WO2014117648A1

WO2014117648A1 - Application access method and device

Info

Publication number: WO2014117648A1
Application number: PCT/CN2014/070668
Authority: WO
Inventors: 刘小元; 孙增才; 何庆建
Original assignee: 华为终端有限公司
Priority date: 2013-01-31
Filing date: 2014-01-15
Publication date: 2014-08-07
Also published as: CN103973647A

Abstract

Provided are an application access method and device, comprising: an application access device generates a secure access request for providing an application security service for an application running on the application access device; the application access device generates a key pair according to the secure access request, the key pair comprising a public key and a private key; the application access device uses the public key to apply for a digital certificate from a certificate server, and the application access device establishes a connection with an application server via the digital certificate; and after establishing a connection with the application server, the application access device uses the private key to encrypt data transmitted between the application access device and the application server. The present invention reduces dependence on an external security device.

Description

Application Access Method and Apparatus This application claims priority to Chinese Patent Application No. 201310038423.8, entitled "Application Access Method and Apparatus", filed on Jan. 23, 2013, the entire contents of In this application.

TECHNICAL FIELD The present invention relates to communication technologies, and in particular, to an application access method and device.

BACKGROUND OF THE INVENTION Many current applications have high security requirements, such as an online banking client, a securities transaction client, etc., when a user uses the above application to conduct a transaction involving funds on his own application access device such as a personal computer. A special encryption device such as a USB key is usually used to implement a security scheme such as encryption and decryption in the transaction process to ensure the security of the transaction process, that is, to enhance the security when accessing the application. In the prior art, the above-mentioned dedicated encryption device generally stores some security information corresponding to the application, such as a digital certificate, a private key, etc.; during the access process of the application, the application uses the above security in the dedicated encryption device. The information is processed by security authentication, data encryption, etc. to ensure application access security.

However, the drawback of this method is that the security of the application access is too dependent on the peripherals of the dedicated encryption device. If the user does not carry the dedicated encryption device, the application access cannot be performed securely, and the user may work. It is very inconvenient to make an impact; and, for different applications, you need to use a dedicated encryption device customized for the application. If you want to use both the online banking client and the securities trading client, you may need to carry and use two. One Too strong and inconvenient for application access.

SUMMARY OF THE INVENTION The present invention provides an application access method and apparatus to reduce reliance on secure peripherals. The first aspect provides an application access method, where the method includes: an application access device generates a security access request, where the security access request is used to request an application security service for an application running on the application access device; The application access device generates a key pair according to the security access request, where the key pair includes a public key and a private key; the application access device uses the public key to apply for obtaining a digital certificate to the certificate server, and the application accesses The device establishes a connection with the application server by using the digital certificate; after the connection is established with the application server, the application access device encrypts data transmitted between the application access device and the application server by using the private key. With reference to the first aspect, in a first possible implementation, after the application access device generates the security access request, the method further includes: the application access device storing a correspondence between the digital certificate and the application. With reference to the first possible implementation manner of the first aspect, in a second possible implementation manner, after the application access device generates the security access request, before generating the key pair according to the security access request, the method further includes: The application access device detects, according to the correspondence, whether a digital certificate corresponding to the application has been stored; when the detection result is yes, directly establishing a connection with the application server by using the stored digital certificate.

The second aspect provides an application access method, where the method includes: the application access device receives a security access request sent by the application running device, where the security access request is used to generate a key pair for running the security access request, The key pair includes a public key and a private key; the application access device sends the public key to the application running device, so that the application running device uses the public key to apply for obtaining a digital certificate to the certificate server. And the application running device establishes a connection with the application server by using the digital certificate; the application access device is transported in the application After the row device establishes a connection with the application server, the private key is used to encrypt data transmitted between the application running device and the application server.

With reference to the second aspect, in a first possible implementation manner, the receiving, by the application running device, the security access request includes: receiving, by the application access device, a USB connection, a WIFI connection, and an NFC connection with the application access device Any one of the connected applications running the secure access request sent by the device.

With reference to the second aspect, or the first possible implementation manner of the second aspect, in a second possible implementation manner, the application accessing device, when receiving the security access request sent by the application running device, includes: the application accessing the device The PKCS#11 interface receives the security access request sent by the application running device.

With the second aspect or the first possible implementation manner of the second aspect, in a third possible implementation, after the application access device sends the public key to the application running device, the method further includes: The application access device receives the digital certificate sent by the application running device, and stores a correspondence between the digital certificate and the application.

With the third possible implementation of the second aspect, in a fourth possible implementation, after the application access device receives the security access request sent by the application running device, generate a key pair according to the security access request. The method further includes: detecting, by the application access device, whether a digital certificate corresponding to the application has been stored according to the correspondence; and performing, when the detection result is yes, directly sending the stored digital certificate to the application Run the device so that

The third aspect provides an application access device, including: an interface unit, an encryption unit, and an application processing unit, where the interface unit is configured to receive a security access request generated by an application access device, where the security access request is used for the request to run The application on the application access device provides an application security service; the encryption unit is configured to generate a key pair according to the secure access request, where the key pair includes a public key and a private key; After the application server establishes the connection, the data transmitted between the application access device and the application server is encrypted by using the private key; the application processing unit is configured to apply for obtaining a digital certificate to the certificate server by using the public key. And establishing a connection with the application server through the digital certificate.

