys, data, and information in the development process of auto parts.
  • WiFi wireless fidelity
  • a client and a key management entity are taken as examples to describe the solution of the present application.
  • the client and the key management entity may be regarded as entities that are not at the same point in space, and this application does not specifically limit the client and the key management entity.
  • Fig. 1 shows the architecture of a possible key transmission system to which a key transmission method provided by an embodiment of the present application is applicable, and the key transmission system can be used in the development process of automobile parts.
  • the key transmission system includes a TIER1 device and an OEM device. During the entire development process of an automobile part, the OEM device stores some important keys inside the car.
  • the TIER1 device After determining the target key required by the in-vehicle component, the TIER1 device sends a request message to the OEM device, where the request message is used to request the target key in the OEM device.
  • the OEM device transmits the target key to the TIER1 device so that the TIER1 device can further fill the target key into the in-vehicle component. Since the important keys stored in the OEM device are the core assets of the car factory, the security of the transmission of these keys will directly affect the security of the components in the car. Therefore, the OEM device needs to transmit the These important target keys are transmitted to the TIER1 device.
  • the OEM device may not necessarily receive a response or receipt from the TIER1 device. Therefore, this solution cannot guarantee that the TIER1 device does not "securely received the target password”. key” is denied. At the same time, since some protocols do not have the "unique source of identification information", the OEM device may also deny the fact that "the target key has been sent".
  • an embodiment of the present application provides a key transmission method.
  • a client sends a request message to a key management entity, where the request message is used to request a target key of the key management entity, and the request message includes The encryption public key of the client or the first key exchange information of the client; the key management entity can use the encryption public key of the client to encrypt the target key to obtain the ciphertext, or the key management entity can use the encryption and decryption encryption of the key management entity
  • the target key is encrypted with the key to obtain the ciphertext.
  • the key management entity sends a response message including the ciphertext or the second key exchange information of the key management entity to the client; the client uses the client's encrypted private key to decrypt the ciphertext to obtain the target key, or the client uses the client's The encryption/decryption key decrypts the ciphertext to obtain the target key.
  • the method utilizes encryption key pair or key negotiation information to realize key transmission, so that the security of key transmission can be ensured.
  • the key transmission method provided in this embodiment of the present application may be, but is not limited to, applicable to the key transmission system shown in FIG. 1 , and the key transmission system may include a client, a key management entity, and a client and a key Manage transport channels between entities.
  • the client can store the client's signature authentication private key and the client's signature authentication public key
  • the key management entity stores some keys required inside the car and the digital signature certificate and key of the key management entity.
  • the digital signature certificate of the key management entity is used to authenticate the authentication signature obtained by signing the signature authentication private key of the key management entity.
  • an embodiment of the present application provides a method for transmitting a key, which can perform key transmission based on a one-time public-private key pair.
  • the flow of the solution includes:
  • the client sends a request message to the key management entity, where the request message is used to request the target key, and the key management entity device receives the request message sent by the client.
  • the request message includes the client's encryption public key, the client's signature on the encryption public key, and the client's signature authentication information.
  • the signature authentication information of the client includes: a digital signature certificate of the client.
  • the client's digital signature certificate can be used to authenticate the client's authentication signature private key.
  • the client uses the client's signature authentication private key to sign the information or content to be sent, and obtains the corresponding authentication signature.
  • the key management entity can use the digital signature certificate of the client to authenticate the corresponding authentication signature. If the authentication is passed, it can be determined that the authentication signature originates from the client.
  • the signature authentication information of the client includes: an initial authentication signature and a signature authentication public key of the client.
  • the method further includes: the client sends an authentication request to the key management entity, and the key management entity receives the authentication request sent by the client; wherein , the authentication request includes: the client's signature authentication public key and the client's identity; then the key management entity can perform identity authentication on the client according to the authentication request; further, after the client's identity authentication is passed, the key management entity uses the password The signature authentication private key of the key management entity signs the client's signature authentication public key to obtain the initial authentication signature; finally, the key management entity sends the initial authentication signature to the client, and the client receives the initial authentication signature of the key management entity.
  • the authentication information can be authenticated by other reliable methods, so as to ensure the security and legality of the communication between the two parties. For example, it is sent offline by a special person, or the two parties agree through a contract to ensure the legitimacy and validity of the client.
  • the specific reliable manner is not specifically limited in this application.
  • process of obtaining the initial authentication signature from the key management entity by the client can be performed online or offline (offline).
  • the encryption public key of the client can be obtained through, but not limited to, the following methods: the client generates a one-time encryption key pair in real time, or the client side pre-stores the one-time encryption key pair, and the client's encryption A key pair includes an encryption public key and an encryption private key.
  • the encryption key pair of the client since the encryption key pair of the client is one-time, it can avoid the leakage of the encryption key of the client due to repeated use, thereby ensuring the security of the target key transmitted between the two sides.
  • the client takes the TIER1 device as an example.
  • the signature authentication private key of the TIER1 device is represented as sk_TIER1
  • the encryption public key is represented as enc_pk
  • the signature of the TIER1 device to the encryption public key is represented as S1
  • nonce1 represents the random number generated by the TIER1 device, and "
  • S202 The key management entity determines that the client's signature on the encryption public key is correct according to the signature authentication information of the client.
  • S203 The key management entity encrypts the target key and the signature of the target key by using the encryption public key of the client to obtain a ciphertext.
  • the method further includes: the key management entity authenticates the public key according to the signature of the client, and determines that the initial authentication signature is correct.
  • step S203 when the key management entity performs step S203, it specifically includes the following:
  • the key management entity signs the target key using the signature authentication private key of the key management entity to obtain the signature of the key management entity on the target key; Sign the target key to obtain the ciphertext to be encrypted; secondly, the key management entity uses the client's encryption public key to encrypt the encrypted ciphertext to obtain the ciphertext; finally, the key management entity uses the signature authentication of the key management entity The private key signs the ciphertext to obtain the signature of the ciphertext.
  • the client takes a TIER1 device as an example
  • the key management entity takes an OEM device as an example.
  • the signature authentication private key of the OEM device is represented by sk_OEM
  • the target key is represented by PMEK
  • the signature of the target key is represented by S2
  • the ciphertext to be encrypted is represented by C'
  • the ciphertext is represented by C
  • the signature of the ciphertext is represented by S3.
  • Sign(.) represents the signature function
  • the signature S2 of the OEM device to the target key is obtained by the OEM device signing the target key PMEK using the OEM's signature authentication private key.
  • the ciphertext C' to be encrypted can be expressed as PMEK
  • nonce1 and nonce2 represent the random number generated by the TIER1 device and the random number generated by the OEM device, respectively.
  • the ciphertext C' to be encrypted is obtained by splicing the target key PMEK, the signature S2 of the target key, the random number nonce1 generated by the TIER1 device, and the random number nonce2 generated by the OEM device in series by the OEM device.
  • Enc(.) represents the encryption symbol
  • the ciphertext C is obtained by the OEM device using the encryption public key enc_pk of the TIER1 device to encrypt the ciphertext C' to be encrypted.
  • the signature S3 of the ciphertext is obtained by signing the ciphertext C by the OEM device using the signature authentication private key of the OEM device.
  • the key management entity uses the client's encryption public key for encryption, it can use an asymmetric encryption algorithm, such as Elliptic Curve Integrated Encryption Scheme (ECIES) (ec25519) or RSA (Rivest- Shamir-Adleman) (person's name) Optimal Asymmetric Encryption Padding (RSA-Optimal Asymmetric Encryption Padding, RSA-OAEP) and so on.
  • ECIES Elliptic Curve Integrated Encryption Scheme
  • RSA Rasteret- Shamir-Adleman
  • RSA-Optimal Asymmetric Encryption Padding RSA-Optimal Asymmetric Encryption Padding
  • the key management entity sends a response message to the client, and the client receives the response message sent by the key management entity, where the response message includes the ciphertext, the key management entity's signature on the ciphertext, and the key management entity's signature Certification Information.
  • S205 The client uses the signature authentication information of the key management entity to determine that the signature of the ciphertext is correct.
  • the authentication information of the key management entity includes: the digital signature certificate of the key management entity.
  • the digital signature certificate of the key management system can be used to authenticate the signature of the key management system to the ciphertext, thereby ensuring that the ciphertext in the response message received by the client is valid and accurate.
  • S206 The client decrypts the ciphertext by using the encrypted private key of the client to obtain the target key.
  • the client takes a TIER1 device as an example
  • the key management entity takes an OEM device as an example.
  • the encrypted private key of the TIER1 device is denoted as enc_sk
  • the target key is denoted as PMEK
  • the ciphertext is denoted as C.
  • the target key PMEK can satisfy the following formula:
  • PMEK Dec(enc_sk, C), while obtaining nonce2.
  • Dec(.) represents the decryption symbol
  • the target key PMEK is obtained by the client using the encrypted private key to decrypt the ciphertext C
  • nonce2 represents the random number generated by the OEM device.
  • the response message further includes: the signature of the target key by the key management entity.
  • the method further includes: the client determines that the signature of the key management entity on the target key is correct according to the signature authentication information of the key management entity.
  • the client can ensure the integrity of the acquired target key by confirming that the key management entity has correctly signed the target key.
  • S207 The client sends confirmation information to the key management entity, the key management entity receives the confirmation information, and the confirmation information is used to confirm that the client receives the target key.
  • the method before the client sends the confirmation message to the key management entity, the method further includes: the client generates a confirmation key according to the target key, the target key transmission process information and the confirmation result of the target key; The client obtains the authentication information according to the confirmation key.
  • the confirmation message specifically includes: verification information, and the client's signature on the verification information and the target key transmission process information.
  • the target key transmission process information includes one or more of the following: the client's signature on the encryption public key, the key management entity's signature on the target key, the key management entity's signature on the ciphertext, and the ciphertext's signature. , encryption public key.
  • the client takes the TIER1 device as an example, and the key management entity takes the OEM device as an example;
  • the signature authentication private key of the TIER1 device is represented as sk_TIER1
  • the target key is represented as PMEK
  • the encryption public key is represented as enc_pk
  • the confirmation key is represented as It is represented as K_ack
  • the verification information is represented as MAC
  • the client's signature on the verification information and the target key transmission process information is represented as ACK.
  • K_ack MAC
  • ACK ACK
  • K_ack HKDF(PMEK,S1
  • MAC HKDF(K_ack,nonce1
  • HKDF represents a key derivation algorithm based on Hash Message Authentication Code (HMAC) (HMAC based Key Derivation Function)
  • nonce1 and nonce2 represent the random number generated by the TIER1 device and the random number generated by the OEM device, respectively.
  • number. "ACK” is a character string or binary string used to identify the derived K_ack, which can be a character string with a specific encoding rule negotiated by the TIER1 device and the OEM device in advance. Of course, it can also be replaced by other character strings. This does not limit.
  • “Succeeded or Failed” is a character string used to identify the purpose of the ACK digital signature, which can be a character string that is pre-negotiated by the TIER1 device and the OEM device for specific encoding rules. Of course, it can also be replaced by other character strings. This embodiment of the present application This is not limited.
  • the method further includes: the key management entity obtains a first confirmation key according to a preset key algorithm and a target key, and uses the first confirmation key.
  • the verification information in the key authentication confirmation message is not limited to a preset key algorithm and a target key.
  • the key management entity uses the first confirmation key to authenticate the verification information in the confirmation information, including: the key management entity first obtains the first confirmation key according to the preset key algorithm and the target key, and then the key The management entity obtains the first verification information according to the first confirmation key, and further compares the first verification information with the verification information in the confirmation information, and if they are the same, it is determined that the authentication is passed.
  • the first confirmation key is represented as K_ack'
  • the first verification information is MAC'
  • the verification information in the confirmation information is represented as MAC.
  • the formulas of K_ack' and MAC' can satisfy the following:
  • K_ack’ HKDF(PMEK,S1
  • HKDF "
  • the key management entity compares the first verification information MAC' with the verification information MAC in the confirmation information, and if they are the same, it is determined that the target key transmission is successful.
  • the client sends a request message for requesting the target key to the key management entity, and the request message includes the client's encrypted public key, The client's signature on the encryption public key, and the client's signature authentication information. Since the encryption public key of the client is one-time, the leakage of the encryption public key can be avoided, thereby ensuring the security of key transmission between the client and the key management entity.
  • the key management entity determines that the client's signature on the encryption public key is correct according to the client's signature authentication information, and then uses the client's encryption public key to encrypt the target key to obtain the encryption key. arts. Further, the key management entity returns a response message to the client. After the client receives the response message, it first authenticates the signature of the ciphertext to ensure that the received ciphertext is valid and accurate, and then uses the encrypted private key to decrypt the ciphertext to obtain the target key, and executes the signature of the target key. Authentication to ensure the integrity of the obtained target key.
  • the client and the key management entity exchange information, they need to authenticate the received information before executing the task, so as to ensure the validity and accuracy of the received information.
  • the encryption key pair of the client can be used to realize the secure encryption and decryption of the target key, so as to ensure the validity and security of the process of obtaining the target key by the client.
  • the client obtains confirmation information after acquiring the target key, and the confirmation information includes verification information, and the client's signature on the verification information and the target key transmission process information.
  • the client sends the confirmation information to the key management entity, so that the key management entity can know that the client has obtained the target key according to the confirmation information.
  • the client can also use the confirmation information as evidence to prevent the key management entity from denying the fact that the target key has been sent.
  • this scheme can not only ensure the security of the target key transmission, but also prevent the two parties of the key transmission from denying the fact of the key transmission.
  • the scheme mainly uses the one-time encryption public key to encrypt the target key to realize the transmission of the key.
  • the present application also provides the following two specific embodiments to illustrate the technical solution of the present application in detail.
  • the client takes the TIER1 device as an example
  • the key management entity takes the OEM device as an example.
  • the TIER1 device does not store the digital signature certificate of the TIER1 device, but stores the signature authentication private key of the TIER1 device and the signature authentication public key of the TIER1 device.
  • the OEM device stores the digital signature certificate of the OEM device, the signature authentication private key of the OEM device, and the target key.
  • the specific process includes the following steps:
  • the OEM device Since the TIER1 device does not have a digital signature certificate, the OEM device needs to authenticate the TIER1 device before performing key transmission with the TIER1 device. Therefore, it is necessary to perform the following initial stage (refer to steps S301-S304 for details) before the OEM device and the TIER1 device perform key transmission.
  • the TIER1 device obtains the initial authentication signature S, and then the OEM device verifies that the initial authentication signature S of the TIER1 device is valid and legal, the target key can be further transmitted, so as to ensure the security of the key transmitted before the OEM device and the TIER1 device.
  • the TIER1 device sends authentication information to the OEM device, where the authentication information includes the identity identifier TIER1_ID of the TIER1 device and the signature authentication public key pk_TIER1 of the TIER1 device.
  • S302 The OEM device authenticates the identity of the TIER1 device and the signature authentication public key of the TIER1 device.
  • the OEM device sends the initial authentication signature S to the TIER1 device, and the TIER1 device receives the initial authentication signature S sent by the OEM device.
  • steps S301-S304 are the initial stage of key transmission, and this stage can be performed online or offline.
  • the TIER1 device generates an encrypted public-private key pair (enc_pk, enc_sk) once, and the encrypted public-private key pair includes an encrypted public key enc_pk and an encrypted private key enc_sk.
  • the TIER1 device sends a request message to the OEM device, and the OEM device receives the request sent by the TIER1 device.
  • the request message includes the encryption public key enc_pk of the TIER1 device, the initial authentication signature S, the first authentication signature S1, the signature authentication public key pk_TIER1 of the TIER1 device, and the one-time random number nonce1.
  • the first authentication signature S1 is obtained by signing the encryption public key enc_pk by the TIER1 device.
  • the OEM device authenticates the initial authentication signature S and the first authentication S1 in the request message.
  • the OEM device uses the signature authentication private key sk_OEM of the OEM device to authenticate the initial authentication signature S. After the OEM device verifies that the initial authentication signature S is valid, the OEM device then uses the signature authentication public key pk_TIER1 of the TIER1 device to authenticate the first authentication signature S1. After the OEM device verifies that the first authentication signature S1 is valid, the following step S308 is performed.
  • the OEM device uses the encryption public key enc_pk of the TIER1 device to encrypt the target key to obtain the ciphertext.
  • step 308 When step 308 is executed, the following steps are specifically included:
  • the first step the OEM device signs the target key PMEK using the signature authentication private key sk_OEM of the OEM device to obtain the first digital signature S2.
  • Step 2 The OEM device obtains the ciphertext C' to be encrypted according to the target key PMEK and the first digital signature S2.
  • the ciphertext C' to be encrypted can be expressed as: PMEK
  • nonce1 represents the random number generated by the TIER1 device
  • nonce2 represents the random number generated by the OEM
  • the third step the OEM device uses the encryption public key enc_pk of the TIER1 device to encrypt the encrypted ciphertext C' to obtain the ciphertext C;
  • asymmetric encryption algorithm ECIES ec25519
  • RSA-OEAP asymmetric encryption algorithm
  • Step 4 The OEM device signs the ciphertext C using the signature authentication private key sk_OEM of the OEM device to obtain a second digital signature S3.
  • S309 The OEM device sends a response message to the TIER1 device, and the TIER1 device receives the response message sent by the OEM device.
  • the response message includes the ciphertext C, the first digital signature S2, the second digital signature S3, and the OEM's digital signature certificate.
  • the TIER1 device authenticates the second digital signature S3 using the digital signature certificate of the OEM device in the response message.
  • step S311 After the TIER1 device authenticates the second digital signature S3 and passes, the following step S311 is performed.
  • the TIER1 device decrypts the ciphertext C by using the encrypted private key enc_sk of the TIER1 device to obtain the target key PMEK.
  • step S311 When step S311 is executed, the following steps are specifically included:
  • the first step after the TIER1 device authenticates the second digital signature S3 and passes, decrypts the ciphertext C by using the encrypted private key enc_sk to obtain the decrypted ciphertext.
  • Step 2 The TIER1 device authenticates the first digital signature S2 using the digital signature certificate of the OEM device in the response message.
  • the third step when the TIER1 device passes the authentication of the first digital signature S2, it obtains the target key PMEK from the decrypted ciphertext.
  • the TIER1 device obtains the confirmation key K_ack according to the preset key algorithm and the target key;
  • K_ack HKDF(PMEK, S1
  • the TIER1 device generates the verification information MAC according to the confirmation key K_ack; further, the TIER1 device obtains the verification signature ACK according to the signature authentication private key sk_TIER1 of the TIER1 device and the verification information MAC.
  • the TIER1 device sends confirmation information to the OEM device, where the confirmation information includes the verification information MAC and the verification signature ACK.
  • the OEM device receives the confirmation message sent by the TIER1 device.
  • the verification signature ACK included in the confirmation information sent by the TIER1 device received by the OEM device is obtained by the TIER1 device after obtaining the target key, it is obtained according to the signature authentication private key and verification information of the TIER1 device, so the ACK can be used as a non-repudiation proof Information to prove that the OEM device sent the target key and the TIER1 device obtained the target key provided by the OEM device.
  • the OEM device After the OEM device receives the confirmation information sent by the TIER1 device, the OEM device obtains the first confirmation key K_ack' according to the preset key algorithm and the target key PMEK, and uses the first confirmation key K_ack' in the authentication response information The authentication information MAC.
  • the OEM device obtains the first verification information MAC' according to the first confirmation key K_ack', and the formulas of K_ack' and MAC' can satisfy the following:
  • K_ack’ HKDF(PMEK,S1
  • MAC' HKDF(K_ack', nonce1
  • the OEM device compares the first verification information MAC' with the verification information MAC in the authentication response information, and if they are the same, the authentication is passed, that is, it is determined that the target key is successfully transmitted.
  • the digital signature certificate of TIER1 and the signature authentication private key sk_TIER1 of the TIER1 device are stored in the TIER1 device.
  • the OEM device stores the digital signature certificate of the OEM device, the signature authentication private key sk_OEM of the OEM device, and the target key PMEK.
  • the specific process for the TIER1 device to request the OEM device to obtain the target key includes the following steps:
  • the TIER1 device generates an encrypted public-private key pair (including the encryption public key enc_pk and the encryption private key enc_sk), and the TIER1 device uses the signature authentication private key sk_TIER1 of the TIER1 device to sign the encryption public key enc_sk of the TIER1 device to obtain a first authentication signature S1.
  • the TIER1 device sends a request message to the OEM device, and the OEM device receives the request message sent by the TIER1 device.
  • the request message includes the encryption public key enc_pk, the first authentication signature S1, the digital signature certificate of the TIER1 device, and the one-time random number nonce1.
  • nonce1 represents a random number generated by the TIER1 device.
  • S403 The OEM device authenticates the first authentication signature S1 in the request message.
  • the OEM device uses the digital signature certificate of the TIER1 device included in the request message to authenticate the first authentication signature S1 included in the request message.
  • step S404 is performed.
  • the OEM device uses the encryption public key enc_pk included in the request message to encrypt the target key to obtain the ciphertext.
  • step 404 When step 404 is executed, specific reference may be made to the foregoing step S308, which will not be described in detail here.
  • S405 The OEM device sends a response message to the TIER1 device, and the TIER1 device receives the response message sent by the OEM device.
  • the response message includes the ciphertext C, the first digital signature S2, the second digital signature S3, and the digital signature certificate of the OEM device.
  • the TIER1 device uses the digital signature certificate of the OEM device in the response message to authenticate the second digital signature S3.
  • step S407 After the TIER1 device authenticates the second digital signature S3 and passes, the following step S407 is performed.
  • the TIER1 device decrypts the ciphertext C by using the encrypted private key enc_sk to obtain the target key PMEK.
  • step S407 When step S407 is executed, reference may be made to the above-mentioned step S311 for details, and details are not repeated here.
  • the TIER1 device obtains the confirmation key K_ack according to the preset key algorithm and the target key;
  • step S408 When step S408 is executed, specific reference may be made to the foregoing step S312, which will not be described in detail here.
  • the TIER1 device generates confirmation information MAC according to the confirmation key K_ack; further, the TIER1 device obtains the verification signature ACK according to the signature private key sk_TIER1 of the TIER1 device and the verification information MAC.
  • step S508 When step S508 is performed, specific reference may be made to the foregoing step S313, which will not be described in detail here.
  • the TIER1 device sends confirmation information to the OEM device, where the confirmation information includes the verification information MAC and the verification signature ACK.
  • the OEM device receives the confirmation message sent by the TIER1 device.
  • step S410 When step S410 is executed, specific reference may be made to the above-mentioned step S314, and details are not repeated here.
  • the OEM device After the OEM device receives the confirmation information sent by the TIER1 device, the OEM device obtains the first confirmation key K_ack' according to the preset key algorithm and the target key PMEK, and uses the first confirmation key K_ack' in the authentication confirmation information The authentication information MAC.
  • step S411 When step S411 is executed, specific reference may be made to the foregoing step S315, which will not be described in detail here.
  • an embodiment of the present application provides another key transmission method, and the process of the method includes:
  • the client sends a request message to the key management entity, and the key management entity receives the request message sent by the client, where the request message is used to request a target key, and the request message includes the first key exchange information, the client pair The signature of the first key exchange information, and the signature authentication information of the client.
  • the client can generate the one-time first key information in real time, or has pre-stored the one-time first key information. How the client obtains the first key information in practice is not required in this application. limited.
  • the first key information and the second key exchange information of the client can generate a one-time elliptic curve cryptosystem-based DH key exchange algorithm (elliptic curves-Diffie-Hellman, EC-DH) secret for the client x and key exchange material X.
  • elliptic curves-Diffie-Hellman, EC-DH elliptic curves-Diffie-Hellman, EC-DH
  • X x*G, where G is the base point of the EC curve used.
  • both the first key information and the first key exchange information on the client side are one-time, which can prevent the first key exchange information of the client from being easily leaked due to repeated use, thereby ensuring that both sides The security of the target key transferred between them.
  • the signature authentication information of the client includes: a digital signature certificate of the client.
  • the client's digital signature certificate may be used to authenticate the client's signature on the first key exchange information.
  • the signature authentication information of the client includes: the initial authentication signature and the signature authentication public key of the client.
  • the method further includes: the client sends an authentication request to the key management entity, and the key management entity receives the authentication request sent by the client; wherein , the authentication request includes: the client's signature authentication public key and the client's identity; then the key management entity performs identity authentication on the client according to the authentication request; further, after the client's identity authentication is passed, the key management entity uses the key The signature authentication private key of the management entity signs the client's signature authentication public key to obtain the initial authentication signature; finally, the key management entity sends the initial authentication signature to the client, and the client receives the initial authentication signature of the key management entity.
  • the key management entity may authenticate the authentication information through other reliable methods, so as to ensure the security and legality of the communication between the two parties. For example, it is sent offline by a special person, or the two parties agree through a contract to ensure the legitimacy and validity of the client.
  • the specific reliable manner is not specifically limited in this application.
  • process of obtaining the initial authentication signature from the key management entity by the client can be performed online or offline (offline).
  • the function of the client's signature authentication public key is: after receiving the request message, the key management entity can use the client's signature public key to authenticate the initial authentication signature.
  • S502 The key management entity determines that the client's signature on the first key exchange information is correct according to the signature authentication information of the client.
  • the signature authentication information of the client includes: the initial authentication signature and the signature authentication public key of the client, and when step S502 is performed, it further includes: the key management entity authenticates the initial authentication using the signature authentication public key of the client The signature is correct.
  • the key management entity encrypts the target key using the encryption/decryption key of the key management entity to obtain a ciphertext.
  • the encryption and decryption keys of the key management entity are the encryption and decryption keys of the key management entity based on the first key exchange information of the client, the second key exchange information of the key management entity, and the client's encryption of the first key exchange information. signed.
  • the key management entity encrypts the target key by using the encryption/decryption key of the key management entity, and when obtaining the ciphertext, the method further includes:
  • the key management entity may obtain the first verification key according to the first key exchange information of the client, the second key exchange information of the key management entity, and the signature of the client on the first key exchange information; The key management entity obtains the first verification information according to the first verification key, the client's signature on the first key exchange information, the first key exchange information, and the second key exchange information.
  • the client takes a TIER1 device as an example
  • the key management entity takes an OEM device as an example.
  • the encryption and decryption keys of the key management entity are represented by K_enc and k_dec
  • the first verification key is represented by K_mac
  • the first verification information is represented by MAC1
  • the target key is represented by PMEK
  • the ciphertext is represented by C.
  • the first key exchange information of the client is represented by X
  • the second key information of the key management entity is represented by y
  • the second key exchange information of the key management entity is represented by Y.
  • K_enc represents the encryption key of the key management entity
  • k_dec represents the decryption key of the key management entity
  • ENC is a character string used to identify the derived K_enc, which can be a character string that is pre-negotiated by the TIER1 device and the OEM device for a specific encoding rule, and of course can also be replaced by other character strings.
  • MAC is a character string used to identify the derived K_mac, which can be a character string with a specific encoding rule negotiated in advance by the TIER1 device and the OEM device. Of course, it can also be replaced by other character strings, which is not performed in this embodiment of the present application. limit.
  • 96” means to take the first 96 bits.
  • the key management entity sends a response message to the client, and the client receives the response message.
  • the response message includes the ciphertext, the second key exchange information of the key management entity, and the key management entity's response to the first transmission process information. signature, and the signature authentication information of the key management entity.
  • the first transmission process information includes one or more of the following: ciphertext, first key exchange information, and second key exchange information.
  • the signature of the first transmission process information by the key management entity is represented as S2.
  • response information further includes: first verification information.
  • the first transmission process information further includes: first verification information.
  • S505 The client determines that the signature of the key management entity to the first transmission process information is correct according to the signature authentication information of the key management entity.
  • the client uses the encryption/decryption key of the client to decrypt the ciphertext to obtain the target key.
  • the encryption and decryption keys of the client are obtained by the client according to the first key exchange information of the client, the second key exchange information of the key management entity, and the signature of the client on the first key exchange information.
  • the method further includes: the client determines that the first verification information is correct according to the second verification key; wherein, The second verification key is obtained by the client according to the first key exchange information of the client, the second key exchange information of the key management entity, and the signature of the client on the first key exchange information.
  • the client takes a TIER1 device as an example
  • the key management entity takes an OEM device as an example.
  • the encryption and decryption keys of the key management entity are expressed as (K_enc, K_dec), the second verification key is expressed as K_mac', the second authentication information is expressed as MAC2, the target key is expressed as PMEK, the ciphertext is expressed as C, and the client's
  • the first key information is denoted as x
  • the first key exchange information of the client is denoted as X
  • the second key information of the key management entity is denoted as y
  • the second key exchange information of the key management entity is denoted as Y.
  • X x*G, where G is the base point of the EC curve used.
  • K_enc is the encryption key used by the key management entity for encryption
  • K_dec is the decryption key used by the key management entity for decryption
  • the key management entity determines that the first verification information is correct according to the second verification key, which specifically includes: the key management entity obtains the second verification information MAC2 according to the second verification key, and compares the first verification information MAC1 with the second verification information. The verification information MAC2 is compared, and if they are the same, it is determined that the first verification information is correct.
  • S507 The client sends a confirmation message to the key management entity, the key management entity receives the confirmation message, and the confirmation message is used to confirm that the client receives the target key.
  • the method before the client sends the confirmation message to the key management entity, the method further includes: the client generates a confirmation key according to the target key, the second transmission process information and the confirmation result of the target key; the client generates a confirmation key according to the confirmation
  • the third verification information is obtained from the key and target key transmission process information.
  • the second transmission process information includes one or more of the following: the client's signature on the first key exchange information, the key management entity's signature on the first transmission process information, the first key exchange information, the second key exchange information key exchange information;
  • the target key transmission process information includes one or more of the following: the client's signature on the first key exchange information, the key management entity's signature on the first transmission process information, the first key exchange information, the second key exchange information Key exchange information, ciphertext.
  • the confirmation message includes: the third verification information, and the client's signature on the third verification information and the target key transmission process information.
  • the client takes the TIER1 device as an example, the signature authentication private key of the TIER1 device is sk_TIER1, the target key is PMEK, the confirmation key is K_ack, and the third verification information is MAC3.
  • the signature of the verification information and the target key transfer process information is represented as ACK.
  • the target key transmission process information includes: S1, S2, X, Y, C
  • the target key transmission process information includes: the client's signature S1 for the first key exchange information, the key management entity's signature S2 for the first transmission process information, the first key exchange information X, and the second key exchange information Y, ciphertext C.
  • the target key transmission process information also includes: the first verification information MAC1
  • the method further includes: the key management entity can obtain the first confirmation key according to the preset key algorithm and the target key, and use the confirmation key to authenticate Confirmation information in the response message.
  • the key management entity when the key management entity uses the first confirmation key to authenticate the first confirmation information in the response information, it specifically includes: the key management entity first obtains the first confirmation according to the preset key algorithm and the target key key, and then, according to the first confirmation key, the key management entity further uses the first confirmation key to authenticate the third verification information in the confirmation information.
  • the client's signature ACK to the third verification information and the target key transmission process information can also be authenticated by using the digital signature certificate of the client stored in advance.
  • the client sends a request message for requesting the target key to the key management entity, and the request message includes the key exchange information of the one-time client, the client The signature of the terminal to the first key exchange information, and the signature authentication information of the client. Since the client's key exchange information is one-time, the repeated use of the client's key exchange information is easily leaked, thereby ensuring the security of key transmission between the client and the key management entity.
  • the key management entity first verifies that the client's signature on the first key exchange information in the request message is correct, and then uses the encryption key of the key management entity to encrypt the target key
  • the ciphertext is obtained, and the first verification information of the key management entity is obtained.
  • the key management entity returns a response message including the ciphertext to the client.
  • the client receives the response message, it is determined that the signature of the key management entity on the first transmission process information is correct; and it is necessary to verify that the first verification message is correct, and then, the client uses the client's encryption and decryption key to perform the ciphertext in the response message. Decrypt to get the target key. It can be seen that, in this way, the security and effectiveness of encryption and decryption performed by both the key management entity and the client can be guaranteed.
  • the client obtains confirmation information after obtaining the target key.
