CN112948797A - Asymmetric key management system and method based on cooperative cryptographic algorithm - Google Patents

Abstract

The invention provides an asymmetric key management system and method based on a cooperative cryptographic algorithm, and relates to the technical field of cryptographic key management and application. The method provides a flexible and efficient authentication system for the asymmetric key management system, and greatly accelerates the authentication process; the asymmetric key management system is evolved towards intellectualization. The system comprises a distributed key management unit, a distributed key storage application unit, an equivalent key negotiation operation unit, a reliability verification unit and a key life cycle management unit, and provides a new key management system, which provides security protection services for the processes of signing and using keys and certificate authentication, so that part of high-reliability verification scenes avoid the storage and retrieval of CRL lists.

Description

Asymmetric key management system and method based on cooperative cryptographic algorithm

Technical Field

The invention relates to the technical field of cipher key management and application, in particular to an asymmetric key management system and method based on a cooperative cipher algorithm.

Background

Cryptography considers a key as the basis for protecting the security of a cryptographic algorithm, and the storage, distribution and utilization modes of the key, particularly a digital secret form key, are key links of the security characteristics of an information system. According to the classification of the key, the corresponding key management system can be divided into a symmetric key management system and an asymmetric key management system.

When a symmetric key is used, the key management system needs to distribute a carrier on which an information system node key (digital secret) is recorded to a corresponding key device (module) before the information system is formally used. According to the general demonstration of information theory, a full-link communication system with N nodes needs to distribute N when adopting symmetric key management²A secondary key. When N is large, it is difficult to implement a fully-connected information system, and this problem is also called key distribution problem.

In order to alleviate the key distribution problem, cryptologists establish asymmetric key application and corresponding management systems, and verify and disclose the corresponding public parts (public keys) of all keys (private keys) in the form of digital certificates. By using an asymmetric key management system, the information system with all nodes in communication does not need to share keys of all other nodes at the beginning of establishment; only when the key of a node is invalid or lost, the state change of the public key can be known.

At present, most of domestic asymmetric key management systems adopt CRL to verify certificates (CRL detection for short). Before the key needs to be verified, the certificate revocation list is inquired, the certificate needing to be verified is inquired through the plurality of certificate revocation lists, and whether the certificate is revoked is judged.

How to effectively reduce the problems of distribution, storage and search of a large number of CRLs (public key storage) related to an asymmetric key management system is accompanied by storage cost and time cost generated during certificate verification, and the method is one of key problems for further deeply popularizing domestic password application.

Disclosure of Invention

Aiming at the defects of the prior art, the invention provides an asymmetric key management system and method based on a cooperative cryptographic algorithm, and provides a new key management system in the calculation process of a cooperative cipher, so as to provide security protection service for the signing and using processes of keys and the certificate authentication process, and prevent the storage and retrieval of a CRL list in part of high-reliability verification scenes. In order to solve the technical problems, the technical scheme adopted by the invention is as follows:

on one hand, the asymmetric key management system based on the cooperative cryptographic algorithm comprises a distributed key management unit, a distributed key storage application unit, an equivalent key negotiation operation unit, a reliability verification unit and a key life cycle management unit.

The distributed key management unit issues two types of asymmetric cryptographic algorithm authentication certificates, a distributed private key authentication certificate and a collaborative equivalent key authentication certificate to an applicant according to the agreed functions and protocols of a certificate issuing authority (CA), including SM2 digital certificate format specification, RSA digital certificate format specification and X500 digital certificate format;

the equivalent key negotiation operation unit is a calculation part for realizing a password function through the dispersed key storage application unit according to a threshold password technology, a two-party cooperative password algorithm and a multi-party cooperative password algorithm, wherein the calculation part comprises a mobile phone, a PDA, a PAD, a personal computer, a calculation server cluster, a cloud server, a database and an optical memory, provides an equivalent key operation function of an asymmetric algorithm, comprises key coordination, encryption, decryption, signature and signature verification operations, checks the validity of the dispersed key management unit before executing the operation, and checks the validity in a mode of comparing a CRL list issued by the dispersed key management unit, a distributor of a dispersed private key authentication certificate and the validity period of the dispersed private key authentication certificate;