With reference to the third aspect, in a first possible implementation manner, the encryption unit is further And configured to store a correspondence between the digital certificate and the application.

With the first possible implementation of the third aspect, in a second possible implementation, the encryption unit is further configured to: after the interface unit receives the secure access request, according to the secure access request Before generating the key pair, detecting, according to the stored correspondence, whether the digital certificate corresponding to the application has been stored; the application processing unit is further configured to directly execute when the detection result of the encryption unit is yes Establishing a connection with the application server through the stored digital certificate.

The fourth aspect provides an application access device, where the application access device establishes a communication connection with an application running device, where the application access device includes: an interface unit and an encryption unit, and the interface unit is configured to receive the application running device. Sending a secure access request, the entire service; and transmitting, by the encryption unit, the public key to the application running device, so that the application running device applies for the digital certificate to the certificate server using the public key, and

The encryption unit is configured to generate a key pair according to the secure access request, where the key pair includes a public key and a private key; and after the application running device establishes a connection with the application server, using the The private key encrypts data transmitted between the application running device and the application server. With reference to the fourth aspect, in a first possible implementation, the interface unit is configured to receive, by using the application access device, the application running by using any one of a USB connection, a WIFI connection, and an NFC connection. A secure access request sent by the device. With reference to the fourth aspect, or the first possible implementation manner of the fourth aspect, in the second possible implementation manner, the interface unit is a PKCS#11 interface.

With reference to the fourth aspect, or the first possible implementation manner of the fourth aspect, in a third possible implementation, the interface unit is further configured to: after sending the public key to the application running device Receiving the digital certificate sent by the application running device;

In conjunction with the third possible implementation of the fourth aspect, in a fourth possible implementation manner, The encryption unit is further configured to: after the interface unit receives the secure access request sent by the application running device, before generating the key pair according to the secure access request, according to the stored correspondence, detecting whether the storage unit has been stored The interface unit is further configured to: when the detection result of the encryption unit is YES, directly send the digital certificate stored by the encryption unit to the application running device, so that The application running device establishes a connection with an application server using the digital certificate. The technical effect of the application access method and device provided by the present invention is: generating a key pair by the application access device according to the secure access request of the application, so that the application can use the key pair to apply for the digital certificate and encrypt the data. Thereby, the security capability of the application access device itself is enhanced, so that the application access device can provide security guarantee for application access, no need to additionally increase the use of security peripherals outside the application access device, and reduce the security peripherals. rely.

BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some of the present invention. For the embodiments, those skilled in the art can obtain other drawings according to the drawings without any creative work. 1 is a schematic structural diagram of an application access device according to an embodiment of the present invention; FIG. 2 is a schematic diagram of another embodiment of an application access device according to the present invention; FIG. 3 is a schematic structural diagram of another embodiment of an application access device according to the present invention; FIG. 5 is a schematic diagram of a working principle of another embodiment of an application access device according to the present invention; FIG. 6 is a schematic structural diagram of another embodiment of an application access device according to the present invention; A schematic structural diagram of another embodiment of an application access device according to the present invention; FIG. 8 is a schematic flowchart of an embodiment of an application access method according to the present invention; FIG. 9 is a schematic flowchart diagram of an embodiment of an application access method according to the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In order to reduce the dependence of an application access on a security peripheral such as a USB Key, the embodiment of the present invention enhances the security capability of the application access device itself, so that the application is accessed without using a secure peripheral. The device provides security for application access. The application refers to, for example, online banking, securities trading, and the like. The application access device refers to a device used by the application during use. For example, if a user launches an online banking application on his tablet and uses the online banking service, the tablet is called an application. Accessing the device; for example, the user uses a securities trading application on his or her own notebook, and the application also uses a key pair provided on another device such as a tablet during use, and this embodiment provides the provided A tablet with a key pair is called an application access device. These will be described in detail in the following specific embodiments. In summary, the application access device of the present embodiment refers to a device capable of providing a security protection service for an application (such as the above-mentioned tablet providing a key pair). The application access method of the embodiment of the present invention is a method performed by the application access device, that is, the embodiment of the present invention improves the application access device, so that the security capability of the device is enhanced, and the access of the application is provided. Services, which also change the way applications are accessed. Based on this, in order to make the description of the scheme of the present invention clearer, the structure of the application access device will first be described below. The application access device of the embodiment of the present invention can provide an access device for an application running on the device. The device can have two different structures. The following is a description of the structure of the application access device in the above two cases and the working principle of the application access device in the corresponding structure: Embodiment 1 FIG. 1 is a schematic structural diagram of an application access device according to an embodiment of the present invention. The application access device of the structure can provide security services for applications running on the device; as shown in FIG. 1, the application access device can include: an interface unit 11, an encryption unit 12, and an application processing unit. The interface unit 11 is configured to receive a secure access request for requesting application security services. The secure access request refers to, for example, when using an online banking application, when The operation of the fund transaction, for example, the user clicks to trigger a step on the online bank. At this time, the device on which the online bank runs is connected to the application server corresponding to the online bank. In order to ensure the communication security between the device and the application server, it is necessary to establish The secure connection, so the device sends the secure access request to the application access device of the embodiment, requesting to provide a security service, for example, requesting to generate a key pair. The interface unit 11 instructs the encryption unit 12 to perform an encryption process for the auxiliary application to establish the secure connection according to the secure access request. In this embodiment, the application access device installs and runs an application, and the application access device itself generates the security access request. For example, if the online banking application is installed and run on the application access device of the embodiment, the secure access request is actually sent by the application processing unit in the application access device (the application processing unit is a module that invokes the online banking application). Secure access request to interface unit 11. Of course, the above security access request is specifically sent when the application access device invokes the execution of the application, such as running online banking on the notebook, and when the online banking runs to when the notebook needs to send a secure access request, the application developer may The application access device of the embodiment provides a security service for the application, as long as the application is designed to automatically trigger the application access device to send a secure access request to the interface unit 11 when the application access security is required. The encryption unit 12 is configured to generate a key pair according to the secure access request, where the key pair includes a public key and a private key; and the operation of generating a key pair may use, for example, RSA (RSA public key force port) The secret algorithm was developed in 1977 by Ron Rivest, Adi Shamirh, and Len Adleman at the Massachusetts Institute of Technology, and the RSA was named from the name of the three of them. It is not detailed. The generated public key will be sent by the encryption unit 12 to the interface unit 11, which in turn sends the public key to the application processing unit 13. The application processing unit 13 is configured to apply, by using the public key, a certificate certificate (ie, a certificate authority (CA server)) to obtain a digital certificate (the certificate server will use the public key to generate a digital certificate) The digital certificate is a certificate uniquely corresponding to the application; and the application access device is established with the application server by using the digital certificate Secure connection.

The application access process of the present embodiment is directly stored in a dedicated encryption device such as a USB Key, and the application access device applied at runtime is directly used in the encryption device. The digital certificate establishes a secure connection with the application server. The application of the embodiment is generated by the encryption unit inside the application access device, and the application access device uses the public key to apply for the digital certificate and passes the certificate. Establish a connection to the application server. The advantages of the above differences are as follows: Since the digital certificate is equivalent to the application ID card and the different applications correspond to different digital certificates, the manner in which the digital certificate is pre-stored in an encryption device such as a USB Key in the prior art also enables the encryption device. Correspondence with the application, for example, the online banking of a bank uses the encryption device A, the online banking of another bank uses the encryption device B, and the encryption device C used for the securities transaction, etc., not only requires the user to carry the encryption device with him or her, Moreover, when using the multiple applications, it is also necessary to carry a plurality of different encryption devices, which is very inconvenient and inefficient. In the solution of the embodiment, the encryption unit in the application access device can provide a key pair for the application in real time during the access process of the application, and the application can apply for a digital certificate in real time, and the encryption unit does not correspond to a specific application. The encryption unit can be used by various applications; for example, the user's tablet is the application access device, and the tablet runs two applications of online banking and securities trading, and the two applications are at runtime tablet. The encryption unit may be requested to generate a key pair for it. The service for generating the key pair may be provided for any application, and each application may apply for a digital certificate corresponding to itself after obtaining the public key. Obviously, the application access device of the embodiment can provide services for various applications, which is very convenient, and improves the access efficiency of the application. The process of establishing the connection between the application access device and the application server by using the digital certificate is a conventional technology, and the simple description is as follows: The application access device sends a connection request to the application server, and carries a digital certificate corresponding to the application, and the application server will use the digital certificate. The certificate is sent to the authentication server (that is, the VA server) for verification. If the authentication server passes the certificate verification, the application server returns a connection response to the application access device, and establishes a connection with the application access device. The connection is established after the certificate is verified, so that the communication between the application access device and the application server can be ensured, that is, a secure connection. Wherein, the authentication of the certificate by the authentication server is that the authentication server uses the number received from the certificate server. The certificate is compared with the certificate received from the application server. If the two are consistent, the verification is passed, and the certificate authentication server performs the verification of the certificate at this time. The encryption unit 12 of the embodiment is further configured to perform encryption processing on data transmitted between the application access device and the application server by using the private key after the application access device establishes a connection with the application server.