  • the confirmation information can be used not only to determine that the client has obtained the target key, but also as evidence to prevent the client from denying the fact that "the target key has been obtained” or Prevents the key management entity from denying the fact that the "target key has been sent”.
  • this scheme can not only ensure the security of the target key transmission, but also prevent the two parties of the key transmission from denying the fact of the key transmission.
  • this scheme mainly uses the key agreement protocol to realize the transmission of the key.
  • the present application also provides the following two specific examples (ie, the following third embodiment and fourth embodiment) to describe the technical solution of the present application in detail.
  • the client takes the TIER1 device as an example
  • the key management entity takes the OEM device as an example.
  • the TIER1 device does not store the digital signature certificate of the TIER1 device, but stores the signature authentication private key of the TIER1 device and the signature authentication public key of the TIER1 device.
  • the OEM device stores the OEM's digital signature certificate, the OEM's signature authentication private key, and the target key PMEK.
  • the specific process for the TIER1 device to request the OEM device to obtain the target key includes the following steps:
  • the OEM device Since the TIER1 device does not have a digital signature certificate, the OEM device needs to perform the relevant authentication on the TIER1 device before performing key transmission with the TIER1 device. Therefore, it is necessary to perform the following initial stage (refer to steps S601-S604 for details) before the OEM device and the TIER1 device perform key transmission.
  • the TIER1 device obtains the initial authentication signature S, and then the OEM device verifies that the initial authentication signature S of the TIER1 device is valid and legal, the target key can be further transmitted. So as to ensure the security of the transmission key between the OEM device and the TIER1 device.
  • the TIER1 device sends the identity identifier TIER1_ID of the TIER1 device and the signature authentication public key pk_TIER1 of the TIER1 device to the OEM device.
  • S602 The OEM device authenticates the identity of the TIER1 device and the signature authentication public key of the TIER1 device.
  • the OEM device sends the initial authentication signature S to the TIER1 device, and the TIER1 device receives the initial authentication signature S sent by the OEM device.
  • the TIER1 device generates one-time first key information, and obtains first key exchange information X according to the first key information x.
  • the first key information may be a one-time DH key exchange algorithm based on elliptic curve cryptosystem EC-DH secret x
  • the TIER1 device sends a request message to the OEM device, and the OEM device receives the request message sent by the TIER1 device.
  • the request message includes: the first key exchange information X of the TIER1 device, the first authentication signature S1, the initial authentication signature S, and the signature authentication public key pk_TIER1 of the TIER1 device; wherein, the first authentication signature S1 is that the TIER1 device uses the TIER1 device
  • the signature authentication private key sk_TIER1 is obtained by signing the first key exchange information X.
  • the first key information x of the TIER1 device and the first key exchange information X of the TIER1 device can be derived from each other.
  • the second key information y of y and the second key exchange information Y of the OEM device can be derived from each other.
  • the OEM device authenticates the initial authentication signature S and the first authentication signature S1 in the request message.
  • the OEM device uses the signature authentication private key sk_OEM of the OEM device to authenticate the initial authentication signature S in the request message. Then, after the OEM device verifies that the initial authentication signature S is valid, it uses the signature authentication public key pk_TIER1 of the TIER1 device in the request message to authenticate the first authentication signature S1 in the request message. After the OEM device verifies that the first authentication signature S1 is valid, The following step S608 is performed.
  • the OEM device obtains the encryption key of the OEM device according to the first authentication signature S1, the first key exchange information X of the TIER1 device, the second key information y of the OEM device, and the second key exchange information Y of the OEM device , use the encryption key of the OEM device to encrypt the target key to obtain the ciphertext C.
  • the OEM device performs step 608, which specifically includes the following steps:
  • Step 1 According to the first authentication signature S1, the first key exchange information X of the TIER1 device, the second key information y of the OEM device, and the second key exchange information Y of the OEM device, the OEM device obtains the information of the OEM device respectively. Encryption key K_enc and work key K_mac for OEM devices.
  • K_enc HKDF(y*X, S1
  • K_mac HKDF(y*X, S1
  • the second step the OEM device encrypts the target key PMEK using the encryption key k_enc of the OEM device to obtain the ciphertext C, and obtains the work key label MAC1 of the OEM device according to the work key k_mac of the OEM device.
  • Step 3 The OEM device signs the ciphertext C and the work key label MAC1 of the OEM device by using the signature authentication private key sk_OEM of the OEM device to obtain a first digital signature S2.
  • S609 The OEM device sends a response message to the TIER1 device, and the TIER1 device receives the response message sent by the OEM device.
  • the response message includes the ciphertext C, the second key exchange information Y of the OEM device, the digital signature certificate of the OEM, the first digital signature S2, and the work key label MAC1 of the OEM device.
  • the TIER1 device uses the digital signature certificate of the OEM device included in the response message to authenticate the first digital signature S2 included in the response message.
  • step S611 is performed only after the TIER1 device verifies that the first digital signature S2 is valid.
  • the TIER1 device obtains the decryption key of the TIER1 device according to the first authentication signature S1, the first key information x of the TIER1 device, the first key exchange information X of the TIER1 device, and the second key exchange information Y of the OEM device , and use the decryption key of the TIER1 device to decrypt the ciphertext C to obtain the target key PMEK.
  • step 611 When the TIER1 device performs step 611, it specifically includes the following steps:
  • Step 1 The TIER1 device uses the digital signature certificate of the OEM device included in the response message to authenticate the first digital signature S2 included in the response message.
  • Step 1 After the TIER1 device verifies that the first digital signature S2 is valid, according to the first authentication S1, the first key information x of the TIER1 device, the first key exchange information X of the TIER1 device, and the second key exchange of the OEM device From the information Y, the decryption key K_dec of the TIER1 device and the work key K_mac' of the TIER1 device are obtained respectively.
  • Step 2 The TIER1 device obtains the work key label MAC2 of the TIER1 device according to the work key K_mac' of the TIER1 device, and compares the work key label MAC2 of the TIER1 device with the work key label MAC1 of the OEM device in the response message .
  • Step 3 When the TIER1 device determines that the work key label MAC2 of the OEM device is the same as the work key label MAC1 of the OEM device, the TIER1 device uses the decryption key K_dec of the TIER1 device to decrypt the ciphertext C in the response message, and obtain Target key PMEK.
  • the TIER1 device obtains the confirmation key K_ack according to the preset key algorithm and the target key PMEK;
  • K_ack HKDF(PMEK, S1
  • the TIER1 device generates the confirmation message MAC3 according to the confirmation key K_ack; further, the TIER1 device authenticates the private key and the confirmation message MAC3 according to the signature of the TIER1 device, and obtains the confirmation signature ACK.
  • the TIER1 device sends confirmation information to the OEM device, and the confirmation information includes the verification information MAC3 and the verification signature ACK.
  • the OEM device receives the confirmation message sent by the TIER1 device.
  • the OEM device obtains the first confirmation key K_ack' according to the preset key algorithm and the target key, and uses the first confirmation key K_ack' to authenticate the verification information MAC3 in the confirmation information.
  • the first confirmation key is represented as K_ack'
  • the verification information in the confirmation message is represented as MAC3
  • the first verification information MAC' The formulas of K_ack' and MAC' can satisfy the following:
  • K_ack’ HKDF(PMEK,S1
  • MAC' HKDF(K_ack', nonce1
  • the OEM device compares the first confirmation key MAC' with the verification information MAC3 in the confirmation message, and if they are the same, it is determined that the TIER1 device has successfully acquired the target key for transmission.
  • the client takes the TIER1 device as an example
  • the key management entity takes the OEM device as an example.
  • the TIER1 device stores the digital signature certificate of the TIER1 device and the signature authentication private key sk_TIER1 of the TIER1 device.
  • the OEM device stores the digital signature certificate of the OEM device, the signature authentication private key sk_OEM of the OEM device, and the target key PMEK.
  • the specific process includes the following steps:
  • the TIER1 device generates one-time first key information, and obtains the first key exchange information X of the TIER1 device according to the first key information x.
  • step S601 may refer to the above-mentioned step S605 for details, and details are not described herein again.
  • the TIER1 device sends a request message to the OEM device, and the OEM device receives the request message sent by the TIER1 device.
  • the request message includes the first key exchange information X of the TIER1 device, the first authentication signature S1, the signature authentication public key pk_TIER1 of the TIER1 device, and the digital signature certificate of the TIER1 device.
  • the first authentication signature S1 is obtained by signing the first key exchange information X by the TIER1 device using the signature authentication private key sk_TIER1 of the TIER1 device.
  • S703 The OEM device authenticates the first authentication signature S1 in the request message.
  • the OEM device uses the digital signature certificate of the OEM device in the request message to authenticate the first authentication signature S1 in the request message. After the OEM device verifies that the first authentication signature S1 is valid, the following step S704 is performed.
  • the OEM device obtains the encryption key of the OEM device according to the first authentication signature S1, the first key exchange information X of the TIER1 device, the second key information y of the OEM device, and the second key exchange information Y of the OEM device , using the encryption key of the OEM device to encrypt the target key PMEK to obtain the ciphertext C.
  • step S704 When the OEM device performs step S704, specific reference may be made to the foregoing step S608, and details are not described herein again.
  • the first key information x of the TIER1 device and the first key exchange information X of the TIER1 device can be derived from each other.
  • the second key information x and the second key exchange information X of the OEM device can be derived from each other.
  • S705 The OEM device sends a response message to the TIER1 device, and the TIER1 device receives the response message sent by the OEM device.
  • the response message includes the ciphertext C, the second key exchange information Y of the OEM device, the digital signature certificate of the OEM, the first digital signature S2, and the work key label MAC1 of the OEM device.
  • the foregoing step S609 which will not be described in detail here.
  • the TIER1 device uses the digital signature certificate of the OEM device included in the response message to authenticate the first digital signature S2 included in the response message.
  • step S707 is performed.
  • the TIER1 device obtains the decryption of the TIER1 device according to the first authentication signature S1, the first key information x of the TIER1 device, the first key exchange information X of the TIER1 device, and the second key exchange information Y of the OEM device Use the decryption key of the TIER1 device to decrypt the ciphertext C to obtain the target key PMEK.
  • step S707 When the TIER1 device executes step S707, specific reference may be made to the above-mentioned step S611, and details are not described herein again.
  • the TIER1 device obtains the confirmation key K_ack according to the preset key algorithm and the target key PMEK;
  • step S708 When the TIER1 device executes step S708, specific reference may be made to the foregoing step S612, which will not be described in detail here.
  • the TIER1 device generates the verification information MAC3 according to the confirmation key K_ack; further, the TIER1 device obtains the verification signature ACK according to the signature authentication private key and the verification information MAC3 of the TIER1 device.
  • step S709 When the TIER1 device executes step S709, specific reference may be made to the above-mentioned step S613, and details are not repeated here.
  • the TIER1 device sends confirmation information to the OEM device, where the confirmation information includes the verification information MAC3 and the verification signature ACK.
  • the OEM device receives the confirmation message sent by TIER1.
  • step S710 When the TIER1 device executes step S710, specific reference may be made to the above-mentioned step S614, and details are not repeated here.
  • the OEM device obtains the first confirmation key K_ack' according to the preset key algorithm and the target key, and uses the confirmation key K_ack' to authenticate the verification information MAC3 in the confirmation information.
  • step S711 When the TIER1 device executes step S711, specific reference may be made to the foregoing step S615, which will not be described in detail here.
  • the embodiments of the present application provide a first key transmission device (corresponding to the first solution of the embodiments of the present application), which has the behavior function of the client in the above method embodiments.
  • the key transmission device may include modules or units corresponding to the methods/operations/steps/actions described in the above method embodiments.
  • the modules or units may be hardware circuits, software, or hardware.
  • the circuit is implemented in combination with software.
  • the device may have a structure as shown in FIG. 8 .
  • the apparatus 800 may include a communication unit 801 and a processing unit 802 , each of which will be described in detail below.
  • the communication unit 801 is configured to send a request message to a key management entity, wherein the request message is used to request a target key, and the request message includes the encryption public key of the client, the encryption The signature of the public key, and the signature authentication information of the client;
  • the communication unit 801 is further configured to receive a response message from the key management entity, where the response message includes a ciphertext, a signature of the key management entity on the ciphertext, and the key management entity The signature authentication information; wherein, the ciphertext is obtained by encrypting the target key according to the encryption public key of the client;
  • the processing unit 802 is configured to use the signature authentication information of the key management entity to determine that the signature of the ciphertext is correct; the processing unit 802 is further configured to decrypt the ciphertext by using the encrypted private key of the client, obtain the target key;
  • the communication unit 801 is further configured to send a confirmation message to the key management entity, where the confirmation message is used to confirm that the client receives the target key.
  • the processing unit 802 is further configured to: before the communication unit 801 sends the confirmation message to the key management entity, transmit process information according to the target key and the target key And the confirmation result of the target key generates a confirmation key; and obtains verification information according to the confirmation key.
  • the confirmation message includes: the verification information, and the client's signature on the verification information and the target key transmission process information.
  • the target key transmission process information includes one or more of the following: the client's signature on the encryption public key, the key management entity's signature on the target key , the key management entity's signature on the ciphertext, the ciphertext, and the encryption public key.
  • the signature authentication information of the client includes: a digital signature certificate of the client.
  • the signature authentication information of the client includes: an initial authentication signature and a signature authentication public key of the client; the communication unit 801 is further configured to: send the request to the key management entity before the message,
  • the authentication request includes: the signature authentication public key of the client and the identity of the client; receiving the initial authentication signature of the key management entity, wherein the The initial authentication signature is obtained by signing the signature authentication public key of the client according to the signature authentication private key of the key management entity.
  • the authentication information of the key management entity includes: a digital signature certificate of the key management system.
  • the response message further includes the signature of the key management entity on the target key
  • the method includes: the client determines, according to the signature authentication information of the key management entity, The key management entity's signature on the target key is correct.
  • the target key transmission process information further includes a signature of the target key by the key management entity.
  • the embodiments of the present application also provide a first key transmission device (corresponding to the first solution of the embodiments of the present application), which has the behavior function of the key management entity in the above method embodiments.
  • the key transmission device may include modules or units corresponding to the methods/operations/steps/actions described in the above method embodiments.
  • the modules or units may be hardware circuits, software, or hardware.
  • the circuit is implemented in combination with software.
  • FIG. 8 For the structure diagram of the device, reference may also be made to the structure shown in FIG. 8 above.
  • the apparatus 800 may include a communication unit 801 and a processing unit 802 , each of which will be described in detail below.
  • the communication unit 801 is configured to receive a request message sent by a client, wherein the request message is used to request a target key, and the request message includes the encryption public key of the client, and the encryption public key of the client to the encryption key.
  • a processing unit 802 configured to determine that the client's signature on the encryption public key is correct according to the signature authentication information of the client;
  • the processing unit 802 is further configured to encrypt the target key and the signature of the target key by using the encryption public key of the client to obtain a ciphertext;
  • the communication unit 801 is further configured to send a response message to the client, where the response message includes the ciphertext, the signature of the key management entity to the target key, and the key management entity Sign the ciphertext and the signature authentication information of the key management entity; receive a confirmation message sent by the client, where the confirmation message is used to confirm that the client receives the target key.
  • the confirmation message includes: the verification information, and the client's signature on the verification information and the target key transmission process information; wherein the verification information is the client.
  • the confirmation key is obtained by the client terminal according to the confirmation key, and the confirmation key is obtained by the client terminal according to the target key, the transmission process information of the target key, and the confirmation result of the target key.
  • the target key transmission process information includes one or more of the following: the client's signature on the encryption public key, the key management entity's signature on the target key , the key management entity's signature on the ciphertext, the ciphertext, and the encryption public key.
  • the signature authentication information of the client includes: a digital signature certificate of the client.
  • the signature authentication information of the client includes: an initial authentication signature and a signature authentication public key of the client;
  • the communication unit 801 is further configured to: before receiving the request message sent by the client, First receive the authentication request sent by the client, wherein the authentication request includes: the signature authentication public key of the client and the identity of the client;
  • the client performs identity authentication; further, after the client identity authentication is passed, use the signature authentication private key of the key management entity to sign the signature authentication public key of the client to obtain an initial authentication signature; finally to the client The terminal sends the initial authentication signature.
  • the authentication information of the key management entity includes: a digital signature certificate of the key management system.
  • the processing unit 802 is further configured to: encrypt the target key and the signature of the target key by using the encryption public key of the client, and use the client before obtaining the ciphertext.
  • the signature authentication public key of the terminal confirms that the initial authentication signature is correct.
  • the embodiments of the present application also provide a key transmission device (corresponding to the second solution of the embodiments of the present application), which has the behavior function of the client in the above method embodiments.
  • the key transmission device may include modules or units corresponding to the methods/operations/steps/actions described in the above method embodiments.
  • the modules or units may be hardware circuits, software, or hardware.
  • the circuit is implemented in combination with software.
  • FIG. 8 For the structure diagram of the device, reference may be made to the structure shown in FIG. 8 above.
  • the apparatus 800 may include a communication unit 801 and a processing unit 802 , each of which will be described in detail below.
  • a communication unit 801 configured to send a request message to a key management entity; the request message is used to request a target key, and the request message includes first key exchange information, the client's pairing of the first key The signature of the exchange information, and the signature authentication information of the client;
  • the communication unit 801 is further configured to receive a response message from the key management entity, where the response message includes ciphertext, the second key exchange information of the key management entity, and the key management entity's response to the first key management entity.
  • the encryption and decryption keys of the key management entity are obtained by encryption, and the encryption and decryption keys of the key management entity are obtained according to the first key exchange information of the client, the second key exchange information of the key management entity, and the Obtained by the client's signature on the first key exchange information;
  • the first transmission process information includes one or more of the following: the ciphertext, the first key exchange information, and the second key exchange information;
  • a processing unit 802 configured to determine that the signature of the key management entity to the first transmission process information is correct according to the signature authentication information of the key management entity
  • the processing unit 802 is further configured to use the encryption/decryption key of the client to decrypt the ciphertext to obtain the target key;
  • the encryption/decryption key of the client is the obtained from the first key exchange information of the terminal, the second key exchange information of the key management entity, and the signature of the client to the first key exchange information;
  • the communication unit 801 is further configured to send a confirmation message to the key management entity, where the confirmation message is used to confirm that the client receives the target key.
  • the processing unit 802 is further configured to: before the communication unit 801 sends the confirmation message to the key management entity, according to the target key, the second transmission process information and the target The confirmation result of the key generates a confirmation key; the third verification information is obtained according to the confirmation key and the target key transmission process information;
  • the second transmission process information includes one or more of the following: the client's signature on the first key exchange information, the key management entity's signature on the first transmission process information, the first key exchange information, the second key exchange information;
  • the target key transmission process information includes one or more of the following: the client's signature on the first key exchange information, the key management entity's signature on the first transmission process information, the a key exchange information, the second key exchange information, and the ciphertext.
  • the confirmation message includes: the third verification information, and the client's signature on the third verification information and the target key transmission process information.
  • the signature authentication information of the client includes: a digital signature certificate of the client.
  • the signature authentication information of the client includes: an initial authentication signature and a public key for signature authentication of the client; the communication unit 801 is further configured to: notify the key management entity at the client Before sending the request message, send an authentication request to the key management entity, wherein the authentication request includes: the client's signature authentication public key and the client's identity; The initial authentication signature, wherein the initial authentication signature is obtained by signing the signature authentication public key of the client according to the signature authentication private key of the key management entity.
  • the authentication information of the key management entity includes: a digital signature certificate of the key management system.
  • the response message further includes: first verification information; wherein the first verification information is the key management entity according to the first verification key, the client's verification of the first verification obtained from the signature of the key exchange information, the first key exchange information, and the second key exchange information; the first verification key is obtained by the key management entity according to the client's first key exchange information, the second key exchange information of the key management entity, and the client's signature on the first key exchange information;
  • the first transmission process information further includes: the first verification information.
  • the processing unit 802 is further configured to: before using the encryption/decryption key of the client to decrypt the ciphertext and obtain the target key, determine according to the second verification key.
  • the first verification information is correct; wherein, the second verification key is obtained by the client according to the first key exchange information of the client, the second key exchange information of the key management entity, the Obtained from the client's signature on the first key exchange information.
  • the target key transmission process information further includes: the first verification information.
  • the embodiments of the present application also provide a key transmission device (corresponding to the second solution of the embodiments of the present application), which has the behavior function of the key management entity in the above method embodiments.
  • the key transmission device may include modules or units corresponding to the methods/operations/steps/actions described in the above method embodiments.
  • the modules or units may be hardware circuits, software, or hardware.
  • the circuit is implemented in combination with software.
  • FIG. 8 For the structure diagram of the device, reference may be made to the structure shown in FIG. 8 above.
  • the apparatus 800 may include a communication unit 801 and a processing unit 802 , each of which will be described in detail below.
  • the communication unit 801 is configured to receive a request message sent by a client; wherein the request message is used to request a target key, and the request message includes first key exchange information, the client's response to the first key. A signature of the key exchange information, and the signature authentication information of the client;
  • the processing unit 802 is configured to determine that the signature of the client to the first key exchange information is correct according to the signature authentication information of the client; the processing unit 802 is further configured to use the encryption of the key management entity.
  • the decryption key encrypts the target key to obtain ciphertext;
  • the communication unit 801 is further configured to send a response message to the client, where the response message includes the ciphertext, the second key exchange information of the key management entity, and the key management entity pair.
  • the first transmission process information includes one or more of the following: the ciphertext, the first key exchange information, and the second key exchange information;
  • the communication unit 801 is further configured to receive a confirmation message sent by the client, where the confirmation message is used to confirm that the client receives the target key.
  • the confirmation message includes: third verification information, and the client's signature on the third verification information and the target key transmission process information; the third verification information is the obtained by the client according to the confirmation key and the transmission process information of the target key; the confirmation key is the confirmation result of the client according to the target key, the second transmission process information and the target key owned.
  • the second transmission process information includes one or more of the following: the client's signature on the first key exchange information, the key management entity's signature on the first transmission process information, the first key exchange information, the second key exchange information;
  • the target key transmission process information includes one or more of the following: the client's signature on the first key exchange information, the key management entity's signature on the first transmission process information, the One key exchange information, the second key exchange information, the ciphertext.
  • the signature authentication information of the client includes: a digital signature certificate of the client.
  • the signature authentication information of the client includes: an initial authentication signature and a signature authentication public key of the client; the communication unit 801 is further configured to: after receiving the request message sent by the client Before, receiving an authentication request from the client, wherein the authentication request includes: the signature authentication public key of the client and the identity of the client; carry out identity authentication;
  • the authentication information of the key management entity includes: a digital signature certificate of the key management system.
  • the processing unit 802 is further configured to: encrypt the target key by using the encryption/decryption key of the key management entity to obtain the ciphertext, according to the first obtaining the first verification key from the key exchange information, the second key exchange information of the key management entity, and the client's signature on the first key exchange information; and then according to the first verification key .
  • the client signs the first key exchange information, the first key exchange information, and the second key exchange information to obtain the first verification information.
  • the response message further includes: the first verification information; the first transmission process information further includes: the first verification information.
  • an embodiment of the present application also provides a device for key transmission used in the first solution of the present application.
  • the device for key transmission may have a structure as shown in FIG. 9 , and the device for key transmission may be
  • the client may also be a chip or a chip system capable of supporting the client to implement the above method.
  • the apparatus 900 for key transmission as shown in FIG. 9 may include at least one processor 902, the at least one processor 902 is configured to be coupled with the memory 903, and read and execute the instructions in the memory to implement the embodiments of the present application The steps involved on the client side in the provided method.
  • the apparatus 900 may further include a transceiver 901, and the transceiver 901 may be used to support the apparatus 900 to receive or send signaling or data.
  • the transceiver 902 in the device 900 can be used to implement the functions of the above-mentioned communication unit 801.
  • the transceiver 901 can be used for the device 900 to perform S201, S204 and S207 in the key transmission method shown in FIG. 2, or
  • the processor 902 can use steps S301 and S304, S306, S309, and S314 in the key transmission method shown in FIG. 3, or steps shown in steps S402, S405, and S410 in the key transmission method shown in FIG. 4
  • the processor 902 can be used for the device 900 to execute S202, S203, S205 and S206 in the key transmission method shown in FIG.
  • transceiver 901 may be coupled to an antenna for enabling device 900 to communicate.
  • the apparatus 900 may further include a memory 903, in which computer programs and instructions are stored, and the memory 903 may be coupled with the processor 902 and/or the transceiver 901 to support the processor 902 to call the computer programs and instructions in the memory 903.
  • the memory 903 may also be used to store the data involved in the method embodiment of the present application, for example, to support the transceiver 902 to realize the necessary data for interaction ,information.
  • An embodiment of the present application also provides a device for key transmission used in the first solution of the present application.
  • the device for key transmission may also have a structure as shown in FIG. 9 , and the device for key transmission may be
  • the key management entity may also be a chip or a chip system capable of supporting the key management entity to implement the above method.
  • the device 900 for key transmission as shown in FIG. 9 may include at least one processor 902, which is configured to be coupled with the memory 903, and read and execute the instructions in the memory 903 to implement the implementation of the present application The steps involved in the key management entity in the method provided in the example.
  • the apparatus 900 may further include a transceiver 901, and the transceiver 901 may be used to support the apparatus 900 to receive or send signaling or data.
  • the transceiver 901 in the device 900 can be used to implement the functions of the communication unit 801.
  • the transceiver 901 can be used for the device 900 to perform S201, S204 and S207 in the key transmission method shown in FIG. 2, or
  • the processor 902 can use steps S301 and S304, S306, S309, and S314 in the key transmission method shown in FIG. 3, or steps S401 and S406-S409 in the key transmission method shown in FIG. 4.
  • the processor 902 can be used for the device 900 to perform S205 and S206 in the key transmission method shown in FIG. 2, or the key transmission method shown in FIG.
  • transceiver 901 may be coupled to an antenna for enabling device 900 to communicate.
  • the apparatus 900 may further include a memory 903, in which computer programs and instructions are stored, and the memory 903 may be coupled with the processor 902 and/or the transceiver 901 to support the processor 902 to call the computer programs and instructions in the memory 903.
  • the memory 903 may also be used to store data involved in the method embodiment of the present application, for example, to support the transceiver 901 to realize the data necessary for interaction ,information.
  • the embodiment of the present application also provides a device for key transmission used in the second solution of the present application.
  • the device for key transmission may also have a structure as shown in FIG. 9 , and the device for key transmission may be a client
  • the client can also be a chip or a chip system capable of supporting the client to implement the above method.
  • the apparatus 900 for key transmission as shown in FIG. 9 may include at least one processor 902, the at least one processor 902 is configured to be coupled with the memory 903, and read and execute the instructions in the memory to implement the embodiments of the present application The steps involved on the client side in the provided method.
  • the apparatus 900 may further include a transceiver 901, and the transceiver 901 may be used to support the apparatus 900 to receive or send signaling or data.
  • the transceiver 901 in the device 900 can be used to implement the functions of the above communication unit 801.
  • the transceiver 901 can be used in the device 900 to perform S501, S504 and S507 in the key transmission method shown in FIG. 5, or In the steps of S601 and S604, S606, S609, and S614 in the key transmission method shown in FIG. 6, or steps shown in steps S702, S705 and S710 in the key transmission method shown in FIG. 7, the processor 902 can be used In order to realize the functions of the above processing unit 802, for example, the processor 902 can be used for the device 900 to execute S502, S503, S505 and S506 in the key transmission method shown in FIG.
  • transceiver 901 may be coupled to an antenna for enabling device 900 to communicate.
  • the apparatus 900 may further include a memory 903, in which computer programs and instructions are stored, and the memory 903 may be coupled with the processor 902 and/or the transceiver 901 to support the processor 902 to call the computer programs and instructions in the memory 903.
  • the memory 903 may also be used to store the data involved in the method embodiment of the present application, for example, to support the transceiver 901 to realize the data necessary for interaction ,information.
  • This embodiment of the present application also provides a key transmission device used in the second solution of the present application.
  • the key transmission device may also have a structure as shown in FIG. 9 , and the key transmission device may be a key management device.
  • the entity may also be a chip or a chip system capable of supporting the key management entity to implement the above method.
  • the apparatus 900 for key transmission as shown in FIG. 9 may include at least one processor 902, the at least one processor 902 is configured to be coupled with the memory 903, and read and execute the instructions in the memory to implement the embodiments of the present application Steps involved in the key management entity in the provided method.
  • the apparatus 900 may further include a transceiver 901, and the transceiver 901 may be used to support the apparatus 900 to receive or send signaling or data.
  • the transceiver 901 in the device 900 can be used to implement the corresponding functions of the above-mentioned communication unit 801.
  • the transceiver 901 can be used for the device 900 to perform S501, S504 and S507 in the key transmission method shown in FIG. 5 . , or step S601, S606, S611 in the key transmission method shown in FIG. 6, or steps shown in S702 and S710 in the key transmission method shown in FIG.
  • the processor 902 can be used to implement the above corresponding The functions possessed by the processing unit 802, for example, the processor 902 can be used for the device 900 to perform S505 and S506 in the key transmission method shown in FIG. 5 , or the key transmission method shown in FIG. 6 .
  • transceiver 901 may be coupled to an antenna for enabling device 900 to communicate.
  • the apparatus 900 may further include a memory 903, in which computer programs and instructions are stored, and the memory 903 may be coupled with the processor 902 and/or the transceiver 902 to support the processor 902 to call the computer programs and instructions in the memory 903.
  • the memory 903 may also be used to store data involved in the method embodiment of the present application, for example, to support the transceiver 901 to realize the data necessary for interaction ,information.
  • the embodiments of the present application further provide a computer-readable storage medium, on which some instructions are stored.
  • the computer can complete the above method embodiments and method implementations.
  • the computer-readable storage medium is not limited, for example, it may be RAM (random-access memory, random access memory), ROM (read-only memory, read-only memory), etc.
  • the present application further provides a computer program product, which, when invoked and executed by a computer, can complete the method embodiments and the methods involved in any possible designs of the above method embodiments.
  • the present application further provides a chip, which may include a processor and an interface circuit, and is used to implement the above method embodiments and any possible implementation manners of the method embodiments.
  • a chip which may include a processor and an interface circuit, and is used to implement the above method embodiments and any possible implementation manners of the method embodiments.
  • method where "coupled” means that two components are directly or indirectly bonded to each other, which may be fixed or movable, and which may allow flow of fluids, electricity, electrical signals, or other types of signals between two components. communication between the components.
  • an embodiment of the present application provides a method for transmitting a key.
  • a client sends a request message to a key management entity, and the request message is used to request the target key of the key management entity.
  • the message includes the client's encryption public key or the client's first key exchange information; the key management entity can use the client's encryption public key to encrypt the target key to obtain the ciphertext, or the key management entity can use the key management entity's encryption key.
  • the encryption/decryption key encrypts the target key to obtain the ciphertext.
  • the key management entity sends a response message including the ciphertext or the second key exchange information of the key management entity to the client; the client uses the client's encrypted private key to decrypt the ciphertext to obtain the target key, or the client uses the client's The encryption/decryption key decrypts the ciphertext to obtain the target key.
  • the method utilizes encryption key pair or key negotiation information to realize key transmission, thereby ensuring the security of key transmission and preventing different devices from denying the target key after sending or receiving it.
  • Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage medium can be any available medium that a computer can access.
  • computer readable media may include RAM, ROM, electrically erasable programmable read only memory (EEPROM), compact disc read-Only memory (CD- ROM) or other optical disk storage, magnetic disk storage media, or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and that can be accessed by a computer. also. Any connection can be appropriately made into a computer-readable medium.
  • RAM random access memory
  • ROM read only memory
  • EEPROM electrically erasable programmable read only memory
  • CD- ROM compact disc read-Only memory
  • Any connection can be appropriately made into a computer-readable medium.
  • disks and discs include compact discs (CDs), laser discs, optical discs, digital video discs (DVDs), floppy disks, and Blu-ray discs, wherein Disks usually reproduce data magnetically, while discs use lasers to reproduce data optically. Combinations of the above should also be included within the scope of computer-readable media.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种密钥的传输方法和装置，该方法包括：客户端向密钥管理实体发送请求消息，请求消息中包括加密公钥或者第一密钥交换信息；密钥管理实体使用加密公钥对目标密钥加密得到密文，或使用由第一密钥信息和第一密钥交换信息、第一认证签名和第二密钥交换信息得到的加解密钥对目标密钥加密得到密文。密钥管理实体向客户端发送包括密文或第二密钥交换信息的响应消息；客户端使用加密私钥对密文解密获得目标密钥，或使用由客户端的第一密钥交换信息、第一认证签名、密钥管理实体的第二密钥信息和第二密钥交换信息得到的加解密密钥对密文解密得到目标密钥。该方法利用加密密钥对或密钥协商信息实现密钥传输，从而可以保证密钥传输的安全性。

