CN107302437B

CN107302437B - A kind of personalization method and personalization device of off line authentication data

Info

Publication number: CN107302437B
Application number: CN201710637779.1A
Authority: CN
Inventors: 陆舟; 于华章
Original assignee: Feitian Technologies Co Ltd
Current assignee: Feitian Technologies Co Ltd
Priority date: 2017-07-31
Filing date: 2017-07-31
Publication date: 2019-10-08
Anticipated expiration: 2037-07-31
Also published as: CN107302437A

Abstract

The present invention relates to field of intelligent cards, provide the personalization method and personalization device of a kind of off line authentication data, comprising: personalization device obtains static data, includes the data to be signed of static data according to preset format tissue；Personalization device generates random number, is signed to obtain digital signature to random number and data to be signed using credit card issuer private key；Signed data is generated according to the remainder data for removing static data in digital signature and data to be signed；Personalization device is combined into data grouping according to preset data packet identifier and signed data group；Individualized instruction is created according to data grouping, and individualized file is written into individualized instruction；When individualized file is completed, the main security domain of personalization device choice cards opens exit passageway, and the individualized instruction in individualized file is sent to card.The signed data of generation can be converted into individualized instruction automatically by this method, so that personalization process efficiency improves and more accurate.

Description

A kind of personalization method and personalization device of off line authentication data

Technical field

The present invention relates to the personalization method of field of intelligent cards more particularly to a kind of off line authentication data and individualized set It is standby.

Background technique

With the development of electronic technology, smart card is widely applied by its information memory capacity greatly with highly-safe advantage In multiple industry fields such as finance, traffic, communication, business, education, medical treatment, social security and tourist recreation.

Currently, static data is maliciously tampered in smart card, information is stolen, and the thing that card is replicated happens occasionally, People have seriously affected the property safety of intelligent card subscriber using being that the safety problem of smart card cannot ensure, for solve with Upper problem need to carry out static data certification perhaps Dynamic Data Authentication but in the prior art static data certification or dynamic number Personalization process according to the off line authentication data needed in verification process is comparatively laborious, and needs artificially to join in personalization process Be easy to appear mistake, cause personal data inaccurate, and personalization process inefficiency.

Summary of the invention

The purpose of the present invention is to solve the deficiencies in the prior art, provide a kind of of off line authentication data Peopleization method and personalization device.

The present invention provides a kind of personalization method of off line authentication data, comprising:

Step S1, personalization device determines the card of current operation, and obtains the static number of the card of the current operation According to, according to preset format tissue include static data data to be signed；

Step S2, personalization device generates random number, is signed using credit card issuer private key to random number and data to be signed Name obtains digital signature；Number of signature is generated according to the remainder data for removing static data in digital signature and data to be signed According to；

Step S3, personalization device is combined into data grouping according to preset data packet identifier and signed data group；According to The individualized instruction of data grouping creation, and individualized file is written into individualized instruction；

When individualized file is completed, personalization method further include: the main security domain of personalization device choice cards is opened Exit passageway, and the individualized instruction in individualized file is sent to the card of the current operation；

It is described that the random number and the data to be signed are signed using credit card issuer private key to obtain digital signature tool Body includes:

Step A-1, user can be distinguished that identification bit length, user can distinguish that mark, elliptic curve are joined by personalization device Several and credit card issuer public key sequential concatenation obtains the first data；First data progress SM3 cryptographic Hash algorithm is obtained first Hash Value；

Step A-2, the data to be signed and the first Hash Value sequential concatenation are obtained the second number by personalization device According to, by second data progress SM3 cryptographic Hash algorithm obtain the second Hash Value；

Step A-3, personalization device generates the first random number with randomizer；It is calculated according to first random number Elliptic curve point；

Step A-4, the sum of the abscissa of personalization device calculating elliptic curve point and second Hash Value, will calculate To result and elliptic curve on basic point rank carry out modular arithmetic obtain third data；

Step A-5, personalization device judges whether the third data are equal with the first preset value, is then return step A- 3, it is no to then follow the steps A-6；

Step A-6, it is oval bent that personalization device judges whether the sum of the third data and first random number are equal to The rank of basic point on line is then return step A-3, no to then follow the steps A-7；

Step A-7, personalization device calculate 1 with the mould of the sum of credit card issuer private key is inverse obtains the 4th data, calculating described the The product of three data and credit card issuer private key obtains the 5th data, and the difference for calculating first random number and the 5th data obtains the The rank of basic point in 6th data and elliptic curve is carried out modular arithmetic and obtains the 7th data, calculates the described 4th by six data The product of data and the 7th data obtains the 8th data；

Step A-8, personalization device judges whether the 8th data are equal to the second preset value, is then return step A-3, It is no to then follow the steps A-9；

Step A-9, the third data and the 8th data sequential concatenation are obtained digital signature by personalization device.

The present invention provides a kind of personalization device of off line authentication data, comprising:

Module is obtained, for determining the card of current operation, and obtains the static data of the card of the current operation；

Data to be signed molded tissue block, it is described quiet for being got according to preset format tissue comprising the acquisition module The data to be signed of state data；

Random number generation module, for generating random number；

Signature blocks, for using credit card issuer private key to the number to be signed of the data to be signed molded tissue block tissue It is signed to obtain digital signature according to the random number generated with the random number generation module；

Signed data generation module, the digital signature for being generated according to the signature blocks and described to be signed The remainder data that the static data is removed in data generates signed data；

Data grouping composite module, for being generated according to preset data packet identifier and the signed data generation module The signed data group be combined into data grouping；

Individualized instruction module is created, the data grouping creation for combining according to the data grouping composite module Individualized instruction；

Writing module, for the individualized instruction write-in for creating individualized instruction module creation to be individualized text Part；

Sending module opens exit passageway for the main security domain of the choice cards when the individualized file is completed, and Individualized instruction in individualized file is sent to the card of the current operation；

The signature blocks specifically include:

Splice submodule, for by user can distinguish identification bit length, user can distinguish mark, elliptic curve parameter and Credit card issuer public key sequential concatenation obtains the first data；Be also used to obtain the data to be signed and SM3 operation submodule One Hash Value sequential concatenation obtains the second data；

The SM3 operation submodule, it is miscellaneous that first data for obtaining the splicing submodule carry out SM3 password The algorithm that gathers obtains the first Hash Value；It is also used to the second data that the splicing submodule obtains carrying out SM3 cryptographic Hash algorithm Obtain the second Hash Value；

Elliptic curve point module is calculated, the first random number for generating according to the random number generation module calculates oval Curve point；

Modular arithmetic module, for calculating the abscissa for the elliptic curve point that the calculating elliptic curve point module obtains The sum of second Hash Value obtained with the SM3 operation submodule, by basic point on the result being calculated and elliptic curve Rank carry out modular arithmetic obtain third data；The product for being also used to calculate the third data and credit card issuer private key obtains the 5th number According to the difference for calculating first random number and the 5th data obtains the 6th data, by the 6th data and elliptic curve The rank of upper basic point carries out modular arithmetic and obtains the 7th data；

First judging submodule, the third data for judging that the modular arithmetic module obtains are with the first preset value It is no equal；

