CN108418677A

CN108418677A - Cipher key backup, restoration methods and device

Info

Publication number: CN108418677A
Application number: CN201710070724.7A
Authority: CN
Inventors: 李长水; 程建; 康卫昌; 赵先林
Original assignee: Hangzhou Hikvision Digital Technology Co Ltd
Current assignee: Hangzhou Hikvision Digital Technology Co Ltd
Priority date: 2017-02-09
Filing date: 2017-02-09
Publication date: 2018-08-17
Anticipated expiration: 2037-02-09
Also published as: CN108418677B

Abstract

The embodiment of the present application provides cipher key backup, restoration methods and device, is applied to Key Issuance device.The method includes：The first encrypted result and first key group to be stored to the first storage card is obtained, wherein the first encrypted result is the encrypted result obtained after the first sub-key is encrypted, the first sub-key is the sub-key obtained from root key；Obtain the first password for first storage card；First password is sent to master card, so that master card is encrypted with first agreement the first password of key pair and obtains the first encryption string；The first encryption string that master card is sent is received, and the first encryption string is sent to the first storage card, so that the first storage card obtains according to the first encryption string and stores the first password；First encrypted result and first key group are sent to the first storage card, so that the first storage card stores the first encrypted result and first key group.Using scheme provided by the embodiments of the present application, the safety of key can be improved.

Description

Cipher key backup, restoration methods and device

Technical field

This application involves fields of communication technology, more particularly to a kind of cipher key backup, restoration methods and device.

Background technology

In the all-purpose cards security protection application field such as IC card, smart card, how frequently encounter highest in enterprise secret key system The root key of rank is backed up on carrier by certain mode, that is, stored to carrier, subsequently to need to use the root close When key, it can be obtained from above-mentioned carrier.Above-mentioned carrier can be the storage cards such as IC card, smart card.

In the prior art, in backup root key, usually can subsequently exist in root key in plain text printing to a set of envelope When needing using the root key, can envelope be opened by envelope holder, root key be inputted in the interface of corresponding software.For Root key, can also be split into several parts, be respectively stored in different envelopes by raising safety, by different personnel point It holds.When in use, the personnel for holding envelope is needed to input key one by one respectively.

After storing key in the way of above-mentioned cipher key backup, it can usually ensure the safety of root key in use Property.But once the envelope for backing up root key is illegally accessed or loses, the safety of root key will be by prestige The side of body.

Invention content

The embodiment of the present application has been designed to provide cipher key backup, restoration methods and device, to improve the safety of key Property.Specific technical solution is as follows.

In order to achieve the above object, the embodiment of the present application discloses a kind of cipher key backup method, is applied to Key Issuance device, The method includes：

Obtain the first encrypted result and first key group to be stored to the first storage card；Wherein, first storage card For one in the storage card for backing up root key, first encrypted result is to be obtained after the first sub-key is encrypted Encrypted result, first sub-key is the sub-key obtained from the root key, for backing up depositing for the root key The encrypted result to be stored in card storage corresponds to the different sub-keys of the root key, and the first key group includes to be removed for encrypting The key of other sub-keys except first sub-key；

Obtain the first password for first storage card；Wherein, first password is for limiting for described the The reading permission of one encrypted result and first key group；

First password is sent to master card, so that the master card is carried out with the first password described in the first agreement key pair It encrypts and obtains the first encryption string；Wherein, the first agreement key is arranged close between the master card and the first storage card Key；

The first encryption string that the master card is sent is received, and the first encryption string is sent to first storage card, So that first storage card obtains according to the first encryption string and stores first password；

First encrypted result and first key group are sent to first storage card, so that first storage card Store first encrypted result and first key group.

Optionally, described the step of first password is sent to master card, including：

According to the second agreement key stored in master card, first storage card is authenticated, is obtained to described first The rewriting permission of storage card；

After obtaining the rewriting permission, first password is sent to master card.

Optionally, described according to the stored in master card second agreement key, first storage card is authenticated, is obtained The step of to the rewriting permission of first storage card, including：

Random number is sent to first storage card and obtains request, and obtains first storage card according to the random number Obtain the determining random number of request；

The random number is sent to master card, is carried out so that the master card arranges random number described in key pair with described second It encrypts and obtains the second encryption string；

The second encryption string that the master card is sent is received, and the second encryption string is sent to first storage card；

It detects whether to receive the first confirmation message that first storage card is fed back, wherein first confirmation message For：The confirmation message that first storage card is sent in the case where decrypting the random number from the second encryption string；

If it is, determining the rewriting permission obtained to first storage card.

Optionally, first sub-key is obtained in the following ways：

Obtain the root key；

It determines the first quantity of the storage card for backing up the root key, and determines second more than first quantity Quantity；

The root key is divided into the second quantity subsegment, determines that the first quantity is used for according to obtained subsegment is divided Synthesize the different sub-keys of the root key；Wherein it is determined that subsegment used by each sub-key is not exactly the same, determine every The quantity of subsegment used by one sub-key is less than the second quantity；

It is chosen from identified sub-key for storing to the first sub-key of the first storage card.

Optionally, identified sub-key is：Any two sub-key can synthesize the key of the root key.

Optionally, first password is additionally operable to limit the reading permission for biological characteristic；The method further includes：

The first biological characteristic for first storage card is obtained, and first biological characteristic is sent to described the One storage card, so that first storage card stores first biological characteristic.

In order to achieve the above object, the embodiment of the present application also discloses a kind of key recovery method, is applied to Key Issuance Device, the method includes：

Obtain corresponding second password of each storage card for backing up root key, wherein second password is for obtaining Obtain the reading permission of the encrypted result and key group that are stored in storage card；

According to each second password obtained and the first password stored in each storage card, each storage card is obtained Reading permission；Wherein, first password is used to limit the reading permission of the encrypted result stored in storage card and key group；

After obtaining each reading permission, the encrypted result stored in each storage card and key group are read；Wherein, one The encrypted result stored in a storage card is to be obtained after a sub-key is encrypted as a result, the sub-key is from described The key obtained in key, the key group stored in the storage card include for encrypt except sub-key corresponding with the storage card it The key of other outer sub-keys, the encrypted result stored in each storage card correspond to the different sub-keys of the root key；

Determine the key for each encrypted result to be decrypted respectively from each key group obtained, and respectively According to identified key, corresponding encrypted result is decrypted, obtains each sub-key；

According to agreement composition rule corresponding with the root key, each sub-key obtained is synthesized, is obtained Obtain the root key.

Optionally, described according to each second password obtained and the first password stored in each storage card, it obtains The step of obtaining the reading permission of each storage card, including：

In the following way, the reading permission of each storage card is obtained：

Target password is sent to target storage card, wherein the target storage card is for backing up the root key Any of each storage card, the target password are：The second password corresponding with the target storage card；

It detects whether to receive the second confirmation message that the target storage card is fed back, wherein second confirmation message For：The target storage card is sent out when confirming that the target password is identical as the first password that the target storage card itself stores The confirmation message sent；

If it is, determining the reading permission for having obtained the target storage card.

Optionally, sub-key is obtained from the root key in the following ways：

The root key is divided into the second quantity subsegment, determines that the first quantity is used for according to obtained subsegment is divided Synthesize the different sub-keys of the root key；Wherein it is determined that subsegment used by each sub-key is not exactly the same, determine every The quantity of subsegment used by one sub-key is less than the second quantity.

Optionally, each storage card is additionally operable to store corresponding first biological characteristic；First password is additionally operable to limit For the reading permission of first biological characteristic；

Described according to each second password obtained and the first password stored in each storage card, obtain each After the step of reading permission of storage card, further include：

Obtain the second biological characteristic for each storage card；

Obtain the first biological characteristic stored in each storage card；

Judge whether corresponding first biological characteristic of each storage card matches with corresponding second biological characteristic；

If matched, execute described determining for each encrypted result respectively from each key group obtained The key being decrypted, and corresponding encrypted result is decrypted according to identified key respectively, obtain each sub-key The step of.

In order to achieve the above object, the embodiment of the present application discloses a kind of cipher key backup device, is applied to Key Issuance device, Described device includes：

First obtains module, for obtaining the first encrypted result and first key group to be stored to the first storage card；Its In, first storage card is one in the storage card for backing up root key, and first encrypted result is to the first son The encrypted result that key obtains after being encrypted, first sub-key are the sub-key obtained from the root key, are used for The different sub-keys that the encrypted result to be stored in the storage card of the root key corresponds to the root key are backed up, described first is close Key group includes the key for encrypting other sub-keys in addition to first sub-key；

Second obtains module, for obtaining the first password for first storage card；Wherein, first password is used In restriction for the reading permission of first encrypted result and first key group；

First sending module, for first password to be sent to master card, so that the master card is with the first agreement key First password is encrypted and obtains the first encryption string；Wherein, the first agreement key is the master card and first The key arranged between storage card；

Receiving module, the first encryption string sent for receiving the master card, and the first encryption string is sent to institute The first storage card is stated, so that first storage card obtains according to the first encryption string and stores first password；

Second sending module, for first encrypted result and first key group to be sent to first storage card, So that first storage card stores first encrypted result and first key group.

Optionally, first sending module, including：

First obtains submodule, for according to the second agreement key stored in master card, being carried out to first storage card Certification obtains the rewriting permission to first storage card；

First sending submodule, for after obtaining the rewriting permission, first password to be sent to master card.

