TW427087B - Full domain key recovering system - Google Patents

Abstract

A system combining key recovering and public key authentication in the digital communication environment with a plurality of client/server which attaches a public key authentication in the digital message to be transmitted so as to authenticate the signer's identification; meanwhile, the private key can be recovered by the authentication agency. The method has the following steps: firstly, each user must select the modulus, private key and authentication agency and calculate the corresponding public key; separating the private key into several partial private keys and calculating the corresponding partial public keys respectively; transmitting the public data (including the public key, partial public key, authentication agency) and one copy of the partial private key to each authentication agency; then, each authentication agency will apply integrity check on the received data and calculate a partial signature for broadcasting to other authentication agencies; signing the public data and sending back the signature result to the user; thereafter, the user can confirm the returned partial signature and combine all the partial signatures into the required public key authentication.

Description

4 2 7 0 8 7 5 'Description of the invention (1) The present invention relates to a private key recovery method for cryptographic communication and public key cryptosystems, and more particularly to network security applications that allow the owner of a public key cryptosystem or A trusted third party can recover lost or unreachable privacy. The combination of computer and communication technology has led to a rapid increase in the speed and quantity of information collection and transmission. Diversified applications have made electronic transmission a replacement for traditional paper-based communication methods. As a result, the use of information is further improved, but it is relatively easy to make information vulnerable to malicious attacks by illegal or unauthorized persons. Therefore, how to combine information security technology with electronic communication systems to protect the privacy and authenticity of information and prevent information from passive eavesdropping or active tampering has become the most important issue at present. DES (Data Encryption Standard) is the first cryptographic algorithm that is publicly available and endorsed by the US government. This is a kind of 1. One Key or "Symmetric Key" cipher. system. The so-called "single key" or "symmetric key" cryptosystem is that the keys used for encryption / decryption can be easily derived from each other, in other words: as long as the encryption key is available, it can be reported easily. Derivation to obtain the decryption key, and vice versa. In 1 976, Diffie and He 1 iamn proposed a so-called " public input η (Public key) or " asymmetric key " (Asymmetric key) cryptosystem, It is used to solve the problem of "single key" or "symmetric key" cryptographic system that needs secret key exchange. In this public key cryptosystem, each encryption key has a corresponding decryption key. This pair looks completely different.

Page 4 427087 V. Description of the invention (2) The keys are inextricably linked, but it is not easy to deduce from one of them to the corresponding one of the other losers. In this public key cryptosystem, each member's encryption key must be made public. In this way, 'anyone can encrypt the confidential file using the encryption key publicly disclosed by the receiver', and the encrypted confidential file can be sent to the receiver through the insecure communication channel. Since only the legitimate receiver will own the decryption key corresponding to the encryption key, only the legitimate receiver can decrypt the encrypted confidential file. © In the standard of Electronic Transaction Security (SETTK), the message data is encrypted with a randomly generated symmetric encryption key, and the symmetric gold record is encrypted with the encryption key (hereinafter referred to as the public key) publicly disclosed by the receiver. This is the " digital envelope " (D i g i t a 1 E n v e 1 ope) of the message data, which will be sent to the recipient along with the encrypted message. After the recipient receives the digital envelope, he will use the unopened solution to open the digital envelope (the following is not a private input) to unlock the digital envelope, to obtain a randomly generated symmetric key, and use this symmetric key to unlock Original message data. The public input cipher system has a very unique feature, which is the so-called digital signature. Digital signatures, like traditional autographs, can be used to identify the author of the signature. Digital signature is the act of signing an electronic document. The signing result can provide authentication and non-repudiation. To sign an electronic document, the sender must first enter the electronic document into a so-called one-way hash function to obtain a message digest or hash value. for safety

Page 5 427087

V. Explanation of the invention (3) For the sake of simplicity, the one-way hash function must have two characteristics: it is very easy to input the message from the message digest; the message digest is pushed back to the input message not; after the message digest is obtained, the sender can The message digest is encrypted with an undisclosed private key, and the result of this encryption is a digital signature. The sender can then attach the digital signature to the original document and send it to the receiver for later verification. 〇 The receiver can use the encryption key (public key) disclosed by the sender to decrypt the digital signature to restore the message digest at the time of signature. On the other hand, the receiver can also enter the received electronic file into the one-way hash function to obtain a message digest, and compare this message digest with the message digest restored from the digital signature. 'If the two are the same, then Indicates that the electronic file has not been tampered with. At present, there are two well-known public key cryptosystems that can provide both encryption and signatures. They are security-based RSA system (IKS. Patent No, 4 '405' 829) and security-based discrete logarithm problem. E 1 Gama 1 system. In 1991, the U.S. government proposed the Digital Signature Standard (DSS) as the federal standard for federal government agents to sign electronic documents with the Digital Signature Algorithm (DSA) ^ The dSS standard is based on the discrete logarithm problem An ElGamal type signature method. Furthermore, the elliptic curve-based cryptosystem (El 1 i Ptic Curve)