Second judgment submodule, for determining the third data and the first preset value not when first judging submodule The third data that the modular arithmetic module the obtains and random number generation module generates described first are judged when equal Whether the sum of random number is equal to the rank of basic point on elliptic curve；

Modular inversion submodule, for determining the institute that the calculating modular arithmetic module obtains when the second judgment submodule State the rank that the sum of third data and first random number of random number generation module generation are equal to basic point on elliptic curve When calculate 1 with the mould of the sum of credit card issuer private key against obtaining the 4th data；

Third judgment module, for calculating the 4th data and the modular arithmetic that the modular inversion submodule obtains The product for the 7th data that module obtains obtains the 8th data, judges whether the 8th data are equal to the second preset value；

Digital signature submodule, for determining that the 8th data are not equal to the second preset value when the third judgment module When, the third data and the 8th data sequential concatenation that the modular arithmetic module obtains are obtained into digital signature；

The random number generation module is specifically used for generating random number as the first random number；It is also used to when described first Judging submodule determines to generate random number when the third data are equal with first preset value, updates the first random number, touch It sends out described and calculates elliptic curve point module；It is also used to determine that the 8th data are pre- with described second when the third judgment module If generating random number when being worth equal, the first random number is updated, triggers the calculating elliptic curve point module.

The beneficial effect that the present invention obtains is: using technical method of the invention, obtains static correspondingly with card Data, and signing automatically according to static data, and individualized instruction is automatically generated according to signature result, and by individualized finger It enables and individualized file is written, so that smart card personalization process efficiency improves and more accurate.

Detailed description of the invention

Fig. 1 is a kind of flow chart of the personalization method for off line authentication data that the embodiment of the present invention 2 provides；

Fig. 2 is a kind of flow chart of the personalization method for off line authentication data that the embodiment of the present invention 3 provides；

Fig. 3 is a kind of module map of the personalization device for off line authentication data that the embodiment of the present invention 4 provides.

Specific embodiment

Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete Site preparation description, it is clear that described embodiments are only a part of the embodiments of the present invention, instead of all the embodiments.It is based on Embodiment in the present invention, it is obtained by those of ordinary skill in the art without making creative efforts every other Embodiment shall fall within the protection scope of the present invention.

Embodiment 1

Present embodiments provide a kind of personalization method of off line authentication data, comprising:

Step S1, personalization device determines the card of current operation, and obtains the static data of the card of current operation, root It include the data to be signed of static data according to preset format tissue；

Static data specifically includes: using main account, using the effective date, using Expiration Date and application version number.

Step S1 specifically: personalization device determines the card of current operation, and obtains the static state of the card of current operation Signed data format, data verification code and static data sequential concatenation are generated data to be signed by data；

Correspondingly, generating signed data tool according to the remainder data that digital signature and data to be signed remove static data Body are as follows: signed data format, data verification code and digital signature sequential concatenation are generated into signed data, signed data is as quiet State signed data.

Alternatively, step S1 specifically: personalization device determines the card of current operation, and obtain the card of current operation IC card public key data and static data sequential concatenation are generated data to be signed by static data；

Correspondingly, generating signed data tool according to the remainder data that digital signature and data to be signed remove static data Body are as follows: IC card public key data and digital signature sequential concatenation are generated into signed data, signed data is IC card public key certificate.

Specifically, being signed to obtain digital signature to random number and data to be signed using credit card issuer private key specifically: Random number and data to be signed are signed to obtain digital signature by SM2 algorithm using credit card issuer private key.

Further, random number and data to be signed are signed to obtain digital signature using credit card issuer private key specific Include:

Step A-1, user can be distinguished that identification bit length, user can distinguish that mark, elliptic curve are joined by personalization device Several and credit card issuer public key sequential concatenation obtains the first data；First data progress SM3 cryptographic Hash algorithm is obtained into the first hash Value；

Step A-2, data to be signed and the first Hash Value sequential concatenation are obtained the second data by personalization device, by second Data carry out SM3 cryptographic Hash algorithm and obtain the second Hash Value；

Step A-3, personalization device generates the first random number with randomizer；It is calculated according to the first random number oval Curve point；

Step A-4, personalization device calculates the sum of abscissa and second Hash Value of elliptic curve point, by what is be calculated As a result modular arithmetic is carried out with the rank of basic point on elliptic curve obtain third data；

Step A-5, personalization device judges whether third data are equal with the first preset value, is then return step A-3, no Then follow the steps A-6；

Step A-6, personalization device judge whether the sum of third data and the first random number are equal to basic point on elliptic curve Rank, be then return step A-3, it is no to then follow the steps A-7；

Step A-7, the mould that personalization device calculates the sum of 1 and credit card issuer private key calculates third number against the 4th data are obtained The 5th data are obtained according to the product with credit card issuer private key, and the difference for calculating the first random number and the 5th data obtains the 6th data, by the The rank of basic point carries out modular arithmetic and obtains the 7th data on six data and elliptic curve, calculates the long-pending of the 4th data and the 7th data To the 8th data；

Step A-8, personalization device judges whether the 8th data are equal to the second preset value, is then return step A-3, otherwise Execute step A-9；

Step A-9, third data and the 8th data sequential concatenation are obtained digital signature by personalization device.

Personalization device is combined into data grouping according to preset data packet identifier and signed data group specifically: personal Change equipment calculate the signature data length, preset data packet identifier, signed data length and signed data sequential concatenation is raw At data grouping.

Individualized instruction is created according to data grouping specifically: is instructed according to data grouping tissue APDU；Data grouping is The order data domain of APDU instruction.

When individualized file is completed, personalization method further include: the main security domain of personalization device choice cards is opened Exit passageway, and the individualized instruction in individualized file is sent to the card of current operation.

Preferably, after step S1, before S2 further include:

Step B1, personalization device checks whether signed data meets preset condition, is to then follow the steps B2, otherwise signs Data failed regeneration；

Step B1 specifically: personalization device judges whether the format of signed data is correct, is to determine that signed data is full Otherwise sufficient preset condition determines that signed data is unsatisfactory for preset condition.

Step B2, personalization device verifies the digital signature in signed data using credit card issuer public key, and judgement is tested Whether card passes through, and is to then follow the steps S3, otherwise signed data failed regeneration.

Step B2 specifically: personalization device is calculated the digital signature in signed data by SM2 using credit card issuer public key Method is verified, and it is to then follow the steps S3 that judgement, which verifies whether to pass through, otherwise signed data failed regeneration.

Further, step B2 is specifically included:

Step C1, user can be distinguished that identification bit length, user can distinguish mark, elliptic curve parameter by personalization device The 9th data are generated with credit card issuer public key sequential concatenation；9th data are subjected to SM3 operation and generate third Hash Value；

Step C2, third Hash Value and data to be signed sequential concatenation are generated the tenth data by personalization device；By the tenth Data carry out SM3 operation and generate the 4th Hash Value；

Step C3, personalization device obtains third data and the 8th data from static number signature, calculates third data The 11st data are obtained with the sum of the 8th data, the rank of the basic point on the 11st data and elliptic curve is subjected to modular arithmetic and is obtained 12nd data；

Step C4, personalization device according to the 8th data, the 12nd data, elliptic curve basic point and credit card issuer public key Calculate elliptic curve point；

Step C5, personalization device calculates the sum of the 4th Hash Value and the abscissa of elliptic curve point and obtains the 13rd number According to the rank of basic point on the 13rd data and elliptic curve is carried out modular arithmetic and obtains the 14th data；

Step C6, personalization device judges whether the 14th data are equal with third data, is to then follow the steps S3, otherwise Sign test failure, terminates.