Optionally, described first submodule is obtained, including：

Obtaining unit obtains request for sending random number to first storage card, and obtains first storage card The determining random number of request is obtained according to the random number；

Transmission unit, for the random number to be sent to master card, so that the master card arranges key pair with described second The random number is encrypted and obtains the second encryption string；

Receiving unit, the second encryption string sent for receiving the master card, and the second encryption string is sent to institute State the first storage card；

Detection unit, for detecting whether receiving the first confirmation message of the first storage card feedback, wherein described First confirmation message is：First storage card is sent in the case where decrypting the random number from the second encryption string Confirmation message；

Determination unit, for when receiving first confirmation message, determination have been obtained to first storage card Rewrite permission.

Optionally, described device further includes that third obtains module；The third obtains module, for obtaining first son Key；

Wherein, the third obtains module, including：

Second obtains submodule, for obtaining the root key；

Determination sub-module, the first quantity for determining the storage card for backing up the root key, and determine and be more than institute State the second quantity of the first quantity；

Submodule is divided, for the root key to be divided into the second quantity subsegment, the subsegment obtained according to division is true Different sub-keys of fixed first quantity for synthesizing the root key；Wherein it is determined that subsegment used by each sub-key It is not exactly the same, determine that the quantity of subsegment used by each sub-key is less than the second quantity；

Choose submodule, for from identified sub-key choose for store to the first storage card first son it is close Key.

Optionally, first password is additionally operable to limit the reading permission for biological characteristic；Described device further includes：

Third sending module for obtaining the first biological characteristic for first storage card, and described first is given birth to Object feature is sent to first storage card, so that first storage card stores first biological characteristic.

In order to achieve the above object, the embodiment of the present application also discloses a kind of key recovery device, is applied to Key Issuance Device, described device include：

4th obtains module, for obtaining corresponding second password of each storage card for backing up root key, wherein institute State reading permission of second password for obtaining the encrypted result stored in storage card and key group；

5th obtains module, for according to each second password obtained and the first stored in each storage card It enables, obtains the reading permission of each storage card；Wherein, first password be used to limit the encrypted result that is stored in storage card and The reading permission of key group；

Read module, for after obtaining each readings permission, read the encrypted result stored in each storage card with Key group；Wherein, the encrypted result stored in a storage card is to be obtained after a sub-key is encrypted as a result, the son Key is the key obtained from the root key, and the key group stored in the storage card includes to be removed and the storage card for encrypting The key of other sub-keys except corresponding sub-key, the encrypted result stored in each storage card correspond to the root key Different sub-keys；

Deciphering module, for being determined respectively for each encrypted result to be decrypted from each key group obtained Key, and corresponding encrypted result is decrypted according to identified key respectively, obtains each sub-key；

Synthesis module is used for according to agreement composition rule corresponding with the root key, and each height obtained is close Key is synthesized, and the root key is obtained.

Optionally, the described 5th module is obtained, is specifically used for obtaining the reading permission of each storage card；

Wherein, the described 5th module is obtained, including：

Second sending submodule, for target password to be sent to target storage card, wherein the target storage card is to use In any of each storage card for backing up the root key, the target password is：It is corresponding with the target storage card Second password；

Detection sub-module, for detecting whether receiving the second confirmation message of the target storage card feedback, wherein institute Stating the second confirmation message is：The target storage card is confirming the of the target password and the target storage card itself storage The confirmation message that one password is sent when identical；

Third obtains submodule, and the target storage has been obtained for when receiving second confirmation message, determining The reading permission of card.

Optionally, described device further includes the 6th acquisition module, for obtaining sub-key from the root key；

Wherein, the described 6th module is obtained, including：

Submodule is divided, for the root key to be divided into the second quantity subsegment, the subsegment obtained according to division is true Different sub-keys of fixed first quantity for synthesizing the root key；Wherein it is determined that subsegment used by each sub-key It is not exactly the same, determine that the quantity of subsegment used by each sub-key is less than the second quantity.

Optionally, each storage card is additionally operable to store corresponding first biological characteristic；First password is additionally operable to limit For the reading permission of first biological characteristic；Described device further includes：

7th obtains module, for according to each second password obtained and stored in each storage card first Password after the reading permission for obtaining each storage card, obtains the second biological characteristic for each storage card；

8th obtains module, for obtaining the first biological characteristic stored in each storage card；

Judgment module, for judging whether are corresponding first biological characteristic of each storage card and corresponding second biological characteristic Match；If matched, the deciphering module is triggered.

Cipher key backup method and device provided by the embodiments of the present application, can by for the first password of the first storage card, First encrypted result and first key group are stored to the first storage card.Wherein, the first password is deposited after master card encryption It stores up to the first storage card.First storage card is one in the storage card for backing up root key, and the first encrypted result is pair The encrypted result that first sub-key obtains after being encrypted, the first sub-key are the sub-key obtained from the root key, are used The encrypted result to be stored corresponds to the different sub-keys of the root key in the storage card for backing up the root key, also, the One key group includes the key for encrypting other sub-keys in addition to first sub-key.

That is, the password and sub-key to be stored to storage card is stored by encrypted test mode, in this way can It avoids key and password from being directly acquired in storing process, the safety of key in storing process can be improved.Moreover, Password authentication could read the encrypted result in storage card after passing through, therefore can improve the safety of key in storage card.Together When, the sub-key in encrypted result and the key for encryption subkey are in interleaved to storage card, and independent one is deposited The key for encryption subkey in card storage can not decrypt the encrypted result in the storage card, therefore can further increase close The safety of key.Certainly, implement the application any product or method it is not absolutely required to and meanwhile reach all the above Advantage.

Description of the drawings

In order to illustrate the technical solutions in the embodiments of the present application or in the prior art more clearly, to embodiment or will show below There is attached drawing needed in technology description to be briefly described.It should be evident that the accompanying drawings in the following description is only this Some embodiments of application for those of ordinary skill in the art without creative efforts, can be with Obtain other attached drawings according to these attached drawings.

Fig. 1 is a kind of flow diagram of cipher key backup method provided by the embodiments of the present application；

Fig. 2 is a kind of structural schematic diagram of Key Issuance device provided by the embodiments of the present application；

Fig. 3 a are a kind of file structure figure of master card；

Fig. 3 b are a kind of file structure figure of storage card；

Fig. 4 is a kind of flow signal that Key Issuance device provided by the embodiments of the present application is interacted between master card, storage card Figure；

Fig. 5 is a kind of flow diagram of key recovery method provided by the embodiments of the present application；

A kind of flow diagram that Fig. 6 is interacted between Key Issuance device provided by the embodiments of the present application and storage card；

Fig. 7 is a kind of structural schematic diagram of cipher key backup device provided by the embodiments of the present application；

Fig. 8 is a kind of structural schematic diagram of key recovery device provided by the embodiments of the present application.

Specific implementation mode

Below in conjunction with the attached drawing in the embodiment of the present application, technical solutions in the embodiments of the present application carries out clear, complete Whole description.Obviously, described embodiment is only a part of the embodiment of the application, instead of all the embodiments.Base Embodiment in the application, those of ordinary skill in the art are obtained all without making creative work Other embodiment shall fall in the protection scope of this application.

The embodiment of the present application provides cipher key backup, restoration methods and device, is applied to Key Issuance device, to improve key Safety.Below by specific embodiment, the application is described in detail.

Fig. 1 is a kind of flow diagram of cipher key backup method provided by the embodiments of the present application, is applied to Key Issuance device, Key Issuance device is referred to as " authorization machine ".As a kind of specific implementation mode, above-mentioned Key Issuance device can have Fig. 2 institutes Show structure.The Key Issuance device includes：The CPU being respectively connected with display screen, keyboard distinguishes with mother card receptacle, memory card socket Connected interface chip, wherein CPU is connected with interface chip.As optional embodiment, Key Issuance device can also include The physical characteristics collecting module being connected with CPU.

As a kind of specific embodiment, the CPU in Key Issuance device can be microcontroller or ARM, and display screen can be with Using liquid crystal LCD display, interface chip can be PSAM (Purchase Secure Access Module, point of sales terminal Secure access module) card interface chip, for inputting the password PIN of storage card, Key Issuance device can also include 2 and insert keyboard Seat, one of them is mother card receptacle, and one is memory card socket.Certainly, more than one mother can also be arranged in Key Issuance device Card insertion seat and more than one memory card socket.Liquid crystal LCD display is used for that operation is prompted to guide.Master card and storage card can be with Use PSAM cards.PSAM master cards can be provided there are many card manufacturer in industry, algorithm includes DES (3DES) or the close SM1 of state Algorithm.Interface command between PSAM cards and Key Issuance device CPU is generally used the APDU orders of ISO7816 standards.

Fig. 3 a give the card structure of PSAM master cards, which includes master control key MK and card letter under MF master catalogues Cease master control key AMK, applicating maintenance key A CK, other keys and EF files, the card image text under file EF, ADF subdirectory Part EF etc..This belongs to card structure common in industry, and development Developmental Engineer is easy to a sky PSAM card to fill in advance Dress up such card structure.

Fig. 3 b give the card structure of PSAM storage cards, which includes master control key MK and card under MF master catalogues Master control key AMK, other keys and EF files, card image file EF under message file EF, ADF subdirectory etc..It also belongs to In card structure common in industry, development Developmental Engineer is easy to a sky PSAM card is filling at such card in advance Structure.Wherein, " the PIN password keys " under ADF catalogues shown in dotted line, sub-key and key group file EF and biological characteristic text The part such as part EF is not belonging to content filling in advance, these contents can just exist after storing key.