Cryptosystem (ECC) has also recently received attention and is considered by IEEE P1 3 63 as one of the standards for cryptosystems. In fact, the security-based elliptic curve-based cryptosystem has many characteristics similar to the E 1 Gama 丨 system whose security is based on solving discrete logarithms.

Page 6 427087 V. Description of the invention (4) In the public key cryptosystem, the public key certificate must be generated by some trusted certificate authority (CA), and the public key certificate should be placed by the certificate authority or user. In the directory. Each public key certificate is signed by the certificate authority with the public input of the user's private key. The purpose of the public record certificate is to help other users verify the legitimacy of the public key owner. ITU-T recommends using X.509 as part of the X · 500 directory retrieval service. X. 5 09 provides authentication services for X. 500 directory retrieval services. However, the standard does not prescribe those specific algorithms. In fact, X.509 has been used in a variety of situations. For example, the certificate format of X.509 has been adopted by S / MIME ’IP Security’ SSL / TLS and SETTM. Key recovery is a technology that allows the owner of the encrypted data or a trusted third party to get Γ to recover the lost or unreachable encryption key (gessión Key). When gold records are lost or unavailable, key recovery becomes a secure and practical method for recovering encrypted information. ^ In view of this, the main object of the present invention is to propose a key recovery system, which can combine the functions of a public key certificate and a key recovery mechanism. The key recovery system of the present invention can be used to recover the user's private key of the public key cryptosystem. In addition, the user's private key in the 'public key cryptosystem' can be used to generate a digital signature or decrypt a "digital envelope" random encryption key. Furthermore, the public key cryptosystem of the present invention has an easy implementation (Easy t〇Implement ), Scalability (Scalable), no single weakness (N〇Singie p〇int 〇f '

(Vulnerability), interoperable (Interoperable) and other advantages, and can be implemented in large global communication systems. To achieve the above and other objectives, the present invention proposes a key recovery system

270 87 V. Description of the invention (5) system, which can restore the user's recurrence algorithm of the public key cryptosystem, usually the following requirements should be considered: 金 ”金 金 回回 • Easy to implement • Can be applied to all cryptographic algorithms • Scalability • No single rhyme • Interoperable operation • Integrity check t The present invention proposes a method that satisfies the above requirements' to restore the use of public cryptosystems [I] The global key recovery system uses multiple The signature algorithm (Mult ^ ignature Algorithra) combines the functions of the certificate authority (CA) and the gold reply mechanism. This kind of global gold loss system, complex system, system structure (PKO and large-scale global communication system. Personal communication The system of α system = cs) is an example to which the present invention can be applied. For example, based on King's: Volume 'personal communication system (PCS), the server can require all personal communication systems (PCS) Users, using the key recovery method of the present invention can be improved without increasing the implementation complexity? Security Basically, the present invention provides an effective method to combine the functions of the certificate authority and the key recovery mechanism. This invention adopts a simple method to allow users to log in at the same time. This financial method will greatly reduce the overall time. US patent issued on January 4, 994 No. 5276737 " Fa & Record-A2.7Q B1 V. Description of Invention (6)

Cryptosystem and Method of Use " was proposed by Silvio Micali. In the M i c a 1 i password system, each user provides several " trustee 11 information pieces. A piece of information provided to each custodian enables the custodian to verify that the information includes a portion of the private key for a given public key. Under certain conditions, these escrow personnel will send out some private keys to reconstruct the original private key