Description

一种密钥的传输方法和装置 技术领域
本申请涉及通信技术领域，尤其涉及一种密钥的传输方法和装置。
背景技术
现有的汽车部件开发中，汽车的部件代工厂(Original Equipment Manufacturer，OEM)需要将存储的一些目标密钥传输给汽车的第一级零部件供应商(Tier One，TIER1)，以便所述部件代工厂进一步将这些目标密钥灌装到汽车部件中。然而，目标密钥的传输安全性将直接影响车内部件的安全性。
现有的密钥传输技术中，通常采用传统的传输层安全协议(Transport Layer Security，TLS)或优良保密协议(Pretty Good Privacy，PGP)协议，甚至密钥明文方式，可以实现所述部件代工厂与所述第一级零部件供应商之间目标密钥的传输。然而，这些方式都极大可能导致目标密钥传输不安全。
发明内容
本申请提供一种密钥的传输方法和装置，用于提高密钥管理实体和客户端之间传输密钥的安全性。
第一方面，本发明实施例提供一种密钥的传输方法，在本申请中，以由客户端执行该方法进行描述。该方法的步骤包括：客户端向密钥管理实体发送请求消息，其中，所述请求消息用于请求目标密钥，所述请求消息中包括所述客户端的加密公钥、所述客户端对所述加密公钥的签名，以及所述客户端的签名认证信息；所述客户端接收所述密钥管理实体的响应消息，所述响应消息中包括密文、所述密钥管理实体对所述密文的签名，以及所述密钥管理实体的签名认证信息；其中，所述密文为是根据所述客户端的加密公钥对所述目标密钥加密得到的；所述客户端使用所述密钥管理实体的签名认证信息确定所述密文的签名正确；所述客户端使用所述客户端的加密私钥对所述密文进行解密，获取所述目标密钥；所述客户端向所述密钥管理实体发送确认消息，所述确认信息用于确认所述客户端收到所述目标密钥。
通过该设计，客户端向密钥管理实体发送请求消息，用于请求目标密钥，该请求消息中包括了客户端的加密公钥、客户端对加密公钥的签名，以及客户端的签名认证信息。进一步的，客户端接收密钥管理实体发送的响应消息，客户端在认证所述响应消息中的密文正确后，使用客户端的加密私钥对密文进行解密获取目标密钥。最后客户端向密钥管理实体返回确认信息，该方案不仅可以保证客户端能准确的获取到目标密钥，也可以保证目标密钥的传输安全性。
在一种可能的实施方式中，所述客户端向所述密钥管理实体发送确认信息之前，所述方法还包括：所述客户端根据所述目标密钥、所述目标密钥传输过程信息以及所述目标密钥的确认结果产生确认密钥；所述客户端根据所述确认密钥得到验证信息。
通过该设计，客户端向密钥管理实体发送确认信息之前，根据目标密钥、目标密钥传输过程信息以及目标密钥的确认结果产生确认密钥，并根据确认密钥得到验证信息，从而 保证客户端得到的确认密钥和验证信息，与目标密钥过程以及其传输结果紧密相关的，使得客户端返回的确认信息更具合法性和有效性。
在一种可能的实施方式中，所述确认信息包括：所述验证信息，以及所述客户端对所述验证信息和所述目标密钥传输过程信息的签名。
通过该设计，客户端通过确认信息向密钥管理实体告知已接收到目标密钥，并且确认信息中包括的验证信息可以用于防止客户端对已获取目标密钥的事实进行抵赖。
在一种可能的实施方式中，所述目标密钥传输过程信息包括以下一项或多项：所述客户端对所述加密公钥的签名、所述密钥管理实体对所述目标密钥的签名、所述密钥管理实体对所述密文的签名、所述密文、所述加密公钥。
通过该设计，目标密钥传输过程信息中涉及客户端和密钥管理实体两端生成的各类签名、密文以及加密公钥中的任意一项或多项，从而可以保证客户端向密钥管理实体返回的确认信息更具合法性和有效性。
在一种可能的实施方式中，所述客户端的签名认证信息包括：所述客户端的数字签名证书。
通过该设计，客户端的签名认证信息包括客户端的数字签名证书时，密钥管理实体可以根据该客户端的签名认证信息，实现对客户端的身份认证。
在一种可能的实施方式中，所述客户端的签名认证信息包括：初始认证签名和所述客户端的签名认证公钥；所述客户端向所述密钥管理实体发送所述请求消息之前，所述方法还包括：所述客户端向所述密钥管理实体发送认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；所述客户端接收所述密钥管理实体的初始认证签名，其中，所述初始认证签名是根据所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名得到的。
通过该设计，当客户端的签名认证信息包括初始认证签名和客户端的签名认证公钥时，客户端向密钥管理实体发送请求消息之前，需要向密钥管理实体发送认证请求，以实现对自己的身份认证并获取密钥管理实体发送的初始认证签名，进而保证后续能有效且安全的获取目标密钥。
在一种可能的实施方式中，所述密钥管理实体的认证信息包括：所述密钥管理系统的数字签名证书。
通过该设计，密钥管理实体的认证信息包括密钥管理系统的数字签名证书，客户端接收密钥管理实体发送的响应消息之后，可以根据密钥管理系统的数字签名证书，实现对密钥管理实体的身份认证。
在一种可能的实施方式中，所述响应消息还包括所述密钥管理实体对所述目标密钥的签名，所述方法包括：所述客户端根据所述密钥管理实体的签名认证信息，确定所述密钥管理实体对所述目标密钥的签名正确。
通过该设计，客户端接收到的响应消息还包括密钥管理实体对目标密钥的签名时，客户端可以根据密钥管理实体的签名认证信息，确定密钥管理实体对目标密钥的签名正确，从而可以保证获取目标密钥的完整性。
在一种可能的实施方式中，所述目标密钥传输过程信息还包括所述密钥管理实体对所述目标密钥的签名。
通过该设计，目标密钥传输过程信息还包括密钥管理实体对目标密钥的签名，从而进 一步可以保证客户端返回的确认信息的有效性，并且通过验证密钥管理实体对目标密钥的签名，可以确保目标密钥在传输过程中的完整性。
第二方面，本发明实施例提供一种密钥的传输方法，在本申请中，以由密钥管理实体执行该方法进行描述。该方法的步骤包括：密钥管理实体接收客户端发送的请求消息，其中，所述请求消息用于请求目标密钥，所述请求消息中包括所述客户端的加密公钥、所述客户端对所述加密公钥的签名，以及所述客户端的签名认证信息；所述密钥管理实体根据所述客户端的签名认证信息确定所述客户端对所述加密公钥的签名正确；所述密钥管理实体使用所述客户端的加密公钥对所述目标密钥和所述目标密钥的签名进行加密，得到密文；所述密钥管理实体向所述客户端发送响应消息，所述响应消息中包括所述密文、所述密钥管理实体对所述目标密钥的签名、所述密钥管理实体对所述密文的签名，以及所述密钥管理实体的签名认证信息；所述密钥管理实体接收所述客户端发送的确认信息，所述确认信息用于确认所述客户端收到所述目标密钥。
通过该设计，密钥管理实体接收客户端发送的请求消息，密钥管理实体先确认请求消息中的客户端对加密公钥的签名正确。进一步的，密钥管理实体使用客户端的加密公钥对目标密钥和目标密钥的签名进行加密得到密文。然后密钥管理实体向客户端发送响应消息，该响应消息中不仅包括密文，还包括密钥管理实体对目标密钥的签名、密钥管理实体对密文的签名，以及密钥管理实体的签名认证信息，从而可以保证客户端接收该响应消息后，最终获取目标密钥的准确性和完整性。最后密钥管理实体还接收客户端发送的确认信息，从而根据该确认信息确认客户端已接收目标密钥。
在一种可能的设计中，所述确认消息包括：所述验证信息，以及所述客户端对所述验证信息和所述目标密钥传输过程信息的签名；其中，所述验证信息为所述客户端根据确认密钥得到的，所述确认密钥为所述客户端根据所述目标密钥、所述目标密钥传输过程信息以及所述目标密钥的确认结果得到的。
通过该设计，密钥管理实体接收客户端的确认信息，该确认信息中包括验证信息、客户端对验证信息和目标密钥传输过程信息的签名。因此，密钥管理实体根据该确认信息不仅可以确认客户端已接收目标密钥，还可以依据客户端对验证信息和目标密钥传输过程信息的签名，防止客户端对已接收目标密钥的事实进行否认。
在一种可能的设计中，所述目标密钥传输过程信息包括以下一项或多项：所述客户端对所述加密公钥的签名、所述密钥管理实体对所述目标密钥的签名、所述密钥管理实体对所述密文的签名、所述密文、所述加密公钥。
通过该设计，由于密钥管理实体接收客户端的确认信息中包括客户端对验证信息和目标密钥传输过程信息的签名，其中，目标密钥传输过程信息的签名包括客户端对加密公钥的签名、密钥管理实体对目标密钥的签名、密钥管理实体对密文的签名、密文、加密公钥中任一项或多项。从而可以保证密钥管理实体接收客户端的确认信息具有有效性和合法性。
在一种可能的设计中，所述客户端的签名认证信息包括：所述客户端的数字签名证书。
通过该设计，客户端发送的请求消息中客户端的签名认证信息包括：客户端的数字签名证书，从而密钥管理实体可以使用客户端的数字签名证书认证客户端对加密公钥的签名，从而可以保证密钥管理实体使用客户端的加密公钥为正确的。
在一种可能的设计中，所述客户端的签名认证信息包括：初始认证签名以及所述客户 端的签名认证公钥；所述密钥管理实体接收所述客户端发送的请求消息之前，所述方法还包括：所述密钥管理实体接收所述客户端发送的认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；所述密钥管理实体根据所述认证请求，对所述客户端进行身份认证；所述密钥管理实体在所述客户端身份认证通过之后，使用所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名，得到初始认证签名；所述密钥管理实体向所述客户端发送所述初始认证签名。
通过该设计，客户端的签名认证信息包括：初始认证签名以及客户端的签名认证公钥时，密钥管理实体在接收客户端的请求消息之前，需要接收到客户端的认证请求，从而根据该认证请求认证客户端的身份。在客户端的身份认证通过后，使用密钥管理实体的签名认证私钥对客户端的签名认证公钥进行签名，得到初始认证签名并发送给所述客户端。进而客户端可以根据该初始认证签名进行身份认证，实现从密钥管理实体获取目标密钥。
在一种可能的设计中，所述密钥管理实体使用所述客户端的加密公钥对所述目标密钥和所述目标密钥的签名进行加密，得到密文之前，所述方法还包括：所述密钥管理实体使用所述客户端的签名认证公钥，确定所述初始认证签名正确。
通过该设计，密钥管理实体使用客户端的加密公钥对目标密钥和目标密钥的签名进行加密，得到密文之前，密钥管理实体使用客户端的签名认证公钥，确定初始认证签名正确，确保客户端的身份正确，进而保证了目标密钥传输的安全性。
在一种可能的设计中，所述密钥管理实体的认证信息包括：所述密钥管理系统的数字签名证书。
通过该设计，密钥管理实体的认证信息包括：密钥管理系统的数字签名证书时；客户端接收到密钥管理实体的响应消息后，可以使用该密钥管理系统的数字签名证书去认证响应消息中密文的签名。从而可以保证目标密钥的传输安全性，也可以保证客户端获取目标密钥的准确性。
第三方面，本发明实施例提供一种密钥的传输方法，在本申请中，以由客户端执行该方法进行描述。该方法的步骤包括：客户端向密钥管理实体发送请求消息；所述请求消息用于请求目标密钥，所述请求消息中包括第一密钥交换信息、所述客户端对所述第一密钥交换信息的签名，以及所述客户端的签名认证信息；所述客户端接收所述密钥管理实体的响应消息，所述响应消息中包括密文、所述密钥管理实体的第二密钥交换信息、所述密钥管理实体对第一传输过程信息的签名，以及所述密钥管理实体的签名认证信息，其中，所述密文为所述密钥管理实体根据所述密钥管理实体的加解密密钥对所述目标密钥加密得到的，所述密钥管理实体的加解密密钥为所述密钥管理实体根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到的；所述第一传输过程信息包括以下一项或多项：所述密文、所述第一密钥交换信息、所述第二密钥交换信息；所述客户端根据所述密钥管理实体的签名认证信息确定所述密钥管理实体对第一传输过程信息的签名正确；所述客户端使用所述客户端的加解密密钥，对所述密文进行解密，获取所述目标密钥；所述客户端的加解密密钥为所述客户端根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到的；所述客户端向所述密钥管理实体发送确认消息，所述确认信息用于确认所述客户端收到所述目标密钥。
通过该设计，客户端向密钥管理实体发送请求消息，并且该请求消息中包括第一密钥 交换信息、所述客户端对第一密钥交换信息的签名，以及客户端的签名认证信息。然后密钥管理实体可以根据自身得到加解密钥对目标密钥进行加密，得到密文。客户端接收密钥管理实体的响应消息之后，客户端根据响应消息中的密钥管理实体的签名认证信息确定密钥管理实体对第一传输过程信息的签名正确。进一步，客户端使用客户端的加解密钥对响应消息中密文进行解密，获取目标密钥。该方案可以保证客户端和密钥管理实体之间传输密钥的安全性，使得客户端准确且有效的获取目标密钥。最后，客户端还向密钥管理实体返回确认信息，用于告知客户端已接收目标密钥。
在一种可能的设计中，所述客户端向所述密钥管理实体发送确认消息之前，所述方法还包括：所述客户端根据所述目标密钥，第二传输过程信息以及所述目标密钥的确认结果产生确认密钥；所述客户端根据所述确认密钥和所述目标密钥传输过程信息得到第三验证信息；其中，所述第二传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名、所述密钥管理实体对第一传输过程信息的签名、所述第一密钥交换信息、所述第二密钥交换信息；所述目标密钥传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名、所述密钥管理实体对第一传输过程信息的签名、所述第一密钥交换信息、所述第二密钥交换信息，所述密文。
通过该设计，客户端向所述密钥管理实体发送确认消息之前，客户端根据目标密钥，第二传输过程信息以及目标密钥的确认结果产生确认密钥，进一步根据确认密钥和目标密钥传输过程信息得到第三验证信息。该方案可以保证第三验证信息的有效性。
在一种可能的设计中，所述确认消息包括：所述第三验证信息，以及所述客户端对所述第三验证信息和所述目标密钥传输过程信息的签名。
通过该设计，确认信息中除了包括第三验证信息，还包括客户端对第三验证信息和目标密钥传输过程信息的签名，因此，该确认信息不仅可以用于确认客户端已接收目标密钥，还可以作为客户端和密钥管理实体双方之间传输目标密钥的证据，以防止双方对传输目标密钥的事实进行否认。
在一种可能的设计中，所述客户端的签名认证信息包括：所述客户端的数字签名证书。
通过该设计，客户端的签名认证信息包括客户端的数字签名证书时；密钥管理实体可根据客户端的数字签名证书，认证客户端对第一密钥交换信息的签名，从而可以保证密钥管理实体接收的第一密钥交换信息的合法性和有效性。
在一种可能的设计中，所述客户端的签名认证信息包括：初始认证签名和所述客户端的签名认证公钥；所述客户端向所述密钥管理实体发送所述请求消息之前，所述方法还包括：所述客户端向所述密钥管理实体发送认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；所述客户端接收所述密钥管理实体的初始认证签名，其中，所述初始认证签名是根据所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名得到的。
通过该设计，客户端的签名认证信息包括初始认证签名和客户端的签名认证公钥时，客户端向密钥管理实体发送请求消息之前，还需要向密钥管理实体发送认证请求，以实现对自己的身份认证，并获取密钥管理实体返回的初始认证签名，进而保证客户端后续可以有效的获取到目标密钥。
在一种可能的设计中，所述密钥管理实体的认证信息包括：所述密钥管理系统的数字签名证书。
通过该设计，密钥管理实体的认证信息包括密钥管理系统的数字签名证书，客户端可以根据密钥管理实体的认证信息，认证密钥管理实体对第一传输过程信息的签名，以保证客户端接收到密钥管理实体发送的第一传输过程信息为正确的。
在一种可能的设计中，所述响应消息还包括：第一验证信息；其中，所述第一验证信息为所述密钥管理实体根据第一验证密钥、所述客户端对所述第一密钥交换信息的签名、所述第一密钥交换信息、所述第二密钥交换信息得到的；所述第一验证密钥为所述密钥管理实体根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到的；所述第一传输过程信息还包括：所述第一验证信息。
通过该设计，客户端接收密钥管理实体的响应消息中还包括第一验证信息，可进一步确保目标密钥的传输安全性。密钥管理实体发送的第一传输过程信息中也包括该第一验证信息，也可进一步保证客户端接收到密钥管理实体发送的第一传输过程信息的正确性。
在一种可能的设计中，所述客户端使用所述客户端的加解密密钥，对所述密文进行解密，获取所述目标密钥之前，所述方法还包括：所述客户端根据第二验证密钥确定所述第一验证信息正确；其中，所述第二验证密钥为所述客户端根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息、所述客户端对所述第一密钥交换信息的签名得到的。
通过该设计，客户端在对密文进行解密之前，使用自身得到的第二验证密钥认证响应消息中的第一验证信息正确，进而可以保证客户端获取目标密钥的合法性和有效性。
在一种可能的设计中，所述目标密钥传输过程信息还包括：所述第一验证信息。
通过该设计，目标密钥传输过程信息还包括第一验证信息，可进一步保证客户端返回的响应消息具有有效性。
第四方面，本发明实施例提供一种密钥的传输方法，在本申请中，以由密钥管理实体执行该方法进行描述。该方法的步骤包括：密钥管理实体接收客户端发送的请求消息；其中，所述请求消息用于请求目标密钥，所述请求消息中包括第一密钥交换信息、所述客户端对所述第一密钥交换信息的签名，以及所述客户端的签名认证信息；所述密钥管理实体根据所述客户端的签名认证信息确定所述客户端对所述第一密钥交换信息的签名正确；所述密钥管理实体使用所述密钥管理实体的加解密密钥对所述目标密钥进行加密，得到密文；所述密钥管理实体向所述客户端发送响应消息，所述响应消息中包括所述密文、所述密钥管理实体的第二密钥交换信息、所述密钥管理实体对第一传输过程信息的签名，以及所述密钥管理实体的签名认证信息；其中，所述第一传输过程信息包括以下一项或多项：所述密文，所述第一密钥交换信息，所述第二密钥交换信息；所述密钥管理实体接收所述客户端发送的确认信息，所述确认信息用于确认所述客户端收到所述目标密钥。
通过该设计，密钥管理实体接收客户端发送请求消息，并且该请求消息中包括第一密钥交换信息、客户端对第一密钥交换信息的签名，以及客户端的签名认证信息。然后，密钥管理实体根据客户端的签名认证信息确定客户端对所述第一密钥交换信息的签名正确。进一步的，密钥管理实体使用密钥管理实体的加解密密钥对目标密钥进行加密，得到密文，密钥管理实体向客户端返回包含密文的响应消息。该方案可以保证客户端和密钥管理实体之间实现密钥的安全传输，使得客户端准确且有效的获取目标密钥。最后，密钥管理实体接收客户端发送的确认信息，以知晓客户端已接收目标密钥。
在一种可能的设计中，所述确认消息包括：第三验证信息，以及所述客户端对所述第三验证信息和所述目标密钥传输过程信息的签名；所述第三验证信息为所述客户端根据确认密钥和所述目标密钥传输过程信息得到的；所述确认密钥为所述客户端根据所述目标密钥、第二传输过程信息以及所述目标密钥的确认结果得到的。其中，所述第二传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名，所述密钥管理实体对第一传输过程信息的签名，所述第一密钥交换信息，所述第二密钥交换信息；所述目标密钥传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名，所述密钥管理实体对第一传输过程信息的签名，所述第一密钥交换信息，所述第二密钥交换信息，所述密文。
通过该设计，密钥管理实体接收的确认信息包括第三验证信息，以及客户端对第三验证信息和目标密钥传输过程信息的签名。因此，该方案中确认信息的有效性更高，并且该确认信息不仅可以用于确认客户端已接收目标密钥，还可以防止双方对传输目标密钥的事实进行否认。
在一种可能的设计中，所述客户端的签名认证信息包括：所述客户端的数字签名证书。
通过该设计，客户端发送的请求消息中客户端的签名认证信息包括客户端的数字签名证书，从而密钥管理实体可以使用客户端的数字签名证书对第一密钥交换信息的签名进行认证，从而可以保证密钥管理实体使用第一密钥交换信息为正确的。
在一种可能的设计中，所述客户端的签名认证信息包括：初始认证签名和所述客户端的签名认证公钥；所述密钥管理实体接收所述客户端发送的所述请求消息之前，所述方法还包括：所述密钥管理实体接收所述客户端的认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；所述密钥管理实体根据所述认证请求，对所述客户端进行身份认证；所述密钥管理实体在所述客户端身份认证通过之后，使用所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名，得到初始认证签名；所述密钥管理实体向所述客户端发送所述初始认证签名。
通过该设计，客户端的签名认证信息包括：初始认证签名以及客户端的签名认证公钥时；密钥管理实体在接收客户端的请求消息之前，接收到客户端的认证请求，从而根据该认证请求认证客户端的身份，在客户端的身份认证通过后，使用密钥管理实体的签名认证私钥对客户端的签名认证公钥进行签名，得到初始认证签名，并发送给所述客户端，从而使得客户端利用该初始认证签名认证自身身份，从而可有效的获取目标密钥。
在一种可能的设计中，所述密钥管理实体的认证信息包括：所述密钥管理实体的数字签名证书。
通过该设计，密钥管理实体的认证信息包括：密钥管理实体的数字签名证书时；客户端接收到密钥管理实体的响应消息后，可以使用该密钥管理实体的数字签名证书去认证密钥管理实体对第一传输过程信息的签名。该方案可以保证客户端接收密钥管理实体第一传输过程信息的准确性，也进一步保证目标密钥的传输安全性。
在一种可能的设计中，所述密钥管理实体使用所述密钥管理实体的加解密密钥对所述目标密钥进行加密，得到密文时，所述方法还包括：所述密钥管理实体根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到第一验证密钥；所述密钥管理实体根据所述第一验证密钥、所述客户端对所述第一密钥交换信息的签名、所述第一密钥交换信息、所述第二密钥交换信息， 得到第一验证信息。
通过该设计，可以使得密钥管理实体得到的第一验证信息更具有效性和准确性。
在一种可能的设计中，所述响应消息还包括：所述第一验证信息；所述第一传输过程信息还包括：所述第一验证信息。
通过该设计，密钥管理实体发送的响应消息中还包括第一验证信息，以及第一传输过程信息中还包括该第一验证信息，可以进一步保证客户端接收该响应消息后，可以准确且有效的获取目标密钥。
第五方面，本申请提供一种密钥的传输装置，该装置可应用于客户端，具有实现上述第一方面或上述第一方面的任意一种可能的设计中第一种方案的功能，或者实现上述第三方面或上述第三方面的任意一种可能的设计中第二种方案的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元。比如包括通信单元和处理单元。
第六方面，本申请提供一种密钥的传输装置，该装置可应用于密钥管理实体，具有实现上述第二方面或上述第二方面的任意一种可能的设计中第一种方案的功能，或者具有实现上述第四方面或上述第四方面的任意一种可能的设计中第二种方案的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元。比如包括通信单元和处理单元。
第七方面，本申请实施例中还提供一种计算机存储介质，该存储介质中存储软件程序，该软件程序在被一个或多个处理器读取并执行时可实现第一方面或其中任意一种设计提供的第一种方案，或者可实现第二方面或其中任意一种设计提供的第一种方案，或者可实现第三方面或其中任意一种设计提供的第二种方案，或者实现第四方面或其中任意一种设计提供的第二种方案。
第八方面，本申请实施例还提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得上述第一方面或其中任一种设计提供的第一方案被执行，或者使得上述第二方面或其中任一种设计提供的第一方案被执行，使得上述第三方面或其中任一种设计提供的第二方案被执行，或者使得上述第四方面或其中任一种设计提供的第二方案被执行。
第九方面，本申请实施例提供了一种芯片系统，该芯片系统包括处理器，用于支持客户端实现上述第一方面中所涉及的功能，或者实现上述第三方面中所涉及的功能。
第十方面，本申请实施例提供了一种芯片系统，该芯片系统包括处理器，用于支持密钥管理实体实现上述第二方面中所涉及的功能，或者实现上述第四方面中所涉及的功能。
在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存通信装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
第十一方面，本申请实施例还提供一种密钥的传输系统，该密钥的传输系统包括用于执行上述第一方面或其中任一种设计提供的方法的客户端，和用于执行上述第二方面或其中任一种设计提供的方法的密钥管理实体，以及用于实现所述客户端和所述密钥管理实体之间进行通信的传输信道。
第十二方面，本申请实施例还提供一种密钥的传输系统，该密钥的传输系统包括用于执行上述第三方面或其中任一种设计提供的方法的客户端，和用于执行上述第四方面或其中任一种设计提供的方法的密钥管理实体，以及用于实现所述客户端和所述密钥管理实体之间进行通信的传输信道。