More specifically, Key Issuance device can select STM32ARM as its CPU, select the PSAM of FMPSAM-COS sequences Master card and PSAM generic cards select the LCD of 320 pixel *, 240 pixels to show respectively as the master card and storage card of the present embodiment Screen selects the keyboard being made of 0~9 10 numeric keys, a confirm key and a cancel key, collectively forms the Hardware Subdivision of Key Issuance device Point.

Specifically, method provided in this embodiment includes the following steps S101~step S105：

Step S101：Obtain the first encrypted result and first key group to be stored to the first storage card.

Wherein, first storage card is one in the storage card for backing up root key, first encrypted result For the encrypted result obtained after the first sub-key is encrypted, first sub-key is the son obtained from the root key Key, the encrypted result to be stored corresponds to the different sub-keys of the root key in the storage card for backing up the root key, The first key group includes the key for encrypting other sub-keys in addition to first sub-key.

It is understood that in backup root key, need to split root key and store to different storage cards On, so that each storage card does not store complete root key, different sub-keys is corresponded in each two storage card.Per height Key is not to be stored in storage card with plaintext version, but stored with ciphertext form after encryption.

Key Issuance device can utilize each for encrypting when each sub-key obtained from root key is encrypted The key of a sub-key is encrypted each sub-key using Encryption Algorithm such as exclusive or algorithm or shifting algorithms, obtains each Encrypted result.It is of course also possible to use each sub-key is encrypted in Encryption Algorithm in the prior art, the present embodiment is to this It is not specifically limited.

In a specific embodiment, 1~step 4 of following steps may be used as the Key Issuance device of executive agent Obtain the first sub-key：

Step 1：Obtain the root key.

Specifically, root key can be obtained from the master card for having stored above-mentioned root key, alternatively, can also be according to user's Input obtains root key.

Step 2：It determines the first quantity of the storage card for backing up the root key, and determines and be more than first quantity The second quantity.

Specifically, in the first quantity for determining the storage card for backing up the root key, it can be according to the defeated of user Enter determination, can also be determined according to default value.When determining the second quantity more than the first quantity, the first quantity can be will be greater than Random number be determined as the second quantity, the second quantity can also be determined according to default rule, for example, pre- according to D2=D1+ If value, determines the second quantity D 2, wherein D1 is the first quantity.

Step 3：The root key is divided into the second quantity subsegment, the first quantity is determined according to obtained subsegment is divided A different sub-keys for synthesizing the root key.Wherein it is determined that subsegment used by each sub-key is not exactly the same, Determine that the quantity of subsegment used by each sub-key is less than the second quantity.

As an example, it is known that need to back up to root key in 3 storage cards, i.e. the first quantity is 3, the second quantity It is 4, root key includes that byte number is from 0 to 15 totally 16 byte datas.Root key is divided into 4 subsegments, each subsegment Byte number it is as follows：[0:3], [4:7], [8:11], [12:15]；Wherein, [X:Y] it indicates from byte number X to byte number The part of Y.According to above-mentioned subsegment, 3 sub-keys determined are as follows：[4:7+8:11], [4:7+12:15], [0:3+4:7].When So, 3 sub-keys determined can also be other combined results between subsegment, above 3 sub-keys providing of content be One kind in numerous combinations.

Further, situations such as key may occur to lose or damage in practice, in order to ensure that root key to the greatest extent may be used It can not lose, above-mentioned identified sub-key can be：Any two sub-key can synthesize the key of the root key.It continues to use The example of epimere, identified 3 sub-keys can be as follows：[4:7+8:11+12:15], [0:3+4:7+12:15], [0:3+4: 7+8:11].Any two sub-key in sub-key determined by this way can synthesize above-mentioned root key.

It should be noted that determining that subsegment is not exactly the same it is to be understood that it is arbitrary to determine used by each sub-key Used subsegment when two sub-keys, other situations other than the fact that identical are all feasible, for example, determining Used subsegment part is identical when arbitrary two sub-key or each is different, is all feasible.

Step 4：It is chosen from identified sub-key for storing to the first sub-key of the first storage card.

Specifically, when choosing the first sub-key from identified sub-key, can randomly select, it can also be according to pre- If sequence choose, this is all feasible.

In order to ensure the safety of sub-key in storage card, for each storage card, corresponded to for encrypting the storage card The key of sub-key cannot store to the storage card, therefore, the present embodiment stored by the way of interleaved sub-key and Key for encryption subkey.Key Issuance device can be in acquisition root key and determining each sub-key and for encrypting respectively After the key of a sub-key, determine for storing to the sub-key of each storage card and key group, to realize interleaved.

The assigning process of sub-key and key group is exemplified below.Known root key is the data for including 16 bytes, Storage card for backing up the root key includes that storage card A, B and C tri- opens, the sub-key that Key Issuance device is obtained from root key Including RK1, RK2 and RK3 tri-, the key for encrypting above three sub-key is respectively RndA, RndB and RndC.It is distributing When sub-key and key group, it can be allocated according to allocation rule shown in table 2.

Table 2

Storage card	Sub-key	Key group
			A	RK1[4:7+8:11+12:15]	RndB, RndC
B	RK2[0:3+4:7+12:15]	RndA, RndC
			C	RK3[0:3+4:7+8:11]	RndA, RndB

The first storage card in the present embodiment can be any one in said memory card A, B and C.Key Issuance device exists It determines for after the allocation rule of sub-key and key group, the allocation rule can be stored, it is close according to son subsequently to need When key restores root key, it can be restored according to the allocation rule.When Key Issuance device backs up at least two root key When, allocation rule corresponding with the root key can be stored respectively for each root key, to avoid between allocation rule Mutually obscure.

Step S102：Obtain the first password for first storage card.Wherein, first password is for limiting needle To the reading permission of first encrypted result and first key group.

Specifically, the first password can be obtained according to the input of user, can also be to be obtained using other modes, Such as it is obtained from designated equipment.Wherein, the first password can be obtained by the keyboard in Key Issuance device.

Step S103：First password is sent to master card, so that the master card is with the described in the first agreement key pair One password is encrypted and obtains the first encryption string.Wherein, the first agreement key be the master card and the first storage card it Between the key arranged.

Before the first password is sent to master card, whether Key Issuance device can first detect in the mother card receptacle of itself It is inserted into master card, if so, executing the step of the first password is sent to master card again.The first password is sent out if it is not, then not executing The step of sending to master card, Key Issuance device can enter wait state, if never being detected within preset waiting time It has been inserted into master card in the mother card receptacle of itself, then can close this backup operation.

Specifically, above-mentioned first agreement key can be prestored into above-mentioned master card and the first storage card.Key Issuance Device has been inserted into detecting mother card receptacle after master card, can also further detect whether the master card belongs to specified master card.Tool Body, Key Issuance device detect the master card whether belong to specified master card when, card image file can be obtained from master card, and Determine whether the master card belongs to specified master card according to the mark in the card image file obtained.Wherein, card image text Part can be the advance filling file in master card, and the mark that can indicate the clamp part is stored in the card image file. Further, in Key Issuance device before obtaining card image file in master card, the repositioning information of master card can be first obtained, it should Repositioning information includes the attributive character of card, and the attributive character is for indicating information format used by master card.Then, key is sent out Row device finally determines whether the master card belongs to specified master card according to the mark in above-mentioned attributive character and card image file.Tool Body, master card can execute power on reset operation when being inserted into the mother card receptacle of Key Issuance device, after completing power on reset operation It sends to reset to Key Issuance device and completes message, Key Issuance device is after message is completed in the reset for receiving master card transmission, i.e., Repositioning information and card image file can be obtained from master card.

As an example, master card and the first storage card can distinguish the card structure of filling Fig. 3 a and Fig. 3 b in advance.For For master card, above-mentioned first agreement key can be the applicating maintenance key A CK under master card ADF catalogues；For the first storage card For, above-mentioned first agreement key can be the master control key AMK under the first storage card ADF master cards.Card image in master card File can be stored in the file under ADF catalogues, can also be the file being stored under MF catalogues.

As a kind of specific implementation mode, due to being generally at least 2 for backing up the storage card of root key, can To prestore above-mentioned first agreement key in the storage card of be useful for backup root key, in this way, master card only uses one , it is not necessary that each to be used to back up storage card one master card of setting of root key, to save card resource, simplification is close Key issues device operating process.

When master card is encrypted with first agreement the first password of key pair, Encryption Algorithm in the prior art may be used, The present embodiment no longer repeats the ciphering process.After master card is completed to the encryption of the first password, master card can be by first Encryption string is sent to Key Issuance device, so that Key Issuance device receives the first encryption string that master card is sent.

Step S104：It receives the first encryption string that the master card is sent, and the first encryption string is sent to described the One storage card, so that first storage card obtains according to the first encryption string and stores first password.

Before the first encryption string is sent to the first storage card, Key Issuance device can first detect the storage card insertion of itself It whether is inserted into the first storage card in seat, if it is, executing the step of the first encryption string is sent to the first storage card.If It is no, then the step of the first encryption string is sent to the first storage card is not executed, can enter wait state, if in preset waiting It is never detected in duration and has been inserted into the first storage card in the memory card socket of itself, then can close this time backup behaviour Make.

Key Issuance device has been inserted into the memory card socket for detecting itself after the first storage card, can also be further Whether the first be inserted into storage card of detection belongs to specified storage card.Specifically, Key Issuance device is detecting first storage card When whether belonging to specified storage card, card image file can be obtained from first storage card, and according to the card obtained Mark in message file determines whether first storage card belongs to specified storage card.Wherein, which can be The advance filling file in the first storage card is stored with the mark that can indicate the clamp part in the card image file.

