WO2016202106A1 - 一种智能密钥设备的工作方法 - Google Patents

一种智能密钥设备的工作方法 Download PDF

Info

Publication number
WO2016202106A1
WO2016202106A1 PCT/CN2016/080630 CN2016080630W WO2016202106A1 WO 2016202106 A1 WO2016202106 A1 WO 2016202106A1 CN 2016080630 W CN2016080630 W CN 2016080630W WO 2016202106 A1 WO2016202106 A1 WO 2016202106A1
Authority
WO
WIPO (PCT)
Prior art keywords
key device
smart key
user
returns
data
Prior art date
Application number
PCT/CN2016/080630
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Original Assignee
飞天诚信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 飞天诚信科技股份有限公司 filed Critical 飞天诚信科技股份有限公司
Priority to US15/561,779 priority Critical patent/US10263985B2/en
Publication of WO2016202106A1 publication Critical patent/WO2016202106A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3823—Payment protocols; Details thereof insuring higher security of transaction combining multiple encryption tools for a transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3825—Use of electronic signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/386—Payment protocols; Details thereof using messaging services or messaging apps
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4014—Identity check for transactions
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00571—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated by interacting with a central unit
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
    • G07C2009/00388—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks code verification carried out according to the challenge/response method
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00857—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys where the code of the data carrier can be programmed
    • G07C2009/0088—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys where the code of the data carrier can be programmed centrally
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash

Definitions

  • the invention relates to a working method of a smart key device, and belongs to the field of information security.
  • online banking With the rapid development of the Internet and e-commerce, the online transaction amount of online banking (referred to as online banking) has been expanding, and the problem of network information security has become increasingly prominent. Consumers are also paying more and more attention to the security of online transactions.
  • a dynamic password or a USB Key can be used for online transactions.
  • a dynamic password needs to be input each time, and the process is too complicated, and then a quick payment method appears.
  • the short message authentication code is needed in the fast payment process.
  • the malicious person may use the mobile phone to conduct online transactions in the name of the user, which may cause irreparable loss to the user, so the prior art It is very insecure to use the short message authentication code for quick payment, and it is very inconvenient to input a text message every time.
  • the object of the present invention is to provide a working method of a smart key device, which can realize fast authentication of a user identity, thereby enabling efficient, secure and fast online transactions.
  • the present invention provides a working method of a smart key device, which includes:
  • Step S1 The smart key device is powered on and initialized.
  • Step S2 When the smart key device receives the enumeration descriptor command sent by the host computer, the smart key device sets the descriptor and returns it to the upper computer;
  • Step S3 When the smart key device receives the command sent by the host computer, determine the type of the command, if it is a registration request command, execute step S4, if it is an authentication request command, execute step S7, if it is another command Performing corresponding operations according to the command, returning to step S3;
  • Step S4 The smart key device determines whether the user button information is received, if yes, step S5 is performed, otherwise, an error is reported, and the process returns to step S3;
  • Step S5 The smart key device associates the generated user key pair with the corresponding created key handle, and signs the data domain part in the registration request command according to a preset algorithm to obtain a first signature. And saving the result; generating a certificate serial number, and issuing a digital certificate corresponding to the certificate serial number to the user key pair using a private key of the preset root key pair; the data field in the registration request command Part includes challenge parameters and registration application parameters;
  • Step S6 The smart key device saves the user key pair and the key handle according to a predetermined format, and generates registration response data according to the digital certificate and the first signature result, and returns the data to the upper computer. Go back to step S3;
  • Step S7 The smart key device determines whether the user is legal according to the authentication request command, if yes, step S8 is performed, otherwise, an error is reported, and the process returns to step S3;
  • Step S8 the smart key device waits for the user button information, and determines whether the user button information is received, if yes, step S9 is performed, otherwise, an error is reported, and the process returns to step S3;
  • Step S9 The smart key device acquires a corresponding user key pair according to the key handle in the authentication request command, and uses the private key in the user key pair according to a preset algorithm to request the authentication request. Signing the data field to get the second signature result;
  • Step S10 The smart key device generates the authentication response data according to the second signature result and returns it to the upper computer, and returns to step S3.
  • the smart key device sets a descriptor and returns it to the upper computer, including:
  • Step S22-1 The smart key device sets the configuration descriptor content as an HID device
  • Step S22-2 the smart key device sets a report descriptor
  • Step S22-2 The smart key device returns the configuration descriptor and the report descriptor to the upper computer.