the threshold cryptography technology comprises a dynamic threshold cryptography, two-party cooperative cryptography and a multi-party cooperative cryptography algorithm, wherein a key life cycle management unit controls an equivalent key negotiation operation unit to respectively generate cooperative equivalent key public keys corresponding to digital secret information in a distributed key storage application unit, and a cooperative equivalent key private key never generates and the equivalent key negotiation operation unit has a self-owned digital secret influence.

The key life cycle management unit stores the state and the change sequence of the life cycle according to the state and the change sequence of each managed and controlled asymmetric key life cycle, receives the data query requirement of the equivalent key negotiation operation unit, and controls the operation and the working flow of the distributed key management unit;

the distributed key storage application unit concealably stores digital secret information only held by an authenticated object, and is matched with the equivalent key cooperative operation unit through a cooperative cryptographic algorithm to provide an equivalent key operation function of an asymmetric algorithm; the storage form of the digital secret information is as follows: storing a password module, storing a program file and storing a third party password;

the reliability verification unit verifies whether the digital secret information and the collaborative equivalent key in the distributed key storage application unit are in an effective key life cycle management period or not to an authentication entity connected with the reliability verification unit by using a distributed private key authentication certificate and a collaborative equivalent key authentication certificate stored in the reliability verification unit and a distributed private key authentication certificate and a collaborative equivalent key authentication certificate stored in the distributed key storage application unit; the reliability verification unit is divided into four types, namely a low reliability module, a medium reliability module, a high reliability module and a bidirectional authentication module according to the storage capacity and the calculation capacity of the information system node and the safety characteristics;

the low-reliability module needs the reliability verification unit to have the communication capability with the equivalent key negotiation operation unit.

The module with the medium reliability and the high reliability only needs to be authenticated that the distributed key storage application unit has the communication capability.

The bidirectional authentication module needs to be authenticated and distributed with the key storage application unit and the reliability verification unit to have communication capability.

The reliability verification unit provides four authentication modes with different safety strengths for the connection reliability verification unit by changing the CRL distribution range in the cooperative password calculation process and the element listing mechanism in the CRL list, wherein the authentication modes comprise low-reliability authentication, medium-reliability authentication, high-reliability authentication and high-reliability mutual authentication.

For the low-reliability authentication, identity authentication, digital signature and decryption operations are realized by inquiring a distributed private key authentication certificate CRL list in a low-reliability authentication module. The CRL list of the low reliability module is updated regularly by the distributed key management unit: by checking the CRL list generated by the scattered key management unit, whether the digital certificate of the authenticated object is revoked is judged, if the certificate is revoked, verification cannot be performed, and if the certificate is not revoked, whether the private key of the authenticated object exists is judged: if the private key of the authenticated object can pass the verification in the effective life cycle, otherwise, the verification fails. The verification module periodically performs CRL data synchronization operation with the distributed key management unit, and periodically updates the database;

the medium reliability authentication only allows the verification of the cooperative equivalent key authentication certificate, the medium reliability module is used for providing a communication interface for verifying the cooperative authentication certificate for the information system, and whether the cooperative equivalent key of the authenticated object exists or not is judged in the verification process, if the cooperative equivalent key of the authenticated object exists, the authentication is regarded as passing, otherwise, the authentication fails;

the high-reliability authentication directly limits the name, the identity and the access authority of an authenticated object by setting a white list on the basis of a middle-reliability module, and adds a user certificate ID constraint condition in the verification process of the verification module, so that identity authentication is carried out on a cooperative authentication certificate in an ID list, and authentication of a cooperative equivalent key authentication certificate cannot be carried out on a cooperative authentication certificate not in the ID list;

the high-reliability bidirectional authentication mode is that bidirectional identity authentication is established between the distributed key management unit and the reliability verification unit, and the distributed key management unit judges the coordinated equivalent key of the distributed key management unit and judges the coordinated equivalent key of the reliability verification unit. The specific judgment method comprises a medium-reliability authentication mode and can also be a high-reliability authentication mode.