Further, in Key Issuance device before obtaining card image file in the first storage card, can first be obtained The repositioning information of one storage card, the repositioning information include the attributive character of card, and the attributive character is for indicating the first storage card Used information format.Then, Key Issuance device is final true according to the mark in above-mentioned attributive character and card image file Whether fixed first storage card belongs to specified storage card.Specifically, the first storage card is in the storage card insertion for being inserted into Key Issuance device Power on reset operation can be executed when seat, sent to reset to Key Issuance device after completion power on reset operation and completed message, key Distribution device is completed in the reset for receiving the transmission of the first storage card after message, you can resets letter to be obtained from the first storage card Breath and card image file.

As an example, as shown in Figure 3b, the card image file in the first storage card can be stored in ADF catalogues Under file, can also be the file being stored under MF catalogues.

First storage card, can be according to the first of itself storage in the first encryption string for receiving the transmission of Key Issuance device The agreement encryption string of key pair first is decrypted, and obtains the first password.In decryption, decipherment algorithm used by the first storage card For：Used Encryption Algorithm corresponding decipherment algorithm when encrypting the first password with master card.First storage card is obtaining first The first password is stored to itself after order.For example, as shown in Figure 3b, the first storage card can be using the first password as PIN passwords Key storage is under ADF catalogues.

As a specific embodiment, when master card and storage card are all made of PSAM cards, and master card, storage card and key hair When interface command between row device uses the APDU orders of ISO7816 standards, " the filling Write_ of password PIN keys can be called Key " is instructed, and the first encryption string is written into storage card.

Step S105：First encrypted result and first key group are sent to first storage card, so that described First storage card stores first encrypted result and first key group.

It is understood that the first password is used to limit the reading permission for the first encrypted result and first key group, After encrypted first password is sent to the first storage card, you can to send the first encrypted result and first key group To the first storage card.First storage card receives the first encrypted result and first key group that Key Issuance device is sent, and stores the One encrypted result and first key group to itself.

As an example, in the card structure shown in Fig. 3 a, the first storage card can be by the first encrypted result and first Key group is stored as sub-key and key group file into ADF catalogues.

It should be noted that scheme provided in this embodiment is that the process of sub-key is stored into a storage card, due to It is generally necessary to which root key is backed up at least two storage cards, therefore, multiple memory card sockets can be arranged in Key Issuance device, It is stored to each storage card according to the step of the present embodiment while by each sub-key.In order to further increase the safety of root key Property, each storage card can be backed up one by one in backup, it in this way can be to avoid the password entry personnel of each storage card Reveal password information.That is, when inputting password for a storage card, the password entry personnel of other storage cards should return It keeps away.Meanwhile password holder, that is, password entry people of a card should be different from holder, i.e., holder has card, but does not know Password, password holder has password, but without corresponding storage card, can further increase the safety of root key in this way.

When backup by the way of being backed up one by one to each storage card, the first encrypted result and first is close Key group is sent to after the first storage card, and whether Key Issuance device can also further prompt to need to continue to make other storages Card, if detecting, needs continue to make other storage cards, can repeat the above steps.

As a specific embodiment, when master card and storage card are all made of PSAM cards, and master card, storage card and key hair When interface command between row device uses the APDU orders of ISO7816 standards, it can call and " write binary file Write_ File " is instructed, and storage card is written in the first encrypted result and first key group.

As shown in the above, cipher key backup method provided in this embodiment, can will be for the first of the first storage card Password, the first encrypted result and first key group are stored to the first storage card.Wherein, the first password is to encrypt it by master card It is stored afterwards to the first storage card.First storage card is one in the storage card for backing up root key, the first encrypted result For the encrypted result obtained after the first sub-key is encrypted, the first sub-key is that the son that is obtained from the root key is close Key, the encrypted result to be stored corresponds to the different sub-keys of the root key in the storage card for backing up the root key, and And first key group includes the key for encrypting other sub-keys in addition to first sub-key.

That is, the password and sub-key to be stored to storage card is stored by encrypted test mode, in this way can It avoids key and password from being directly acquired in storing process, the safety of key in storing process can be improved.Moreover, Password authentication could read the encrypted result in storage card after passing through, therefore can improve the safety of key in storage card.Together When, the sub-key in encrypted result and the key for encryption subkey are in interleaved to storage card, and independent one is deposited The key for encryption subkey in card storage can not decrypt the encrypted result in the storage card, therefore can further increase close The safety of key.When making storage card using this method of the present embodiment, unrelated with Developmental Engineer, Developmental Engineer only knows The road above method, but card content can not be read due to lacking password, because card can not be read in the case of password mistake Piece content.

Meanwhile the storage card made according to the method that the present embodiment is provided, each storage card only store root key Part of key, an independent storage card can not recover entire root key, it is necessary to and at least 2 or more storage cards are provided simultaneously with, Root key can just be restored.Therefore, it even if holder surprisingly loses a storage card, and is picked up by malicious persons, malice people Member and the password holder of the storage card conspire, and entire root key can not be also recovered, to improve the safety of root key.

From the present embodiment it can also be seen that in the present embodiment Key Issuance device low in hardware cost.Used CPU with And other hardware materials are common materials, the entire hardware cost for issuing device is within 400 yuan.And currently, in industry Professional encryption equipment for backup keys involves great expense, usually at 100,000 yuan or so.Therefore, the Key Issuance in the present embodiment Device can be as the substitute of professional encryption equipment, to reduce hardware cost.

In order to further increase the safety during cipher key backup, a kind of specific implementation based on embodiment illustrated in fig. 1 In mode, described the step of first password is sent to master card, 1 and step 2 may comprise steps of：

Step 1：According to the second agreement key stored in master card, first storage card is authenticated, is obtained to institute State the rewriting permission of the first storage card.

It should be noted that in Fig. 1, in order to which subsequently string, the first encrypted result and first key can be encrypted by first The first storage card is written in group, can obtain the rewriting permission to the first storage card first.It is obtaining rewriting permission and then is inciting somebody to action First password is sent to master card, and then makes the first password of master card pair that acquisition the first encryption string be encrypted, after executing Continuous the step of first encryption string, the first encrypted result and first key group are sent to the first storage card.

May include a variety of implementations when being authenticated to the first storage card according to the second agreement key stored in master card Mode can determine specific field by the first storage card, specific field is encrypted by master card, and the first storage card is decrypted, according to Whether decrypted result is identical as specific field to judge whether certification succeeds.Can also be that above-mentioned finger is determined by Key Issuance device Determine field, will encrypt the specific field by master card, whether the first storage card is decrypted, identical as specific field according to decrypted result To judge whether certification succeeds.

Step 2：After obtaining the rewriting permission, first password is sent to master card.

Specifically, above-mentioned steps 1 carry out first storage card that is, according to the second agreement key stored in master card Certification can be recognized the step of acquisition to the rewriting permission of first storage card with the outside of 1a in accordance with the following steps~step 1e Card process executes：

Step 1a：Random number is sent to first storage card and obtains request, and obtains first storage card according to institute It states random number and obtains the determining random number of request.

It should be noted that the first storage card first determines a random number, then the random number is encrypted by master card, then will Encrypted result is sent to the first storage card, if the first storage card can successful decryption go out the first storage card itself determination Above-mentioned random number, it is determined that certification success, this verification process belong to a kind of external authentication.This authentication mode can detect mother Whether card and storage card belong to the same set of card being mutually matched.It can be to Key Issuance after storage card confirms certification success Device, which opens, rewrites permission.

Step 1b：The random number is sent to master card so that the master card with it is described second arrange key pair described in Machine number is encrypted and obtains the second encryption string.

Wherein, the second agreement key can be different from the first agreement key, can also be identical as the first agreement key.As One example, in the card structure shown in Fig. 3 a and Fig. 3 b, when the first agreement key arranges key difference with second, second about It can be other keys in Fig. 3 a under ADF catalogues in master card to determine key, can be under ADF catalogues in Fig. 3 b in storage card Other keys.When the first agreement key is identical as the second agreement key, the second agreement key can be in Fig. 3 a in master card Applicating maintenance key A CK under ADF catalogues can be the master control key AMK under ADF catalogues in Fig. 3 b in storage card.

When master card is encrypted with random number described in the second agreement key pair, encryption in the prior art may be used and calculate Method, the present embodiment no longer repeat the ciphering process.It, can be by second after master card is completed to above-mentioned encryption several at any time Encryption string is sent to the first storage card by Key Issuance device.

Step 1c：The second encryption string that the master card is sent is received, and the second encryption string is sent to described first Storage card.

Step 1d：It detects whether to receive the first confirmation message that first storage card is fed back, if it is, executing step Rapid 1e, if not receiving the first confirmation message always in preset duration, it is determined that can not obtain and change to the first storage card Write permission terminates this backup procedure.

Wherein, first confirmation message is：First storage card from the second encryption string described in decrypting The confirmation message sent in the case of random number.

It is understood that if the first storage card is specified storage card, wherein have stored second agreement key, and And it is identical as the random number that itself is determined according to the data that the second agreement secret key decryption goes out, you can to confirm that certification is successful, first Storage card can send the first confirmation message to Key Issuance device.

Step 1e：Determine the rewriting permission obtained to first storage card.

As a specific embodiment, when master card and storage card are all made of PSAM cards, and master card, storage card and key hair When interface command between row device uses the APDU orders of ISO7816 standards, above-mentioned steps 1a~step 1e can refer to following Process：Key Issuance device is introduced into the ADF catalogues of storage card, to one random number R d1 of storage card application, obtains storage card hair The random number R d1 sent.Then, Key Issuance device enters the ADF catalogues of master card, is sent to master card and " generates internal key Init_ For_Crypt " is instructed and " encryption Crypt " instruction, and random number R d1 is sent to master card, and master card is made to add random number R d1 The second encryption string CipherData is obtained after close, Key Issuance device obtains the second encryption string CipherData that master card is sent, and CipherData is sent to storage card, so that storage card carries out external authentication.The outside that Key Issuance device receives storage card is recognized Card is as a result, certification obtains the rewriting permission of storage card after passing through.