The encryption process described herein includes: encrypting data transmitted between the application access device and the application server, and transmitting the data to the application server after being encrypted by the application access device side (for example, the application access device encrypts the data by using the private key, and the application server utilizes the public The key decryption obtains data, and the public key is sent by the application access device to the application server, and also includes decrypting the data, and decrypting data sent by the application server to the application access device (for example, the application server encrypts the data by using the public key) , the application access device decrypts the data using the private key). The application access device of this embodiment generates a key pair by the application access device according to the secure access request for requesting the application security service, so that the application access device can use the key pair to apply for the digital certificate and encrypt the data. Processing, establishing a secure connection with the application server, thereby enhancing the security capability of the application access device itself, so that the application access device can provide security guarantee for application access, and no additional need to increase the use security outside the application access device. Peripherals reduce the reliance on secure peripherals. The application access device of the embodiment of the present invention can provide the working principle of the application access device in the two cases described in the second embodiment and the third embodiment for the application running on the device. The second embodiment of the present invention provides a security service for an application running on the device. FIG. 2 is a schematic diagram of the working principle of another embodiment of the application access device according to the present invention.

As shown in FIG. 2, the application access device in this embodiment takes a tablet computer as an example, and the application uses an online banking as an example. The online banking is an application running on a tablet computer. Therefore, the tablet computer is an application access device (ie, an application). The device that provides the security service) is the application running device (that is, the device that installs and runs the application). The application access device of this embodiment further includes an application processing unit 13 for calling and executing an online banking application; and the application office The unit 13 is capable of communicating with the interface unit 11 in communication. In addition, since the application access device of the embodiment is also an application running device, the application access device can also communicate with the application server and the certificate server. In this embodiment, the transceiver unit 14 in the application access device communicates with the server. of. Specifically, the application processing unit 13 calls to execute the online banking, and the online banking starts running on the tablet; during the running process (for example, the user starts using the online banking on the tablet), according to the setting of the online banking, at a certain The runtime application processing unit 13 will initiate a secure access request based on the pre-set of the online banking, which will be sent to the interface unit 11. For example, the tablet computer of the embodiment is installed with an android system, and an application such as an online bank running in the system may send a secure access request to the interface unit 11 at runtime. The interface unit 11 instructs the encryption unit 12 to perform a service for generating a key pair according to the secure access request, and the public key generated by the encryption unit 12 is returned to the application processing unit 13 through the interface unit 11. The application processing unit 13 sends the public key to the transceiver unit 14, instructing the transceiver unit 14 to apply for a digital certificate to the certificate server using the public key, and establish a secure connection with the application server using the certificate. It should be noted that the transceiver unit 14 is only an interface between the tablet computer and the server. The actual data transmission with the server is still the application processing unit 13. For example, when the application processing unit 13 calls the online banking, The data is transmitted to the application server, which is sent by the application processing unit 13 to the transceiver unit 14, which is only responsible for forwarding the data to the application server, essentially still the communication between the application processing unit 13 and the application server. In addition, after the tablet establishes a connection with the application server, when the application processing unit 13 sends data to the application server, the data may be sent to the encryption unit 12 through the interface unit 11, and the data is encrypted by the encryption unit 12 and then passed through the interface. The unit 11 returns to the application processing unit 13, which in turn instructs the transceiver unit 14 to transmit the data to the application server. When receiving the data sent by the application server from the transceiver unit 14, the application processing unit 13 may send the data to the encryption unit 12 through the interface unit 11, decrypt the data by the encryption unit 12, and then return it to the application processing through the interface unit 11. Unit 13, the application processing unit 13 obtains the data, and continues to run the online banking through the data. That is, the data encryption and decryption process between the online bank and its application server is also handled by the encryption unit 12. Embodiment 3 FIG. 3 is a schematic structural diagram of another embodiment of an application access device according to the present invention. The device in the embodiment may be referred to as an application running device. As shown in FIG. 3, the application access device may include: an interface unit 31 and an encryption unit 32. The interface unit 31 is configured to receive a secure access request for requesting to provide an application security service, where the secure access request refers to, for example, when using an application of the online banking, when the funds are involved In the transaction operation, for example, the user clicks to trigger a certain step on the online banking. At this time, the device on which the online banking is running must be connected to the application server corresponding to the online banking. In order to ensure the communication security between the device and the application server, it is necessary to establish security. The connection is sent, so the device sends the secure access request to the application access device of the embodiment, requesting to provide a security service, for example, requesting to generate a key pair. The interface unit 31 instructs the encryption unit 32 to perform an encryption process for the auxiliary application to establish the secure connection according to the secure access request. In this embodiment, the device that sends the foregoing security access request is an application running device that installs and runs an application, and the application running device is other devices than the application access device in this embodiment. For example, if the online banking application is installed and run on another device, and the application access device is not in the embodiment, for example, running on a certain notebook, the secure access request is sent by the notebook to the embodiment. The interface unit 31 of the access device is applied. Of course, the above security access request is specifically sent when the application running device invokes the execution of the application, such as running online banking on the notebook, and when the online banking runs to when the notebook needs to send a secure access request, the application developer may The application access device of the present embodiment provides security for the application by the application access device of the embodiment, as long as the application is configured to automatically trigger the application running device to send a secure access request to the interface unit 31 of the application access device of the embodiment. service. The encryption unit 32 is configured to generate a key pair according to the secure access request, where the key pair includes a public key and a private key; and the operation of generating the key pair may use a conventional technology such as RSA, no longer Detailed. The generated public key will be sent by the encryption unit 32 to the interface unit 31, and then the interface unit 31 sends the public key to the application running device, so that the application running device uses the public key to apply for obtaining a digital certificate from the certificate server. The digital certificate is a certificate that uniquely corresponds to the application. The application running device will establish a secure connection with the application server through the digital certificate. The application access process of the present embodiment is directly stored in a dedicated encryption device such as a USB Key, and the application running device used in the runtime is directly used in the encryption device. The digital certificate establishes a secure connection with the application server. The application of the embodiment is requested by the application running device to request an encryption unit in the application access device to generate a public key, and the application running device uses the public key to apply for the digital certificate. And establish a connection with the application server through the certificate.