key. As for the cryptographic system of the present invention and Mi c a 1 i, there are several differences. First, the certificate authority and the custodian are different individuals in the crypto system of M i ca 1 i ′, but the present invention combines the two early with a group signature. Since the certificate authority and the key recovery authority need to be trusted by all users, combining these two types of certificate authority can simplify the implementation steps. Secondly, there is only a single certificate authority in the cryptosystem of M i c a 1 i, but the present invention selects several key reply and public certificate authorities by the user. Therefore, the present invention has no single weakness. Furthermore, the present invention proposes to integrate the gold loss reply in the X, 509 public key architecture, so it has the advantages of scalability and interoperability. In addition, the present invention also enables each user to efficiently partition the private key β of any public key cryptosystem, which makes key recovery feasible and practical. In short, the present invention utilizes a key-splitting algorithm so that the user can divide the private key into segments, and each segment of the private key is stored in a certificate authority selected by the user when logging in. According to the present invention, the certificate authority selected by the user is: both a key recovery authority and a public key certificate authority. Each certificate authority performs an integration check to verify that the private key has been properly subdivided and that the private key has been properly stored before signing the public key certificate of the user's public key. In addition, each certificate authority will also use a multi-signature algorithm to generate some certificates. Wait for all certificate authorities to confirm receipt of some private keys (all certificate authorities ^

Page 9 427087 V. Description of the invention (7) * " --- ^ You can know the user's private key when working) and send some certificates, then use = to combine all the certificates to get the brief certificate of public key communication (Compact Certificate) ° In particular, the modulus P (large prime number of the ElGamal type signature method order) is agreed by all certificate authorities. All certificate authorities will use this module to produce ^ some certificates. The user needs to select several certificate authorities as the key = ^ and public key certificate authority. The user can choose the RSA type or the private key of the type 1; the user needs to use an appropriate key split algorithm to divide the private key into several partial private keys. Then, the user calculates Some private keys corresponding to some private keys. The user sends the public information (including the user's public key, all partial public keys, and the names of all selected certificate authorities) and a private key of 77 to each certificate authority. Waiting for each certificate After the organization verifies the user's public information and some additional private keys, it will generate a part of the user's public Besson certificate. This part of the certificate will be returned to the user. After the user receives all of the part of the certificate, he can Combine all the partial certificates to get a brief core, also. This brief certificate can be stored in the public key directory or sent to the communication system, any member. When the user needs to confirm this brief certificate, all the certificate agencies that signed the stab knife will then It can be identified from the brief certificate. The brief certificate can also be confirmed by using the group public key (the modulus product P of all CA public keys). This J: method can greatly reduce the overall calculation of confirming multiple signatures. ， Because only Y, sign the early confirmation action◊ In addition, 'When the private key owner or a trusted second party wants to return; ί |] Guisheng 4, · & j_ lost or unable to obtain the private key, All the key responses em ίI are identified from the public key certificate. Then, as long as you return to each key ^ back to part of the private input ', you can combine all parts of the private key to get the original

Page 10 427087 V. Description of the Invention (8) Originality The following are the features of the present invention. (a) The present invention can be implemented in the public key architecture of X.509, and has the advantages of scalability and interoperability. (b) The present invention does not rely on any Tamper_Resistant device 'and can be implemented in software or hardware. (c) The present invention allows the user to select a number of key reply and public key certificate authorities' so there is no single-weakness. In other words, unless the attacker can obtain the consent of all certificate authorities, the system cannot be successfully cracked. 0 (d) The present invention does not increase the time to confirm the registration certificates of several certificate authorities. Regardless of the number of certificate authorities selected by the user, the confirmation time of a public key certificate is equal to the confirmation time of a public key certificate signed by a single institution. (e) The present invention allows a user to freely choose a public key and a private key. In addition, any user can freely decide the certificate authority, and decide the number of key recovery and public certificate authorities. This user-led feature is especially important when seeking broad support for key replies. (〇 By checking the user's public key, anyone can perform an integration check to see if the user's private key is properly partitioned. In addition, anyone can identify the key recovery mechanism.

The invention is not intended to be limited to any particular method of public signature. Since the ECC signature method proposed by IEEE P 1 363 and the E1Garaal type signature method have similar characteristics, the present invention can also be applied to these methods. In addition, because the DSS standard is an E1Gamal signature method based on the discrete logarithm problem, and uses a prime factor of P-1 (Prime

Page 11 427087 V. Description of the invention (9)