To sum up, the scheme that present embodiment provides can encrypt string, the first encrypted result and first key group by first It is written before the first storage card, is authenticated, is obtained to the according to second agreement the first storage card of key pair stored in master card The rewriting permission of one storage card is obtaining rewriting permission and then is executing the step of the first password is sent to master card, and then holding It is about to the step of the first encryption string, the first encrypted result and first key group are sent to the first storage card, avoids above- mentioned information In the card of write error, so as to further increase the safety of root key.

It, can be with other than using safety of first password to ensure root key in order to improve the safety of key Further use the safety that biological characteristic ensures sub-key.

In a kind of specific implementation mode based on embodiment illustrated in fig. 1, first password is additionally operable to limit for biology The reading permission of feature.The method can also include：The first biological characteristic for first storage card is obtained, and by institute It states the first biological characteristic and is sent to first storage card, so that first storage card stores first biological characteristic.

Wherein, biological characteristic may include fingerprint characteristic, face characteristic, iris feature, skeleton character etc..First biology is special Sign can be the biological characteristic of password holder, or be different from other people life of password holder and card holder Object feature.

Specifically, above-mentioned acquisition be directed to first storage card the first biological characteristic the step of can be same with step S102 Shi Zhihang.The first biological characteristic is obtained while obtaining the first password.

The step of obtaining the first biological characteristic for first storage card can be by the biology in Key Issuance device It is obtained after the acquisition of collection apparatus module.It, can be with the multi collect user's for the same user when acquiring biological characteristic Biological characteristic can prompt user to face physical characteristics collecting module with not ipsilateral for example, when the face-image of acquisition user Camera lens, to acquire the different characteristic of the user.When acquiring fingerprint characteristic, same user can be prompted with different fingers Fingerprint input physical characteristics collecting device.In this way, being directed to the same user, multiple characteristics of the user can be obtained, When subsequent bio characteristic matching, successful match rate can be improved, and then improve user experience.

Certainly, the prior art, this implementation can also be used using the method that physical characteristics collecting module acquires biological characteristic Example no longer repeats this.

First storage card can store the first biological characteristic to itself after receiving above-mentioned first biological characteristic. In the example of card result shown in Fig. 3 b, the first storage card can using the first biological characteristic as biological characteristic file store to Under ADF catalogues.

It is understood that after the first password is proved to be successful, could obtain to the first encrypted result, first key group and The reading permission of first biological characteristic.Key Issuance device is after reading the above, since the first biological characteristic is for limiting To the permission that the first encrypted result is decrypted, therefore after the success of the first biological characteristic validation, Key Issuance device could be right First encrypted result is decrypted, and then obtains sub-key.It, can be into one using biological characteristic since biological characteristic is difficult to forge Step ensures the safety of root key.

As a specific embodiment, when master card and storage card are all made of PSAM cards, and master card, storage card and key hair When interface command between row device uses the APDU orders of ISO7816 standards, it can call and " write binary file Write_ File " is instructed, and storage card is written in the first biological characteristic.

Compared to embodiment illustrated in fig. 1, the present embodiment stores the first biological characteristic in the first storage card, with further Improve the safety of key.Even if it is understood that storage card is stolen, password is stolen, but also being needed when obtaining key Biological characteristic is verified, and biological characteristic is difficult to steal, so as to further ensure the safety of key.

In order to clearly illustrate interacting between Key Issuance device and master card and the first storage card in the present embodiment Journey gives the flow diagram of interaction between three in Fig. 4.Wherein, Key Issuance device first to the first storage card send with Machine number obtains request, then receives the random number of the first storage card return, and sends the random number to master card, receives master card and returns Second encryption string.Key Issuance device sends the second encryption string to the first storage card, then receives recognizing for the first storage card return Card as a result, when the authentication result indicate certification by when, to master card send the first password, then receive master card return first plus Close string.Key Issuance device goes here and there the first encryption, the first encrypted result and first key group and the first biological characteristic are sent to the One storage card, so that the first encryption of the first storage card storage string, the first encrypted result and first key group and the first biology are special Sign.

Fig. 5 is a kind of flow diagram of key recovery method provided by the embodiments of the present application, is applied to Key Issuance device. The present embodiment is embodiment corresponding with embodiment illustrated in fig. 1, and related content can be cross-referenced.The method includes following Step S501~step S505：

Step S501：Obtain corresponding second password of each storage card for backing up root key.Wherein, described second mouthful Enable the reading permission for obtaining the encrypted result stored in storage card and key group.

Specifically, the second password can be obtained according to the input of user, can also be to be obtained using other modes, Such as it is obtained from designated equipment.Wherein, the second password can be obtained by the keyboard in Key Issuance device.

It should be noted that since each sub-key that root key divides is respectively stored in different storage cards, When carrying out root key recovery, the sub-key in each storage card can be restored simultaneously.It is close in order to further increase root The safety of key can also restore the sub-key in each storage card one by one, in this way can be to avoid each storage card Password entry personnel reveal password information.That is, when inputting password for a storage card, the password of other storage cards Entry personnel should avoid.

Step S502：According to each second password obtained and the first password stored in each storage card, obtain The reading permission of each storage card.Wherein, first password is for limiting the encrypted result stored in storage card and key group Reading permission.

In the present embodiment, according to each second password obtained and the first password stored in each storage card, obtain The step of obtaining the reading permission of each storage card, can specifically execute according to following procedure：

The mode of 1~step 3 according to the following steps obtains the reading permission of each storage card：

Step 1：Target password is sent to target storage card.Wherein, the target storage card is for backing up described Any of each storage card of key, the target password are：The second password corresponding with the target storage card.

Step 2：It detects whether to receive the second confirmation message that the target storage card is fed back, if it is, executing step Rapid 3.If not receiving the second confirmation message always in preset duration, it is determined that the rewriting to target storage card can not be obtained Permission terminates this recovery process.

Wherein, second confirmation message is：The target storage card is deposited in the confirmation target password with the target The confirmation message that first password of card storage itself storage is sent when identical.

Step 3：Determine the reading permission for having obtained the target storage card.

It should be noted that the above embodiment is a kind of embodiment for the reading permission for obtaining storage card, ability Domain those of ordinary skill can also obtain other different embodiments by slightly improving the above embodiment.

As a specific embodiment, when master card and storage card are all made of PSAM cards, and master card, storage card and key hair When interface command between row device uses the APDU orders of ISO7816 standards, Key Issuance device can call " password PIN keys Verification Verify_PIN " instructions make storage card carry out password authentication according to the second password and the first password, to obtain storage card Read permission.

Before the reading permission for obtaining each storage card, Key Issuance device can first detect in the memory card socket of itself Whether each storage card has been inserted into, if it is, executing according to each second password obtained and being deposited in each storage card First password of storage, the step of obtaining the reading permission of each storage card.If it is not, then not executing according to each obtained The first password stored in two passwords and each storage card, can enter the step of obtaining the reading permission of each storage card Wait state has been inserted into each storage if never being detected within preset waiting time in the memory card socket of itself Card, then can close this recovery operation.

Key Issuance device has been inserted into the memory card socket for detecting itself after each storage card, can also be further Detect whether each storage card being inserted into belongs to specified storage card.Specifically, Key Issuance device is in each storage card of detection It is not no when belonging to specified storage card, card image file can be obtained from each storage card, and according to the card image obtained Mark in file determines whether each storage card belongs to specified storage card.Wherein, which can fill in advance The file being filled in each storage card is stored with the mark that can indicate the clamp part in the card image file.

Further, it in Key Issuance device before obtaining card image file in each storage card, can first obtain each The repositioning information of a storage card, the repositioning information include the attributive character of card, and the attributive character is for indicating each storage card Used information format.Then, Key Issuance device is final true according to the mark in above-mentioned attributive character and card image file Whether fixed each storage card belongs to specified storage card.Specifically, each storage card is in the memory card socket for being inserted into Key Issuance device When can execute power on reset operation, complete to send to reset to Key Issuance device after power on reset operation to complete message, key hair Row device is after receiving the reset that each storage card is sent and completing message, you can to obtain repositioning information from each storage card With card image file.

Step S503：After obtaining each reading permission, the encrypted result stored in each storage card and key are read Group.

Wherein, the encrypted result stored in a storage card is to be obtained after a sub-key is encrypted as a result, should Sub-key is the key obtained from the root key, and the key group stored in the storage card includes to be removed and the storage for encrypting Block the key of other sub-keys except corresponding sub-key, the encrypted result stored in each storage card corresponds to the root key Different sub-keys.

As a kind of specific implementation mode, sub-key is obtained from the root key using 1~step 2 of following steps：

Step 1：It determines the first quantity of the storage card for backing up the root key, and determines and be more than first quantity The second quantity.

Step 2：The root key is divided into the second quantity subsegment, the first quantity is determined according to obtained subsegment is divided A different sub-keys for synthesizing the root key.Wherein it is determined that subsegment used by each sub-key is not exactly the same, Determine that the quantity of subsegment used by each sub-key is less than the second quantity.