The advantages of the above differences are as follows: Since the digital certificate is equivalent to the application ID card and the different applications correspond to different digital certificates, the manner in which the digital certificate is pre-stored in an encryption device such as a USB Key in the prior art also enables the encryption device. Correspondence with the application, for example, the online banking of a bank uses the encryption device A, the online banking of another bank uses the encryption device B, and the encryption device C used for the securities transaction, etc., not only requires the user to carry the encryption device with him or her, Moreover, when using the multiple applications, it is also necessary to carry a plurality of different encryption devices, which is very inconvenient and inefficient. In the solution of the embodiment, the encryption unit in the application access device can provide a key pair for the application in real time during the access process of the application, and the application can apply for a digital certificate in real time, and the encryption unit does not correspond to a specific application. The encryption unit can be used by various applications; for example, the user's tablet is the application access device, and the tablet runs two applications of online banking and securities trading, and the two applications are at runtime tablet. The encryption unit may be requested to generate a key pair for it. The service for generating the key pair may be provided for any application, and each application may apply for a digital certificate corresponding to itself after obtaining the public key. Obviously, the application access device of the embodiment can provide services for various applications, which is very convenient and improves the access efficiency of the application.

It is a conventional technology, and is briefly described as follows: The application running device sends a connection request to the application server, and carries a digital certificate corresponding to the application, and the application server sends the digital certificate to the authentication server (ie, the VA server) for verification, if the authentication server After the certificate is verified, the application server returns a connection response to the application running device, and establishes a connection with the running device of the application. Since the connection is established after the certificate verification is passed, the application running device and the device can be guaranteed. The communication security between the application servers is a secure connection. The authentication of the certificate by the authentication server is performed by the authentication server by using the digital certificate received from the certificate server and the certificate received from the application server, and if the two are consistent, the verification is passed. The authentication server performs the verification of the certificate at this time. The encryption unit 32 of the embodiment is further configured to perform encryption processing on data transmitted between the application running device and the application server by using the private key after the application running device establishes a connection with the application server.

The encryption process described herein includes: encrypting data transmitted between the application running device and the application server, and transmitting the data to the application server after the application running device side encrypts (for example, the application running device encrypts the data by using the private key, and the application server utilizes the public The key decryption obtains data, and the public key is sent by the application running device to the application server, and also includes decrypting the data, and decrypting data sent by the application server to the application running device (for example, the application server encrypts the data by using the public key) , the application running device decrypts the data by using the private key). The application access device of this embodiment generates a key pair by the application access device according to the secure access request for requesting the application security service, so that the application running device can use the key pair to apply for the digital certificate and encrypt the data. Processing, establishing a secure connection with the application server, thereby enhancing the security capability of the application access device itself, so that the application access device can provide security guarantee for application access, and no additional need to increase the use security outside the application access device. Peripherals reduce the reliance on secure peripherals.