On the other hand, an asymmetric key management method based on a cooperative cryptographic algorithm is realized based on the asymmetric key management system based on the cooperative cryptographic algorithm, and comprises the following steps:

step 1: when the terminal user performs identity authentication, digital signature or encryption operation, reliability authentication is performed firstly, if the client side has corresponding digital certificates, namely a private key authentication certificate and a collaborative authentication certificate, the step 4 is skipped, and if no authentication certificate exists, the step 2 is skipped;

step 2: and (3) generating a secret key: the key generation mode comprises the steps that a low-reliability private key is generated by a client or a cooperative equivalent key is generated by the client and an equivalent key negotiation unit together, according to a threshold password technology, a two-party cooperative password algorithm and a multi-party cooperative password algorithm, the key generation mode is a computing component for realizing a password function through the distributed key storage application unit, the validity of the distributed key management unit is checked before operation is executed, and the checking mode is a mode of comparing a CRL list issued by the distributed key management unit, checking a distributor of a distributed private key authentication certificate and the validity period of the distributed private key authentication certificate;

and step 3: issuing a certificate: the distributed key management unit uses the existing key to generate the corresponding certificate of authentication, which is stored locally and distributed to the verification device or the terminal user, and the specific issuing mode is as the claim 1.

And 4, step 4: and (3) authentication certificate: and the client performs identity authentication, wherein the identity authentication comprises low-reliability authentication, medium-reliability authentication and high-reliability authentication.

Adopt the produced beneficial effect of above-mentioned technical scheme to lie in:

the invention provides an asymmetric key management system and method based on a cooperative cryptographic algorithm, which provides a flexible and efficient authentication system for the asymmetric key management system and greatly accelerates the authentication process; the asymmetric key management system is evolved towards intellectualization. The authenticity, integrity and reliability of the certificate are guaranteed through a collaborative authentication mode, a revocation list is not needed, and the asymmetric key management system can be protected without distributing a black, white and grey list.

Drawings

Fig. 1 is a flow chart of a structure of an asymmetric key management method according to an embodiment of the present invention;

fig. 2 is a structural diagram of a collaborative equivalent signature generation process according to an embodiment of the present invention;

FIG. 3 is a block diagram of a certificate issuing process provided by an embodiment of the present invention;

FIG. 4 is a block diagram of a one-way low reliability authentication process provided by an embodiment of the present invention;

fig. 5 is a structural diagram of a one-way medium reliability authentication process provided by an embodiment of the present invention;

FIG. 6 is a block diagram of a one-way high reliability authentication process provided by an embodiment of the present invention;

fig. 7 is a structural diagram of a bidirectional cooperative authentication process according to an embodiment of the present invention;

FIG. 8 is a diagram showing a relationship between the units and the information system modules in embodiment 1 of the present invention;

fig. 9 is a diagram of a deployment relationship between each unit and an information system module according to embodiment 2 of the present invention.

Detailed Description

The following detailed description of embodiments of the present invention is provided in connection with the accompanying drawings and examples. The following examples are intended to illustrate the invention but are not intended to limit the scope of the invention.