Divis〇r) q the length of the digital signature with reduced moments,

In the signature method. This issue of the month can also be applied to DSS. To make the above and other aspects of the present invention easy to understand, the following is enumerated-preferred embodiments: and ;; the :; the advantages can be explained in more detail as follows: Figure 1 is a detailed flowchart. Figure 1 is a flowchart of the actions required by the present invention to respond to the RSA type of private users and certificate authorities. 7 When the key certificate is used, the second figure is when the present invention responds to the ^^ 丨 type. Figure 3 shows the actions required by the user and the certificate authority to generate the public record certificate. Figure 3 is a flowchart of the actions required by some people or trusted third parties to respond to the private round. The process map is the example of the present invention that the reader needs to execute the moving turtle- 隹 when the bee recognition of the voucher is issued. In the following description, the purpose is to explain rather than limit the way of use. It has been completely explained that those skilled in the art may also apply the present invention to other embodiments different from the above specific details. Therefore, details such as algorithms and programs will be omitted to avoid unnecessary restrictions. ^ An example to which the present invention is applied will be described with reference to FIG. 1, in which the user's privacy-is a cryptosystem of the RSA type. In the following discussion, it is assumed that the user selects two certificate authorities CA1 and CA2 as the gold loss reply and public record certificate authorities. According to the R S A type of cryptographic algorithm, the user

Page 12 427087 V. Description of the invention (ίο) Select the modulus n = pq ′ where p and q are two large prime numbers (Prime). Let e and d not be public records and private rounds, where ed mod 4 (n) = l and 0 (η) = (ρ-1) (Q-i). The user must divide the private key d into two partial private keys and (12, where d = dl + d2 mod 0 (n) 'and calculate the corresponding partial public keys pki and pk2' where pk / adl mod η and pk2 = o: d2 mod η. In this example, 'α is the component of the largest power in the multiplicative group Zη. Then, the user will disclose the information (e, η, (ph, CAd, (pkz' CAD ) And part of the private record to the certificate authority CA1, and the public information (e, η, (pk〗, CAd, (Pk2, CA2)) and part of the private key d2 to the certificate authority CA2. To receive public information (e 'n' (pki 'CA〗), (pk2, C,)) and some private keys d! After the' certificate authority CAi will determine whether pki = adl mdn to perform an integration check. Then, the certificate authority CAi will judge Whether (pkipk2) e mod ri = α. If both conditions are met, it means that the user has correctly stored part of the private key d in the certificate authority CAi. Similarly, the certificate authority will also disclose the information (e, η, (Ph, CAJ, (pk2, CA2)) and part of the private key d2 to perform integration checks. In this way, the rSA type private key's gold The reply procedure is completed. Another example of applying the present invention will be described with reference to FIG. 2 below. The user's private key belongs to a cryptosystem of type "^". According to E1 Gama 1 cryptosystem algorithm The user selects the modulus n, where η is a large prime number. Let 6 and d be the public key and the private key, respectively, where e = ^ dn and α is the element of the finite field GF (n). First, The user should divide his private key d into two partial private keys and 4-270 87 and invention description (11) d2, and calculate the corresponding partial public keys and, respectively, where d = di + d2 mod 0 f (η) > φ (n) = nl, and it is called = adl mod η pk2 = ad2 mod n, then the user will public information (e, n, (pk, CA), '(: ~)) and some private keys Send to the certificate authority, and send the public private key (= 'n, (pkl, CAi), (pk2, Ca2)) and part of the private key t to the certificate machine called CA2. To receive the public information (e, n, After (pki, CAi) '(pk2, CA2)) and j are the private key t, the certificate authority CAi will determine whether pki = adl m〇dn to perform the integration check. Then, the certificate machine The structure CAi will determine whether (γ mod n = e. If both conditions are met, it means that the user has correctly stored some private key d in the certificate authority CA !. Similarly, the certificate authority will also check the public information (e, η '(pkl, CAJ, (pk2, CA2)) and the integrity of the seven licenses. In this way, the ElGamal type private gold record recovery process is completed It is worth mentioning that this key recovery procedure can also be applied to ECC cryptosystems based on discrete logarithms. Then 'explain how each certificate authority CAi issues some public certificates. According to the multi-signature method 'Assume that the certificate authorities CAi and 〇82 have different private keys X! And 乂 2, respectively, where the corresponding public key% = adi m〇dpl > and y2 = ad2 mod p, where p is a large prime number and a is Elements of the finite field GF (p). [Each certificate authority CAi randomly selects a value ^ from [1, pl], and calculates the corresponding integer ri = aki mod p, and broadcasts it to other certificate authorities. To be confirmed! ^ And 〇After obtaining, each certificate authority CA can calculate the entrusted value