  • step S3 if the smart key device determines that the type of the command is a protocol command, the step is performed. A1;
  • Step A1 The smart key device detects the fifth byte in the command. If the data on the fifth byte is the first data, the received data is returned to the upper computer, and the process returns to step S3. If the data on the fifth byte is the second data, the data of the seventeen valid bytes is returned to the upper computer, and the process returns to step S3.
  • step S3 if the smart key device determines that the type of the command is the acquisition version number command, step B1 is performed;
  • Step B1 The smart key device returns a preset character string to the upper computer, and returns to step S3.
  • the step S3 and the step S4 include:
  • Step C1 The smart key device generates a user key pair and the key handle, and obtains key information according to the user key pair and the registration application parameter in the registration request command, and searches for an idle key. Index, if found, step S4 is performed, if not found, step C2 is performed;
  • Step C2 The smart key device determines whether there is a remaining space of a suitable size in the space, and generates a corresponding key index, and performs step S4, otherwise returns space shortage information, and returns to step S3;
  • the step S5 further includes: the smart key device associating the generated user key pair with the key index;
  • the step S6 further includes: the smart key device saving the user key pair, the key index, and the registered application parameter in the registration request command according to a predetermined format.
  • the smart key device determines whether the waiting time reaches a preset time, and if yes, returns an error, and returns to step S3, otherwise returns to step S4.
  • the signing the data domain part in the registration request command according to a preset algorithm, including:
  • the smart key device performs hash calculation on the data domain part in the registration request command according to the preset algorithm to obtain a first hash value, and uses the private key pair in the user key pair to the first The hash value is signed to obtain the first signature result.
  • the method further includes:
  • Step S71 The smart key device determines whether the corresponding key handle is registered according to the key handle and the key handle length in the authentication request command, if yes, step S72 is performed, otherwise, an error is reported, and the process returns to step S3;
  • Step S72 The smart key device determines whether the registered application parameter in the authentication request command is consistent with the saved registration application parameter, if yes, step S8 is performed; otherwise, an error is reported, and the process returns to step S3.
  • the step S71 specifically includes:
  • Step S71-1 The smart key device determines whether the key handle length in the authentication request command is the same as the saved key handle length, if yes, step S71-2 is performed; otherwise, an error is reported, and the process returns to step S3;
  • Step S71-2 The smart key device determines whether the key handle in the authentication request command is the same as the saved key handle. If yes, step S72 is performed; otherwise, an error is reported, and the process returns to step S3.
  • the smart key device saves the user key pair and the key handle according to a predetermined format, including: the smart key device saves the user key pair, the key handle according to a predetermined format And registering the application parameter in the registration request command; the step S3 and the step S4 include:
  • Step D1 The smart key device determines, according to the registered application parameter, whether the current user has already registered, and then returns an error, and returns to step S3, otherwise step D2 is performed;
  • Step D2 The smart key device generates the user key pair, and obtains key information according to the user key pair and the registration application parameter in the registration request command, and performs step S4.
  • the step D1 comprises:
  • the smart key device determines whether the registered application parameter is saved, and the current user has already registered, otherwise the current user is not registered.
  • the smart key device determines whether the waiting time reaches a preset time, and if yes, returns an error, and returns to step S3, otherwise returns to step S8.
  • the determining the type of the command in the step S3 includes: the smart key device determining, according to the second byte of the data field in the command, the type of the command, such as the second word of the data field.
  • the data on the section is the first value.
  • the registration request command such as the data on the second byte of the data field being the second value, is an authentication request command.
  • the fast authentication of the user identity is realized, so that the online transaction can be performed efficiently, safely and quickly.
  • FIG. 1 is a flowchart of a working method of a smart key device according to Embodiment 1 of the present invention
  • FIG. 2 is a flowchart of a working method of a smart key device according to Embodiment 2 of the present invention.
  • FIG. 3 is a flowchart of a working method of a smart key device according to Embodiment 3 of the present invention.
  • Embodiment 1 of the present invention provides a working method of a smart key device, as shown in FIG. 1 , including:
  • Step S1 The smart key device is powered on and initialized.