An asymmetric key management system based on a cooperative cryptographic algorithm comprises a distributed key management unit, a distributed key storage application unit, an equivalent key negotiation operation unit, a reliability verification unit and a key life cycle management unit;

the distributed key management unit makes a digital certificate and issues a distributed key storage application unit, as shown in fig. 3; storing the state change of the key generated by the application unit according to the distributed key, and making and providing a certificate revocation list; the unit is used as a trustable authorization organization, and stores independent private keys in the application unit and keys negotiated by equivalent keys according to the distributed keys respectively to realize the merging and issuing functions of a digital certificate and a collaborative authentication certificate;

the distributed key storage application unit stores digital secret information of an authenticated object in a concealed manner, namely a key, stores a digital certificate and a cooperative authentication certificate of the authenticated object, confirms whether the key or the cooperative equivalent key is in an effective key life cycle management period or not to the reliability verification unit according to reliability requirements including low reliability, medium reliability and high reliability, checks the key life cycle through inquiring the key life cycle management unit and judges whether the key is effective or not;

the equivalent key agreement operation unit is used for generating a collaborative key certificate, performing decryption, signature and identity authentication cryptographic operation by using an agreement key, as shown in fig. 2, namely, the client and the server operate according to the CRL of the distributed key management unit, the collaborative equivalent key is generated by agreement based on a key generation protocol, the collaborative equivalent key certificate is generated and used for performing collaborative equivalent key authentication and calculation, and the module forcibly performs CRL check before performing collaborative calculation;

the reliability verification unit is divided into four types, namely a low reliability module, a medium reliability module, a high reliability module and a bidirectional authentication module according to the storage capacity and the calculation capacity of the information system node and the safety characteristics;

the judgment indexes of the reliability level comprise access control authority, namely, autonomous access and mandatory access control (a white list and a digital certificate authentication ID list), identity authentication and object reuse;

and (4) judging low reliability: through autonomous access control authority and identity authentication (judging whether a digital certificate is valid or not);

and (3) judging the medium reliability: through autonomous access control authority and identity authentication (judging whether a cooperative authentication certificate is valid or not);

and (3) judging high reliability: judging through three conditions of mandatory access control authority, identity authentication, audit and object reuse; wherein:

autonomous access control: the computer information system trusted computing base defines and controls access of a named user to a named object in the system. Enforcement mechanisms (e.g., access control tables) allow named users to specify and control the sharing of objects with the identity of the user and/or group of users; and controls access rights diffusion. The granularity of preventing unauthorized users from accessing the object access control is a single user according to a user-specified mode or a default mode.

And (3) forced access control: all subjects and objects are assigned sensitive labels, which are a combination of hierarchical and non-hierarchical categories, which are the basis for enforcing mandatory access control. The trusted computing base of the computer information system supports a security level consisting of two or more components. The computer information system trusted computing base uses the identity and the authentication data to authenticate the identity of the user and ensure that the security level and the authorization of the external main body of the computer information system trusted computing base created by the user are controlled by the security level and the authorization of the user.

Identity authentication: when the trusted computing base of the computer information system is initially executed, a user is required to identify the identity of the user, a protection mechanism (such as a password) is used for authenticating the identity of the user, and an unauthorized user is prevented from accessing the user identity authentication data.

Object reuse: in the free storage object space of the trusted computing base of the computer information system, all authorization of information contained in an object is revoked before the object is initially assigned, allocated or allocated to the object. When a subject gains access to a released object, the current subject cannot obtain any information generated by the original subject's activities

The verification process of the low-reliability module is as shown in fig. 4, and whether the digital certificate of the authenticated object is revoked or not is judged by checking the CRL list generated by the distributed key management unit, and whether the private key of the authenticated object exists or not is judged in the verification process; if the private key of the authenticated object can pass the verification in the effective life cycle, the verification module periodically performs CRL data synchronization operation with the distributed key management unit, and periodically updates the database; therefore, the method can meet the scenes with relatively low safety requirements, such as residential area access control and the like.

The medium reliability module is shown in fig. 5, and avoids retrieving the CRL list by only allowing the certificate of authentication of the collaborative signature to pass verification; the module provides a communication interface for verifying the collaborative authentication certificate for the information system, and judges whether the collaborative equivalent key of the authenticated object exists in the verification process, if so, the collaborative equivalent key of the authenticated object can pass the verification in the life validity period; therefore, the system can meet the scenes with relatively high safety requirements, such as building unit access control and the like.