Further, situations such as key may occur to lose or damage in practice, in order to ensure that root key to the greatest extent may be used It can not lose, above-mentioned identified sub-key can be：Any two sub-key can synthesize the key of the root key.This Sample, the sub-key obtained after the encrypted result stored in any two storage card is decrypted contain all sons of root key Section.That is, the recovery to root key can be thus achieved using any two and more than two storage cards.When for storing When some storage card of root key breaks down or loses, other storage cards for storage root key can also be utilized to recover Root key ensures that root key is not lost.For example, using 3 storage card storage root keys, after one of storage card damages, 2 other storage cards can also be utilized to restore root key.

Step S504：Determination is close for each encrypted result to be decrypted respectively from each key group obtained Key, and corresponding encrypted result is decrypted according to identified key respectively, obtain each sub-key.

Specifically, determining the key for each encrypted result to be decrypted respectively from each key group obtained When, the allocation rule of the sub-key and key group that can be preserved according to Key Issuance device is divided from each key group obtained Key that Que Ding be for each encrypted result not to be decrypted.The allocation rule of above-mentioned sub-key and key group is Key Issuance The allocation rule that device is preserved when being backed up to root key.For example, the table 2 in embodiment illustrated in fig. 1 is a kind of distribution rule Then.

Key Issuance device is according to identified key, when corresponding encrypted result is decrypted, the decipherment algorithm of use For：Decipherment algorithm corresponding with the Encryption Algorithm taken when encrypting each sub-key.

It, can also be each according to obtaining after corresponding encrypted result is decrypted according to identified key Sub-key verifies whether each storage card belongs to each storage card for backing up same root key.Specifically, can basis Above-mentioned allocation rule judges whether corresponding subsegment is identical in each sub-key, if identical, it is determined that each storage card belongs to Each storage card for backing up same root key.

It is exemplified below, still by taking the content in table 2 as an example, the subsegment [4 in the corresponding sub-keys of storage card A:7] and it is sub Section [12:15] should be respectively equivalent in the corresponding sub-keys of storage card B [4:7] and [12:15]；The corresponding sons of storage card B are close The subsegment [0 of key:3] and subsegment [4:7] subsegment [0 that should be respectively equivalent in the corresponding sub-keys of storage card C:3] and subsegment [4: 7]；Subsegment [4 in the corresponding sub-keys of storage card A:7] and subsegment [8:11] it is close that the corresponding sons of storage card C should be respectively equivalent to Subsegment [4 in key:7] and subsegment [8:11].If above-mentioned subsegment is equivalent, it can determine that storage card A, B, C belong to and be used for Each storage card of backup same root key.

Step S505：According to agreement composition rule corresponding with the root key, by each sub-key obtained into Row synthesis, obtains the root key.

The composition rule corresponding with the root key of above-mentioned agreement can be the distribution rule of above-mentioned sub-key and key group Then.It, can be according to composition rule from each height when being synthesized each sub-key obtained according to above-mentioned composition rule Each subsegment for forming root key is determined in key, then each subsegment is synthesized according to the number of subsegment, is obtained Root key.

As an example, still by taking allocation rule shown in table 2 as an example, it is known that in storage card A, B, C for decrypting acquisition Sub-key is respectively：RK1[4:7+8:11+12:15], [0 RK2:3+4:7+12:15], [0 RK3:3+4:7+8:11].Then basis Above-mentioned each sub-key can be synthesized root key by the content of table 2, and as [0:3]+[4:7]+[8:11]+[12:15].

When Key Issuance device is backed up and is restored at least two root key, Key Issuance device can determine first with The corresponding composition rule of above-mentioned root key synthesizes each sub-key obtained then according to determining composition rule, Obtain the root key.

After obtaining the root key, above-mentioned root key can be stored to target master card, which is different from Master card in embodiment illustrated in fig. 1, the target master card are used for the root key that recovery of stomge obtains.

As shown in the above, key recovery method provided in this embodiment can obtain after password authentication success The reading permission of each storage card reads the encrypted result stored in each storage card and key after obtaining reading permission Then group is decrypted each encrypted result according to each key group obtained, each sub-key is obtained, according to agreement Composition rule synthesizes each sub-key obtained, obtains root key.Wherein, the encryption stored in a storage card As a result it is to be obtained after a sub-key is encrypted as a result, the sub-key be the key obtained from the root key, this The key group stored in storage card includes for encrypting the close of other sub-keys in addition to sub-key corresponding with the storage card Key, the encrypted result stored in each storage card correspond to the different sub-keys of the root key.

That is, the encrypted result in storage card could be read after password authentication passes through, therefore storage can be improved The safety of key in card.Meanwhile sub-key is stored in each storage card by encrypted test mode, rather than stored in clear , the safety of key can be improved in this way.In addition, the sub-key in encrypted result and the key for encryption subkey are to hand over Fork is stored into storage card, and the key for encryption subkey in an independent storage card can not be decrypted in the storage card Encrypted result, therefore the safety of key can be further increased.

In order to further increase the safety of root key, in a kind of embodiment based on embodiment illustrated in fig. 5, Ge Gecun Card storage is additionally operable to store corresponding first biological characteristic；First password is additionally operable to limit for first biological characteristic Read permission；

After step S502, i.e., according to each second password obtained and stored in each storage card first Password, after the reading permission for obtaining each storage card, the method can also include the following steps 1~step 3：

Step 1：Obtain the second biological characteristic for each storage card.

Wherein, biological characteristic may include fingerprint characteristic, face characteristic, iris feature, skeleton character etc..Second biology is special Sign can be the biological characteristic of password holder, or be different from other people life of password holder and card holder Object feature.The step of obtaining the second biological characteristic for each storage card can be adopted by the biological characteristic in Key Issuance device It is obtained after collection module acquisition.The prior art, this implementation may be used in the method for physical characteristics collecting module acquisition biological characteristic Example no longer repeats this.

Step 2：Obtain the first biological characteristic stored in each storage card.

It is understood that the first password is additionally operable to limit the reading permission for the first biological characteristic, when according to second After password and the first password obtain the reading permission of each storage card, it is special that the first biology can be read from each storage card Sign.

Specifically, when obtaining the first biological characteristic stored in each storage card, may include：Key Issuance device can be to Each storage card sends the first biological characteristic and obtains request, after each storage card receives the acquisition request of the first biological characteristic, The first biological characteristic that each storage card itself stores is sent to Key Issuance device, Key Issuance device receives in each storage card First biological characteristic of storage.

Step 3：Judge whether corresponding first biological characteristic of each storage card matches with corresponding second biological characteristic, If matched, S504 is thened follow the steps, i.e., is determined respectively for each encrypted result from each key group obtained The key being decrypted, and corresponding encrypted result is decrypted according to identified key respectively, it is close to obtain each height Key.Otherwise, it can prompt to re-enter the second biological characteristic, if the number that it fails to match reaches preset quantity threshold value, tie Shu Benci recovery processs.

Specifically, judging whether corresponding first biological characteristic of each storage card matches with corresponding second biological characteristic When, may include：It determines the similarity of each storage card corresponding first biological characteristic and corresponding second biological characteristic, judges Whether each similarity is more than similarity threshold, if be all higher than, it is determined that corresponding first biological characteristic of each storage card with Corresponding second biological characteristic matches.

It is understood that the first biological characteristic may include a characteristic, then in matching, directly by first Biological characteristic is matched with the second biological characteristic.Certainly, the first biological characteristic can also include multiple characteristics.For example, When biological characteristic is face feature, the face image of the same user can be acquired from different sides, and obtain multiple faces Feature, so that in matching, user can face the camera lens of physical characteristics collecting module at different angles, to improve user Experience Degree.

As another specific embodiment, the first biological characteristic may include at least two characteristics, judge When whether corresponding first biological characteristic of each storage card matches with corresponding second biological characteristic, may include：Judge each It whether there is characteristic identical with corresponding second biological characteristic in corresponding first biological characteristic of storage card, if deposited , it is determined that corresponding first biological characteristic of each storage card is matched with corresponding second biological characteristic.

As an example, it is known that the first biological characteristic is fingerprint characteristic, and the first biological characteristic includes multiple fingerprints Characteristic：The fingerprint characteristic data and left index finger of right hand index finger, right hand middle finger, hand thumb etc., left hand middle finger, a left side Hand thumbprint characteristic.The second received biological characteristic can be fingerprint characteristic data, the right hand of right hand index finger The finger of the fingerprint characteristic data of middle finger, the fingerprint characteristic data of hand thumb, the fingerprint characteristic data of left index finger, left hand middle finger Any one in line characteristic, left hand thumbprint characteristic.It, can be by fingerprint input by user spy in matching Sign data be compared with each fingerprint characteristic data in the first biological characteristic, if in the first biological characteristic exist comparison at The fingerprint characteristic data of work(, it is determined that the first biological characteristic and the second biometric matches.

Certainly, in matching biological, method in the prior art, detailed process can also be used to repeat no more.

To sum up, the present embodiment also needs to verification biological characteristic before each encrypted result is decrypted, when verification is logical Later, each encrypted result could be decrypted, is not otherwise decrypted, be difficult to steal due to biological characteristic, this Embodiment can further ensure the safety of key.

In order to clearly illustrate the interactive process in the present embodiment between Key Issuance device and storage card, given in Fig. 6 The flow diagram of interaction between the two is gone out.Wherein, Key Issuance device sends the second password to storage card first, then receives Storage card return password authentication as a result, when the authentication result indicate certification by when, from storage card read encrypted result and Key group.Then, Key Issuance device sends the first life after receiving the second biological characteristic for storage card to storage card Object feature obtains request, then receives the first biological characteristic that storage card returns.Key Issuance device is by the first biological characteristic and Two biological characteristics are matched, and in successful match, are decrypted to each encrypted result, are finally synthesized root key.