  • Step S2 When the smart key device receives the enumeration descriptor command sent by the host computer, the smart key device sets the descriptor and returns it to the upper computer;
  • Step S3 When the smart key device receives the command sent by the host computer, determines whether the type of the command is a function command, if yes, step S4 is performed; otherwise, the corresponding operation is performed according to the command, and the process returns to step S3;
  • Step S4 The smart key device determines the type of the function command, if it is a registration request command, step S5 is performed, and if it is an authentication request command, step S9 is performed;
  • Step S5 The smart key device determines whether the user button information is received, if yes, step S6 is performed, otherwise, an error is reported, and the process returns to step S3;
  • Step S6 The smart key device associates the generated user key pair with the corresponding created key handle, and signs the data domain part in the registration request command according to a preset algorithm, and obtains the first signature result and saves the result;
  • the data domain part in the registration request command includes a challenge parameter and a registration application parameter
  • Step S7 The smart key device generates a certificate serial number, and issues a digital certificate corresponding to the certificate serial number to the user key pair by using the private key of the preset root key pair;
  • Step S8 The smart key device saves the user key pair and the corresponding key handle according to the predetermined format, and generates registration response data according to the digital certificate and the first signature result and returns to the upper computer, and returns to step S3;
  • Step S9 The smart key device determines whether the user is legal according to the authentication request command, if yes, step S10 is performed, otherwise, an error is reported, and the process returns to step S3;
  • Step S10 The smart key device waits for the user button information, and determines whether the user button information is received within the preset time, if yes, step S11 is performed, otherwise, an error is reported, and the process returns to step S3;
  • Step S11 The smart key device acquires a corresponding user key pair according to the key handle in the authentication request command, and uses the private key in the user key pair according to a preset algorithm to sign the data field of the authentication request command to obtain a second. Signature result;
  • Step S12 The smart key device generates the authentication response data according to the second signature result and returns it to the upper computer, and returns to step S3.
  • the embodiment 2 of the present invention provides a working method of the smart key device.
  • the method is repeated, and then the identity authentication is performed.
  • the method in the second embodiment includes:
  • Step 101 The smart key device is powered on and initialized.
  • Step 102 When the smart key device receives the enumeration descriptor command sent by the upper computer, the smart key device sets Descriptor;
  • the smart key device setting descriptor is specifically:
  • Step 102-1 Setting the content of the configuration descriptor to be an HID device
  • Step 102-2 setting a report descriptor
  • the report descriptor format is specifically:
  • the report descriptor in Embodiment 2 of the present invention is set to:
  • Step 103 The smart key device returns the descriptor to the upper computer, and performs step 104;
  • Step 104 When the smart key device receives the command sent by the host computer, determines the type of the command, if it is a protocol command, step 105 is performed, and if it is a function command, step 106 is performed;
  • the judgment is made according to the fifth byte in the command. If the byte is 83H, it is represented as a function command, and if 81H or 86H is a protocol command;
  • Step 105 The smart key device returns the corresponding data, and returns to step 104;
  • the received data is returned; if the fifth byte in the command is the second data, the data of the seventeen valid bytes is returned.
  • the first data is 81H and the second data is 86H;
  • Step 106 The smart key device determines the type of the function command, such as a registration request command, step 107 is performed, and if the command is an authentication request, step 114 is performed, and if the version number command is obtained, step 119 is performed;
  • the smart key device determines the type of the function command according to the second byte of the data field in the command, such as the registration request command if the data on the second byte of the data field is the first value. If the data on the second byte of the data field is the second value, it is an authentication request command. If the data on the second byte of the data field is the third value, the version number command is obtained; preferably, the first value is Is 01, the second value is 02, and the third value is 03;
  • the data field of the registration request command includes a 32-byte challenge parameter and a 32-byte registered application parameter, wherein the challenge parameter is client trust end data;
  • the registered application parameter is registered by the user with the domain name and Registered user information for the summary calculation of the registration digest value;
  • the authentication request command data field includes a 32-byte challenge parameter, a 32-byte registration application parameter, a 1-byte key handle length, and a key handle;
  • an authentication request The command conforms to the APDU format, specifically: CL IN P1 P2 Lc data field Le.
  • P1 represents a control character. If the value of P1 is 0x07, the smart key device must return the authentication response information. If the value of P1 is 0x03, it means that the smart key device performs the signing and authentication operation and returns a response message;
  • Step 107 The smart key device generates a user key pair and a corresponding key handle, obtains key information according to the generated user key pair and the registration application parameter in the registration request command, and searches for an idle key index, such as found. Then step 109 is performed, if not found, step 108 is performed;
  • each key index corresponds to a key handle, a registered application parameter, a user key pair, and a counter;
  • the key handle is used to query a corresponding user key pair outside the smart key device
  • the key index is used to query the corresponding user key pair in the smart key device.