It preferably, include the to be signed of static data according to preset format tissue after obtaining static data in step S1 Before data, further includes:

Step D1, whether personalization device judges in static data to include the list of static data authenticating tag, is to execute Otherwise step D2 executes the data to be signed according to preset format tissue comprising static data；

Step D2, whether personalization device judges in static data authenticating tag list only comprising the mark using interaction feature Label are the data to be signed then executed according to preset format tissue comprising static data, otherwise static signature data failed regeneration.

Embodiment 2

The present embodiment provides a kind of personalization methods of off line authentication data, the static label specially in off line authentication data The personalization method of name data, as shown in Figure 1, specifically including:

Step 101, personalization device determine the card of current operation, and obtain the static number of the card of the current operation According to；

Specifically, static data include using primary account number, using the effective date, using Expiration Date and application version number etc. Smart card static data；

In the present embodiment, the static data that need to authenticate specifically:

0X 5A086228000100001117 5F2403301231 5F2503950701 9F08020030, wherein first A byte to the tenth byte is using primary account number；11st byte to the 16th byte is using the effective date；17th word Section to the 22nd byte is using the Expiration Date；23rd byte to the 27th byte is application version number.

Step 101 specifically: personalization device determines the card of current operation, and obtains related to the card of current operation The static data of connection；

Further, personalization device reads the preprinted card image of card face of current operation, such as blocks Number, and static data associated with the card image is obtained from state data file.

In more detail, static data associated with the card image is obtained from state data file specifically: It obtains from state data file using primary account number and the consistent static data of card image.

Or step 101 specifically: personalization device determines the card of current operation, and obtains from state data file One static data.；

Whether step 102, personalization device judge in static data to include the list of static data authenticating tag, are to execute Step 103, no to then follow the steps 104；

In the present embodiment static data be TLV format, i.e., the list of static data authenticating tag be by label, data length with And data composition.

Specifically, judge in static data whether include the list of static data authenticating tag label, i.e. judgement needs to authenticate Static data in whether include 0X4A；It is to determine to include the list of static data authenticating tag in static data；Otherwise determine It does not include static data authenticating tag list in static data；

Whether step 103, personalization device judge in static data authenticating tag list only comprising using interaction feature Label is to then follow the steps 104, otherwise static signature data failed regeneration, is terminated；

Step 103 specifically includes:

Step 103-1, personalization device judges that the data length of static data authenticating tag list whether be 1 is to execute Step 103-2；Otherwise static signature data failed regeneration terminates；

Step 103-2, personalization device judges whether the data of static data authenticating tag list are using interaction feature Label, be to then follow the steps 104；Otherwise static signature data failed regeneration.

Specifically, personalization device judges whether the data of static data authenticating tag list are 0X82, are to execute step Rapid 104；Otherwise static signature data failed regeneration.

Step 104, personalization device generate number to be signed according to signed data format, data verification code and static data According to；

Specifically, signed data format is preset byte 0X13, data verification code is the code of credit card issuer distribution, this reality Applying is specially 0XDAC5 in example；Signed data format, data verification code and the static data sequential concatenation that need to be authenticated are generated Data to be signed,

0X13DAC55A0862280001000011175F24033012315F25039507019F08020030。

Step 105, personalization device generate random number, and are carried out using credit card issuer private key to data to be signed and random number Signature obtains static number signature；

Step 105 specifically: personalization device generates random number, and using credit card issuer private key to data to be signed and at random Number is signed to obtain static signature data by SM2 algorithm；

Further, in step 105, data to be signed and random number are signed to obtain using credit card issuer private key quiet State digital signature, specifically includes:

Step 105-1, user can be distinguished that identification bit length, user can distinguish mark, elliptic curve by personalization device Parameter and credit card issuer public key sequential concatenation obtain the first data；It is miscellaneous that first data progress SM3 cryptographic Hash algorithm is obtained first Gather value；

In the present embodiment, the first data specifically:

0x008031323334353637383132333435363738FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFF00000000FFFFFFFFFFFFFFFC28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB 8F92DDBCBD414D940E9332C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589 334C74C7BC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0C3AC 12B81B9D175936B5BF72BB8FE3A2266BC013B2E94F5837F16AA1C01AA7323B75626AB64D02AE D20CC6F440841F10EE6873BCBEA3F41D6869D0FEADD71154；Wherein preceding 18 bytes are fixed data, Thereafter 128 bytes are preset elliptic curve parameter, and 64 bytes thereafter are credit card issuer public key.

SM3 operation is specially that the data of input are mapped as to the cryptographic Hash of 32 bytes；According to first in the present embodiment First cryptographic Hash of data progress SM3 operation generation are as follows:

228C5EDBD4150CD02785F763C074DDCD2E21294465341CFE48530B589BA0FC85。

Step 105-2, data to be signed and the first Hash Value sequential concatenation are obtained the second data by personalization device, by Two data carry out SM3 cryptographic Hash algorithm and obtain the second Hash Value；

Specifically, the second data that the first Hash Value and data to be signed are connected specifically:

0X228C5EDBD4150CD02785F763C074DDCD2E21294465341CFE48530B589BA0FC855A 0862280001000011175F24033012315F25039507019F08020030；

The second cryptographic Hash generated in the present embodiment specifically:

0XB178B75CAE400122778070132278EE73D511846076424A4041E8E427759FF7B6。

Step 105-3, personalization device generates the first random number with randomizer；It is calculated according to the first random number ellipse Circular curve point；

The first random number that specific random number generator generates is denoted as K, calculates K times of point of the basic point on elliptic curve, K times of the basic point on elliptic curve being calculated is put and is denoted as elliptic curve point.

Step 105-4, personalization device calculates the sum of abscissa and second Hash Value of elliptic curve point, will be calculated Result and elliptic curve on basic point rank carry out modular arithmetic obtain third data；

Step 105-5, personalization device judges that third data are whether equal with the first preset value, is then return step 105-3, it is no to then follow the steps 105-6；

Step 105-6, personalization device judge whether the sum of third data and the first random number are equal to base on elliptic curve The rank of point is then return step 105-3, no to then follow the steps 105-7；

Step 105-7, the mould that personalization device calculates the sum of 1 and credit card issuer private key calculates third against the 4th data are obtained Data and the product of credit card issuer private key obtain the 5th data, and the difference for calculating the first random number and the 5th data obtains the 6th data, will The rank of basic point carries out modular arithmetic and obtains the 7th data in 6th data and elliptic curve, calculates the product of the 5th data and the 7th data Obtain the 8th data；

Step 105-8, personalization device judges whether the 8th data are equal to the second preset value, is then return step 105-3, It is no to then follow the steps 105-9；

Step 105-9, third data and the 8th data sequential concatenation are obtained static number signature by personalization device；

Step 106, personalization device are signed according to signed data format, digital verification code and static number generates static state Signed data；

Specifically, signed data format is preset byte 0X13, data verification code is the code of credit card issuer distribution, this reality Applying is specially 0XDAC5 in example；Signed data format, data verification code and static number signature sequential concatenation are generated static Signed data.