上述第五方面至第十二方面中可以达到的技术效果，可以参照上述第一方面或第二方面中任意一种设计可以达到的技术效果说明，或者参照上述第三方面或第四方面中任意一种设计可以达到的技术效果说明。这里不再重复赘述。
附图说明
图1为本申请实施例提供的一种适用的密钥传输系统的示意图；
图2为本申请实施例提供的第一种密钥传输的方法流程示意图；
图3为本申请实施例提供的第一种密钥传输的实例流程示意图；
图4为本申请实施例提供的第二种密钥传输的实例流程示意图；
图5为本申请实施例提供的第二种密钥传输的方法流程示意图；
图6为本申请实施例提供的第三种密钥传输的实例流程示意图；
图7为本申请实施例提供的第四种密钥传输的实例流程示意图；
图8为本申请实施例提供的一种密钥传输装置的结构示意图；
图9为本申请实施例提供的一种密钥传输设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。
本申请实施例提供一种密钥的传输方法及装置，方法和装置是基于同一发明构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。本申请实施例的描述中，“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。本申请中所涉及的至少一个是指一个或多个；多个，是指两个或两个以上。另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。本申请实施例中请求或响应中“包括”信息，可以理解为请求或响应中“携带”信息。在本申请实施例中方案中涉及的字母“S”表示为签名Sign。“K”表示为密钥Key。
本申请实施例提供的密钥传输方法可以用于客户端和密钥管理系统之间传输密钥，客户端可以是软件实体，虚拟功能实体，或者硬件装置等，密钥管理系统也可以是软件实体，虚拟功能实体，或者硬件装置等。例如，客户端可以设置于汽车的第一级零部件供应商TIER1设备，对应的密钥管理系统可以设置在汽车的部件代工厂OEM设备上。在密钥管理系统中存储了汽车内部的一些重要的密钥，密钥管理系统可以对这些密钥进行管理和维护，而客户端可以向密钥管理系统请求获取需要的目标密钥，并将获取到的目标密钥灌装到汽车内部件中。客户端和密钥管理系统可以通过移动通信网络、无线保真(wireless fidelity，WiFi)或者其它等连接方式进行通信，以实现汽车部件开发过程中的密钥、数据、信息等传输。
应理解在本申请实施例中，以客户端和密钥管理实体为例，对本申请的方案进行描述。但在实际运用中，客户端和密钥管理实体可以视为空间上不处于同一点的实体，本申请对客户端和密钥管理实体不做具体限定。
图1示出了本申请实施例提供一种密钥的传输方法所适用的一种可能的密钥传输系统 的架构，该密钥传输系统可用于汽车部件开发过程。
参阅图1所示，该密钥传输系统中包括TIER1设备和OEM设备，在整个汽车部件开发过程中，所述OEM设备中存储了汽车内部的一些重要密钥。
所述TIER1设备在确定车内部件所需的目标密钥后，向所述OEM设备发送请求消息，所述请求消息用于请求所述OEM设备中的目标密钥。所述OEM设备将所述目标密钥传输给所述TIER1设备，从而所述TIER1设备可以进一步将该目标密钥灌装到车内部件中。由于所述OEM设备中存储了的重要密钥是车厂的核心资产，传输这些密钥的安全性将直接影响车内部件的安全性，因此，所述OEM设备需要通过高安全的传输方式，将这些重要的目标密钥传输给所述TIER1设备。
在现有技术中，通常采用传统的传输层安全协议(Transport Layer Security，TLS)或优良保密协议(Pretty Good Privacy，PGP)，甚至密钥明文方式，可实现所述OEM设备与所述TIER1设备之间的密钥传输。然而，现有技术中简单执行“直接返回密钥再更新”的策略，在很多场景不可行，在得到目标密钥和更新期间，容易违规泄露密钥。其中，所述TLS并不能实现真正的安全传输，所述PGP为一个自签名公钥/私钥加密，公钥的合法性认证没有信任根，且PGP使用静态加密方式，仅采用PGP并不具有前向安全。另外，所述TLS和所述PGP等协议的局限，所述OEM设备并不一定会收到所述TIER1设备的响应或回执，因此，该方案无法保证所述TIER1设备不对“已安全接收目标密钥”这一事实进行否认。同时，由于部分协议不具备“标识信息唯一来源”，从而也会可能导致所述OEM设备对“已发送目标密钥”这一事实进行否认。
因此，本申请实施例提供了一种密钥的传输方法，该方法中，客户端向密钥管理实体发送请求消息，该请求消息用于请求密钥管理实体的目标密钥，请求消息中包括客户端的加密公钥或者客户端的第一密钥交换信息；密钥管理实体可以使用客户端的加密公钥对目标密钥加密得到密文，或者密钥管理实体可以使用密钥管理实体的加解密密钥对目标密钥进行加密，得到密文。密钥管理实体向客户端发送包括密文或密钥管理实体的第二密钥交换信息的响应信息；客户端使用客户端的加密私钥对密文解密获得目标密钥，或者客户端使用客户端的加解密密钥对密文进行解密，得到目标密钥。该方法利用加密密钥对或密钥协商信息实现密钥传输，从而可以保证密钥传输的安全性。
本申请实施例提供的密钥的传输方法可以但不限于适用于如图1所示的密钥传输系统中，该密钥传输系统中可以包括客户端和密钥管理实体以及客户端和密钥管理实体之间的传输通道。可选的，客户端可存储了客户端的签名认证私钥和客户端的签名认证公钥，密钥管理实体中存储了一些汽车内部所需的密钥和密钥管理实体的数字签名证书以及密钥管理实体的签名认证私钥。其中，密钥管理实体的数字签名证书用于认证由密钥管理实体的签名认证私钥进行签名得到的认证签名。
参阅图2所示，本申请实施例提供一种密钥的传输方法，可以基于一次性公私钥对进行密钥传输，该方案的流程包括：
S201：客户端向密钥管理实体发送请求消息，该请求消息用于请求目标密钥，密钥管理实体设备接收客户端发送的请求消息。请求消息中包括客户端的加密公钥、客户端对加密公钥的签名，以及客户端的签名认证信息。
在第一种实施方式中，客户端的签名认证信息包括：客户端的数字签名证书。
可选的，客户端的数字签名证书可用于对客户端的认证签名私钥进行认证。例如，客 户端使用客户端的签名认证私钥对待发送的信息或内容进行签名，得到相应的认证签名，客户端将自身的数字签名证书和相应的认证签名发送给密钥管理实体之后，密钥管理实体可以利用客户端的数字签名证书对相应的认证签名进行认证，若认证通过，则可以确定该认证签名来源于客户端。
在第二种实施方式中，客户端的签名认证信息包括：初始认证签名以及客户端的签名认证公钥。
在第二种实施方式情况下，客户端向密钥管理实体发送所述请求消息之前，还包括：客户端向密钥管理实体发送认证请求，密钥管理实体接收客户端发送的认证请求；其中，认证请求包括：客户端的签名认证公钥和客户端的身份标识；然后密钥管理实体可以根据该认证请求，对客户端进行身份认证；进一步密钥管理实体在客户端身份认证通过之后，使用密钥管理实体的签名认证私钥对客户端的签名认证公钥进行签名，得到初始认证签名；最后密钥管理实体向客户端发送初始认证签名，客户端接收密钥管理实体的初始认证签名。
其中，密钥管理实体根据该认证请求，对客户端进行身份认证时，可以通过其他可靠方法对该认证信息进行认证，以确保双方通信的安全性和合法性。例如线下由专人传送，或者双方通过合同进行约定，以保证客户端的合法性和有效性。具体的可靠方式，本申请不做具体限定。
需要注意的是，客户端从密钥管理实体获取初始认证签名的过程可以设为在线上或离线(线下)进行。
在该步骤S201中，客户端的加密公钥，可以通过但不限于以下方式获得：客户端通过实时生成一次性加密密钥对，或者客户端侧预先存储了一次性加密密钥对，客户端的加密密钥对中包括加密公钥和加密私钥。
需要注意的是，由于客户端的加密密钥对为一次性的，从而可以避免客户端的加密密钥因重复使用而易导致泄露，进而可保证两侧之间传输目标密钥的安全性。
示例性的，客户端以TIER1设备为例，此时，TIER1设备的签名认证私钥表示为sk_TIER1，加密公钥表示为enc_pk，TIER1设备对加密公钥的签名表示为S1，S1可以满足以下公式：S1＝Sign(sk_TIER1，enc_pk||nonce1)。
其中，nonce1表示TIER1设备产生的随机数，“||”表示串联拼接。
S202：密钥管理实体根据客户端的签名认证信息确定客户端对加密公钥的签名正确。
S203：密钥管理实体使用客户端的加密公钥对目标密钥和目标密钥的签名进行加密，得到密文。
在一种实施方式中，若客户端的签名认证信息包括：初始认证签名以及客户端的签名认证公钥时；密钥管理实体使用客户端的加密公钥对目标密钥和目标密钥的签名进行加密，得到密文之前，还包括：密钥管理实体根据客户端的签名认证公钥，确定初始认证的签名正确。
在一种实施方式中，密钥管理实体在执行步骤S203时，具体包括以下：
首先，密钥管理实体使用密钥管理实体的签名认证私钥对目标密钥进行签名，得到密钥管理实体对目标密钥的签名；然后，密钥管理实体根据目标密钥、密钥管理实体对目标密钥的签名，得到待加密密文；其次，密钥管理实体使用客户端的加密公钥对待加密密文进行加密，得到密文；最后，密钥管理实体使用密钥管理实体的签名认证私钥对密文进行 签名，得到密文的签名。
示例性的，客户端以TIER1设备为例，密钥管理实体以OEM设备为例。此时OEM设备的签名认证私钥表示为sk_OEM，目标密钥表示为PMEK，目标密钥的签名表示为S2，待加密密文表示为C’，密文表示为C，密文的签名表示为S3。
S2可以满足公式为：S2＝Sign(sk_OEM，PMEK)。
其中，Sign(.)表示签名函数，OEM设备对目标密钥的签名S2由OEM设备使用OEM的签名认证私钥对目标密钥PMEK进行签名得到的。.
待加密密文C’可以表示为PMEK||S2||nonce1||nonce2。
其中，“||”表示串联拼接，nonce1和nonce2分别表示TIER1设备产生的随机数和OEM设备产生的随机数。待加密密文C’由OEM设备将目标密钥PMEK、目标密钥的签名S2、TIER1设备产生的随机数nonce1、OEM设备产生的随机数nonce2串联拼接得到的。
密文C可以满足公式为：C＝Enc(enc_pk，C’)。
即C＝Enc(enc_pk，PMEK||S2||nonce1||nonce2)。
其中，Enc(.)表示加密符号，密文C由OEM设备使用TIER1设备的加密公钥enc_pk对待加密密文密文C’进行加密得到的。
密文的签名S3可以满足公式为：S3＝Sign(sk_OEM，C)。
其中，密文的签名S3由OEM设备使用OEM设备的签名认证私钥对密文C进去签名得到的。
需要注意的是，密钥管理实体使用客户端的加密公钥进行加密时，可以使用非对称加密算法，例如，椭圆曲线综合加密方案(Elliptic Curve Integrated Encryption Scheme，ECIES)(ec25519)或者RSA(Rivest-Shamir-Adleman)(人名)最优非对称加密填充(RSA-Optimal Asymmetric Encryption Padding，RSA-OAEP)等。
S204：密钥管理实体向客户端发送响应消息，客户端接收密钥管理实体发送的响应消息，该响应消息中包括密文、密钥管理实体对密文的签名，以及密钥管理实体的签名认证信息。
S205：客户端使用密钥管理实体的签名认证信息确定密文的签名正确。
其中，密钥管理实体的认证信息包括：密钥管理实体的数字签名证书。
该密钥管理系统的数字签名证书可以用于认证密钥管理系统对密文的签名，从而可以保证客户端接收响应消息中的密文为有效且准确的。
S206：客户端使用客户端的加密私钥对密文进行解密，获取目标密钥。
示例性的，客户端以TIER1设备为例，密钥管理实体以OEM设备为例。TIER1设备的加密私钥表示为enc_sk，目标密钥表示为PMEK，密文表示为C。
具体的，目标密钥PMEK可以满足以下公式：
PMEK＝Dec(enc_sk，C)，同时获得nonce2。
其中，Dec(.)表示解密符号，目标密钥PMEK由客户端使用加密私钥对密文C进行解密得到的，nonce2表示OEM设备产生的随机数。
在一种实施方式中，响应消息还包括：密钥管理实体对目标密钥的签名。在执行步骤S206之后，还包括：客户端根据密钥管理实体的签名认证信息，确定密钥管理实体对目标密钥的签名正确。
在该方式中，客户端可以通过确定密钥管理实体对目标密钥的签名正确，从而保证获 取的目标密钥的完整性。
S207：客户端向密钥管理实体发送确认信息，密钥管理实体接收该确认信息，确认信息用于确认客户端收到目标密钥。
在一种实施方式中，客户端向密钥管理实体发送确认消息之前，所述方法还包括：客户端根据目标密钥、目标密钥传输过程信息以及目标密钥的确认结果产生确认密钥；客户端根据确认密钥得到验证信息。
因此，确认消息中具体包括：验证信息，以及客户端对验证信息和目标密钥传输过程信息的签名。
可选的，目标密钥传输过程信息包括以下一项或多项：客户端对加密公钥的签名、密钥管理实体对目标密钥的签名、密钥管理实体对密文的签名、密文、加密公钥。
示例性的，客户端以TIER1设备为例，密钥管理实体以OEM设备为例；TIER1设备的签名认证私钥表示为sk_TIER1，目标密钥表示为PMEK，加密公钥表示为enc_pk，确认密钥表示为K_ack，验证信息表示为MAC，客户端对验证信息和目标密钥传输过程信息的签名表示为ACK。
具体的，K_ack、MAC、ACK可以满足以下公式：
K_ack＝HKDF(PMEK,S1||S2||S3||enc_pk||nonce1||nonce2||“ACK”)；
MAC＝HKDF(K_ack,nonce1||nonce2)；
ACK＝Sign(sk_TIER1,MAC||S1||S2||S3||C||enc_pk||nonce1||nonce2||“Succeeded or Failed”)。
其中，HKDF表示一种基于散列消息鉴别码(Hash Message Authentication Code，HMAC)的密钥推导算法(HMAC based Key Derivation Function)，nonce1和nonce2分别表示TIER1设备产生的随机数和OEM设备产生的随机数。“ACK”为一个用于标识派生K_ack的字符串或二进制串，可以是由TIER1设备和OEM设备预先协商特定编码规则的字符串，当然也可采用其它的字符串所代替，本申请实施例对此不做限制。“Succeeded or Failed”为一个用于标识ACK数字签名用途的字符串，可以是由TIER1设备和OEM设备预先协商特定编码规则的字符串，当然也可采用其它的字符串所代替，本申请实施例对此不做限定。
在一种实施方式中，密钥管理实体接收客户端发送的确认信息之后，还包括：密钥管理实体根据预设的密钥算法和目标密钥得到第一确认密钥，使用该第一确认密钥认证确认信息中的验证信息。
具体的，密钥管理实体使用第一确认密钥认证确认信息中的验证信息，包括：密钥管理实体先根据预设的密钥算法和目标密钥得到第一确认密钥，然后，密钥管理实体根据第一确认密钥得到第一验证信息，进一步的，将该第一验证信息与确认信息中的验证信息进行比较，若相同，则确定认证通过。
示例性的，第一确认密钥表示为K_ack’，第一验证信息MAC’，确认信息中的验证信息表示为MAC。K_ack’和MAC’的公式可以满足以下：
K_ack’＝HKDF(PMEK,S1||S2||S3||enc_pk||nonce1||nonce2||“ACK”)；
MAC’＝HKDF(K_ack’,nonce1||nonce2)；
其中，HKDF、“||”、nonce1、nonce2、“ACK”的意义具体可参考上述实施，此处不再具体赘述。
密钥管理实体将第一验证信息MAC’与确认信息中的验证信息MAC进行比较，若相同，则确定目标密钥传输成功。
综上所述，基于一次性公私钥对进行密钥传输的方案中，首先，客户端向密钥管理实体发送用于请求目标密钥的请求消息，该请求消息中包括客户端的加密公钥、客户端对加密公钥的签名，以及客户端的签名认证信息。由于客户端的加密公钥为一次性，从而可避免加密公钥发生泄露，从而保证客户端和密钥管理实体之前的密钥传输安全性。
然后，密钥管理实体在接收到该请求消息后，密钥管理实体根据客户端的签名认证信息确定客户端对加密公钥的签名正确，则使用客户端的加密公钥对目标密钥进行加密得到密文。进一步，密钥管理实体向客户端返回响应消息。客户端接收响应消息后，先对其中密文的签名进行认证，确保接收的密文为有效且准确的，进而使用加密私钥对密文解密获取目标密钥，并对目标密钥的签名进行认证，以确保获取的目标密钥的完整性。从而可知，客户端和密钥管理实体在进行信息交互时，执行任务之前均需要对接收的信息进行认证，保证接收的信息的有效性和准确性。且客户端的加密密钥对可以用于实现对目标密钥的安全加密和解密，保证客户端获取目标密钥过程的有效性和安全性。
最后，客户端获取目标密钥之后得到确认信息，该确认信息中包括验证信息，以及客户端对验证信息和所述目标密钥传输过程信息的签名。客户端将确认信息发送给密钥管理实体，从而密钥管理实体可以根据确认信息知晓客户端已获取目标密钥，同时，密钥管理实体可依据该确认信息，防止客户端对“已获取目标密钥”的事实进行否认，客户端也可以以该确认信息为证据，防止密钥管理实体对“已发送目标密钥”的事实进行否认。
因此，该方案既可以保证目标密钥传输的安全性，也可以防止密钥传输的双方对密钥传输的事实进行否认。
基于以上实施例提供的第一种密钥的传输方案，该方案主要利用一次性加密公钥来加密目标密钥，以实现密钥的传输。本申请根据该方案，还提供了以下两个具体的实施例，以详细说明本申请的技术方案。
在第一个实施例中，如图3所示，客户端以TIER1设备为例，密钥管理实体以OEM设备为例。TIER1设备中没有存储TIER1设备的数字签名证书、但存储了TIER1设备的签名认证私钥和TIER1设备的签名认证公钥。OEM设备中存储了OEM设备的数字签名证书、OEM设备的签名认证私钥、目标密钥。具体流程包括以下步骤：
由于TIER1设备没有数字签名证书，OEM设备在与TIER1设备进行密钥传输之前，需要先对TIER1设备进行认证。因此，需要在OEM设备与TIER1设备进行密钥传输之前，执行下述初始阶段(具体参考步骤S301-S304)，TIER1设备获取初始认证签名S，进而OEM设备通过验证TIER1设备的初始认证签名S有效且合法，才可以进一步传输目标密钥，从而可保证OEM设备与TIER1设备之前传输密钥的安全性。
S301：TIER1设备向OEM设备发送认证信息，该认证信息中包括TIER1设备的身份标识TIER1_ID和TIER1设备的签名认证公钥pk_TIER1。
S302：OEM设备对TIER1设备的身份标识和TIER1设备的签名认证公钥进行认证。
S303：OEM设备认证TIER1设备的身份标识和TIER1设备的签名认证公钥通过之后，使用OEM设备的证书对应的签名认证私钥sk_OEM对TIER1设备的签名认证公钥pk_TIER1进行签名，得到初始认证签名S。
具体的，初始认证签名S可以满足：S＝Sign(sk_OEM，TIER1_ID||pk_TIER1)。
S304：OEM设备将初始认证签名S发送给TIER1设备，TIER1设备接收OEM设备发送的初始认证签名S。
需要注意的是，上述步骤S301-S304为密钥传输初始阶段，此阶段可以在线或离线进行。
下面的步骤为TIER1设备向OEM设备请求获取目标密钥的在线阶段：
S305：TIER1设备产生一次加密公私钥对(enc_pk，enc_sk)，该加密公私钥对包括加密公钥enc_pk和加密私钥enc_sk。
S306：TIER1设备向OEM设备发送请求消息，OEM设备接收TIER1设备发送的请求。
其中，所述请求消息中包括TIER1设备的加密公钥enc_pk、初始认证签名S，第一认证签名S1、TIER1设备的签名认证公钥pk_TIER1，以及一次性随机次数nonce1。第一认证签名S1由TIER1设备对加密公钥enc_pk签名得到的。
具体的，第一认证签名S1可以满足：S＝Sign(sk_TIER1，enc_pk||nonce1)。
S307：OEM设备对请求消息中的初始认证签名S和第一认证S1进行认证。
具体的，首先，OEM设备使用OEM设备的签名认证私钥sk_OEM对初始认证签名S进行认证。当OEM设备认证初始认证签名S有效后，然后，OEM设备使用TIER1设备的签名认证公钥pk_TIER1对第一认证签名S1进行认证。当OEM设备认证第一认证签名S1有效之后，执行下面步骤S308。
S308：OEM设备使用TIER1设备的加密公钥enc_pk对目标密钥进行加密，得到密文。
执行步骤308时，具体包括以下步骤：
第一步骤：OEM设备使用OEM设备的签名认证私钥sk_OEM对目标密钥PMEK进行签名，得到第一数字签名S2。
具体的，第一数字签名S2可以满足：S2＝Sign(sk_OEM，PMEK)。
第二步骤：OEM设备根据目标密钥PMEK和第一数字签名S2，得到待加密密文C’。
具体的，待加密密文C’可以表示为：PMEK||S2||nonce1||nonce2。
nonce1表示为TIER1设备产生的随机数，nonce2表示为OEM产生的随机数。
第三步骤：OEM设备使用TIER1设备的加密公钥enc_pk对待加密密文C’进行加密，得到密文C；
密文C可以满足：C＝Enc(enc_pk，C’)，即：C＝Enc(enc_pk，PMEK||S2||nonce1||nonce2)。
需要注意的是，该处可以使用非对称加密算法ECIES(ec25519)或者RSA-OEAP，本申请实施例不做具体限定。
第四步骤：OEM设备使用OEM设备的签名认证私钥sk_OEM对密文C进行签名，得到第二数字签名S3。
第二数字签名S3可以满足：S3＝Sign(sk_OEM，C)。
S309：OEM设备向TIER1设备发送响应消息，TIER1设备接收OEM设备发送的响应消息。
其中，响应消息中包括密文C、第一数字签名S2、第二数字签名S3、OEM的数字签名证书。
S310：TIER1设备使用响应消息中的OEM设备的数字签名证书对第二数字签名S3进行认证。
当TIER1设备认证第二数字签名S3通过之后，执行下面步骤S311。
S311：TIER1设备使用TIER1设备的加密私钥enc_sk对密文C进行解密，获取目标密钥PMEK。
执行步骤S311时，具体包括以下步骤：
第一步骤：当TIER1设备认证第二数字签名S3通过后，使用加密私钥enc_sk对密文C进行解密，得到解密后的密文。
第二步骤：TIER1设备使用响应消息中的OEM设备的数字签名证书对第一数字签名S2进行认证。
第三步骤：当TIER1设备认证第一数字签名S2通过后，从解密后的密文中获取目标密钥PMEK。
目标密钥PMEK可以满足：PMEK＝Dec(enc_sk，C)，同时可以获得OEM设备产生的第二随机次数nonce2。另外，该步骤可以确保获取的目标密钥PMEK的完整性。
S312：TIER1设备根据预设的密钥算法和目标密钥，得到确认密钥K_ack；
确认密钥K_ack可以满足：K_ack＝HKDF(PMEK,S1||S2||S3||enc_pk||nonce1||nonce2“ACK”)。
S313：TIER1设备根据确认密钥K_ack，生成验证信息MAC；进一步TIER1设备根据TIER1设备的签名认证私钥sk_TIER1和验证信息MAC，得到验证签名ACK。
确认信息MAC可以满足：MAC＝HKDF(K_ack,nonce1||nonce2)。
确认签名ACK可以满足：
ACK＝Sign(sk_TIER1,MAC||S1||S2||S3||C||enc_pk||nonce1||nonce2||“Succeeded or Failed”)。
S314：TIER1设备向OEM设备发送确认信息，该确认信息中包括验证信息MAC和验证签名ACK。OEM设备接收TIER1设备发送的确认信息。
该步骤中由于OEM设备接收TIER1设备发送的确认信息包括的验证签名ACK是TIER1设备在获取目标密钥之后，根据TIER1设备的签名认证私钥和验证信息得到，因此，ACK可以作为不可抵赖的证明信息，用于证明OEM设备发送了目标密钥且TIER1设备获取了OEM设备提供的目标密钥。
S315：OEM设备接收TIER1设备发送的确认信息之后，OEM设备根据预设的密钥算法和目标密钥PMEK得到的第一确认密钥K_ack’，使用该第一确认密钥K_ack’认证响应信息中的验证信息MAC。
OEM设备根据该第一确认密钥K_ack’得到第一验证信息MAC’，K_ack’和MAC’的公式可以满足以下：
K_ack’＝HKDF(PMEK,S1||S2||S3||enc_pk||nonce1||nonce2||“ACK”)；
MAC’＝HKDF(K_ack’,nonce1||nonce2)。
OEM设备将第一验证信息MAC’与认证响应信息中的验证信息MAC进行比较，若相同，则认证通过，即确定目标密钥传输成功。
在第二个实施例中，TIER1设备中存储了TIER1的数字签名证书、TIER1设备的签名认证私钥sk_TIER1。OEM设备中存储了OEM设备的数字签名证书、OEM设备的签名认证私钥sk_OEM，目标密钥PMEK。如图4所示，TIER1设备向OEM设备请求获取目标密钥的具体流程包括以下步骤：
S401：TIER1设备产生一次加密公私钥对(包括加密公钥enc_pk和加密私钥enc_sk)， TIER1设备使用TIER1设备的签名认证私钥sk_TIER1对TIER1设备的加密公钥enc_sk进行签名，得到第一认证签名S1。
S402：TIER1设备向OEM设备发送请求消息，OEM设备接收TIER1设备发送的请求消息。
其中，请求消息中包括加密公钥enc_pk、第一认证签名S1、TIER1设备的数字签名证书，以及一次性随机次数nonce1。