Embodiment 4 The application access device of this embodiment provides a security service for an application running on another device, and the other device is a device that communicates with the application access device of the embodiment through an external connection. FIG. 4 is a schematic diagram of a working principle of still another embodiment of an application access device according to the present invention. As shown in FIG. 4, the application access device of this embodiment takes a tablet computer as an example, and the external device uses a notebook as an example, and the application uses an online banking as an example. The online banking is an application running on a notebook, and therefore, the tablet is an application access. The device, the notebook is the application running device. The transceiver unit of the embodiment may be provided with a transceiver unit, wherein the notebook is provided with an application processing unit 21 and a transceiver unit 22, and the application processing unit 21 is configured to invoke an online banking application installed on the notebook, and the notebook can Communicating with the application server and the certificate server, and being able to communicate with the tablet computer, the transceiver unit 22 serves as an interface for the notebook to communicate with the server and the tablet. For example, the transceiver unit 22 can transfer the secure access request sent by the application processing unit 21. The tablet is sent to the application processing unit 21 and the public key returned by the tablet is forwarded. A transceiver unit 33 is also provided on the tablet as an interface for communication between the tablet and the notebook. Specifically, the application processing unit 21 on the notebook calls to execute the online banking, and the online banking starts running on the notebook; during the running process (for example, the user starts using the online banking on the tablet), according to the setting of the online banking, in a certain The runtime application processing unit 21 will initiate a secure access request according to the preset of the online banking, and the secure access request will be sent to the interface on the tablet through the transceiver unit 22 on the notebook and the transceiver unit 33 on the tablet. Unit 31. The interface unit 31 instructs the encryption unit 32 to perform a service for generating a key pair according to the secure access request, and the public key generated by the encryption unit 32 is returned to the application processing unit 21 on the notebook through the interface unit 31 and each of the above-described transceiver units. The application processing unit 21 then uses the public key to apply for a digital certificate to the certificate server, and uses the certificate to establish a secure connection with the application server, and the communication with the server in the process is forwarded by the transceiver unit 22. In addition, after the notebook establishes a connection with its application server, the encryption unit 32 on the tablet of the embodiment may also be responsible for data encryption and decryption processing between the application processing unit 21 and the application server, and the process is similar to the previous embodiment. For example, when the application processing unit 21 sends data to the application server, the data encryption request may be sent to the interface unit 31 through the transceiver unit 22 on the notebook, the transceiver unit 33 on the tablet, and the data to be encrypted is carried; the interface unit 31 The encryption unit 32 is instructed to perform data encryption processing; the encryption unit 32 encrypts the data, and then returns it to the application processing unit 21 on the notebook through the interface unit 31 and the above-mentioned transceiver units, and the application processing unit 21 instructs the transceiver unit 22 to transmit the data. To the application server. In this embodiment, the notebook and the tablet communicate with each other through an external connection, such as a Universal Serial Bus (USB) connection, a WIFI connection, and a near field communication (Near). Field Communication, abbreviated as: NFC) Any of the connections, of course, other connection methods may be used in the specific implementation. The above are just examples. For example, for a USB connection, the notebook can send a secure access request to the interface unit 31 on the tablet through the USB port; for the WIFI connection, the notebook can communicate with the interface unit 31 on the tablet through the WIFI network interface, wherein the WIFI link Security is guaranteed by the 802.11 protocol; for NFC connections, the notebook communicates with the tablet through the NFC interface, and the security of the NFC link is guaranteed by the NFC protocol. Embodiment 5 FIG. 5 is a schematic diagram of a working principle of another embodiment of an application access device according to the present invention. This embodiment is described by taking an application running inside an application access device as an example. The principle of this embodiment is also applicable to an external device. The situation of operation. As shown in FIG. 5, after the tablet computer applies for obtaining the digital certificate to the certificate server, the transceiver unit 14 sends the digital certificate received from the certificate server to the application processing unit 13, and then the application processing unit 13 sends the digital certificate to the interface. Unit 11, the interface unit 11 sends the certificate to the encryption unit 12. When the application processing unit 13 sends the digital certificate to the interface unit 11, the identifier of the online banking application can be carried, so that the interface unit 11 can send the application identifier and the digital certificate to the encryption unit 12. The encryption unit 12 stores the received digital certificate and application identifier, and establishes a correspondence between the digital certificate and the application identifier, that is, establishes a correspondence between the digital certificate and the online banking application.

Further, when the interface unit 11 forwards the secure access request sent by the application processing unit 13 to the encryption unit 12, it is equivalent to when the interface unit 11 instructs the encryption unit 12 to generate a key pair that has stored a digital certificate corresponding to the application. Of course, the above-mentioned interface unit 11 sends the identifier of the online banking application to the encryption unit 12. When the detection result of the encryption unit 12 is YES, that is, the digital certificate of the online banking application is stored, the encryption unit 12 sends the stored digital certificate to the application processing unit 13 through the interface unit 11, and the application processing is performed. Unit 13 will not need to apply for a digital certificate any more, but will directly establish a connection with the application server using the digital certificate.