Static signature data specifically:

0X13DAC59BABD0781722AC9D1AA73E3EED30A5B91FA1BA3CE6E51B492FFF4FDF810C 607AF738D73B359659BA8F755E0BF38B9F1289E0FC2B84F518A60C852FB01290E61A

Step 107, personalization device check whether static signature data format is correct, are to then follow the steps 108, otherwise quiet The failure of state data authentication, terminates；

Specifically, step 107 specifically: personalization device judges that the value of the signed data format in static signature data is No is OX13, is to continue checking, and otherwise judges whether the value of the data verification code in static signature data is credit card issuer point The code matched i.e. OXDAC5 is that then static signature data format is correct, and otherwise static signature data format is incorrect；

Step 108, personalization device test the static number signature in static signature data using credit card issuer public key Card, judgement verify whether to pass through, and are to then follow the steps 109, otherwise static signature data failed regeneration, terminate.

Step 108 is specifically, personalization device uses credit card issuer public key to the static signature data in static signature data Sign test is carried out by SM2 algorithm, judgement verifies whether to pass through, and thens follow the steps 109 if being verified, otherwise static signature data Failed regeneration terminates.

Further, the static number signature in static signature data is tested using credit card issuer public key in step 108 Card, specifically includes:

Step 108-1, user can be distinguished that identification bit length, user can distinguish mark, elliptic curve by personalization device Parameter and the series connection of credit card issuer public key generate the 9th data；9th data are subjected to SM3 operation and generate third Hash Value；

The 9th data are specially in the present embodiment

0X008031323334353637383132333435363738FFFFFFFEFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFF00000000FFFFFFFFFFFFFFFC28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515 AB8F92DDBCBD414D940E9332C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A45 89334C74C7BC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0C3 AC12B81B9D175936B5BF72BB8FE3A2266BC013B2E94F5837F16AA1C01AA7323B75626AB64D02 AED20CC6F440841F10EE6873BCBEA3F41D6869D0FEADD71154。

Third Hash Value in the present embodiment specifically:

0X228C5EDBD4150CD02785F763C074DDCD2E21294465341CFE48530B589BA0FC85。

Step 108-2, third Hash Value and data to be signed series connection are generated the tenth data by personalization device；By the tenth number The 4th Hash Value is generated according to SM3 operation is carried out；

Tenth data in the present embodiment specifically:

0X228C5EDBD4150CD02785F763C074DDCD2E21294465341CFE48530B589BA0FC8513 DAC55A0862280001000011175F24033012315F25039507019F08020030.4th Hash in the present embodiment Value specifically:

0XB178B75CAE400122778070132278EE73D511846076424A4041E8E427759FF7B6。

Step 108-3, personalization device obtains third data and the 8th data from static number signature, calculates third number The 11st data are obtained according to the sum of the 8th data, the rank of the basic point on the 11st data and elliptic curve is subjected to modular arithmetic and is obtained To the 12nd data；

Step 108-4, personalization device according to the 8th data, the 12nd data, elliptic curve basic point and credit card issuer Public key calculates elliptic curve point；

Specifically, the 8th data are denoted as S, S times of point of basic point on elliptic curve is calculated, the 12nd data are denoted as T, counted T times of point for calculating credit card issuer public key, S times is put to put with T times is added to obtain elliptic curve point.

Step 108-5, personalization device calculates the sum of the 4th Hash Value and the abscissa of elliptic curve point and obtains the 13rd The rank of basic point in 13rd data and elliptic curve is carried out modular arithmetic and obtains the 14th data by data；

Step 108-6, personalization device judges whether the 14th data are equal with third data, is to then follow the steps 109, Otherwise sign test fails, and terminates.

Step 109, personalization device generate data grouping according to preset data packet identifier and static signature data；

Specifically, personalization device calculate static signature data length, by data packet identifier, static data length and Static data sequential concatenation obtains data grouping；

Step 110, personalization device create individualized instruction according to data grouping, and the individualized instruction of creation is written Individualized file；

Specifically, the data format of individualized instruction is CLA+INS+P1+P2+Lc+DGI+Length+Data；

Wherein, command byte, P1 and the P2 that CLA is the classification byte of command message, INS is command message are reference control Parameter and block number, Lc are the length of data DGI+Length+Data, DGI is data packet identifier；Length is static label Name data length；Data is static signature data；

It is specially 0X80E20004 that instruction is individualized in the present embodiment

A02054770459313DAC59BABD0781722AC9D1AA73E3EED30A5B91FA1BA3CE6E51B492 FFF4FDF810C607AF738D73B359659BA8F755E0BF38B9F1289E0FC2B84F518A60C852FB01290E 61A；Wherein OX80 is CLA, and E2 is INS, that is, storing data order command byte, and 00 is P1, and 05 is P2,4A Lc, thereafter Data are DATA, label OX93 and static signature data including static signature data.

The response data that the smart card to be received such as personalization device returns shows quiet if including 0X9000 in response data State signed data is successfully written smart card, otherwise static signature data write-in failure.

When the card face of card does not have preparatory printing cards information, then this method further include: personalization device is from static number Card face is printed onto using primary account number according to middle obtain.

Embodiment 3

The present embodiment provides a kind of personalization methods of off line authentication data, specially the IC card public key card in off line certification The personalization method of book；As shown in Fig. 2, specifically including:

Step 201, personalization device determine the card of current operation, and obtain the static number of the card of the current operation According to；

0X 5A086228000100001117 5F2403301231 5F25039507019F08020030, wherein first A byte to the tenth byte is using primary account number；11st byte to the 16th byte is using the effective date；17th word Section to the 22nd byte is using the Expiration Date；23rd byte to the 27th byte is application version number.

Step 201 specifically: personalization device determines the card of current operation, and obtains related to the card of current operation The static data of connection；

Further, personalization device reads the preprinted card image of card face of current operation, such as blocks Number, and static information associated with the card image is obtained from state data file.

Or step 201 specifically: personalization device determines the card of current operation, and obtains from state data file One static data.；

Step 202, personalization device judge whether static data includes static data authenticating tag list, are to execute step Rapid 203, it is no to then follow the steps 204；

Specifically, judge static data whether include static data authenticating tag list label, that is, judge static data In whether include 0X4A；It is to determine to include the list of static data authenticating tag in static data；Otherwise determine in static data It does not include static data authenticating tag list；

Whether step 203 judges only comprising the label using interaction feature in static data authenticating tag list, is to hold Row step 204, otherwise IC card public key certificate failed regeneration；

Step 203 specifically includes:

Step 203-1, it is to then follow the steps 203-2 that whether the data length for judging static data authenticating tag list, which is 1,； Otherwise IC card public key certificate failed regeneration；

Step 203-2, whether the data for judging static data authenticating tag list are to sentence using the label of interaction feature Whether the data of disconnected static data authenticating tag list are 0X82, are to then follow the steps 204；Otherwise IC card public key certificate, which generates, loses It loses.