具体的，第一认证签名S1可以满足：S＝Sign(sk_TIER1，enc_pk||nonce1)。
nonce1表示为TIER1设备产生的随机数。
S403：OEM设备对请求消息中的第一认证签名S1进行认证。
具体的，OEM设备使用请求消息中包含的TIER1设备的数字签名证书对请求消息中包含的第一认证签名S1进行认证。
当OEM设备认证第一认证签名S1有效且合法之后，执行下面步骤S404。
S404：OEM设备使用请求消息中包括加密公钥enc_pk对目标密钥进行加密，得到密文。
执行步骤404时，具体可以参考上述步骤S308，此处不再具体赘述。
S405：OEM设备向TIER1设备发送响应消息，TIER1设备接收OEM设备发送的响应消息。
其中，响应消息中包括密文C、第一数字签名S2、第二数字签名S3、OEM设备的数字签名证书。
S406：TIER1设备使用响应消息中的OEM设备的数字签名证书对第二数字签名S3进行认证。
当TIER1设备认证第二数字签名S3通过之后，执行下面步骤S407。
S407：TIER1设备使用加密私钥enc_sk对所述密文C进行解密，获取所述目标密钥PMEK。
执行步骤S407时，具体可参考上述步骤S311，此处不再具体赘述。
S408：TIER1设备根据预设的密钥算法和所述目标密钥，得到确认密钥K_ack；
执行步骤S408时，具体可参考上述步骤S312，此处不再具体赘述。
S409：TIER1设备根据确认密钥K_ack，生成确认信息MAC；进一步TIER1设备根据TIER1设备的签名私钥sk_TIER1和验证信息MAC，得到验证签名ACK。
执行步骤S508时，具体可参考上述步骤S313，此处不再具体赘述。
S410：TIER1设备向OEM设备发送确认信息，该确认信息中包括验证信息MAC和验证签名ACK。OEM设备接收TIER1设备发送的确认信息。
执行步骤S410时，具体可参考上述步骤S314，此处不再具体赘述。
S411：OEM设备接收TIER1设备发送的确认信息之后，OEM设备根据预设的密钥算法和目标密钥PMEK得到的第一确认密钥K_ack’，使用该第一确认密钥K_ack’认证确认信息中的验证信息MAC。
执行步骤S411时，具体可参考上述步骤S315，此处不再具体赘述。
参阅图5所示，本申请实施例提供又一密钥的传输方法，该方法的流程包括：
S501：客户端向密钥管理实体发送请求消息，密钥管理实体接收客户端发送的请求消息，其中，请求消息用于请求目标密钥，请求消息中包括第一密钥交换信息、客户端对第 一密钥交换信息的签名，以及客户端的签名认证信息。
可选的，客户端可以通过实时生成一次性第一密钥信息，或者已预先存储了一次性的第一密钥信息，客户端在实际中如何得到第一密钥信息，本申请可不做具体限定。
示例性的，客户端的第一密钥信息和第二密钥交换信息可以为客户端生成一次性基于椭圆曲线密码体制的DH密钥交换算法(elliptic curves-Diffie-Hellman，EC-DH)的秘密x和密钥交换材料X。并且，X＝x*G，其中，G为所使用EC曲线的基点(base point)。
需要注意的是，客户端侧的第一密钥信息和第一密钥交换信息均为一次性的，可以避免客户端的第一密钥交换信息因重复使用而易导致泄露，进而可保证两侧之间传输目标密钥的安全性。
在第一种实施方式中，客户端的签名认证信息包括：客户端的数字签名证书。
客户端的数字签名证书可以用于认证客户端对第一密钥交换信息的签名。
在第二种实施方式中，客户端的签名认证信息包括：初始认证签名和所述客户端的签名认证公钥。
在第二种实施方式情况下，客户端向密钥管理实体发送请求消息之前，还包括：客户端向密钥管理实体发送认证请求，密钥管理实体接收所述客户端发送的认证请求；其中，认证请求包括：客户端的签名认证公钥和客户端的身份标识；然后密钥管理实体根据该认证请求，对客户端进行身份认证；进一步密钥管理实体在客户端身份认证通过之后，使用密钥管理实体的签名认证私钥对客户端的签名认证公钥进行签名，得到初始认证签名；最后密钥管理实体向客户端发送初始认证签名，客户端接收密钥管理实体的初始认证签名。
可选的，密钥管理实体根据该认证请求，对客户端进行身份认证时，可以通过其他可靠方法对该认证信息进行认证，以确保双方通信的安全性和合法性。例如线下由专人传送，或者双方通过合同进行约定，以保证客户端的合法性和有效性。具体的可靠方式，本申请不做具体限定。
需要注意的是，客户端从密钥管理实体获取初始认证签名的过程可以设为在线上或离线(线下)进行。
其中，客户端的签名认证公钥的作用为：密钥管理实体在接收到该请求消息之后，可以使用客户端的签名公钥对初始认证签名进行认证。
S502：密钥管理实体根据客户端的签名认证信息确定客户端对第一密钥交换信息的签名正确。
示例性的，客户端以TIER1设备为例，TIER1设备的签名认证私钥表示为sk_TIER1，第一密钥交换信息表示为X，客户端对第一密钥交换信息的签名表示为S1，S1可以满足以下公式：S1＝Sign(sk_TIER1，X)。即该步骤为了确定S1正确。
在上述第二种实施方式中，客户端的签名认证信息包括：初始认证签名和客户端的签名认证公钥时，执行步骤S502时，还包括：密钥管理实体使用客户端的签名认证公钥认证初始认证签名正确。
S503：密钥管理实体使用密钥管理实体的加解密密钥对目标密钥进行加密，得到密文。其中，密钥管理实体的加解密密钥为密钥管理实体根据客户端的第一密钥交换信息、密钥管理实体的第二密钥交换信息以及客户端对所述第一密钥交换信息的签名得到的。
在一种实施方式中，密钥管理实体使用密钥管理实体的加解密密钥对目标密钥进行加密，得到密文时，还包括：
密钥管理实体可以根据所述客户端的第一密钥交换信息、密钥管理实体的第二密钥交换信息，以及客户端对第一密钥交换信息的签名，得到第一验证密钥；密钥管理实体根据第一验证密钥、客户端对第一密钥交换信息的签名、第一密钥交换信息、第二密钥交换信息，得到第一验证信息。
示例性的，客户端以TIER1设备为例，密钥管理实体以OEM设备为例。密钥管理实体的加解密密钥表示为K_enc、k_dec，第一验证密钥表示为K_mac，第一验证信息表示为MAC1，目标密钥表示为PMEK，密文表示为C。客户端的第一密钥交换信息表示为X，密钥管理实体的第二密钥信息表示为y，密钥管理实体的第二密钥交换信息表示为Y。
其中，Y＝y*G，其中，G为所使用EC曲线的基点(base point)。
密钥管理实体的加解密密钥可以满足公式为：K_enc＝k_dec＝HKDF(y*X，S1||X||Y||“ENC”)。
其中，K_enc表示为密钥管理实体的加密密钥，k_dec表示为密钥管理实体的解密密钥。
K_mac可以满足公式为：K_mac＝HKDF(y*X，S1||X||Y||“MAC”)。
MAC1可以满足公式为：MAC1＝HKDF(K_mac，S1||X||Y||)。
C＝AES-GCM(K_enc，PMEK)，其中，C需要的IV＝|SHA256(X||Y)| 96；
其中，“ENC”为一个用于标识派生K_enc的字符串，可以是由TIER1设备和OEM设备预先协商特定编码规则的字符串，当然也可采用其它的字符串所代替，本申请实施例对此不进行限制。“MAC”为一个用于标识派生K_mac的字符串，可以是由TIER1设备和OEM设备预先协商特定编码规则的字符串，当然也可采用其它的字符串所代替，本申请实施例对此不进行限制。“|…|96”表示取前96个比特。
S504：密钥管理实体向客户端发送响应消息，客户端接收该响应消息，响应消息中包括密文、密钥管理实体的第二密钥交换信息、密钥管理实体对第一传输过程信息的签名，以及密钥管理实体的签名认证信息。
其中，所述第一传输过程信息包括以下一项或多项：密文，第一密钥交换信息，第二密钥交换信息。
示例性的，密钥管理实体对第一传输过程信息的签名表示为S2。
S2可以满足公式为：S2＝Sign(sk_OEM，X||Y||MAC1||C)。
需要注意的是，响应信息中还包括：第一验证信息。第一传输过程信息还包括：第一验证信息。
S505：客户端根据密钥管理实体的签名认证信息确定密钥管理实体对第一传输过程信息的签名正确。
S506：客户端使用客户端的加解密密钥，对密文进行解密，获取目标密钥。
其中，客户端的加解密密钥为客户端根据客户端的第一密钥交换信息、密钥管理实体的第二密钥交换信息以及客户端对所述第一密钥交换信息的签名得到的。
在一种实施方式中，在客户端使用客户端的加解密密钥，对密文进行解密，获取目标密钥之前，还包括：客户端根据第二验证密钥确定第一验证信息正确；其中，第二验证密钥为客户端根据客户端的第一密钥交换信息、密钥管理实体的第二密钥交换信息、客户端对所述第一密钥交换信息的签名得到的。
示例性的，客户端以TIER1设备为例，密钥管理实体以OEM设备为例。密钥管理实 体的加解密密钥表示为(K_enc、K_dec)，第二验证密钥表示为K_mac’，第二验证信息表示为MAC2，目标密钥表示为PMEK，密文表示为C，客户端的第一密钥信息表示为x，客户端的第一密钥交换信息表示为X，密钥管理实体的第二密钥信息表示为y，密钥管理实体的第二密钥交换信息表示为Y。
X＝x*G，其中，G为所使用EC曲线的基点(base point)。
密钥管理实体的加解密密钥可以满足公式为：K_enc＝K_dec＝HKDF(x*Y，S1||X||Y||“ENC”)；
其中，K_enc为密钥管理实体进行加密使用的加密密钥，K_dec为密钥管理实体进行解密使用的解密密钥。
K_mac’可以满足公式为：K_mac’＝HKDF(x*Y，S1||X||Y||“MAC”)；
MAC2可以满足公式为：MAC2＝HKDF(K_mac’，S1||X||Y)；
PMEK可以满足公式为：PMEK＝AES-GCM(K_dec，C)；其中，C需要的IV＝|SHA256(X||Y)| 96。
此处公式的解释可参考第一种密钥传输方案，此处不再具体赘述。
可选的，密钥管理实体根据第二验证密钥确定第一验证信息正确，具体包括：密钥管理实体根据第二验证密钥得到第二验证信息MAC2，将第一验证信息MAC1与第二验证信息MAC2进行比较，若相同，确定第一验证信息正确。
S507：客户端向密钥管理实体发送确认消息，密钥管理实体接收该确认信息，确认信息用于确认客户端收到目标密钥。
在一种实施方式中，客户端向密钥管理实体发送确认消息之前，还包括：客户端根据目标密钥，第二传输过程信息以及目标密钥的确认结果产生确认密钥；客户端根据确认密钥和目标密钥传输过程信息得到第三验证信息。
其中，第二传输过程信息包括以下一项或多项：客户端对第一密钥交换信息的签名、密钥管理实体对第一传输过程信息的签名、第一密钥交换信息、第二密钥交换信息；
目标密钥传输过程信息包括以下一项或多项：客户端对所述第一密钥交换信息的签名、密钥管理实体对第一传输过程信息的签名、第一密钥交换信息、第二密钥交换信息，密文。
因此，确认消息包括：第三验证信息，以及客户端对第三验证信息和目标密钥传输过程信息的签名。
示例性的，客户端以TIER1设备为例，TIER1设备的签名认证私钥表示为sk_TIER1，目标密钥表示为PMEK，确认密钥表示为K_ack，第三验证信息表示为MAC3，客户端对第三验证信息和目标密钥传输过程信息的签名表示为ACK。
K_ack满足公式为：K_ack＝HKDF(PMEK，S1||S2||X||Y||“ACK”)；
MAC3满足公式为：MAC3＝HKDF(K_ack，S1||S2||X||Y||MAC1||C)；
ACK满足公式为：ACK＝Sign(sk_TIER1，MAC3||S1||S2||X||Y|||MAC1||C||“Succeeded or Failed”)。
此处公式的解释可参考第一种密钥传输方案，此处不再具体赘述。
其中，目标密钥传输过程信息包括：S1、S2、X、Y、C
即目标密钥传输过程信息包括：客户端对第一密钥交换信息的签名S1、密钥管理实体对第一传输过程信息的签名S2、第一密钥交换信息X、第二密钥交换信息Y、密文C。
需要注意的是：目标密钥传输过程信息还包括：第一验证信息MAC1
在一种实施方式中，密钥管理实体接收该确认信息之后，还包括：密钥管理实体可以根据预设的密钥算法和目标密钥得到的第一确认密钥，使用该确认密钥认证响应信息中的确认信息。
其中，密钥管理实体使用该第一确认密钥对响应信息中的第一确认信息进行认证时，具体包括：密钥管理实体先根据预设的密钥算法和目标密钥得到的第一确认密钥，然后，密钥管理实体根据第一确认密钥，进一步密钥管理实体使用该第一确认密钥认证确认信息中的第三验证信息。同时还可以利用事先存储的客户端的数字签名证书认证客户端对第三验证信息和目标密钥传输过程信息的签名ACK。
示例性的，密钥管理实体生成的第一确认密钥K_ack’的方式可参考客户端生成确认密钥的方式。此处不再具体赘述。
综上所述，基于密钥协商协议传输的方案中，首先，客户端向密钥管理实体发送用于请求目标密钥的请求消息，该请求消息中包括一次性客户端的密钥交换信息、客户端对第一密钥交换信息的签名，以及客户端的签名认证信息。由于客户端的密钥交换信息为一次性，进而避免客户端的密钥交换信息重复使用容易发生泄漏，从而保证客户端和密钥管理实体之间的密钥传输安全性。
然后，密钥管理实体在接收到该请求消息后，先认证该请求消息中客户端对第一密钥交换信息的签名正确后，则使用密钥管理实体的加密密钥对目标密钥进行加密得到密文，并得到密钥管理实体的第一验证信息。进一步，密钥管理实体向客户端返回包括密文的响应消息。客户端接收响应消息之后，确定密钥管理实体对第一传输过程信息的签名正确；并且需要认证第一验证消息正确，然后，客户端使用客户端的加解密钥对响应消息中的密文进行解密，获取目标密钥。从而可知，这样可以保证密钥管理实体和客户端双方进行加密和解密的安全性和有效性。
最后，客户端获取目标密钥之后得到确认信息，该确认信息既可以用于确定客户端已获取目标密钥，还可以作为证据，防止客户端对“已获取目标密钥”的事实进行否认或者防止密钥管理实体对“已发送目标密钥”的事实进行否认。
因此，该方案既可以保证目标密钥传输的安全性，也可以防止密钥传输的双方对密钥传输的事实进行否认。
基于以上实施例提供的第二种密钥的传输方案，该方案主要利用密钥协商协议的方式，实现密钥的传输。本申请根据该方案，同样也提供了以下两种具体的实例(即下述的第三实施例和第四实施例)，以详细说明本申请的技术方案。
在第三个实施例中，客户端以TIER1设备为例，密钥管理实体以OEM设备为例。TIER1设备中没有存储TIER1设备的数字签名证书、但存储了TIER1设备的签名认证私钥和TIER1设备的签名认证公钥。OEM设备中存储了OEM的数字签名证书、OEM的签名认证私钥、目标密钥PMEK。如图6所示，TIER1设备向OEM设备请求获取目标密钥的具体流程包括以下步骤：
由于TIER1设备没有数字签名证书，OEM设备在与TIER1设备进行密钥传输之前，需要先对TIER1设备进行相关认证。因此，需要在OEM设备与TIER1设备进行密钥传输之前，执行下述初始阶段(具体参考步骤S601-S604)，TIER1设备获取初始认证签名S，进而OEM设备通过验证TIER1设备的初始认证签名S有效且合法，才可以进一步传输目 标密钥。从而保证OEM设备与TIER1设备之前传输密钥的安全性。
S601：TIER1设备向OEM设备发送TIER1设备的身份标识TIER1_ID和TIER1设备的签名认证公钥pk_TIER1。
S602：OEM设备对TIER1设备的身份标识和TIER1设备的签名认证公钥进行认证。
S603：OEM设备认证TIER1的身份标识和TIER1设备的签名认证公钥通过时，使用OEM设备的证书对应的签名认证私钥sk_OEM对TIER1设备的签名认证公钥pk_TIER1进行签名，得到初始认证签名S。
具体的，初始认证签名S可以满足：S＝Sign(sk_OEM，TIER1_ID||pk_TIER1)。
S604：OEM设备将初始认证签名S发送给TIER1设备，TIER1设备接收OEM设备发送的初始认证签名S。
S605：TIER1设备生成一次性第一密钥信息，并根据该第一密钥信息x，得到第一密钥交换信息X。
在本申请实施例中，第一密钥信息可以为一次性基于椭圆曲线密码体制的DH密钥交换算法EC-DH秘密x，第一密钥交换信息可以为密钥交换材料X，并且满足公式：X＝x*G。其中，G为所使用EC曲线的基点(base point)。
S606：TIER1设备向OEM设备发送请求消息，OEM设备接收TIER1设备发送的请求消息。
该请求消息中包括：TIER1设备的第一密钥交换信息X、第一认证签名S1、初始认证签名S、TIER1设备的签名认证公钥pk_TIER1；其中，第一认证签名S1为TIER1设备使用TIER1设备的签名认证私钥sk_TIER1对第一密钥交换信息X进行签名得到的。
具体的，S1可以满足：S1＝Sign(sk_TIER1，X)。
需要注意的是，TIER1设备和OEM设备中均存储了EC曲线的基点G的情况下，TIER1设备的第一密钥信息x和TIER1设备的第一密钥交换信息X可以互相推导出来，OEM设备的第二密钥信息y和OEM设备的第二密钥交换信息Y可以互相推导出来。
S607：OEM设备对请求消息中的初始认证签名S和第一认证签名S1进行认证。
具体的，首先，OEM设备使用OEM设备的签名认证私钥sk_OEM对请求消息中的初始认证签名S进行认证。然后，当OEM设备认证初始认证签名S有效之后，使用请求消息中的TIER1设备的签名认证公钥pk_TIER1对请求消息中第一认证签名S1进行认证，当OEM设备认证第一认证签名S1有效之后，执行下面步骤S608。
S608：OEM设备根据第一认证签名S1、TIER1设备的第一密钥交换信息X、OEM设备的第二密钥信息y、OEM设备的第二密钥交换信息Y，得到OEM设备的加密密钥，使用该OEM设备的加密密钥对目标密钥进行加密，得到密文C。
OEM设备执行步骤608，具体包括以下步骤：
第一步骤：OEM设备根据第一认证签名S1、TIER1设备的第一密钥交换信息X、OEM设备的第二密钥信息y、OEM设备的第二密钥交换信息Y，分别得到OEM设备的加密密钥K_enc和OEM设备的工作密钥K_mac。
OEM设备的加密密钥K_enc可以满足：K_enc＝HKDF(y*X，S1||X||Y||“ENC”)；
OEM设备的工作密钥K_mac可以满足：K_mac＝HKDF(y*X，S1||X||Y||“MAC”)。
第二步骤：OEM设备使用OEM设备的加密密钥k_enc对目标密钥PMEK进行加密，得到密文C，并根据OEM设备的工作密钥k_mac，得到OEM设备的工作密钥标签MAC1。
密文C可以满足：C＝AES-GCM(K_enc，PMEK)，其中，C需要的IV＝|SHA256(X||Y)| 96。
OEM设备的工作密钥标签MAC1可以满足：MAC1＝HMAC(K_mac，S1||X||Y)。
第三步骤：OEM设备使用OEM设备的签名认证私钥sk_OEM对密文C和OEM设备的工作密钥标签MAC1进行签名，得到第一数字签名S2。
第一数字签名S2可以满足：S2＝Sign(sk_OEM，X||Y||MAC1||C)。
S609：OEM设备向TIER1设备发送响应消息，TIER1设备接收OEM设备发送的响应消息。
其中，响应消息中包括密文C、OEM设备的第二密钥交换信息Y、OEM的数字签名证书、第一数字签名S2、OEM设备的工作密钥标签MAC1。
S610：TIER1设备使用上述响应消息中包括的OEM设备的数字签名证书，对响应消息中包含的第一数字签名S2进行认证。
TIER1设备认证第一数字签名S2有效之后，才执行下面步骤S611。
S611：TIER1设备根据第一认证签名S1、TIER1设备的第一密钥信息x、TIER1设备的第一密钥交换信息X、OEM设备的第二密钥交换信息Y，得到TIER1设备的解密密钥，并使用该TIER1设备的解密密钥对密文C进行解密，获取目标密钥PMEK。
TIER1设备在执行步骤611时，具体包括以下步骤：
第一步骤：TIER1设备使用上述响应消息中包括的OEM设备的数字签名证书，对响应消息中包含的第一数字签名S2进行认证。
第一步骤：TIER1设备认证第一数字签名S2有效之后，根据第一认证S1、TIER1设备的第一密钥信息x、TIER1设备的第一密钥交换信息X、OEM设备的第二密钥交换信息Y，分别得到TIER1设备的解密密钥K_dec和TIER1设备的工作密钥K_mac’。
TIER1设备的解密密钥K_dec可以满足：K_dec＝HKDF(x*Y，S1||X||Y||“ENC”)；
TIER1设备的工作密钥K_mac’可以满足：K_mac＝HKDF(x*Y，S1||X||Y||“MAC”)。
第二步骤：TIER1设备根据TIER1设备的工作密钥K_mac’，得到TIER1设备的工作密钥标签MAC2,将TIER1设备的工作密钥标签MAC2和响应消息中的OEM设备的工作密钥标签MAC1进行比较。
TIER1设备的工作密钥标签MAC2可以满足：MAC2＝HMAC(K_mac，S1||X||Y)。
第三步骤：当TIER1设备确定OEM设备的工作密钥标签MAC2和OEM设备的工作密钥标签MAC1相同时，TIER1设备使用TIER1设备的解密密钥K_dec对响应消息中的密文C进行解密，得到目标密钥PMEK。
目标密钥PMEK可以满足：PMEK＝AES-GCM(K_dec，C)，其中，C需要的IV＝|SHA256(X||Y)| 96。
S612：TIER1设备根据预设的密钥算法和目标密钥PMEK，得到确认密钥K_ack；
确认密钥K_ack可以满足：K_ack＝HKDF(PMEK，S1||X||Y“ACK”)。
S613：TIER1设备根据确认密钥K_ack，生成确认信息MAC3；进一步TIER1设备根据TIER1设备的签名认证私钥和确认信息MAC3，得到确认签名ACK。
确认信息MAC3可以满足：MAC3＝HKDF(K_ack，S1||S2||X||Y||MAC1||C)。
确认签名ACK可以满足：ACK＝Sign(sk_TIER1，MAC1||S1||S2||X||Y||MAC1||C“Succeeded or Failed”)。
S614：TIER1设备向OEM设备发送确认信息，该确认信息中包括验证信息MAC3和 验证签名ACK。OEM设备接收TIER1设备发送的确认信息。
S615：OEM设备根据预设的密钥算法和目标密钥得到的第一确认密钥K_ack’，使用该第一确认密钥K_ack’认证确认信息中的验证信息MAC3。
第一确认密钥表示为K_ack’，确认信息中的验证信息表示为MAC3，第一验证信息MAC’。K_ack’和MAC’的公式可以满足以下：
K_ack’＝HKDF(PMEK,S1||S2||S3||enc_pk||nonce1||nonce2||“ACK”)；
MAC’＝HKDF(K_ack’，nonce1||nonce2)。
OEM设备将第一确认密钥MAC’与确认信息中的验证信息MAC3进行比较，若相同，则确定TIER1设备已成功获取目标密钥传输。
在第四个实施例中，客户端以TIER1设备为例，密钥管理实体以OEM设备为例。TIER1设备中存储了TIER1设备的数字签名证书、TIER1设备的签名认证私钥sk_TIER1。OEM设备中存储了OEM设备的数字签名证书、OEM设备的签名认证私钥sk_OEM，目标密钥PMEK。如图7所示，具体流程包括以下步骤：
S701：TIER1设备生成一次性第一密钥信息，并根据该第一密钥信息x，得到TIER1设备的第一密钥交换信息X。
TIER1设备在有数字签名证书的情况下，执行步骤S601具体可以参考上述步骤S605，此处不再具体赘述。
S702：TIER1设备向OEM设备发送请求消息，OEM设备接收TIER1设备发送的请求消息。
该请求消息中包括TIER1设备的第一密钥交换信息X、第一认证签名S1、TIER1设备的签名认证公钥pk_TIER1，以及TIER1设备的数字签名证书。其中，第一认证签名S1为TIER1设备使用TIER1设备的签名认证私钥sk_TIER1对第一密钥交换信息X进行签名得到的。
具体的，S1可以满足：S1＝Sign(sk_TIER1，X)。
S703：OEM设备对请求消息中的第一认证签名S1进行认证。
具体的，OEM设备使用请求消息中的OEM设备的数字签名证书对请求消息中的第一认证签名S1进行认证。当OEM设备认证第一认证签名S1有效之后，执行下面步骤S704。
S704：OEM设备根据第一认证签名S1、TIER1设备的第一密钥交换信息X、OEM设备的第二密钥信息y、OEM设备的第二密钥交换信息Y，得到OEM设备得加密密钥，使用OEM设备的加密密钥，对目标密钥PMEK进行加密，得到密文C。
OEM设备执行步骤S704时，具体可以参考上述步骤S608，此处不再具体赘述。
需要注意的是，TIER1设备和OEM设备均存储了EC曲线的基点G的情况下，TIER1设备的第一密钥信息x和TIER1设备的第一密钥交换信息X可以互相推导出来，OEM设备的第二密钥信息x和OEM设备的第二密钥交换信息X可以互相推导出来。
S705：OEM设备向TIER1设备发送响应消息，TIER1设备接收OEM设备发送的响应消息。
响应消息中包括密文C、OEM设备的第二密钥交换信息Y、OEM的数字签名证书、第一数字签名S2、OEM设备的工作密钥标签MAC1。具体可参考上述步骤S609，此处不再具体赘述。
S706：TIER1设备使用上述响应消息中包括的OEM设备的数字签名证书，对响应消 息中包含的第一数字签名S2进行认证。
TIER1设备认证第一数字签名S2有效之后，才执行下述步骤S707。
S707：TIER1设备根据所述第一认证签名S1、TIER1设备的第一密钥信息x、TIER1设备的第一密钥交换信息X、OEM设备的第二密钥交换信息Y，得到TIER1设备的解密密钥，使用该TIER1设备的解密密钥，对密文C进行解密，获取目标密钥PMEK。
TIER1设备执行步骤S707时，具体可参考上述步骤S611，此处不再具体赘述。