The high-reliability module is shown in fig. 6, and on the basis of the medium-reliability module, the name, the identity and the access authority of the authenticated object are directly limited by setting a white list, so that scenes with higher security requirements, such as home door access control and subway gate verification, are met. User certificate ID constraint conditions are added in the verification process of the verification module, identity authentication is carried out on the collaborative authentication certificate in the ID list, and the collaborative signature certificate authentication can not be carried out when the collaborative authentication certificate is not in the ID list;

the bidirectional authentication reliability module is as shown in fig. 7, and in the authentication process of the distributed key storage application unit, on the basis of the medium reliability module, only the authentication certificate of the collaborative signature is allowed to pass verification, and the collaborative signature authentication certificate issued by the distributed key management unit is sent to the distributed key storage application unit, and the collaborative equivalent key is verified to be valid to the distributed key management unit, that is, within the key life cycle;

the key life cycle management unit controls the work flow of the distributed key management unit according to the sequence of the managed asymmetric key life cycle;

on the other hand, an asymmetric key management method based on a cooperative cryptographic algorithm is implemented based on the foregoing asymmetric key management system based on a cooperative cryptographic algorithm, as shown in fig. 1, and includes the following steps:

step 1: when the terminal user performs identity authentication, digital signature or encryption operation, reliability authentication is performed firstly, if the client side has corresponding digital certificates, namely a private key authentication certificate and a collaborative authentication certificate, the step 3 is skipped, and if no authentication certificate exists, the step 2 is skipped;

step 2: and (3) generating a secret key: the key generation mode comprises the steps that a low-reliability private key is generated by the client or a cooperative equivalent key is generated by the client and an equivalent key negotiation unit together;

the equivalent key negotiation unit generates an equivalent key through communication negotiation with the client terminal, and specifically comprises the following steps:

step S1: a client initiating stage: the client side sends an equivalent key cooperative generation request to the equivalent key negotiation unit, the server side verifies the object identity and forcibly checks the CRL list of the object identity, the verification result is fed back after the verification is passed, the next operation is carried out if the verification is passed, and otherwise the message is ignored.

Step S2: an equivalent key generation stage: using a safe two-party computing mode, after the identity authentication of the client passes, the client obtains the private key d thereof by generating a random number_uAnd use of

Generating a client public key, and returning to a server S message after the public key is generated

After the server receives the object U message, the server cooperates with the equivalent key negotiation unit to generate a protocol by using a key

A cooperative equivalent key is generated. Each parameter meaning, Du client public key, G is the base point of n order on the elliptic curve, sid identifies whether the message is a new request, ds server private key

The safe calculation mode is that two participants finish data collaborative calculation without data aggregation, and simultaneously, both parties of an original data privacy protocol of all data sides execute a given calculation logic and obtain a calculation result under the condition that data are kept in respective local places, and the privacy requirements are as follows: after the calculation is finished, the two sides of the calculation can not obtain any additional effective information except the input data of the two sides, the intermediate result and the output result related to the input data of the two sides

Step S3: and an equivalent key output stage: after the cooperative equivalent key is generated, the equivalent key negotiation operation unit sends the equivalent key to the distributed key management unit and the key life cycle management unit, the distributed key management unit generates a negotiation authentication certificate by using the equivalent key and sends the negotiation authentication certificate to the client, and the key life cycle management unit manages the validity period of the key.

And step 3: issuing a certificate: the distributed key management unit generates corresponding authentication certificates by using the existing keys, stores the authentication certificates locally and distributes the authentication certificates to verification equipment or terminal users.