Step 204 generates data to be signed according to IC card public key data and static data.

Specifically, by personal data certificate format, using primary account number, Certificate Revocation date, certificate serial number, IC Card public key signature algorithm mark, IC card public key encryption algorithm mark, IC card public key parameter identification, IC card public key length and IC card are public Key sequential concatenation obtains data to be signed as IC card public key data, by IC card public key data and static data sequential concatenation.

The data to be signed got in the present embodiment are specially 0X14 6228000100001117FFFF 1230 000001 04 00 11 40

C3AC12B81B9D175936B5BF72BB8FE3A2266BC013B2E94F5837F16AA1C01AA7323B75 626AB64D02AED20CC6F440841F10EE6873BCBEA3F41D6869D0FEADD71154

5A0862280001000011175F24033012315F25039507019F08020030

Wherein the first character section 0X14 of data to be signed is certificate format, second byte to the 11st byte 0X6228000100001117FFFF is using primary account number；12nd byte to the 13rd byte OX1230 be the certificate expiry date Phase, the tenth nybble to the 16th byte 0X000001 are certificate serial number；17th byte 0X04 is the calculation of IC card public key signature Method mark；18th byte 0X00 is IC card public key encryption algorithm mark；19th byte 0X11 is IC card public key parameter identification, For identifying elliptic curve；Second crossed joint 0X40 is IC card public key length；21st byte to the 6th crossed joint is IC card Public key, 27 bytes thereafter are static data；

Step 205, personalization device generate random number, and are carried out using credit card issuer private key to data to be signed and random number Signature obtains IC card digital signature；

Step 205 specifically: personalization device generates random number, and using credit card issuer private key to data to be signed and at random Number is signed to obtain IC card digital signature by SM2 algorithm；

IC card digital signature obtained in the present embodiment is specially 0X

AF3A6E51AC91005CDD6136497793091D8A52EA3AD49D8C215FB25A9E3B9E110511D0 089A7450147553147BF4144E435CC55DE8C8C0D0BFE34115DE19804333A5

Specifically, being signed to obtain IC card number to data to be signed and random number using credit card issuer private key in step 205 That mentions in word signature and embodiment 1 is signed to obtain static number using credit card issuer private key to data to be signed and random number The process of signature is similar, and details are not described herein；

Step 206, personalization device generate IC card public key certificate according to IC card public key data and IC card digital signature.

Specifically, by personal data certificate format, using primary account number, Certificate Revocation date, certificate serial number, IC Card public key signature algorithm mark, IC card public key encryption algorithm mark, IC card public key parameter identification, IC card public key length and IC card are public Key sequential concatenation obtains IC card public key card as IC card public key data, by IC card public key data and IC card digital signature sequential concatenation Book.

IC card public key certificate is generated in the present embodiment specifically:

0X 6228000100001117FFFF 1230 000001 04 00 11 40

DD956D186252EE711398B339270CB1839DAF4A15B7F907E0AD334470CB83F0E3,0XF D395978A5A0FFD2A2055A986522368E6F3A6BE34E0C416EB69FA7A08 C89DFF2, wherein preceding 60 byte For IC card public key data；Thereafter 64 bytes are IC card digital signature obtained in step 210.

Step 207, personalization device judge whether the value of the certificate format in IC card public key certificate is preset value, is to hold Row step 208, otherwise IC card public key certificate failed regeneration；

Preset value is specially OX14；

Step 208, personalization device judge whether certificate is expired according to the Certificate Revocation date in IC card public key certificate, It is to then follow the steps 209, otherwise IC card public key certificate failed regeneration；

Step 209, personalization device judge whether the IC card public key signature algorithm in IC card public key certificate is SM2 algorithm, It is to then follow the steps 210, otherwise IC card public key certificate failed regeneration；

Specifically, personalization device judges whether the value of the IC card public key signature algorithm in IC card public key data is 0X04, It is to determine IC card public key signature algorithm for SM2 algorithm, otherwise determines that IC card public key signature algorithm is not SM2 algorithm.

Step 210, personalization device test the IC card digital signature in IC card public key certificate using credit card issuer public key Card；Judgement verifies whether to pass through, and is to then follow the steps 211, otherwise IC card public key certificate failed regeneration；

Step 210 specifically: personalization device is using credit card issuer public key to the IC card digital signature in IC card public key certificate It is verified by SM2 algorithm, judgement verifies whether to pass through, and thens follow the steps 211 if being verified, otherwise IC card public key certificate Failed regeneration；

Specifically, being calculated by SM2 using credit card issuer private key the IC card digital signature in IC card public key certificate in step 210 Method carries out the mistake verified using credit card issuer public key to the static number signature in static signature data in verifying and step 108 Journey is similar, and details are not described herein；

Step 211, personalization device generate data grouping according to preset data packet identifier and IC card public key certificate；

Specifically, personalization device calculates IC card public key certificate length, data packet identifier, IC card public key certificate is long Degree and static data sequential concatenation obtain data grouping；

Step 212, personalization device create individualized instruction according to data grouping；And the individualized instruction of creation is written Individualized file；

Specifically, write-in IC card public key certificate, and the response data for waiting smart card to be received to return are sent to smart card, if It include that 0X9000 then shows that IC card public key certificate is successfully written smart card in response data, otherwise IC card public key certificate write-in is lost It loses.

When individualized file is completed, personalization method further include: the main security domain of personalization device choice cards is opened Exit passageway, and the individualized instruction in individualized file is sent to card.

Embodiment 4

The present embodiment provides a kind of personalization devices of off line authentication data, referring to Fig. 3, comprising:

Module 11 is obtained, for determining the card of current operation, and obtains the static data of the card of the current operation；

Obtain and specifically included in the static data that gets of module 11: using main account, using the effective date, using failure Date and application version number.

Data to be signed molded tissue block 12, for including the static number for obtaining module 11 and getting according to preset format tissue According to data to be signed；

Random number generation module 13, for generating random number；

Signature blocks 14, data to be signed for using credit card issuer private key to organize data to be signed molded tissue block 12 and The random number that random number generation module 13 generates is signed to obtain digital signature；

Specifically, signature blocks 14, random number for using credit card issuer private key to generate random number generation module 13 and The data to be signed that data to be signed molded tissue block 12 is organized are signed to obtain digital signature by SM2 algorithm.