S708：TIER1设备根据预设的密钥算法和目标密钥PMEK，得到确认密钥K_ack；
TIER1设备执行步骤S708时，具体可参考上述步骤S612，此处不再具体赘述。
S709：TIER1设备根据所述确认密钥K_ack，生成验证信息MAC3；进一步TIER1设备根据TIER1设备的签名认证私钥和验证信息MAC3，得到验证签名ACK。
TIER1设备执行步骤S709时，具体可参考上述步骤S613，此处不再具体赘述。
S710：TIER1设备向OEM设备发送确认信息，该确认信息中包括验证信息MAC3和验证签名ACK。OEM设备接收TIER1发送的确认信息。
TIER1设备执行步骤S710时，具体可参考上述步骤S614，此处不再具体赘述。
S711：OEM设备根据预设的密钥算法和目标密钥得到的第一确认密钥K_ack’，使用该确认密钥K_ack’认证确认信息中的验证信息MAC3。
TIER1设备执行步骤S711时，具体可参考上述步骤S615，此处不再具体赘述。
基于同一技术构思，本申请实施例提供第一种密钥的传输装置(与本申请实施例的第一种方案相对应)，具有上述方法实施例中客户端的行为功能。该密钥的传输装置可以包括执行上述方法实施例中所描述的方法/操作/步骤/动作所一一对应的模块或单元，该模块或单元可以是硬件电路，也可是软件，也可以是硬件电路结合软件实现。该装置可以具有如图8所示的结构。
如图8所示，该装置800可包括通信单元801、处理单元802，下面对各单元进行具体的介绍。
通信单元801，用于向密钥管理实体发送请求消息，其中，所述请求消息用于请求目标密钥，所述请求消息中包括所述客户端的加密公钥、所述客户端对所述加密公钥的签名，以及所述客户端的签名认证信息；
所述通信单元801，还用于接收所述密钥管理实体的响应消息，所述响应消息中包括密文、所述密钥管理实体对所述密文的签名，以及所述密钥管理实体的签名认证信息；其中，所述密文为是根据所述客户端的加密公钥对所述目标密钥加密得到的；
处理单元802，用于使用所述密钥管理实体的签名认证信息确定所述密文的签名正确；所述处理单元802还用于使用所述客户端的加密私钥对所述密文进行解密，获取所述目标密钥；
所述通信单元801还用于向所述密钥管理实体发送确认消息，所述确认信息用于确认所述客户端收到所述目标密钥。
一种可能的设计中，所述处理单元802，还用于：在所述通信单元801向所述密钥管理实体发送确认消息之前，根据所述目标密钥、所述目标密钥传输过程信息以及所述目标密钥的确认结果产生确认密钥；根据所述确认密钥得到验证信息。
一种可能的设计中，所述确认消息包括：所述验证信息，以及所述客户端对所述验证信息和所述目标密钥传输过程信息的签名。
一种可能的设计中，所述目标密钥传输过程信息包括以下一项或多项：所述客户端对所述加密公钥的签名、所述密钥管理实体对所述目标密钥的签名、所述密钥管理实体对所述密文的签名、所述密文、所述加密公钥。
一种可能的设计中，所述客户端的签名认证信息包括：所述客户端的数字签名证书。
一种可能的设计中，所述客户端的签名认证信息包括：初始认证签名和所述客户端的签名认证公钥；所述通信单元801还用于：在向所述密钥管理实体发送所述请求消息之前，
向所述密钥管理实体发送认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；接收所述密钥管理实体的初始认证签名，其中，所述初始认证签名是根据所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名得到的。
一种可能的设计中，所述密钥管理实体的认证信息包括：所述密钥管理系统的数字签名证书。
一种可能的设计中，所述响应消息还包括所述密钥管理实体对所述目标密钥的签名，所述方法包括：所述客户端根据所述密钥管理实体的签名认证信息，确定所述密钥管理实体对所述目标密钥的签名正确。
一种可能的设计中，所述目标密钥传输过程信息还包括所述密钥管理实体对所述目标密钥的签名。
基于同一技术构思，本申请实施例还提供第一种密钥的传输装置(与本申请实施例的第一种方案相对应)，具有上述方法实施例中密钥管理实体的行为功能。该密钥的传输装置可以包括执行上述方法实施例中所描述的方法/操作/步骤/动作所一一对应的模块或单元，该模块或单元可以是硬件电路，也可是软件，也可以是硬件电路结合软件实现。该装置结构图也可以参考上述图8所示的结构。
如图8所示，该装置800可包括通信单元801、处理单元802，下面对各单元进行具体的介绍。
通信单元801，用于接收客户端发送的请求消息，其中，所述请求消息用于请求目标密钥，所述请求消息中包括所述客户端的加密公钥、所述客户端对所述加密公钥的签名，以及所述客户端的签名认证信息；
处理单元802，用于根据所述客户端的签名认证信息确定所述客户端对所述加密公钥的签名正确；
所述处理单元802，还用于使用所述客户端的加密公钥对所述目标密钥和所述目标密钥的签名进行加密，得到密文；
所述通信单元801，还用于向所述客户端发送响应消息，所述响应消息中包括所述密文、所述密钥管理实体对所述目标密钥的签名、所述密钥管理实体对所述密文的签名，以及所述密钥管理实体的签名认证信息；接收所述客户端发送的确认消息，所述确认信息用于确认所述客户端收到所述目标密钥。
一种可能的设计中，所述确认消息包括：所述验证信息，以及所述客户端对所述验证信息和所述目标密钥传输过程信息的签名；其中，所述验证信息为所述客户端根据确认密钥得到的，所述确认密钥为所述客户端根据所述目标密钥、所述目标密钥传输过程信息以及所述目标密钥的确认结果得到的。
一种可能的设计中，所述目标密钥传输过程信息包括以下一项或多项：所述客户端对 所述加密公钥的签名、所述密钥管理实体对所述目标密钥的签名、所述密钥管理实体对所述密文的签名、所述密文、所述加密公钥。
一种可能的设计中，所述客户端的签名认证信息包括：所述客户端的数字签名证书。
一种可能的设计中，所述客户端的签名认证信息包括：初始认证签名以及所述客户端的签名认证公钥；所述通信单元801还用于：在接收所述客户端发送的请求消息之前，先接收所述客户端发送的认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；然后通过处理单元802使用所述认证请求，对所述客户端进行身份认证；进一步在所述客户端身份认证通过之后，使用所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名，得到初始认证签名；最后向所述客户端发送所述初始认证签名。
一种可能的设计中，所述密钥管理实体的认证信息包括：所述密钥管理系统的数字签名证书。
一种可能的设计中，所述处理单元802还用于：使用所述客户端的加密公钥对所述目标密钥和所述目标密钥的签名进行加密，得到密文之前，使用所述客户端的签名认证公钥，确定所述初始认证签名正确。
基于同一技术构思，本申请实施例还提供一种密钥的传输装置(与本申请实施例的第二种方案相对应)，具有上述方法实施例中客户端的行为功能。该密钥的传输装置可以包括执行上述方法实施例中所描述的方法/操作/步骤/动作所一一对应的模块或单元，该模块或单元可以是硬件电路，也可是软件，也可以是硬件电路结合软件实现。该装置的结构图可以参考上述图8所示的结构。
如图8所示，该装置800可包括通信单元801、处理单元802，下面对各单元进行具体的介绍。
通信单元801，用于向密钥管理实体发送请求消息；所述请求消息用于请求目标密钥，所述请求消息中包括第一密钥交换信息、所述客户端对所述第一密钥交换信息的签名，以及所述客户端的签名认证信息；
所述通信单元801还用于接收所述密钥管理实体的响应消息，所述响应消息中包括密文、所述密钥管理实体的第二密钥交换信息、所述密钥管理实体对第一传输过程信息的签名，以及所述密钥管理实体的签名认证信息，其中，所述密文为所述密钥管理实体根据所述密钥管理实体的加解密密钥对所述目标密钥加密得到的，所述密钥管理实体的加解密密钥为所述密钥管理实体根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到的；
所述第一传输过程信息包括以下一项或多项：所述密文、所述第一密钥交换信息、所述第二密钥交换信息；
处理单元802，用于根据所述密钥管理实体的签名认证信息确定所述密钥管理实体对第一传输过程信息的签名正确；
所述处理单元802还用于使用所述客户端的加解密密钥，对所述密文进行解密，获取所述目标密钥；所述客户端的加解密密钥为所述客户端根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到的；
所述通信单元801还用于向所述密钥管理实体发送确认消息，所述确认信息用于确认 所述客户端收到所述目标密钥。
一种可能的设计中，所述处理单元802还用于：在所述通信单元801向所述密钥管理实体发送确认消息之前，根据所述目标密钥，第二传输过程信息以及所述目标密钥的确认结果产生确认密钥；根据所述确认密钥和所述目标密钥传输过程信息得到第三验证信息；
其中，所述第二传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名、所述密钥管理实体对第一传输过程信息的签名、所述第一密钥交换信息、所述第二密钥交换信息；
所述目标密钥传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名、所述密钥管理实体对第一传输过程信息的签名、所述第一密钥交换信息、所述第二密钥交换信息，所述密文。
一种可能的设计中，所述确认消息包括：所述第三验证信息，以及所述客户端对所述第三验证信息和所述目标密钥传输过程信息的签名。
一种可能的设计中，所述客户端的签名认证信息包括：所述客户端的数字签名证书。
一种可能的设计中，所述客户端的签名认证信息包括：初始认证签名和所述客户端的签名认证公钥；所述通信单元801还用于：在所述客户端向所述密钥管理实体发送所述请求消息之前，向所述密钥管理实体发送认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；接收所述密钥管理实体的初始认证签名，其中，所述初始认证签名是根据所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名得到的。
一种可能的设计中，所述密钥管理实体的认证信息包括：所述密钥管理系统的数字签名证书。
一种可能的设计中，所述响应消息还包括：第一验证信息；其中，所述第一验证信息为所述密钥管理实体根据第一验证密钥、所述客户端对所述第一密钥交换信息的签名、所述第一密钥交换信息、所述第二密钥交换信息得到的；所述第一验证密钥为所述密钥管理实体根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到的；
所述第一传输过程信息还包括：所述第一验证信息。
一种可能的设计中，所述处理单元802还用于：在使用所述客户端的加解密密钥，对所述密文进行解密，获取所述目标密钥之前，根据第二验证密钥确定所述第一验证信息正确；其中，所述第二验证密钥为所述客户端根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息、所述客户端对所述第一密钥交换信息的签名得到的。
一种可能的设计中，所述目标密钥传输过程信息还包括：所述第一验证信息。
基于同一技术构思，本申请实施例还提供一种密钥的传输装置(与本申请实施例的第二种方案相对应)，具有上述方法实施例中密钥管理实体的行为功能。该密钥的传输装置可以包括执行上述方法实施例中所描述的方法/操作/步骤/动作所一一对应的模块或单元，该模块或单元可以是硬件电路，也可是软件，也可以是硬件电路结合软件实现。该装置的结构图可以参考上述图8所示的结构。
如图8所示，该装置800可包括通信单元801、处理单元802，下面对各单元进行具体的介绍。
所述通信单元801，用于接收客户端发送的请求消息；其中，所述请求消息用于请求 目标密钥，所述请求消息中包括第一密钥交换信息、所述客户端对所述第一密钥交换信息的签名，以及所述客户端的签名认证信息；
处理单元802，用于根据所述客户端的签名认证信息确定所述客户端对所述第一密钥交换信息的签名正确；所述处理单元802，还用于使用所述密钥管理实体的加解密密钥对所述目标密钥进行加密，得到密文；
所述通信单元801，还用于向所述客户端发送响应消息，所述响应消息中包括所述密文、所述密钥管理实体的第二密钥交换信息、所述密钥管理实体对第一传输过程信息的签名，以及所述密钥管理实体的签名认证信息；
其中，所述第一传输过程信息包括以下一项或多项：所述密文，所述第一密钥交换信息，所述第二密钥交换信息；
所述通信单元801，还用于接收所述客户端发送的确认消息，所述确认信息用于确认所述客户端收到所述目标密钥。
一种可能的设计中，所述确认消息包括：第三验证信息，以及所述客户端对所述第三验证信息和所述目标密钥传输过程信息的签名；所述第三验证信息为所述客户端根据确认密钥和所述目标密钥传输过程信息得到的；所述确认密钥为所述客户端根据所述目标密钥、第二传输过程信息以及所述目标密钥的确认结果得到的。
其中，所述第二传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名，所述密钥管理实体对第一传输过程信息的签名，所述第一密钥交换信息，所述第二密钥交换信息；
所述目标密钥传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名，所述密钥管理实体对第一传输过程信息的签名，所述第一密钥交换信息，所述第二密钥交换信息，所述密文。
一种可能的设计中，所述客户端的签名认证信息包括：所述客户端的数字签名证书。一种可能的设计中，所述客户端的签名认证信息包括：初始认证签名和所述客户端的签名认证公钥；所述通信单元801还用于：在接收所述客户端发送的所述请求消息之前，接收所述客户端的认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；然后通过处理单元802根据所述认证请求，对所述客户端进行身份认证；
进一步在所述客户端身份认证通过之后，使用所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名，得到初始认证签名；最后向所述客户端发送所述初始认证签名。
一种可能的设计中，所述密钥管理实体的认证信息包括：所述密钥管理系统的数字签名证书。
一种可能的设计中，所述处理单元802还用于：在使用所述密钥管理实体的加解密密钥对所述目标密钥进行加密，得到密文时，根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到第一验证密钥；然后根据所述第一验证密钥、所述客户端对所述第一密钥交换信息的签名、所述第一密钥交换信息、所述第二密钥交换信息，得到第一验证信息。
一种可能的设计中，所述响应消息还包括：所述第一验证信息；所述第一传输过程信息还包括：所述第一验证信息。
此外，本申请实施例还提供一种本申请第一种方案所使用的密钥传输的设备，该密钥 传输的设备可以具有如图9所示的结构，所述密钥传输的设备可以是客户端，也可以是能够支持客户端实现上述方法的芯片或芯片系统。如图9所示的密钥传输的设备900可以包括至少一个处理器902，所述至少一个处理器902用于与存储器903耦合，读取并执行所述存储器中的指令以实现本申请实施例提供的方法中客户端涉及的步骤。可选的，该装置900还可以包括收发器901，所述收发器901可以用于支持装置900进行信令或者数据的接收或发送。装置900中的收发器902，可用于实现上述通信单元801所具有的功能，例如，收发器901可用于装置900执行如图2所示的密钥的传输方法中的S201、S204和S207，或者如图3所示的密钥的传输方法中的S301和S304、S306、S309、S314，或者如图4所示的密钥的传输方法中的S402、S405和S410所示步骤，处理器902可用于实现上述处理单元802所具有的功能，例如，处理器902可用于装置900执行如图2所示的密钥的传输方法中的S202、S203、S205和S206，或者如图3所示的密钥的传输方法中的S305和S310-S313，或者如图4所示的密钥的传输方法中的S401和S406-S409所示步骤。此外，收发器901可与天线耦合，用于支持装置900进行通信。可选的，装置900还可以包括存储器903，其中存储有计算机程序、指令，存储器903可以与处理器902和/或收发器901耦合，用于支持处理器902调用存储器903中的计算机程序、指令以实现本申请实施例提供的方法中TIER1设备涉及的步骤；另外，存储器903还可以用于存储本申请方法实施例所涉及的数据，例如，用于存储支持收发器902实现交互所必须的数据、信息。
本申请实施例还提供的一种本申请第一种方案所使用的密钥传输的设备，该密钥传输的设备也可以具有如图9所示的结构，所述密钥传输的设备可以是密钥管理实体，也可以是能够支持密钥管理实体实现上述方法的芯片或芯片系统。如图9所示的密钥传输的设备900可以包括至少一个处理器902，所述至少一个处理器902用于与存储器903耦合，读取并执行所述存储器903中的指令以实现本申请实施例提供的方法中密钥管理实体涉及的步骤。可选的，该装置900还可以包括收发器901，所述收发器901可以用于支持装置900进行信令或者数据的接收或发送。装置900中的收发器901，可用于实现上述通信单元801所具有的功能，例如，收发器901可用于装置900执行如图2所示的密钥的传输方法中的S201、S204和S207，或者如图3所示的密钥的传输方法中的S301和S304、S306、S309、S314，或者如图4所示的密钥的传输方法中的S401和S406-S409所示步骤，处理器902可用于实现上述处理单元802所具有的功能，例如，处理器902可用于装置900执行如图2所示的密钥的传输方法中的S205、S206，或者如图3所示的密钥的传输方法中的S302-S303、S307-S308、S315，或者如图4所示的密钥的传输方法中的S403-S404、S411所示步骤。此外，收发器901可与天线耦合，用于支持装置900进行通信。可选的，装置900还可以包括存储器903，其中存储有计算机程序、指令，存储器903可以与处理器902和/或收发器901耦合，用于支持处理器902调用存储器903中的计算机程序、指令以实现本申请实施例提供的方法中OEM设备涉及的步骤；另外，存储器903还可以用于存储本申请方法实施例所涉及的数据，例如，用于存储支持收发器901实现交互所必须的数据、信息。
本申请实施例还提供一种本申请第二种方案所使用的密钥传输的设备，该密钥传输的设备也可以具有如图9所示的结构，所述密钥传输的设备可以是客户端，也可以是能够支持客户端实现上述方法的芯片或芯片系统。如图9所示的密钥传输的设备900可以包括至少一个处理器902，所述至少一个处理器902用于与存储器903耦合，读取并执行所述存 储器中的指令以实现本申请实施例提供的方法中客户端涉及的步骤。可选的，该装置900还可以包括收发器901，所述收发器901可以用于支持装置900进行信令或者数据的接收或发送。装置900中的收发器901，可用于实现上述通信单元801所具有的功能，例如，收发器901可用于装置900执行如图5所示的密钥的传输方法中的S501、S504和S507，或者如图6所示的密钥的传输方法中的S601和S604、S606、S609、S614，或者如图7所示的密钥的传输方法中的S702、S705和S710所示步骤，处理器902可用于实现上述处理单元802所具有的功能，例如，处理器902可用于装置900执行如图5所示的密钥的传输方法中的S502、S503、S505和S506，或者如图6所示的密钥的传输方法中的S605和S610-S613，或者如图7所示的密钥的传输方法中的S701和S706-S709所示步骤。此外，收发器901可与天线耦合，用于支持装置900进行通信。可选的，装置900还可以包括存储器903，其中存储有计算机程序、指令，存储器903可以与处理器902和/或收发器901耦合，用于支持处理器902调用存储器903中的计算机程序、指令以实现本申请实施例提供的方法中TIER1设备涉及的步骤；另外，存储器903还可以用于存储本申请方法实施例所涉及的数据，例如，用于存储支持收发器901实现交互所必须的数据、信息。
本申请实施例还提供本申请第二种方案所使用的密钥传输的设备，该密钥传输的设备也可以具有如图9所示的结构，所述密钥传输的设备可以是密钥管理实体，也可以是能够支持密钥管理实体实现上述方法的芯片或芯片系统。如图9所示的密钥传输的设备900可以包括至少一个处理器902，所述至少一个处理器902用于与存储器903耦合，读取并执行所述存储器中的指令以实现本申请实施例提供的方法中密钥管理实体涉及的步骤。可选的，该装置900还可以包括收发器901，所述收发器901可以用于支持装置900进行信令或者数据的接收或发送。装置900中的收发器901，可用于实现上述通信单元801相应的所具有的功能，例如，收发器901可用于装置900执行如图5所示的密钥的传输方法中的S501、S504和S507，或者如图6所示的密钥的传输方法中的S601和S606、S611，或者如图7所示的密钥的传输方法中的S702和S710所示步骤，处理器902可用于实现上述相应的处理单元802所具有的功能，例如，处理器902可用于装置900执行如图5所示的密钥的传输方法中的S505、S506，或者如图6所示的密钥的传输方法中的S602-S603、S607-S608、S615，或者如图7所示的密钥的传输方法中的S703-S704、S711所示步骤。此外，收发器901可与天线耦合，用于支持装置900进行通信。可选的，装置900还可以包括存储器903，其中存储有计算机程序、指令，存储器903可以与处理器902和/或收发器902耦合，用于支持处理器902调用存储器903中的计算机程序、指令以实现本申请实施例提供的方法中OEM设备涉及的步骤；另外，存储器903还可以用于存储本申请方法实施例所涉及的数据，例如，用于存储支持收发器901实现交互所必须的数据、信息。
基于与上述方法实施例相同构思，本申请实施例还提供了一种计算机可读存储介质，其上存储有一些指令，这些指令被计算机调用执行时，可以使得计算机完成上述方法实施例、方法实施例的任意一种可能的设计中所涉及的方法。本申请实施例中，对计算机可读存储介质不做限定，例如，可以是RAM(random-access memory，随机存取存储器)、ROM(read-only memory，只读存储器)等。
基于与上述方法实施例相同构思，本申请还提供一种计算机程序产品，该计算机程序产品在被计算机调用执行时可以完成方法实施例以及上述方法实施例任意可能的设计中所涉及的方法。
基于与上述方法实施例相同构思，本申请还提供一种芯片，该芯片可以包括处理器以及接口电路，用于完成上述方法实施例、方法实施例的任意一种可能的实现方式中所涉及的方法，其中，“耦合”是指两个部件彼此直接或间接地结合，这种结合可以是固定的或可移动性的，这种结合可以允许流动液、电、电信号或其它类型信号在两个部件之间进行通信。
综上所述，本申请实施例提供了一种密钥的传输方法，该方法中，客户端向密钥管理实体发送请求消息，该请求消息用于请求密钥管理实体的目标密钥，请求消息中包括客户端的加密公钥或者客户端的第一密钥交换信息；密钥管理实体可以使用客户端的加密公钥对目标密钥加密得到密文，或者密钥管理实体可以使用密钥管理实体的加解密密钥对目标密钥进行加密，得到密文。密钥管理实体向客户端发送包括密文或密钥管理实体的第二密钥交换信息的响应信息；客户端使用客户端的加密私钥对密文解密获得目标密钥，或者客户端使用客户端的加解密密钥对密文进行解密，得到目标密钥。该方法利用加密密钥对或密钥协商信息实现密钥传输，从而可以保证密钥传输的安全性，并防止不同设备发送或接收目标密钥后进行否认。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请实施例可以用硬件实现，或固件实现，或它们的组合方式来实现。当使用软件实现时，可以将上述功能存储在计算机可读介质中或作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是计算机能够存取的任何可用介质。以此为例但不限于：计算机可读介质可以包括RAM、ROM、电可擦可编程只读存储器(electrically erasable programmable read only memory，EEPROM)、只读光盘(compact disc read-Only memory，CD-ROM)或其他光盘存储、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质。此外。任何连接可以适当的成为计算机可读介质。例如，如果软件是使用同轴电缆、光纤光缆、双绞线、数字用户线(digital subscriber line，DSL)或者诸如红外线、无线电和微波之类的无线技术从网站、服务器或者其他远程源传输的，那么同轴电缆、光纤光缆、双绞线、DSL或者诸如红外线、无线和微波之类的无线技术包括在所属介质的定影中。如本申请实施例所使用的，盘(disk)和碟(disc)包括压缩光碟(compact disc，CD)、激光碟、光碟、数字通用光碟(digital video disc，DVD)、软盘和蓝光光碟，其中盘通常磁性的复制数据，而碟则用激光来光学的复制数据。上面的组合也应当包括在计算机可读介质的保护范围之内。
总之，以上所述仅为本申请的实施例而已，并非用于限定本申请的保护范围。凡根据本申请的揭露，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (35)