The distributed key management unit realizes the function of signing and issuing certificates, and the types of the signing and issuing certificates comprise an organization certificate, an equipment certificate and a personnel certificate (a private key certificate and a cooperative certificate); the authority certificate is not distributed to the cooperative computing unit, and other units, the password equipment and the terminal user all have the authority certificate; the unit also generates a user private key authentication certificate and a collaborative authentication certificate for the terminal user, and generates a collaborative authentication certificate for the equipment;

and 4, step 4: and (3) authentication certificate: the client performs identity authentication, wherein the identity authentication comprises low-reliability authentication, medium-reliability authentication and high-reliability authentication;

the low-reliability authentication is realized by inquiring a CRL (public key certificate) list of a client private key authentication certificate in a local reliability authentication module to identify, digitally sign and decrypt, and the CRL list of the low-reliability module is regularly updated by a scattered key management unit and is authenticated in a non-communication state;

the medium-reliability authentication module is connected with the dispersed key storage unit, and identity authentication, digital signature and decryption operation are realized by inquiring the validity of the cooperative authentication certificate of the medium-reliability authentication module;

the authentication mode of the cooperative authentication certificate is divided into one-way authentication and two-way authentication according to the security level, wherein the one-way authentication mode is identity authentication between a terminal user and a password module; the two-way authentication mode is that two terminal users are authenticated through respective cooperative authentication certificates, the cooperative equivalent key is checked in the authentication process, and any one of the two authentication parties can complete interaction without requiring the channel capacity of the two authentication parties when the two authentication parties have a communication channel.

The high-reliability authentication one-way authentication mode is identity authentication between a terminal user and a password module, a distributed key storage application unit is connected in a butt joint mode, the authentication process firstly inquires a collaborative authentication certificate authority list of the terminal user to judge whether the collaborative authentication certificate authority list belongs to a high-reliability authentication condition, if the collaborative authentication certificate exists in the list, the validity of the collaborative authentication certificate and whether a collaborative key exists in the life cycle of the collaborative authentication certificate are further inquired, and inquiry is carried out through a key life cycle management unit;

the two-way authentication mode is that two terminal users are authenticated through respective cooperative authentication certificates, the cooperative equivalent key is checked in the authentication process, the authentication is the highest reliability authentication, a white list is added on the basis of the high reliability one-way authentication, the authentication process inquires the white list of the cooperative authentication certificates, the cooperative authentication certificate of the client authentication server side is verified, only the validity of the certificate and whether the cooperative key is in the life cycle are verified, the client terminal has two authentication certificates, the corresponding certificate authentication is performed according to the security requirement, and the authentication is realized only by the private key of the client side in the low reliability authentication; high reliability authentication requires a user to authenticate using a collaborative authentication certificate.

Example 1: the application of the access control system is shown in fig. 8. Although the same card is used in the process from the cell gate to the home gate, the security of the key management system needs to be gradually improved in the process from the cell gate to the cell gate and finally entering the home gate due to different identity authentication modes. The access process from the cell gate can be completed by using a low-security mode, whether the digital certificate is revoked is verified by inquiring the CRL list, whether the private key of the applicant exists is checked, and the cell gate can be accessed after the verification is passed; in the process of entering the unit door, the passing authority is required to be increased, the cooperative equivalent encryption operation is carried out on each unit door through different equivalent key negotiation parameters by utilizing a one-way cooperative authentication mode, the personnel entering and exiting problems of each unit door are further controlled, and the cooperative authentication mode can only carry out digital certificate authentication through a high-reliability unit module; the home authentication and identification process needs to have the highest security level, and a bidirectional cooperative authentication mode is used, namely, the home authentication and identification process can be accessed only when two parties pass authentication at the same time.