Fig. 7 is a kind of structural schematic diagram of cipher key backup device provided by the embodiments of the present application, is applied to Key Issuance device, Corresponding with embodiment of the method shown in Fig. 1, described device includes：

First obtains module 701, for obtaining the first encrypted result and first key group to be stored to the first storage card； Wherein, first storage card is one in the storage card for backing up root key, and first encrypted result is to first The encrypted result that sub-key obtains after being encrypted, first sub-key are the sub-key obtained from the root key, are used The encrypted result to be stored corresponds to the different sub-keys of the root key in the storage card for backing up the root key, and described first Key group includes the key for encrypting other sub-keys in addition to first sub-key；

Second obtains module 702, for obtaining the first password for first storage card；Wherein, the first It enables for limiting the reading permission for first encrypted result and first key group；

First sending module 703, for first password to be sent to master card, so that the master card is close with the first agreement Key is encrypted first password and obtains the first encryption string；Wherein, the first agreement key is the master card and the The key arranged between one storage card；

Receiving module 704, the first encryption string sent for receiving the master card, and the first encryption string is sent to First storage card, so that first storage card obtains according to the first encryption string and stores first password；

Second sending module 705, for first encrypted result and first key group to be sent to first storage Card, so that first storage card stores first encrypted result and first key group.

In a kind of embodiment based on embodiment illustrated in fig. 7, first sending module 703 may include：

First obtains submodule (not shown), for according to the second agreement key stored in master card, to described the One storage card is authenticated, and obtains the rewriting permission to first storage card；

First sending submodule (not shown) is used for after obtaining the rewriting permission, by first password It is sent to master card.

In a kind of embodiment based on embodiment illustrated in fig. 7, the first acquisition submodule may include：

Obtaining unit (not shown) obtains request for sending random number to first storage card, and obtains institute It states the first storage card and the determining random number of request is obtained according to the random number；

Transmission unit (not shown), for the random number to be sent to master card, so that the master card is with described Random number is encrypted and obtains the second encryption string described in two agreement key pairs；

Receiving unit (not shown), the second encryption string sent for receiving the master card, and described second is added Close string is sent to first storage card；

Detection unit (not shown) disappears for detecting whether receiving the first of the first storage card feedback and confirming Breath, wherein first confirmation message is：First storage card is decrypting the random number from the second encryption string In the case of the confirmation message that sends；

Determination unit (not shown), for when receiving first confirmation message, determination have been obtained to described The rewriting permission of first storage card.

In a kind of embodiment based on embodiment illustrated in fig. 7, described device can also include that third obtains module (in figure It is not shown)；The third obtains module, for obtaining first sub-key；

Wherein, the third obtains module and can specifically include：

Second obtains submodule (not shown), for obtaining the root key；

Determination sub-module (not shown), the first quantity for determining the storage card for backing up the root key, And determine the second quantity for being more than first quantity；

Submodule (not shown) is divided, for the root key to be divided into the second quantity subsegment, according to division Obtained subsegment determines different sub-keys of the first quantity for synthesizing the root key；Wherein it is determined that each sub-key Used subsegment is not exactly the same, determines that the quantity of subsegment used by each sub-key is less than the second quantity；

Submodule (not shown) is chosen, for being chosen from identified sub-key for storing to the first storage card The first sub-key.

In a kind of embodiment based on embodiment illustrated in fig. 7, first password, which is additionally operable to limit, is directed to biological characteristic Reading permission；Described device can also include：

Third sending module (not shown), for obtaining the first biological characteristic for first storage card, and First biological characteristic is sent to first storage card, so that first storage card storage, first biology is special Sign.

Fig. 8 is a kind of structural schematic diagram of key recovery device provided by the embodiments of the present application, is applied to Key Issuance device, Corresponding with embodiment of the method shown in Fig. 5, described device includes：

4th obtains module 801, for obtaining corresponding second password of each storage card for backing up root key, In, second password is used to obtain the reading permission of the encrypted result stored in storage card and key group；

5th obtains module 802, for according to each second password obtained and stored in each storage card the One password obtains the reading permission of each storage card；Wherein, first password is for limiting the encryption knot stored in storage card The reading permission of fruit and key group；

Read module 803, for after obtaining each reading permission, reading the encrypted result stored in each storage card With key group；Wherein, the encrypted result stored in a storage card is to be obtained after a sub-key is encrypted as a result, should Sub-key is the key obtained from the root key, and the key group stored in the storage card includes to be removed and the storage for encrypting Block the key of other sub-keys except corresponding sub-key, the encrypted result stored in each storage card corresponds to the root key Different sub-keys；

Deciphering module 804, for being determined respectively from each key group obtained for being carried out to each encrypted result The key of decryption, and corresponding encrypted result is decrypted according to identified key respectively, obtain each sub-key；

Synthesis module 805 is used for according to agreement composition rule corresponding with the root key, each height that will be obtained Key is synthesized, and the root key is obtained.

In a kind of embodiment based on embodiment illustrated in fig. 8, the 5th acquisition module 802 specifically can be used for obtaining The reading permission of each storage card；

Wherein, the 5th acquisition module 802 may include：

Second sending submodule (not shown), for target password to be sent to target storage card, wherein the mesh It is any of each storage card for backing up the root key to mark storage card, and the target password is：With the target Corresponding second password of storage card；

Detection sub-module (not shown), for detecting whether receive the target storage card feedback second confirms Message, wherein second confirmation message is：The target storage card is confirming the target password and the target storage card The confirmation message that first password of itself storage is sent when identical；

Third obtains submodule (not shown), for when receiving second confirmation message, determination to have obtained The reading permission of the target storage card.

In a kind of embodiment based on embodiment illustrated in fig. 8, described device can also include the 6th acquisition module (in figure It is not shown), for obtaining sub-key from the root key；

Wherein, the 6th acquisition module may include：

Submodule (not shown) is divided, for the root key to be divided into the second quantity subsegment, according to division Obtained subsegment determines different sub-keys of the first quantity for synthesizing the root key；Wherein it is determined that each sub-key Used subsegment is not exactly the same, determines that the quantity of subsegment used by each sub-key is less than the second quantity.

In a kind of embodiment based on embodiment illustrated in fig. 8, each storage card is additionally operable to store corresponding first biology Feature；First password is additionally operable to limit the reading permission for first biological characteristic；Described device can also include：

7th obtains module (not shown), for according to each second password obtained and each storage card First password of middle storage, after the reading permission for obtaining each storage card, the second biology obtained for each storage card is special Sign；

8th obtains module (not shown), for obtaining the first biological characteristic stored in each storage card；

Judgment module (not shown), for judging corresponding first biological characteristic of each storage card and corresponding second Whether biological characteristic matches；If matched, the deciphering module 804 is triggered.

Since above-mentioned apparatus embodiment is obtained based on embodiment of the method, and this method technique effect having the same, Therefore details are not described herein for the technique effect of device embodiment.

It should be noted that herein, relational terms such as first and second and the like are used merely to a reality Body or operation are distinguished with another entity or operation, are deposited without necessarily requiring or implying between these entities or operation In any actual relationship or order or sequence.Moreover, the terms "include", "comprise" or any other variant be intended to it is non- It is exclusive to include, so that the process, method, article or equipment including a series of elements includes not only those elements, But also include other elements that are not explicitly listed, or further include solid by this process, method, article or equipment Some elements.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including There is also other identical elements in the process, method, article or equipment of the element.

Each embodiment in this specification is all made of relevant mode and describes, identical similar portion between each embodiment Point just to refer each other, and each embodiment focuses on the differences from other embodiments.Especially for device reality For applying example, since it is substantially similar to the method embodiment, so describing fairly simple, related place is referring to embodiment of the method Part explanation.

The foregoing is merely the preferred embodiments of the application, are not intended to limit the protection domain of the application.It is all Any modification, equivalent substitution, improvement and etc. done within spirit herein and principle are all contained in the protection domain of the application It is interior.

Claims

1. a kind of cipher key backup method, which is characterized in that it is applied to Key Issuance device, the method includes：

Obtain the first encrypted result and first key group to be stored to the first storage card；Wherein, first storage card is to use One in the storage card of backup root key, first encrypted result be obtained after the first sub-key is encrypted plus It is close as a result, first sub-key is the sub-key obtained from the root key, the storage card for backing up the root key In the encrypted result to be stored correspond to the different sub-keys of the root key, the first key group includes for encrypting except described The key of other sub-keys except first sub-key；

Obtain the first password for first storage card；Wherein, first password adds for limiting for described first The reading permission of close result and first key group；

First password is sent to master card, so that the master card is encrypted with the first password described in the first agreement key pair And obtain the first encryption string；Wherein, the key that the first agreement key is arranged between the master card and the first storage card；

First encrypted result and first key group are sent to first storage card, so that first storage card stores First encrypted result and first key group.

2. according to the method described in claim 1, it is characterized in that, described the step of first password is sent to master card, Including：

According to the second agreement key stored in master card, first storage card is authenticated, is obtained to first storage The rewriting permission of card；

3. according to the method described in claim 2, it is characterized in that, it is described according to stored in master card second agreement key, it is right First storage card is authenticated, the step of acquisition to the rewriting permission of first storage card, including：

Random number is sent to first storage card and obtains request, and is obtained first storage card and obtained according to the random number Ask determining random number；

The random number is sent to master card, is encrypted so that the master card arranges random number described in key pair with described second And obtain the second encryption string；

Detect whether to receive the first confirmation message of the first storage card feedback, wherein first confirmation message is：Institute State the confirmation message that the first storage card is sent in the case where decrypting the random number from the second encryption string；

If it is, determining the rewriting permission obtained to first storage card.