  1. 一种密钥的传输方法，其特征在于，包括：
    客户端向密钥管理实体发送请求消息，其中，所述请求消息用于请求目标密钥，所述请求消息中包括所述客户端的加密公钥、所述客户端对所述加密公钥的签名，以及所述客户端的签名认证信息；
    所述客户端接收所述密钥管理实体的响应消息，所述响应消息中包括密文、所述密钥管理实体对所述密文的签名，以及所述密钥管理实体的签名认证信息；其中，所述密文为是根据所述客户端的加密公钥对所述目标密钥加密得到的；
    所述客户端使用所述密钥管理实体的签名认证信息确定所述密文的签名正确；
    所述客户端使用所述客户端的加密私钥对所述密文进行解密，获取所述目标密钥；
    所述客户端向所述密钥管理实体发送确认信息，所述确认信息用于确认所述客户端收到所述目标密钥。
  2. 如权利要求1所述的方法，其特征在于，所述客户端向所述密钥管理实体发送确认信息之前，所述方法还包括：
    所述客户端根据所述目标密钥、所述目标密钥传输过程信息以及所述目标密钥的确认结果产生确认密钥；
    所述客户端根据所述确认密钥得到验证信息。
  3. 如权利要求2所述的方法，其特征在于，所述确认信息中包括：所述验证信息，以及所述客户端对所述验证信息和所述目标密钥传输过程信息的签名。
  4. 如权利要求3所述的方法，其特征在于，所述目标密钥传输过程信息包括以下一项或多项：所述客户端对所述加密公钥的签名、所述密钥管理实体对所述密文的签名、所述密文、所述加密公钥。
  5. 如权利要求1至4任一项所述的方法，其特征在于，所述客户端的签名认证信息包括：所述客户端的数字签名证书。
  6. 如权利要求1至4任一项所述的方法，其特征在于，所述客户端的签名认证信息包括：初始认证签名和所述客户端的签名认证公钥；
    所述客户端向所述密钥管理实体发送所述请求消息之前，所述方法还包括：
    所述客户端向所述密钥管理实体发送认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；
    所述客户端接收所述密钥管理实体的初始认证签名，其中，所述初始认证签名是根据所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名得到的。
  7. 如权利要求1至6任一项所述的方法，其特征在于，所述密钥管理实体的认证信息包括：所述密钥管理实体的数字签名证书。
  8. 如权利要求1至7任一项所述的方法，其特征在于，所述响应消息还包括所述密钥管理实体对所述目标密钥的签名，所述方法包括：所述客户端根据所述密钥管理实体的签名认证信息，确定所述密钥管理实体对所述目标密钥的签名正确。
  9. 如权利要求8所述的方法，其特征在于，所述目标密钥传输过程信息还包括：所述密钥管理实体对所述目标密钥的签名。
  10. 一种密钥的传输方法，其特征在于，所述方法包括：
    密钥管理实体接收客户端发送的请求消息，其中，所述请求消息用于请求目标密钥，所述请求消息中包括所述客户端的加密公钥、所述客户端对所述加密公钥的签名，以及所述客户端的签名认证信息；
    所述密钥管理实体根据所述客户端的签名认证信息确定所述客户端对所述加密公钥的签名正确；
    所述密钥管理实体使用所述客户端的加密公钥对所述目标密钥和所述目标密钥的签名进行加密，得到密文；
    所述密钥管理实体向所述客户端发送响应消息，所述响应消息中包括所述密文、所述密钥管理实体对所述目标密钥的签名、所述密钥管理实体对所述密文的签名，以及所述密钥管理实体的签名认证信息；
    所述密钥管理实体接收所述客户端发送的确认信息，所述确认信息用于确认所述客户端收到所述目标密钥。
  11. 如权利要求10所述的方法，其特征在于，所述确认信息中包括：所述验证信息，以及所述客户端对所述验证信息和所述目标密钥传输过程信息的签名；其中，所述验证信息为所述客户端根据确认密钥得到的，所述确认密钥为所述客户端根据所述目标密钥、所述目标密钥传输过程信息以及所述目标密钥的确认结果得到的。
  12. 如权利要求11所述的方法，其特征在于，所述目标密钥传输过程信息包括以下一项或多项：所述客户端对所述加密公钥的签名、所述密钥管理实体对所述目标密钥的签名、所述密钥管理实体对所述密文的签名、所述密文、所述加密公钥。
  13. 如权利要求10至12任一项所述的方法，其特征在于，所述客户端的签名认证信息包括：所述客户端的数字签名证书。
  14. 如权利要求10至12任一项所述的方法，其特征在于，所述客户端的签名认证信息包括：初始认证签名以及所述客户端的签名认证公钥；
    所述密钥管理实体接收所述客户端发送的请求消息之前，所述方法还包括：
    所述密钥管理实体接收所述客户端发送的认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；
    所述密钥管理实体根据所述认证请求，对所述客户端进行身份认证；
    所述密钥管理实体在所述客户端身份认证通过之后，使用所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名，得到初始认证签名；
    所述密钥管理实体向所述客户端发送所述初始认证签名。
  15. 如权利要求14所述的方法，其特征在于，所述密钥管理实体使用所述客户端的加密公钥对所述目标密钥和所述目标密钥的签名进行加密，得到密文之前，所述方法还包括：
    所述密钥管理实体使用所述客户端的签名认证公钥，确定所述初始认证签名正确。
  16. 如权利要求10至15任一项所述的方法，其特征在于，所述密钥管理实体的认证信息包括：所述密钥管理系统的数字签名证书。
  17. 一种密钥的传输方法，其特征在于，所述方法包括：
    客户端向密钥管理实体发送请求消息；所述请求消息用于请求目标密钥，所述请求消息中包括第一密钥交换信息、所述客户端对所述第一密钥交换信息的签名，以及所述客户端的签名认证信息；
    所述客户端接收所述密钥管理实体的响应消息，所述响应消息中包括密文、所述密钥 管理实体的第二密钥交换信息、所述密钥管理实体对第一传输过程信息的签名，以及所述密钥管理实体的签名认证信息，其中，所述密文为所述密钥管理实体根据所述密钥管理实体的加解密密钥对所述目标密钥加密得到的，所述密钥管理实体的加解密密钥为所述密钥管理实体根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到的；
    所述第一传输过程信息包括以下一项或多项：所述密文、所述第一密钥交换信息、所述第二密钥交换信息；
    所述客户端根据所述密钥管理实体的签名认证信息确定所述密钥管理实体对第一传输过程信息的签名正确；
    所述客户端使用所述客户端的加解密密钥，对所述密文进行解密，获取所述目标密钥；所述客户端的加解密密钥为所述客户端根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到的；
    所述客户端向所述密钥管理实体发送确认信息，所述确认信息用于确认所述客户端收到所述目标密钥。
  18. 如权利要求17所述的方法，其特征在于，所述客户端向所述密钥管理实体发送确认信息之前，所述方法还包括：
    所述客户端根据所述目标密钥，第二传输过程信息以及所述目标密钥的确认结果产生确认密钥；所述客户端根据所述确认密钥和所述目标密钥传输过程信息得到第三验证信息；
    其中，所述第二传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名、所述密钥管理实体对第一传输过程信息的签名、所述第一密钥交换信息、所述第二密钥交换信息；
    所述目标密钥传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名、所述密钥管理实体对第一传输过程信息的签名、所述第一密钥交换信息、所述第二密钥交换信息，所述密文。
  19. 如权利要求18所述的方法，其特征在于，所述确认信息中包括：所述第三验证信息，以及所述客户端对所述第三验证信息和所述目标密钥传输过程信息的签名。
  20. 如权利要求17至19任一项所述的方法，其特征在于，所述客户端的签名认证信息包括：所述客户端的数字签名证书。
  21. 如权利要求17至19任一项所述的方法，其特征在于，所述客户端的签名认证信息包括：初始认证签名和所述客户端的签名认证公钥；
    所述客户端向所述密钥管理实体发送所述请求消息之前，所述方法还包括：
    所述客户端向所述密钥管理实体发送认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；
    所述客户端接收所述密钥管理实体的初始认证签名，其中，所述初始认证签名是根据所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名得到的。
  22. 如权利要求17至21任一项所述的方法，其特征在于，所述密钥管理实体的认证信息包括：所述密钥管理实体的数字签名证书。
  23. 如权利要求17至22任一项所述的方法，其特征在于，所述响应消息中还包括：第一验证信息；其中，所述第一验证信息为所述密钥管理实体根据第一验证密钥、所述客户 端对所述第一密钥交换信息的签名、所述第一密钥交换信息、所述第二密钥交换信息得到的；所述第一验证密钥为所述密钥管理实体根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到的；
    所述第一传输过程信息还包括：所述第一验证信息。
  24. 如权利要求23所述的方法，其特征在于，所述客户端使用所述客户端的加解密密钥，对所述密文进行解密，获取所述目标密钥之前，所述方法还包括：
    所述客户端根据第二验证密钥确定所述第一验证信息正确；其中，所述第二验证密钥为所述客户端根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息、所述客户端对所述第一密钥交换信息的签名得到的。
  25. 如权利要求23或24所述的方法，其特征在于，所述目标密钥传输过程信息中还包括：所述第一验证信息。
  26. 一种密钥的传输方法，其特征在于，所述方法包括：
    密钥管理实体接收客户端发送的请求消息；其中，所述请求消息用于请求目标密钥，所述请求消息中包括第一密钥交换信息、所述客户端对所述第一密钥交换信息的签名，以及所述客户端的签名认证信息；
    所述密钥管理实体根据所述客户端的签名认证信息确定所述客户端对所述第一密钥交换信息的签名正确；
    所述密钥管理实体使用所述密钥管理实体的加解密密钥对所述目标密钥进行加密，得到密文；所述密钥管理实体的加解密密钥为所述密钥管理实体根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到的；
    所述密钥管理实体向所述客户端发送响应消息，所述响应消息中包括所述密文、所述密钥管理实体的第二密钥交换信息、所述密钥管理实体对第一传输过程信息的签名，以及所述密钥管理实体的签名认证信息；
    其中，所述第一传输过程信息包括以下一项或多项：所述密文，所述第一密钥交换信息，所述第二密钥交换信息；
    所述密钥管理实体接收所述客户端发送的确认信息，所述确认信息用于确认所述客户端收到所述目标密钥。
  27. 如权利要求26所述的方法，其特征在于，所述确认信息中包括：第三验证信息，以及所述客户端对所述第三验证信息和所述目标密钥传输过程信息的签名；所述第三验证信息为所述客户端根据确认密钥和所述目标密钥传输过程信息得到的；所述确认密钥为所述客户端根据所述目标密钥、第二传输过程信息以及所述目标密钥的确认结果得到的；
    其中，所述第二传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名，所述密钥管理实体对第一传输过程信息的签名，所述第一密钥交换信息，所述第二密钥交换信息；
    所述目标密钥传输过程信息包括以下一项或多项：所述客户端对所述第一密钥交换信息的签名，所述密钥管理实体对第一传输过程信息的签名，所述第一密钥交换信息，所述第二密钥交换信息，所述密文。
  28. 如权利要求26或27所述的方法，其特征在于，所述客户端的签名认证信息包括：所述客户端的数字签名证书。
  29. 如权利要求26或27所述的方法，其特征在于，所述客户端的签名认证信息包括：初始认证签名和所述客户端的签名认证公钥；
    所述密钥管理实体接收所述客户端发送的所述请求消息之前，所述方法还包括：
    所述密钥管理实体接收所述客户端的认证请求，其中，所述认证请求包括：所述客户端的签名认证公钥和所述客户端的身份标识；
    所述密钥管理实体根据所述认证请求，对所述客户端进行身份认证；
    所述密钥管理实体在所述客户端身份认证通过之后，使用所述密钥管理实体的签名认证私钥对所述客户端的签名认证公钥进行签名，得到初始认证签名；
    所述密钥管理实体向所述客户端发送所述初始认证签名。
  30. 如权利要求26至29任一项所述的方法，其特征在于，所述密钥管理实体的认证信息包括：所述密钥管理实体的数字签名证书。
  31. 如权利要求26至30任一项所述的方法，其特征在于，所述密钥管理实体使用所述密钥管理实体的加解密密钥对所述目标密钥进行加密，得到密文时，所述方法还包括：
    所述密钥管理实体根据所述客户端的第一密钥交换信息、所述密钥管理实体的第二密钥交换信息以及所述客户端对所述第一密钥交换信息的签名得到第一验证密钥；
    所述密钥管理实体根据所述第一验证密钥、所述客户端对所述第一密钥交换信息的签名、所述第一密钥交换信息、所述第二密钥交换信息，得到第一验证信息。
  32. 如权利要求31所述的方法，其特征在于，所述响应消息还包括：所述第一验证信息；所述第一传输过程信息还包括：所述第一验证信息。
  33. 一种密钥的传输装置，所述装置应用于客户端时，其特征在于，所述装置包括：
    通信单元，用于接收或发送信息；
    处理单元，用于使得所述客户端执行如权利要求1至9任一所述的方法，或者使得所述客户端执行如权利要求17至25任一所述的方法。
  34. 一种密钥的传输装置，所述装置应用于密钥管理实体时，其特征在于，所述装置包括：
    通信单元，用于接收或发送信息；
    处理单元，用于使得所述密钥管理实体执行如权利要求10至16任一所述的方法，或者使得所述密钥管理实体执行如权利要求26至32任一所述的方法。
  35. 一种密钥的传输系统，其特征在于，包括客户端和密钥管理实体，所述客户端用于执行如权利要求1-9任一所述的方法，所述密钥管理实体用于执行如权利要求10-16任一所述方法；或者所述客户端用于执行如权利要求17-25任一所述的方法，所述密钥管理实体用于执行如权利要求26-32任一所述的方法。
PCT/CN2021/078330 2021-02-27 2021-02-27 一种密钥的传输方法和装置 WO2022178890A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2021/078330 WO2022178890A1 (zh) 2021-02-27 2021-02-27 一种密钥的传输方法和装置
CN202180003014.7A CN113796058B (zh) 2021-02-27 2021-02-27 一种密钥的传输方法和装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/078330 WO2022178890A1 (zh) 2021-02-27 2021-02-27 一种密钥的传输方法和装置