Further, signature blocks 14 specifically include:

Splice submodule, for by user can distinguish identification bit length, user can distinguish mark, elliptic curve parameter and Credit card issuer public key sequential concatenation obtains the first data；Be also used to obtain data to be signed and SM3 operation submodule first is miscellaneous The value sequential concatenation that gathers obtains the second data；

Correspondingly, SM3 operation submodule, carries out the calculation of SM3 cryptographic Hash for that will splice the first data that submodule obtains Method obtains the first Hash Value；It is also used to splice the second data progress SM3 cryptographic Hash algorithm that submodule obtains and obtains second Hash Value；

Elliptic curve point module is calculated, the first random number for generating according to random number generation module 13 calculates oval bent Line point；

Modular arithmetic module, for calculating the abscissa and SM3 fortune that calculate the elliptic curve point that elliptic curve point module obtains The rank of basic point on the result being calculated and elliptic curve is carried out modular arithmetic and obtained by the sum of the second Hash Value that operator module obtains To third data；The product for being also used to calculate third data and credit card issuer private key obtains the 5th data, calculates the first random number and the The difference of five data obtains the 6th data, and the rank of basic point in the 6th data and elliptic curve is carried out modular arithmetic and obtains the 7th data；

Whether the first judging submodule, the third data for judging that modular arithmetic module obtains are equal with the first preset value；

Second judgment submodule, for sentencing when the first judging submodule determines third data and unequal the first preset value Whether the sum of the first random number that the third data and random number generation module 13 that disconnected modular arithmetic module obtains generate is equal to ellipse The rank of basic point on curve；

Modular inversion submodule determines the third data and random number life that modular arithmetic module obtains for the second judgment module When the sum of first random number generated at module 13 is equal to the rank of basic point on elliptic curve, the sum of 1 and credit card issuer private key are calculated Mould is inverse to obtain the 4th data；

Third judgment module, for calculating the 4th data that modular inversion submodule obtains and modular arithmetic module obtains the The product of seven data obtains the 8th data, judges whether the 8th data are equal to the second preset value；

Digital signature submodule, for transporting mould when third judgment module determines that the 8th data are not equal to the second preset value It calculates the third data that module obtains and obtains digital signature with the 8th data sequential concatenation；

Random number generation module 13 is specifically used for generating random number as the first random number；It is also used to when the first judgement Module determines to generate random number when third data are equal with the first preset value, updates the first random number, trigger and calculate elliptic curve Point module；It is also used to generate random number when third judgment module determines that the 8th data are equal with the second preset value, updates first Random number, triggering calculate elliptic curve point module.

Signed data generation module 15 removes in the digital signature and data to be signed for being generated according to signature blocks 14 The remainder data of static data is gone to generate signed data；

Data grouping composite module 16, for being generated according to preset data packet identifier and signed data generation module 15 Signed data group be combined into data grouping；

Specifically, data grouping composite module 16, be used for calculate the signature data length, by preset data packet identifier, The signed data sequential concatenation that signed data length and signed data generation module 15 generate generates data grouping.

Individualized instruction module 17 is created, it is personal for being created according to the combined data grouping of data grouping composite module 16 Change instruction；

Specifically, individualized instruction module 17 is created, for the data grouping combined according to data grouping composite module 16 Knit APDU instruction；Data grouping is the order data domain of APDU instruction.

Individualized file is written for that will create the individualized instruction that individualized instruction module 17 creates in writing module 18；

Sending module 19 opens exit passageway for the main security domain of the choice cards when individualized file is completed, and will Individualized instruction in individualized file is sent to the card of current operation.

Specifically, data to be signed molded tissue block 12, is used for signed data format, data verification code and obtains module The 11 static data sequential concatenations got generate data to be signed；

Correspondingly, signed data generation module 15, is specifically used for signed data format, data verification code and signature mould The digital signature sequential concatenation that block 14 obtains generates signed data, and signed data is static signature data.

Specifically, data to be signed molded tissue block 12, quiet for getting IC card public key data with acquisition module 11 State data sequential concatenation obtains data to be signed；

Correspondingly, signed data generation module 15, specifically for the number for obtaining IC card public key data and signature blocks 14 Word signature sequential concatenation generates signed data, and signed data is IC card public key certificate.

Preferably, personalization device further include:

First judgment module, for judging whether the signed data of signed data molded tissue block tissue meets preset condition；

Specifically, first judgment module, for judge signed data molded tissue block tissue signed data format whether Correctly.

Sign test module, if using credit card issuer public key pair when determining that signed data meets preset condition for first judgment module Digital signature in signed data is verified, and judges to verify whether success；

Specifically, sign test module, if using hair fastener when determining that signed data meets preset condition for first judgment module Row public key verifies the digital signature in signed data by SM2 algorithm, and judges to verify whether success.

Correspondingly, data grouping composite module 16, is specifically used for when the success of sign test module decision verification according to present count Data grouping is combined into according to packet identifier and signed data group.

Further, sign test module specifically includes:

Splice submodule, for by user can distinguish identification bit length, user can distinguish mark, elliptic curve parameter and Credit card issuer public key sequential concatenation generates the 9th data；It is also used to the third Hash Value and data to be signed of SM3 operation submodule The data to be signed sequential concatenation that generation module 15 generates generates the tenth data；

SM3 operation submodule, the 9th data for that will splice submodule generation carry out SM3 operation and generate third hash Value；The tenth data for being also used to splice submodule generation carry out SM3 operation and generate the 4th Hash Value；

Modular arithmetic module, for obtaining third data and the 8th from the signed data that signed data generation module 15 generates Data calculate the sum of third data and the 8th data and obtain the 11st data, by the basic point on the 11st data and elliptic curve Rank carry out modular arithmetic obtain the 12nd data；It is also used to calculate the 4th Hash Value that SM3 operation submodule obtains and calculates ellipse The sum of the abscissa of elliptic curve point that circular curve module obtains obtains the 13rd data, will be in the 13rd data and elliptic curve The rank of basic point carries out modular arithmetic and obtains the 14th data；

Calculate elliptic curve module, the 12nd data, elliptic curve for obtaining according to the 8th data, modular arithmetic module Basic point and credit card issuer public key calculate elliptic curve point；

Whether judging submodule, the 14th data for judging that modular arithmetic module obtains are equal with third data；

Data grouping composite module 16 is used for when judging submodule determines that the 14th data are equal with third data, root Data grouping is combined into according to the signed data group that preset data packet identifier and signed data generation module 15 generate.

Preferably, personalization device, further includes: first judgment module, the static state got for judging acquisition module 11 It whether include the list of static data authenticating tag in data；

Second judgment module, for determining to include the list of static data authenticating tag in static data when first judgment module When whether judge in static data authenticating tag list only comprising the label using interaction feature；

Correspondingly, data to be signed molded tissue block 12, for determining that in static data do not include quiet when first judgment module It include the number to be signed for obtaining the static data that module 11 is got according to preset format tissue when state data authentication list of labels According to；It is also used to when the second judgment module determines in the list of static data authenticating tag only to include the label using interaction feature, It include the data to be signed for obtaining the static data that module 11 is got according to preset format tissue.

Embodiment described above is the present invention more preferably specific embodiment, and those skilled in the art is in this hair The usual variations and alternatives carried out in bright technical proposal scope should be all included within the scope of the present invention.