4. according to the method described in claim 3, it is characterized in that, obtaining first sub-key in the following ways：

Obtain the root key；

It determines the first quantity of the storage card for backing up the root key, and determines the second number more than first quantity Amount；

The root key is divided into the second quantity subsegment, determines the first quantity for synthesizing according to obtained subsegment is divided The different sub-keys of the root key；Wherein it is determined that subsegment used by each sub-key is not exactly the same, each is determined The quantity of subsegment used by sub-key is less than the second quantity；

5. according to the method described in claim 4, it is characterized in that, identified sub-key is：Any two sub-key can Synthesize the key of the root key.

6. according to claim 1-5 any one of them methods, which is characterized in that first password is additionally operable to limit for life The reading permission of object feature；The method further includes：

The first biological characteristic for first storage card is obtained, and first biological characteristic is sent to described first and is deposited Card storage, so that first storage card stores first biological characteristic.

7. a kind of key recovery method, which is characterized in that it is applied to Key Issuance device, the method includes：

Obtain corresponding second password of each storage card for backing up root key, wherein second password is for being deposited The reading permission of the encrypted result and key group that are stored in card storage；

According to each second password obtained and the first password stored in each storage card, the reading of each storage card is obtained Weighting limits；Wherein, first password is used to limit the reading permission of the encrypted result stored in storage card and key group；

After obtaining each reading permission, the encrypted result stored in each storage card and key group are read；Wherein, it deposits for one The encrypted result stored in card storage is to be obtained after a sub-key is encrypted as a result, the sub-key is from the root key The key of middle acquisition, the key group stored in the storage card include for encrypting in addition to sub-key corresponding with the storage card The key of other sub-keys, the encrypted result stored in each storage card correspond to the different sub-keys of the root key；

Determine the key for each encrypted result to be decrypted, and basis respectively respectively from each key group obtained Corresponding encrypted result is decrypted in identified key, obtains each sub-key；

According to agreement composition rule corresponding with the root key, each sub-key obtained is synthesized, obtains institute State root key.

8. the method according to the description of claim 7 is characterized in that described according to each second password obtained and each The first password stored in storage card, the step of obtaining the reading permission of each storage card, including：

Target password is sent to target storage card, wherein the target storage card is for backing up each of the root key Any of storage card, the target password are：The second password corresponding with the target storage card；

Detect whether to receive the second confirmation message of the target storage card feedback, wherein second confirmation message is：Institute State what target storage card was sent when confirming that the target password is identical as the first password that the target storage card itself stores Confirmation message；

9. according to the method described in claim 8, it is characterized in that, being obtained from the root key in the following ways sub close Key：

The root key is divided into the second quantity subsegment, determines the first quantity for synthesizing according to obtained subsegment is divided The different sub-keys of the root key；Wherein it is determined that subsegment used by each sub-key is not exactly the same, each is determined The quantity of subsegment used by sub-key is less than the second quantity.

10. according to the method described in claim 9, it is characterized in that, identified sub-key is：Any two sub-key can Synthesize the key of the root key.

11. according to claim 7-10 any one of them methods, which is characterized in that each storage card is additionally operable to store corresponding First biological characteristic；First password is additionally operable to limit the reading permission for first biological characteristic；

Described according to each second password obtained and the first password stored in each storage card, each storage is obtained After the step of reading permission of card, further include：

Obtain the second biological characteristic for each storage card；

Obtain the first biological characteristic stored in each storage card；

If matched, execute described determining for being carried out to each encrypted result respectively from each key group obtained The key of decryption, and corresponding encrypted result is decrypted according to identified key respectively, obtain the step of each sub-key Suddenly.

12. a kind of cipher key backup device, which is characterized in that be applied to Key Issuance device, described device includes：

First obtains module, for obtaining the first encrypted result and first key group to be stored to the first storage card；Wherein, institute It is one in storage card for backing up root key to state the first storage card, first encrypted result be to the first sub-key into The encrypted result obtained after row encryption, first sub-key is the sub-key obtained from the root key, for backing up State the different sub-keys that the encrypted result to be stored in the storage card of root key corresponds to the root key, the first key group packet Containing the key for encrypting other sub-keys in addition to first sub-key；

Second obtains module, for obtaining the first password for first storage card；Wherein, first password is for limiting Surely it is directed to the reading permission of first encrypted result and first key group；

First sending module, for first password to be sent to master card, so that the master card is with the first agreement key pair institute The first password is stated to be encrypted and obtain the first encryption string；Wherein, the first agreement key is the master card and the first storage The key arranged between card；

Receiving module, the first encryption string sent for receiving the master card, and the first encryption string is sent to described the One storage card, so that first storage card obtains according to the first encryption string and stores first password；

13. device according to claim 12, which is characterized in that first sending module, including：

First obtains submodule, for according to the second agreement key stored in master card, being authenticated to first storage card, Obtain the rewriting permission to first storage card；

14. device according to claim 13, which is characterized in that described first obtains submodule, including：

Obtaining unit, for first storage card send random number obtain request, and obtain first storage card according to The random number obtains the determining random number of request；

Transmission unit, for the random number to be sent to master card, so that the master card is arranged with described second described in key pair Random number is encrypted and obtains the second encryption string；

Receiving unit, the second encryption string sent for receiving the master card, and the second encryption string is sent to described the One storage card；

Detection unit, for detecting whether receiving the first confirmation message of the first storage card feedback, wherein described first Confirmation message is：First storage card is sent really in the case where decrypting the random number from the second encryption string Recognize message；

Determination unit, for when receiving first confirmation message, determining the rewriting obtained to first storage card Permission.

15. device according to claim 14, which is characterized in that described device further includes that third obtains module；Described Three obtain module, for obtaining first sub-key；

Wherein, the third obtains module, including：

Second obtains submodule, for obtaining the root key；

Determination sub-module, the first quantity for determining storage card for backing up the root key, and determine and be more than described the Second quantity of one quantity；

Submodule is divided, for the root key to be divided into the second quantity subsegment, the is determined according to the obtained subsegment of division Different sub-keys of one quantity for synthesizing the root key；Wherein it is determined that subsegment used by each sub-key is endless It is exactly the same, determine that the quantity of subsegment used by each sub-key is less than the second quantity；

Submodule is chosen, for being chosen from identified sub-key for storing to the first sub-key of the first storage card.

16. according to claim 12-15 any one of them devices, which is characterized in that first password is additionally operable to limit needle To the reading permission of biological characteristic；Described device further includes：

Third sending module, for obtaining the first biological characteristic for first storage card, and first biology is special Sign is sent to first storage card, so that first storage card stores first biological characteristic.

17. a kind of key recovery device, which is characterized in that be applied to Key Issuance device, described device includes：

4th obtains module, for obtaining corresponding second password of each storage card for backing up root key, wherein described the Two passwords are used to obtain the reading permission of the encrypted result stored in storage card and key group；

5th obtains module, for according to each second password obtained and the first password stored in each storage card, Obtain the reading permission of each storage card；Wherein, first password is for limiting the encrypted result stored in storage card and close The reading permission of key group；

Read module, for after obtaining each reading permission, reading the encrypted result stored in each storage card and key Group；Wherein, the encrypted result stored in a storage card is to be obtained after a sub-key is encrypted as a result, the sub-key For the key obtained from the root key, the key group stored in the storage card includes for encrypting except corresponding with the storage card Sub-key except other sub-keys key, the encrypted result stored in each storage card corresponds to the difference of the root key Sub-key；

Deciphering module, for determination to be close for each encrypted result to be decrypted respectively from each key group obtained Key, and corresponding encrypted result is decrypted according to identified key respectively, obtain each sub-key；

Synthesis module, for according to agreement composition rule corresponding with the root key, by each sub-key obtained into Row synthesis, obtains the root key.

18. device according to claim 17, which is characterized in that the described 5th obtains module, is specifically used for obtaining each The reading permission of a storage card；

Wherein, the described 5th module is obtained, including：

Second sending submodule, for target password to be sent to target storage card, wherein the target storage card is for standby Any of each storage card of part root key, the target password are：With the target storage card corresponding second Password；

Detection sub-module, for detecting whether receiving the second confirmation message of target storage card feedback, wherein described the Two confirmation messages are：The target storage card is in the first for confirming the target password and the target storage card itself storage The confirmation message sent when enabling identical；

Third obtains submodule, for when receiving second confirmation message, determination to have obtained the target storage card Read permission.

19. device according to claim 18, which is characterized in that described device further include the 6th acquisition module, for from Sub-key is obtained in the root key；

Wherein, the described 6th module is obtained, including：

Submodule is divided, for the root key to be divided into the second quantity subsegment, the is determined according to the obtained subsegment of division Different sub-keys of one quantity for synthesizing the root key；Wherein it is determined that subsegment used by each sub-key is endless It is exactly the same, determine that the quantity of subsegment used by each sub-key is less than the second quantity.

20. according to claim 17-19 any one of them devices, which is characterized in that each storage card is additionally operable to storage and corresponds to The first biological characteristic；First password is additionally operable to limit the reading permission for first biological characteristic；Described device Further include：

7th obtains module, for according to each second password obtained and the first stored in each storage card It enables, after the reading permission for obtaining each storage card, obtains the second biological characteristic for each storage card；

Judgment module, for judging whether equal of corresponding first biological characteristic of each storage card and corresponding second biological characteristic Match；If matched, the deciphering module is triggered.