Publications (1)

Publication Number Publication Date
WO2022178890A1 true WO2022178890A1 (zh) 2022-09-01

Family

ID=78877403

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/078330 WO2022178890A1 (zh) 2021-02-27 2021-02-27 一种密钥的传输方法和装置

Country Status (2)

Country Link
CN (1) CN113796058B (zh)
WO (1) WO2022178890A1 (zh)

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0651533A2 (en) * 1993-11-02 1995-05-03 Sun Microsystems, Inc. Method and apparatus for privacy and authentication in a mobile wireless network
CN1534936A (zh) * 2003-03-31 2004-10-06 华为技术有限公司 一种无线局域网中基于公钥证书机制的密钥分发方法
CN101286842A (zh) * 2008-05-26 2008-10-15 西安西电捷通无线网络通信有限公司 一种利用公钥密码技术的密钥分配及其公钥在线更新方法
CN101600204A (zh) * 2009-06-30 2009-12-09 中兴通讯股份有限公司 一种文件传输方法及系统
CN105577613A (zh) * 2014-10-11 2016-05-11 电信科学技术研究院 一种密钥信息的发送和接收方法、设备及系统
CN106453330A (zh) * 2016-10-18 2017-02-22 深圳市金立通信设备有限公司 一种身份认证的方法和系统
CN112054906A (zh) * 2020-08-21 2020-12-08 郑州信大捷安信息技术股份有限公司 一种密钥协商方法及系统

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0651533A2 (en) * 1993-11-02 1995-05-03 Sun Microsystems, Inc. Method and apparatus for privacy and authentication in a mobile wireless network
CN1534936A (zh) * 2003-03-31 2004-10-06 华为技术有限公司 一种无线局域网中基于公钥证书机制的密钥分发方法
CN101286842A (zh) * 2008-05-26 2008-10-15 西安西电捷通无线网络通信有限公司 一种利用公钥密码技术的密钥分配及其公钥在线更新方法
CN101600204A (zh) * 2009-06-30 2009-12-09 中兴通讯股份有限公司 一种文件传输方法及系统
CN105577613A (zh) * 2014-10-11 2016-05-11 电信科学技术研究院 一种密钥信息的发送和接收方法、设备及系统
CN106453330A (zh) * 2016-10-18 2017-02-22 深圳市金立通信设备有限公司 一种身份认证的方法和系统
CN112054906A (zh) * 2020-08-21 2020-12-08 郑州信大捷安信息技术股份有限公司 一种密钥协商方法及系统

Also Published As

Publication number Publication date
CN113796058A (zh) 2021-12-14
CN113796058B (zh) 2022-08-19

Similar Documents

Publication Publication Date Title
US10382485B2 (en) Blockchain-assisted public key infrastructure for internet of things applications
CN113438071B (zh) 安全通信的方法及设备
EP2082525B1 (en) Method and apparatus for mutual authentication
US9641344B1 (en) Multiple factor authentication in an identity certificate service
CN108604985B (zh) 数据传送方法、控制数据使用的方法以及密码设备
JP5136012B2 (ja) データ送付方法
US9124561B2 (en) Method of transferring the control of a security module from a first entity to a second entity
WO2019041802A1 (zh) 基于服务化架构的发现方法及装置
WO2019041809A1 (zh) 基于服务化架构的注册方法及装置
EP2586169A1 (en) Privacy preserving authorisation in pervasive environments
US10411886B1 (en) Authenticating secure channel establishment messages based on shared-secret
WO2022135391A1 (zh) 身份鉴别方法、装置、存储介质、程序、及程序产品
WO2022001225A1 (zh) 身份凭据的申请方法、身份认证的方法、设备及装置
US20240113885A1 (en) Hub-based token generation and endpoint selection for secure channel establishment
JP2021073564A (ja) 通信装置、通信方法、およびコンピュータプログラム
WO2022178890A1 (zh) 一种密钥的传输方法和装置
CN114696999A (zh) 一种身份鉴别方法和装置
CN114765544A (zh) 可信执行环境数据离线迁移方法及装置
WO2022135386A1 (zh) 一种身份鉴别方法和装置
EP4270866A1 (en) Identity authentication method and apparatus, device, chip, storage medium, and program
WO2022135384A1 (zh) 一种身份鉴别方法和装置
Yoon et al. Security enhancement scheme for mobile device using H/W cryptographic module
EP3800825A1 (en) Method and device for configuring alias credential
CN114760038A (zh) 一种身份鉴别方法和装置
KR20220107431A (ko) 하드웨어 보안 모듈을 이용한 인증 서버와 디바이스 간의 상호 인증 방법 및 이를 이용한 장치

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21927325

Country of ref document: EP

Kind code of ref document: A1