Claims

1. a kind of personalization method of off line authentication data characterized by comprising

Step S1, personalization device determines the card of current operation, and obtains the static data of the card of the current operation, root It include the data to be signed of the static data according to preset format tissue；

Step S2, personalization device generates random number, using credit card issuer private key to the random number and the data to be signed into Row signature obtains digital signature；According to remaining for removing the static data in the digital signature and the data to be signed Data generate signed data；

Step S3, personalization device is combined into data grouping according to preset data packet identifier and signed data group；According to described The individualized instruction of data grouping creation, and individualized file is written into individualized instruction；

When individualized file is completed, the personalization method further include: the main security domain of personalization device choice cards is opened Exit passageway, and the individualized instruction in individualized file is sent to the card of the current operation；

It is described the random number and the data to be signed are signed to obtain digital signature using credit card issuer private key specifically wrap It includes:

Step A-1, personalization device by user can distinguish identification bit length, user can distinguish mark, elliptic curve parameter and Credit card issuer public key sequential concatenation obtains the first data；First data progress SM3 cryptographic Hash algorithm is obtained into the first hash Value；

Step A-2, the data to be signed and the first Hash Value sequential concatenation are obtained the second data by personalization device, will Second data carry out SM3 cryptographic Hash algorithm and obtain the second Hash Value；

Step A-3, personalization device generates the first random number with randomizer；It is calculated according to first random number oval Curve point；

Step A-4, the sum of the abscissa of personalization device calculating elliptic curve point and second Hash Value, by what is be calculated As a result modular arithmetic is carried out with the rank of basic point on elliptic curve obtain third data；

Step A-5, personalization device judges whether the third data are equal with the first preset value, is then return step A-3, no Then follow the steps A-6；

Step A-6, personalization device judge whether the sum of the third data and first random number are equal on elliptic curve The rank of basic point is then return step A-3, no to then follow the steps A-7；

Step A-7, the mould that personalization device calculates the sum of 1 and credit card issuer private key calculates the third number against the 4th data are obtained The 5th data are obtained according to the product with credit card issuer private key, the difference for calculating first random number and the 5th data obtains the 6th number According to the rank of basic point on the 6th data and elliptic curve is carried out modular arithmetic and obtains the 7th data, calculates the 4th data The 8th data are obtained with the product of the 7th data；

2. the method as described in claim 1, which is characterized in that the static data specifically includes: using main account, using life Imitate the date, using Expiration Date and application version number.

3. the method as described in claim 1, which is characterized in that the step S1 specifically: personalization device determines current behaviour The card of work, and obtain the static data of the card of the current operation, by signed data format, data verification code and described Static data sequential concatenation generates data to be signed；

The remainder data for removing the static data according to the digital signature and the data to be signed generates signature Data specifically: the signed data format, the data verification code and the digital signature sequential concatenation are generated and signed Data, the signed data are static signature data.

4. the method as described in claim 1, which is characterized in that the step S1 specifically: personalization device determines current behaviour The card of work, and the static data of the card of the current operation is obtained, and IC card public key data and the static data is suitable Sequence splicing generates data to be signed；

The remainder data for removing the static data according to the digital signature and the data to be signed generates signature Data specifically: the IC card public key data and the digital signature sequential concatenation are generated into signed data, the signed data As IC card public key certificate.

5. the method as described in claim 1, which is characterized in that it is described using credit card issuer private key to the random number and it is described to Signed data is signed to obtain digital signature specifically: using credit card issuer private key to the random number and the data to be signed It is signed to obtain digital signature by SM2 algorithm.

6. the method as described in claim 1, which is characterized in that the personalization device is according to preset data packet identifier It is data grouping with signed data specifically: personalization device calculate the signature data length, by preset data packet identifier, label Name data length and the signed data sequential concatenation generate data grouping.

7. the method as described in claim 1, which is characterized in that create individualized instruction according to the data grouping specifically: It is instructed according to data grouping tissue APDU；The data grouping is the order data domain of APDU instruction.

8. the method as described in claim 1, which is characterized in that after the step S2, before the S3 further include:

Step B1, personalization device checks whether signed data meets preset condition, is to then follow the steps B2, otherwise signed data Failed regeneration；

Step B2, personalization device verifies the digital signature in signed data using credit card issuer public key, judges that verifying is It is no to pass through, it is to then follow the steps S3, otherwise signed data failed regeneration.

9. method according to claim 8, which is characterized in that the step B1 specifically: personalization device judges the label Whether the format of name data is correct, is to determine that the signed data meets preset condition, otherwise determines that signed data is unsatisfactory for Preset condition.

10. method according to claim 8, which is characterized in that the step B2 specifically: personalization device uses credit card issuer Public key verifies the digital signature in signed data by SM2 algorithm, and it is to then follow the steps that judgement, which verifies whether to pass through, S3, otherwise signed data failed regeneration.

11. method according to claim 8, which is characterized in that the step B2 is specifically included:

Step C1, user can be distinguished that identification bit length, user can distinguish mark, elliptic curve parameter and hair by personalization device Card row public key sequential concatenation generates the 9th data；9th data are subjected to SM3 operation and generate third Hash Value；

Step C2, third Hash Value and data to be signed sequential concatenation are generated the tenth data by personalization device；By the tenth data It carries out SM3 operation and generates the 4th Hash Value；

Step C3, personalization device obtains third data and the 8th data from digital signature, calculates third data and the 8th number According to the sum of obtain the 11st data, the rank of the basic point on the 11st data and elliptic curve is subjected to modular arithmetic and obtains the 12nd number According to；

Step C4, personalization device is calculated according to the 8th data, the 12nd data, the basic point of elliptic curve and credit card issuer public key Elliptic curve point；

Step C5, personalization device calculates the sum of the 4th Hash Value and the abscissa of elliptic curve point and obtains the 13rd data, will The rank of basic point carries out modular arithmetic and obtains the 14th data in 13rd data and elliptic curve；

Step C6, personalization device judges whether the 14th data are equal with third data, is to then follow the steps S3, otherwise sign test Failure terminates.

12. the method as described in claim 1, which is characterized in that described according to preset format after the acquisition static data Before tissue is comprising the data to be signed of static data, further includes:

Step D1, whether personalization device judges in static data to include the list of static data authenticating tag, is to then follow the steps Otherwise D2 executes the data to be signed according to preset format tissue comprising static data；

Step D2, whether personalization device judges in static data authenticating tag list only to include the label for applying interaction feature, It is to execute the data to be signed according to preset format tissue comprising static data, otherwise static signature data, which generate, loses It loses.

13. a kind of personalization device of off line authentication data characterized by comprising

Data to be signed molded tissue block, for including the static number for obtaining module and getting according to preset format tissue According to data to be signed；

Random number generation module, for generating random number；

Signature blocks, for using credit card issuer private key to the data to be signed of the data to be signed molded tissue block tissue and The random number that the random number generation module generates is signed to obtain digital signature；

Signed data generation module, the digital signature and the data to be signed for being generated according to the signature blocks The middle remainder data for removing the static data generates signed data；

Data grouping composite module, for the institute according to preset data packet identifier and signed data generation module generation It states signed data group and is combined into data grouping；

Individualized instruction module is created, the data grouping for combining according to the data grouping composite module creates personal Change instruction；

Writing module, for individualized file to be written in the individualized instruction for creating individualized instruction module creation；

Sending module opens exit passageway for the main security domain of the choice cards when the individualized file is completed, and will be a Individualized instruction in peopleization file is sent to the card of the current operation；

The signature blocks specifically include:

Splice submodule, for user can be distinguished that identification bit length, user can distinguish mark, elliptic curve parameter and hair fastener Row public key sequential concatenation obtains the first data；Be also used to obtain the data to be signed and SM3 operation submodule first is miscellaneous The value sequential concatenation that gathers obtains the second data；