When the application is running on the external device, similar to the situation shown in FIG. 4, after the notebook applies for the obtained digital certificate to the certificate server, the transceiver unit 22 on the notebook can send the digital certificate to the tablet for storage; For example, the transceiver unit 22 on the notebook sends the digital certificate to the transceiver unit 33 of the tablet computer, and simultaneously transmits the application identifier of the application running on the notebook corresponding to the certificate to the transceiver unit 33; the transceiver unit 33 then digitizes The certificate and application identifier are sent to the interface unit 31, which sends it to the encryption unit 32. The encryption unit 32 stores the digital certificate and the application identifier described above, and establishes a correspondence between the digital certificate and the application identifier. Application processing on the notebook when the notebook is next connected to the application server The unit 21 instructs the transceiver unit 22 to send the application identification to the tablet, and finally sends the application identification to the encryption unit 32 of the tablet in accordance with the above-described transmission process. The encryption unit 32 will query whether a digital certificate corresponding to the application identifier is stored, and if so, the encryption unit 32 can send the digital certificate to the notebook according to the reverse process described above, so that the notebook does not need to go to the certificate server again. Obtain the certificate, but use the stored certificate to establish a connection with the application server. If the encryption unit 32 queries that it does not store the digital certificate corresponding to the application identifier, it can directly start a security service for the notebook, generate a key pair, and return the public key to the notebook, so that the notebook uses the public key to connect to the certificate server to apply for a number. For the certificate, the related process can be referred to the above embodiment, and will not be described in detail. The method in this embodiment, that is, when the application running device needs to connect to the application server for the first time, the application access device of the embodiment provides a key pair for the application running device to use the key to apply for a digital certificate; and, the application The running device sends the certificate of the application to the application access device for storage. When the application running device starts to connect to the application server next time, the application access device detects that the certificate is no longer generated if the certificate corresponding to the application is already stored. Yes, sending the certificate directly to the application running device also improves the efficiency of application access. Embodiment 6 In the foregoing embodiments, the interface unit in the application access device may use, for example, a PKCS#11 interface, and the encryption unit may be implemented by software or an encryption chip, for example. 6 is a schematic structural diagram of another embodiment of an application access device according to the present invention. As shown in FIG. 6, the device is a software mode, and the encryption unit is a soft encryption module, that is, the encryption, decryption, and the like of the encryption unit are based on Software algorithm implementation, support common encryption and decryption algorithms, such as Triple Data Encryption Algorithm (3DES), AESRC4, Message Digest Algorithm 5 (MD5), DSA and RSA. The encryption, decryption, generation key pair, and security services such as signature and signature verification provided by the soft encryption module are provided to the application through the PKCS#11 interface. In the software implementation manner, in the various processes of encrypting, decrypting, and generating a key pair, the encryption unit may involve some data cache or data storage, and the storage medium used by the application device is an application access device. Some storage media, such as the memory block of the emmc chip, the storage process is through the input and output of the emmc chip (Input/Output, referred to as: 10) Operational implementation, not visible to the file system of the application access device. FIG. 7 is a schematic structural diagram of another embodiment of an application access device according to the present invention. As shown in FIG. 7, the device is in hardware mode, and the encryption unit is an encryption chip, that is, the encryption, decryption, and the like of the encryption unit are driven by the driver. The program is implemented by the encryption chip and supports a common encryption and decryption algorithm. The security services provided by the encryption chip, such as encryption, decryption, signature, signature verification, and key generation, are provided to the application through the PKCS#11 interface.

Wherein, in the hardware implementation manner, in the various processing processes such as encryption, decryption, and generation of a key pair performed by the encryption unit, the data storage involved is a memory built in the encryption chip, and the storage process It is implemented by 10 operations of the encryption chip, and is invisible to the file system (for example, not visible to the android system). Embodiment 7 This embodiment provides an application access method, which is performed by an application access device. FIG. 8 is a schematic flowchart of an application access method according to an embodiment of the present invention. The method in this embodiment is performed by an application access device that provides a security service for an application running on the device itself. This embodiment only describes the method briefly. The implementation principle can be combined as described in the device embodiment. As shown in Figure 8, it can include:

801. The application access device generates a security access request, where the security access request is used to request an application security service for an application running on the application access device.

802. The application access device generates a key pair according to the security access request, where the key pair includes a public key and a private key.

803. The application access device uses the public key to apply for obtaining a digital certificate to the certificate server, and the application access device establishes a connection with the application server by using the digital certificate.

804. The application access device encrypts data transmitted between the application access device and the application server by using the private key after establishing a connection with the application server. Further, after the application access device generates the security access request, the method further includes: the application access device storing a correspondence between the digital certificate and the application. Further, after the application access device generates the security access request, before generating the key pair according to the security access request, the method further includes: the application access device according to the pair Correspondingly, detecting whether a digital certificate corresponding to the application has been stored; when the detection result is YES, directly establishing a connection with the application server by using the stored digital certificate. FIG. 9 is a schematic flowchart of an application access method according to an embodiment of the present invention. The method of the present embodiment is only described briefly. The specific implementation principle may be as described in conjunction with the device embodiment. As shown in FIG. 9, it may include:

901. The application access device receives a security access request sent by an application running device, where the service is used.

902. The application access device generates a key pair according to the security access request, where the key pair includes a public key and a private key.

903. The application access device sends the public key to the application running device, so that the application running device requests the certificate server to obtain a digital certificate by using the public key, and the application running device passes the number. The certificate establishes a connection with the application server;

904. After the application running device establishes a connection with the application server, the application access device encrypts data transmitted between the application running device and the application server by using the private key. Further, the receiving the security access request sent by the application running device includes: the application accessing device receiving the application running connected with the application access device by using any one of a USB connection, a WIFI connection, and an NFC connection. A secure access request sent by the device.