Example 2: the application of ticket authentication identification is shown in fig. 9. The user is a bidirectional authentication process when buying the ticket, the security requirement level is equivalent to the limited high reliability level, the server side not only needs the client side to authenticate the identity of the ticket buyer, but also needs the server side to authenticate the authenticity of the identity in the verification process; when a user enters a station and checks a ticket, namely the low security requirement is met, the user only needs to own the ticket entering the station on the same day without distinguishing the time and the train number of the ticket, the ticket on the same day is equivalent to the certificate authentication validity period, namely a CRL (certificate verification) list, the user and the ticket correspond to each other and are used for the private key authentication process, and the user can enter the station after the authentication is passed; when the ticket checking and taking process of the customer needs to verify whether the customer belongs to the train number, the authentication process is one-way cooperative authentication, the customer who is not in the train number can not take the train, the train number and the time of the customer correspond to the cooperative equivalent key generated by the user terminal and the server, and the passenger can take the train after the verification is passed.

The foregoing description is only exemplary of the preferred embodiments of the disclosure and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the invention in the embodiments of the present disclosure is not limited to the specific combination of the above-mentioned features, but also encompasses other embodiments in which any combination of the above-mentioned features or their equivalents is made without departing from the inventive concept as defined above. For example, the above features and (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure are mutually replaced to form the technical solution.

Claims (4)

1. An asymmetric key management system based on a cooperative cryptographic algorithm is characterized by comprising a distributed key management unit, a distributed key storage application unit, an equivalent key negotiation operation unit, a reliability verification unit and a key life cycle management unit;

the distributed key management unit issues two types of asymmetric cryptographic algorithm authentication certificates, a distributed private key authentication certificate and a collaborative equivalent key authentication certificate to an applicant according to the agreed functions and protocols of a certificate issuing authority (CA), including SM2 digital certificate format specification, RSA digital certificate format specification and X500 digital certificate format;

the equivalent key negotiation operation unit is a calculation part for realizing a password function through the dispersed key storage application unit according to a threshold password technology, a two-party cooperative password algorithm and a multi-party cooperative password algorithm, wherein the calculation part comprises a mobile phone, a PDA, a PAD, a personal computer, a calculation server cluster, a cloud server, a database and an optical memory, provides an equivalent key operation function of an asymmetric algorithm, comprises key coordination, encryption, decryption, signature and signature verification operations, checks the validity of the dispersed key management unit before executing the operation, and checks the validity in a mode of comparing a CRL list issued by the dispersed key management unit, a distributor of a dispersed private key authentication certificate and the validity period of the dispersed private key authentication certificate;

the key life cycle management unit stores the state and the change sequence of the life cycle according to the state and the change sequence of each managed and controlled asymmetric key life cycle, receives the data query requirement of the equivalent key negotiation operation unit, and controls the operation and the working flow of the distributed key management unit;

the distributed key storage application unit concealably stores digital secret information only held by an authenticated object, and is matched with the equivalent key cooperative operation unit through a cooperative cryptographic algorithm to provide an equivalent key operation function of an asymmetric algorithm; the storage form of the digital secret information is as follows: storing a password module, storing a program file and storing a third party password;

the reliability verification unit verifies whether the digital secret information and the collaborative equivalent key in the distributed key storage application unit are in an effective key life cycle management period or not to an authentication entity connected with the reliability verification unit by using a distributed private key authentication certificate and a collaborative equivalent key authentication certificate stored in the reliability verification unit and a distributed private key authentication certificate and a collaborative equivalent key authentication certificate stored in the distributed key storage application unit; the reliability verification unit is divided into four types, namely a low reliability module, a medium reliability module, a high reliability module and a bidirectional authentication module according to the storage capacity and the calculation capacity of the information system node and the safety characteristics;

the low-reliability module needs a reliability verification unit to have the communication capability with the equivalent key negotiation operation unit;

the centering reliability and high reliability module only needs the authenticated scattered key storage application unit to have communication capacity;

the bidirectional authentication module needs to be authenticated and distributed with the key storage application unit and the reliability verification unit to have communication capability.