  • Step 108 The smart key device determines whether there is a remaining space of a suitable size in the space, and then generates a corresponding key index, step 109 is performed, otherwise, an error is reported, and the process returns to step 104;
  • Step 109 The smart key device determines whether the user button information is received within a preset time, if yes, step 110 is performed; otherwise, an error is reported, and the process returns to step 104;
  • the preset time in the second embodiment is preferably 5 seconds
  • Step 110 The smart key device associates the generated user key pair with the key index and the key handle, and signs the data domain part in the registration request command according to a preset algorithm, and obtains the first signature result and saves the result;
  • the user key pair is an ECC key pair, and the length is 96 bytes;
  • the preset algorithm is an ECDSA algorithm, and may also be an SM2 algorithm;
  • the data to be signed signed in the second embodiment includes: a 1-byte reserved character (for example, 0x00), a 32-byte response parameter, a 32-byte registered application parameter, a key handle of the user key pair, and 65-byte user public key;
  • the specific implementation process of performing the signature is: performing hash calculation on the data domain part in the registration request command according to the preset algorithm to obtain the first hash value, and using the private key in the user key pair.
  • the key signs the first hash value to obtain a first signature result;
  • Step 111 The smart key device issues a digital certificate to the user key pair by using the private key of the preset root key pair;
  • the digital certificate in the second embodiment includes: a registration application parameter such as user information and a user public key;
  • the process of generating a digital certificate is specifically: the smart key device internally stores a certificate template, and then the smart key device generates a certificate serial number, and uses the certificate serial number and the user public key to update the serial number in the certificate. And the user public key, using the private key pre-stored in the smart key device to sign the version number and the public key in the certificate template, and put the signature result into the signature item of the certificate template;
  • the process of issuing a certificate includes: presetting a pair of root key pairs in the smart key device, the public key of the root key pair exists on the server side, and the smart key device issues the private key pair of the root key pair to the user key pair a digital certificate; the server can use the public key of the root key pair to verify the validity of the certificate and achieve the purpose of mutual authentication;
  • the digital certificate is an X.509 certificate, and the specific format is:
  • Subject Name / / subject information
  • SubjectPublic smart key device Info SubjectPublic smart key device Info, / / certificate holder's public key
  • the certificate signature object in this solution is the content of the TBSCertificate; that is, the content of the TBSCertificate is signed using the private key pre-stored in the smart key device;
  • Step 112 The smart key device saves the generated user key pair according to the key index.
  • the save format of the user key pair is predetermined, specifically: a key handle of a 4-byte user key pair + 32 bytes of registered application parameters + 96 bytes of user key pair +4 Byte counter (0 when registering);
  • the counter is used to indicate the number of times the identity verification operation is performed on the smart key device, and the initial value is 0. Each successful authentication is performed, and the counter is incremented by one;
  • Step 113 The smart key device returns registration response data to the host computer according to the first preset format, and returns to step 104;
  • the registration response data includes a digital certificate and a first signature result, where the first preset format is specifically:
  • Step 114 The smart key device determines whether the corresponding key handle is registered according to the key handle length and the key handle in the authentication request command, if yes, step 115 is performed; otherwise, an error is reported, and the process returns to step 104;
  • the step 114 specifically includes:
  • Step 114-1 The smart key device determines whether the key handle length in the authentication request command is the same as the saved key handle length, if yes, step 114-2 is performed; otherwise, an error is reported, and the process returns to step 104;
  • Step 114-2 The smart key device determines whether the key handle in the authentication request command is the same as the saved key handle, if yes, step 115 is performed; otherwise, an error is reported, and the process returns to step 104;
  • Step 115 The smart key device determines whether the registered application parameter in the authentication request command is consistent with the saved registration application parameter, if yes, step 116 is performed; otherwise, an error is reported, and the process returns to step 104;
  • the key index, the key handle, the registered application parameter, and the user key pair are saved in one-to-one correspondence;
  • Step 116 The smart key device waits for the user button information, and determines whether the user button information is received within the preset time. If yes, step 117 is performed; otherwise, an error is reported, and the process returns to step 104;
  • Step 117 The smart key device acquires a corresponding user key pair according to the key handle in the authentication request command, according to The preset algorithm uses the private key in the user key pair to sign the data field of the authentication request command to obtain a second signature result;
  • the data field in step 117 includes: 32 bytes of registered application parameters, 1 byte of user presence bytes, 4 bytes of counters, 32 bytes of challenge parameters;
  • Step 118 The smart key device returns the authentication response data to the upper computer according to the second preset format, and returns to step 104.