The SM3 operation submodule, first data for obtaining the splicing submodule carry out the calculation of SM3 cryptographic Hash Method obtains the first Hash Value；It is also used to the second data that the splicing submodule obtains carrying out SM3 cryptographic Hash algorithm to obtain Second Hash Value；

Elliptic curve point module is calculated, the first random number for generating according to the random number generation module calculates elliptic curve Point；

Modular arithmetic module, for calculating abscissa and the institute of the elliptic curve point that the calculating elliptic curve point module obtains The sum of second Hash Value that SM3 operation submodule obtains is stated, by the rank of basic point on the result being calculated and elliptic curve It carries out modular arithmetic and obtains third data；The product for being also used to calculate the third data and credit card issuer private key obtains the 5th data, counts The difference for calculating first random number and the 5th data obtains the 6th data, by basic point in the 6th data and elliptic curve Rank carry out modular arithmetic obtain the 7th data；

First judging submodule, for judge third data that the modular arithmetic module obtains and the first preset value whether phase Deng；

Second judgment submodule, for determining that the third data and the first preset value are unequal when first judging submodule When judge third data that the modular arithmetic module the obtains and random number generation module generates described first random Whether the sum of number is equal to the rank of basic point on elliptic curve；

Modular inversion submodule, for the modular arithmetic module to obtain described the when the second judgment submodule determines to calculate The sum of described first random number that three data are generated with the random number generation module is counted when being equal to the rank of basic point on elliptic curve 1 is calculated with the mould of the sum of credit card issuer private key against obtaining the 4th data；

Third judgment module, for calculating the 4th data and the modular arithmetic module that the modular inversion submodule obtains The product of obtained the 7th data obtains the 8th data, judges whether the 8th data are equal to the second preset value；

Digital signature submodule is used for when the third judgment module determines that the 8th data are not equal to the second preset value, The third data that the modular arithmetic module obtains are obtained into digital signature with the 8th data sequential concatenation；

The random number generation module is specifically used for generating random number as the first random number；It is also used to when first judgement Submodule determines to generate random number when the third data are equal with first preset value, updates the first random number, trigger institute It states and calculates elliptic curve point module；It is also used to determine the 8th data and second preset value when the third judgment module Random number is generated when equal, updates the first random number, triggers the calculating elliptic curve point module.

14. personalization device as claimed in claim 13, which is characterized in that the static number for obtaining module and getting Specifically included in: using main account, using the effective date, using Expiration Date and application version number.

15. personalization device as claimed in claim 13, which is characterized in that

The data to be signed molded tissue block is specifically used for signed data format, data verification code and the acquisition module The static data sequential concatenation got generates data to be signed；

The signed data generation module is specifically used for the signed data format, the data verification code and the label The digital signature sequential concatenation that name module obtains generates signed data, and the signed data is static signature data.

16. personalization device as claimed in claim 13, which is characterized in that

The data to be signed molded tissue block, it is described quiet specifically for getting IC card public key data with the acquisition module State data sequential concatenation generates data to be signed；

The signed data generation module is signed specifically for the number for obtaining IC card public key data and the signature blocks Name sequential concatenation generates signed data, and the signed data is IC card public key certificate.

17. personalization device as claimed in claim 13, which is characterized in that the signature blocks are specifically used for using hair fastener Described in the random number that row private key generates the random number generation module and the data to be signed molded tissue block tissue Data to be signed are signed to obtain digital signature by SM2 algorithm.

18. personalization device as claimed in claim 13, which is characterized in that the data grouping composite module is specifically used for Calculate the signature data length generates preset data packet identifier, signed data length and the signed data generation module The signed data sequential concatenation generate data grouping.

19. personalization device as claimed in claim 13, which is characterized in that described to create individualized instruction module, specific use APDU instruction is knitted in the data grouping combined according to the data grouping composite module；The data grouping is APDU instruction Order data domain.

20. personalization device as claimed in claim 13, which is characterized in that further include:

First judgment module, for judging whether the signed data of the signed data molded tissue block tissue meets default item Part；

Sign test module, if public using credit card issuer when determining that the signed data meets preset condition for the first judgment module Key verifies the digital signature in signed data, and judges to verify whether to pass through；

The data grouping composite module, specifically for being grouped when the sign test module decision verification is successful according to preset data Identifier and signed data group are combined into data grouping.

21. personalization device as claimed in claim 20, which is characterized in that the first judgment module is specifically used for judgement Whether the format of the signed data of the signed data molded tissue block tissue is correct.

22. personalization device as claimed in claim 20, which is characterized in that the sign test module, if being specifically used for described the One judgment module determines when the signed data meets preset condition using credit card issuer public key to the digital signature in signed data It is verified by SM2 algorithm, and judges to verify whether success.

23. personalization device as claimed in claim 20, which is characterized in that the sign test module specifically includes:

Splice submodule, for user can be distinguished that identification bit length, user can distinguish mark, elliptic curve parameter and hair fastener Row public key sequential concatenation generates the 9th data；It is also used to the third Hash Value and the data to be signed of SM3 operation submodule The data to be signed sequential concatenation that generation module generates generates the tenth data；

The SM3 operation submodule, it is miscellaneous that the 9th data for generating the splicing submodule carry out SM3 operation generation third Gather value；It is also used to the tenth data that the splicing submodule generates carrying out SM3 operation to generate the 4th Hash Value；

Modular arithmetic module, for obtaining third data and the from the signed data that the signed data generation module generates Eight data calculate the sum of the third data and the 8th data and obtain the 11st data, by the 11st data and ellipse The rank of basic point on circular curve carries out modular arithmetic and obtains the 12nd data；It is also used to calculate what the SM3 operation submodule obtained 4th Hash Value and the sum of the abscissa for calculating the elliptic curve point that elliptic curve module obtains obtain the 13rd number According to the rank of basic point on the 13rd data and elliptic curve is carried out modular arithmetic and obtains the 14th data；

The calculating elliptic curve module, for according to the described 12nd of the 8th data, modular arithmetic module generation Data, the basic point of elliptic curve and credit card issuer public key calculate elliptic curve point；

Judging submodule, for judge the 14th data that the modular arithmetic module obtains and the third data whether phase Deng；

The data grouping composite module, for determining the 14th data and the third data when the judging submodule When equal, number is combined into according to the signed data group that preset data packet identifier and the signed data generation module generate According to grouping.

24. personalization device as claimed in claim 13, which is characterized in that further include: first judgment module, for judging It states and whether obtains in the static data that module is got including the list of static data authenticating tag；

Second judgment module, for determining to include static data authenticating tag in the static data when the first judgment module Whether judged in static data authenticating tag list when list only comprising the label using interaction feature；

The data to be signed molded tissue block, for determining that in the static data do not include static state when the first judgment module It include the static data that the acquisition module is got wait sign according to preset format tissue when data authentication list of labels Name data；It is also used to determine in the static data authenticating tag list when second judgment module only comprising special using interaction It include the data to be signed for the static data that the acquisition module is got according to preset format tissue when the label of sign.