Further, the application access device specifically receives the security access request sent by the application running device by using a PKCS#11 interface. Further, after the application access device sends the public key to the application running device, the method further includes: the application access device receiving the digital certificate sent by the application running device, and storing the digital certificate and The corresponding relationship of the application. Further, after the application access device receives the security access request sent by the application running device, before generating the key pair according to the security access request, the method further includes: detecting, by the application access device, whether the storage device has been stored according to the corresponding relationship. Digital certificate corresponding to the application When the detection result is YES, the stored digital certificate is directly sent to the acknowledgment connection. It will be understood by those skilled in the art that all or part of the steps of implementing the above method embodiments may be performed by hardware related to the program instructions. The aforementioned program can be stored in a computer readable storage medium. The program, when executed, performs the steps including the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk. It should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art The technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. range.

Claims

Rights request

1. An application access method, characterized in that the method includes: the application access device generates a security access request, and the security access request is used to request to provide application security services for an application running on the application access device;

The application access device generates a key pair according to the security access request, the key pair includes a public key and a private key; the application access device uses the public key to apply to the certificate server to obtain a digital certificate, and the The application access device establishes a connection with the application server through the digital certificate;

After establishing a connection with the application server, the application access device uses the private key to encrypt data transmitted between the application access device and the application server.

2. The method according to claim 1, characterized in that, after the application access device generates a security access request, it further includes:

The application access device stores the corresponding relationship between the digital certificate and the application.

3. The method according to claim 2, characterized in that, after the application access device generates a secure access request and before generating a key pair according to the secure access request, it further includes:

The application access device detects whether the digital certificate corresponding to the application has been stored according to the corresponding relationship;

When the detection result is yes, directly establish a connection with the application server through the stored digital certificate.

4. An application access method, characterized in that the method includes: the application access device receives a secure access request sent by an application running device, and the application access device generates a key pair according to the secure access request. , the key pair includes a public key and a private key; the application access device sends the public key to the application running device, so that the application running device uses the public key to apply to the certificate server to obtain a digital certificate , and the said should Use the running device to establish a connection with the application server through the digital certificate;

After the application running device establishes a connection with the application server, the application access device uses the private key to encrypt data transmitted between the application running device and the application server.

5. The method according to claim 4, wherein the receiving the security access request sent by the application running device includes:

The application access device receives a secure access request sent by the application running device connected to the application access device through any one of USB connection, WIFI connection, and NFC connection.

6. The method according to claim 4 or 5, characterized in that the application access device receives the security access request sent by the application running device, including: the application access device receives the application running request through the PKCS#11 interface. The secure access request sent by the device.

7. The method according to claim 4 or 5, characterized in that, after the application access device sends the public key to the application running device, it further includes:

The application access device receives the digital certificate sent by the application running device, and stores the corresponding relationship between the digital certificate and the application.

8. The method according to claim 7, wherein after the application access device receives the security access request sent by the application running device and before generating a key pair according to the security access request, it further includes:

When the detection result is yes, sending the stored digital certificate to the application connection is directly performed.

9. An application access device, characterized by including: an interface unit, an encryption unit and an application processing unit; The interface unit is configured to receive a security access request generated by an application access device, where the security access request is used to request to provide application security services for an application running on the application access device;

The encryption unit is configured to generate a key pair according to the secure access request, where the key pair includes a public key and a private key; and, after establishing a connection with the application server, use the private key to The data transmitted between the application access device and the application server is encrypted; the application processing unit is configured to use the public key to apply to the certificate server for a digital certificate, and establish a connection with the application server through the digital certificate.

10. The application access device according to claim 9, characterized in that,

11. The application access device according to claim 10, wherein the encryption unit is further configured to: after the interface unit receives the secure access request and before generating a key pair according to the secure access request, according to The stored corresponding relationship is used to detect whether the digital certificate corresponding to the application has been stored; the application processing unit is further configured to directly execute the stored digital certificate when the detection result of the encryption unit is yes. Establish a connection with the application server.

12. An application access device, characterized in that the application access device establishes a communication connection with an application running device, and the application access device includes: an interface unit and an encryption unit;

The interface unit is configured to receive a secure access request sent by the application running device to provide all services; and send the public key to the application running device by the encryption unit, so that the application running device uses The public key applies to the certificate server to obtain a digital certificate, and

The encryption unit is configured to generate a key pair according to the secure access request, where the key pair includes a public key and a private key; and, after the application running device establishes a connection with the application server, use the The private key encrypts data transmitted between the application running device and the application server.

13. The device according to claim 12, characterized in that, The interface unit is configured to receive a secure access request sent by the application running device connected to the application access device through any one of USB connection, WIFI connection, and NFC connection.

14. The device according to claim 12 or 13, characterized in that the interface unit is a PKCS#11 interface.

15. The device according to claim 12 or 13, characterized in that,

Then, receive the digital certificate sent by the application running device;

16. The device according to claim 15, wherein the encryption unit is further configured to generate a key pair according to the secure access request after the interface unit receives the secure access request sent by the application running device. , according to the stored corresponding relationship, detect whether the digital certificate corresponding to the application has been stored; the interface unit is further configured to directly detect when the detection result of the encryption unit is yes.