427087 V. Description of the invention (12) (Committment Value) r = rir2 mod p »Since this value is not relevant to fisheries agency information, it can be calculated offline in advance. After each certificate authority CAi successfully performs the integration check of the user's public key m = (e, n, (^ CA [) (Ph, C Aa)), the value h selected by the secret wheel 1 machine can be used to sign the message „1 , Where m, = h (m) and h is a one-way ^ function. Then, each certificate authority CAi can solve the equation sSi = Xj, k,, m〇d p_1 'and partially sign (ri, Si ) To return to the user. Γ The user will check whether V, = r / 〇: si mod p after receiving the parts (I \ —Si) returned by each certificate authority to verify that this part is early ^. If both partial signatures pass the verification, — can be generated, where S = s + Q ^ ^ 4 and also U's), the length of the partial signatures is the same 2: P_1. Because the length of the public key certificate communicates with the domain. Users can use this public key certificate to achieve the full-service private key owner or the private key that can be obtained by Sheng Er, all & two, and all want to recover the lost or unable to come out so that the private distribution can be identified from the public input certificate Key, and then get a reply of $ can be obtained by each certificate authority's department additionally 'any confirmer's π ±: ~ (Ρ ,, CA1), (pk, ΓΑ can be publicly funded by the user (E, η, name. As for public round 2; Ma Wei ^ identified the institution that signed this public key certificate to confirm. Xinye verification can check whether r.ns m〇dp according to the present invention, rabbit public key certificate , The user and the key that is rolled to the RS A type private key reply and generate a flow chart of 1 to illustrate the execution actions required by the following certificate authority

Page 15 Λ27〇8 ^ V. Description of the invention (13) First, in step 10, the user selects the modulus n = pq, where 1) and 兑 are two large prime numbers. Let e and d be public railways and private records, respectively, gan + j where ed mod φ Cn) = 1 ο Then 'in step 11' the user must divide the private key into two parts, the private key clerk and 4 'and respectively Calculate the corresponding part of the public key pkl, where d = d! + D2 mod f (n) 2 and pk / ad1 mod η pk2 = ad2 mod n Then 'in step 12' the user will disclose the information (e, n , (Send the public private key (to the certificate authority ca2.) Then, in step 13 mod η to perform the integration check a. If both conditions are met

Ph 'CA〗), (Pk2, CA2)) and part of the private key di are sent to the certificate authority, and (Pkl, CAl), (Pki !, CA2)) and part of the private key d2 a certificate authority CAi will determine whether pk And determine whether (pkiPk2) e mod n = indicates that the user has correctly stored part of the private key VII in the certificate authority CA ,. Similarly, CA2 will check the integrity of public information (e, n, (Pki, CA1), (pk2, CA2)) and some private keys.

Next, in step 14, each certificate authority% will randomly select a value ki from] and calculate the corresponding integer ri = aki m0d p, and broadcast it to other certificate authorities. After q and! ^ Are obtained, each certificate authority will calculate the commission value mod p. Next, in step 15 after each certificate authority successfully performs the integration check of the user's public key m = (e, η, (ph, (^), (pk2 ’CA2)) 427087

V. Description of the invention (14) ′ Use its key Xi and a randomly selected value h to sign a message m ′, where m = h (m) and h is a one-way hash function. Each certificate authority CAi can solve the equation si = Xiin '-hr mod P-1' and send a part of the signature, Si) back to the user. Finally, in step 16 'the user will check whether «aSim〇dp to verify Each part is signed. If both partial signatures pass the verification, the final public key certificate (r, s) can generate ′ where 3 = 3032 mod p-l.

In addition, according to the present invention, to perform the key recovery of the ElGamal type private key and generate the public key certificate, the execution actions required by the user and each certificate authority are described below with reference to the flow chart in FIG. 2. In the first step of the prime age, in step 2 °, the user must select the prime number in the modulus n ′ i. Let e and d be a 廿, ^ ^ ^ τη ^ ^ α, respectively, '" V, Mod key and private key of the finite field GF (n), and let e = a < 1 mOd η, ΙΑ Sense. Then 'in step 2 φ 分 divide the private key ... and (12, and divide ^, the user will divide the private key d into two parts d = d1 + d2 m〇d ^ to calculate the corresponding part of the public call and call, Its Η and PMW m0d η 0 (Π) and Μη)-! Pk2 = ad2 mod ri Then, in step 22,

(P ,, CA1), (Pk2, u / user sends the public information (e, n, and sends the public information (e, n / and part of the private key dl to the certificate authority CA, d2 to the certificate authority CA2 Pki 'CA1) (pk2' CA2)) and some private keys followed by 'In step 23, the certificate authority CAt will determine whether ρ, = 1