2. An asymmetric key management system based on cooperative cryptographic algorithm according to claim 1,

the reliability verification unit provides four authentication modes with different safety strengths for the connection reliability verification unit by changing the CRL distribution range and the element listing mechanism in the CRL list in the cooperative password calculation process, wherein the authentication modes comprise low reliability authentication, medium reliability authentication, high reliability authentication and high reliability bidirectional authentication;

for the low-reliability authentication, identity authentication, digital signature and decryption operations are realized by inquiring a distributed private key authentication certificate CRL list in a low-reliability authentication module; the CRL list of the low reliability module is updated regularly by the distributed key management unit: by checking the CRL list generated by the scattered key management unit, whether the digital certificate of the authenticated object is revoked is judged, if the certificate is revoked, verification cannot be performed, and if the certificate is not revoked, whether the private key of the authenticated object exists is judged: if the private key of the authenticated object can pass the verification in the effective life cycle, otherwise, the verification fails; the verification module periodically performs CRL data synchronization operation with the distributed key management unit, and periodically updates the database;

the medium reliability authentication only allows the verification of the cooperative equivalent key authentication certificate, the medium reliability module is used for providing a communication interface for verifying the cooperative authentication certificate for the information system, and whether the cooperative equivalent key of the authenticated object exists or not is judged in the verification process, if the cooperative equivalent key of the authenticated object exists, the authentication is regarded as passing, otherwise, the authentication fails;

the high-reliability authentication directly limits the name, the identity and the access authority of an authenticated object by setting a white list on the basis of a middle-reliability module, and adds a user certificate ID constraint condition in the verification process of the verification module, so that identity authentication is carried out on a cooperative authentication certificate in an ID list, and authentication of a cooperative equivalent key authentication certificate cannot be carried out on a cooperative authentication certificate not in the ID list;

the high-reliability bidirectional authentication mode is that bidirectional identity authentication is established between the distributed key management unit and the reliability verification unit, and the distributed key management unit judges the coordinated equivalent key of the distributed key management unit and judges the coordinated equivalent key of the reliability verification unit; the specific judgment method comprises a medium-reliability authentication mode and can also be a high-reliability authentication mode.

3. An asymmetric key management system based on cooperative cryptographic algorithm according to claim 1,

the threshold cryptography technology comprises a dynamic threshold cryptography, two-party cooperative cryptography and a multi-party cooperative cryptography algorithm, wherein a key life cycle management unit controls an equivalent key negotiation operation unit to respectively generate cooperative equivalent key public keys corresponding to digital secret information in a distributed key storage application unit, and a cooperative equivalent key private key never generates and the equivalent key negotiation operation unit has a self-owned digital secret influence.

4. An asymmetric key management method based on a cooperative cryptographic algorithm is realized based on the asymmetric key management system based on the cooperative cryptographic algorithm, and is characterized by comprising the following steps:

step 1: when the terminal user performs identity authentication, digital signature or encryption operation, reliability authentication is performed firstly, if the client side has corresponding digital certificates, namely a private key authentication certificate and a collaborative authentication certificate, the step 4 is skipped, and if no authentication certificate exists, the step 2 is skipped;

step 2: and (3) generating a secret key: the key generation mode comprises the steps that a low-reliability private key is generated by a client or a cooperative equivalent key is generated by the client and an equivalent key negotiation unit together, according to a threshold password technology, a two-party cooperative password algorithm and a multi-party cooperative password algorithm, the key generation mode is a computing component for realizing a password function through the distributed key storage application unit, the validity of the distributed key management unit is checked before operation is executed, and the checking mode is a mode of comparing a CRL list issued by the distributed key management unit, checking a distributor of a distributed private key authentication certificate and the validity period of the distributed private key authentication certificate;

and step 3: issuing a certificate: the distributed key management unit uses the existing key to generate a corresponding authentication certificate, stores the certificate locally and distributes the certificate to verification equipment or terminal users, and the specific issuing mode is as the claim 1;

and 4, step 4: and (3) authentication certificate: and the client performs identity authentication, wherein the identity authentication comprises low-reliability authentication, medium-reliability authentication and high-reliability authentication.

Images