Page 17 427087 V. Description of the invention (15) _ mod η is used to perform integration check. If both conditions are met, table ~ factory and determine whether Pklt) k2 mod n = e. Placed in the certificate authority CAi. The user has correctly stored part of the private key di (e, η, (ph, CA!), (K 'certificate authority CA2 will also check the public information. P 2' C ~)) and part of the private round (i2 Integrity is implemented as step 24 in FIG. 2 and will not be repeated here. It is the same as steps 14 to 16 in FIG. 2 'According to the present invention, it is back to the box' + someone or a trusted third person f The lost or unreachable private key, the private key is identified as follows. The actions performed by the person are described in the flow of Figure 3 Θ First, in step 30, the private key owner or a trusted third party needs to obtain the public key certificate Identifies all the key replying agencies. Then 'in step 32, the private key owner or a trusted third party needs to obtain a partial private record from each certificate authority' and combines all the obtained private keys into the original The user's private key (1 = 4 + (12 mod p-1.) According to the present invention, for the dish to recognize the Jinyu certificate, the execution action required by the confirmer is described below with reference to the flowchart in FIG. 4.

First, in step 40, the confirmer can identify the names of all certificate authorities from the user's public information (e'n, (ph 'CA]), (pk2' CA2)). Then, in step 42, ym = rr as mod p is checked to confirm the correctness of this register certificate, where mod p. To sum up, the global gold loss recovery system of the present invention can combine the functions of a public record certificate and a key recovery mechanism to restore the user privacy of the public key cryptosystem.

Page 18 4270B7 V. Description of the invention (16) '-Ϊ " The private record of the user in the code system can generate a digital signature or solution. Digital envelope = random conversation key. In addition, the public key cryptosystem of the present invention is easy to implement (Scalable) and has no single weakness (No

(Single Point of Vulnerability), Interoperable, etc., and can be implemented in large-scale global communication systems. Although the present invention has been disclosed as above with preferred embodiments, it is not intended to limit the present invention. In addition, without departing from the spirit and scope of the present invention, it can be modified and retouched. Therefore, the scope of protection of the present invention is subject to the scope defined in the attached patent application. ^ © '

Claims (1)

6. Patent Application Fanyuan __ 1. In the digital communication environment of a generator of public key certificates, there are methods such as 'in the case of having multiple users / servicing information' to verify the identity of the signatory. (A) Each user selects a wedge number, including:, and calculates the public round corresponding to the private record, sf calculates the private key of at least one certificate authority (b) each user divides the private key, and calculates the The corresponding part of the private input of the Ministry of Eighth, the plural part of the private key, and separately count (c :) each user will disclose the funds, Gongyu; Yu, the vouchers and the land including the public record 、 These parts of the public structure; ~ ° 卩 One of the private keys is distributed to each certificate machine (d) Each certificate authority shall check the receipt4, (e) Each certificate authority calculates a dollar for integration check; broadcast to other certificate authorities; ° sub-sign the seal 'and sign the part widely (0 each certificate authority sign Send it back to the user early; and Ίtribute alum, and combine the signed part of the signature (g) each user's confirmation of the public seal to form the public key certificate. To sign early, and sign all parts 2. Such as Item 1 of the scope of patent application where 'This private record is an RSA type private ship. How to generate a U 鍮 certificate' The method of generating a public key certificate as described in item 3, and item 1 in the scope, includes a side private key and an ElGamai type private key. The method of generating a public key certificate as described in Item 1 of i.4. The method of replying to the private key includes: (a) The owner of the private key or a trusted third party is the 427〇87__ VI. Identifies all certificate authorities in the scope of patent application; and (b) the private key owner or a trusted third party obtains part of the private key from all certificate authorities and synthesizes all the obtained private keys into the original private key . 5. The method for generating a public key certificate according to item 4 of the scope of patent application, wherein the private key is an RSA type private key. 6. The method for generating a public key certificate as described in item 4 of the scope of patent application, wherein the private record is an ElGamal type private input. 7. The method for generating a public key certificate as described in item 1 of the scope of patent application, wherein the method for confirming the public key certificate includes: (a) the confirmer identifies all certificate authorities from the public key certificate; and (b) The confirmer uses the public keys of all certificate authorities as the group public key to identify the user's public key certificate. 8. The method for generating a public key certificate as described in item 7 of the scope of patent application, wherein the public key certificate is a combination of all the confirmed partial signatures and Cj