  • the second preset format is:
  • Step 119 The smart key device returns a preset character string, and returns to step 104;
  • the preset character string in the second embodiment is U2F_V2.
  • Embodiment 3 of the present invention provides a working method of a smart key device.
  • only one registration can be performed (that is, registration is not allowed to be repeated), and then identity authentication is performed, as shown in FIG.
  • the method of Example 3 includes:
  • Step 201 The smart key device is powered on and initialized.
  • Step 202 When the smart key device receives the enumeration descriptor command sent by the upper computer, the smart key device sets a descriptor.
  • the smart key device setting descriptor is specifically:
  • Step 202-1 Setting the content of the configuration descriptor to be an HID device
  • Step 202-2 setting a report descriptor
  • the report descriptor format is specifically:
  • Set the report descriptor to: set the global Usage Page to 0x d0 f1, set the local Usage to 0x01, set the Usage in the Input Report structure to 0x20, and set the Usage in the Output Report structure to 0x21.
  • Step 203 The smart key device returns the descriptor to the upper computer, and performs step 204;
  • Step 204 When the smart key device receives the command sent by the host computer, determines the type of the command, if it is a protocol command, step 205 is performed, and if it is a function command, step 206 is performed;
  • the judgment is made according to the fifth byte in the command. If the byte is 83H, it is represented as a function command, and if 81H or 86H is a protocol command;
  • Step 205 The smart key device returns the corresponding data, and returns to step 204;
  • the received data is returned; if the fifth byte in the order is the second data, the data of the seventeen valid bytes is returned.
  • the first data is 81H and the second data is 86H;
  • Step 206 The smart key device determines the type of the function command, such as a registration request command, step 207 is performed, such as the authentication request command, step 214 is performed, and if the version number command is obtained, step 219 is performed;
  • the smart key device determines the type of the function command according to the second byte of the data field in the command, for example, if the data on the second byte of the data field is 01, it is a registration request command, such as If the data on the second byte of the data field is 02, it is an authentication request command. For example, if the data on the second byte of the data field is 03, the version number command is obtained;
  • the data field of the registration request command includes a 32-byte challenge parameter and a 32-byte registered application parameter, wherein the challenge parameter is client trust end data; the registered application parameter is registered user information; authentication
  • the request command data field includes a 32-byte challenge parameter, a 32-byte registered application parameter, a 1-byte key handle length, and a key handle; the authentication request command conforms to the APDU format, specifically: CL IN P1 P2 Lc data
  • P1 represents a control character. If the value of P1 is 0x07, it means that the smart key device must return the authentication response information; if the value of P1 is 0x03, the smart key device performs Sign and authenticate operations and return a response message;
  • Step 207 The smart key device determines whether the current user has been registered, and then reports an error, and returns to step 204, otherwise step 208 is performed;
  • Step 208 The smart key device generates a user key pair, obtains key information according to the generated user key pair and the registration application parameter in the registration request command, and obtains an idle key index.
  • each key index corresponds to a key handle, a registered application parameter, a key pair, and a counter
  • Step 209 The smart key device determines whether the user button information is received within a preset time, if yes, step 210 is performed; otherwise, an error is reported, and the process returns to step 204;
  • the preset time in the third embodiment is preferably 5 seconds
  • Step 210 The smart key device associates the generated user key pair with the key index, and signs the data domain part in the registration request command according to a preset algorithm, and obtains the first signature result and saves the result;
  • the user key pair is an ECC key pair, and the length is 96 bytes;
  • the preset algorithm is an ECDSA algorithm, and may also be an SM2 algorithm;
  • the data to be signed signed in the third embodiment includes: a 1-byte reserved character (for example, 0x00), a 32-byte response parameter, a 32-byte registered application parameter, a key handle of the user key pair, and 65-byte user public key;
  • the specific implementation process of performing the signature is: performing hash calculation on the data domain part in the registration request command according to the preset algorithm to obtain the first hash value, and using the private key in the user key pair.
  • the key signs the first hash value to obtain a first signature result;
  • Step 211 The smart key device issues a digital certificate to the user key pair by using the private key of the preset root key pair;
  • the digital certificate in the third embodiment includes: a registration application parameter such as user information and a user public key;
  • the process of generating a digital certificate is specifically: the smart key device internally stores a certificate template, and then the smart key device generates a certificate serial number, and uses the certificate serial number and the user public key to update the serial number in the certificate. And the user public key, using the private key pre-stored in the smart key device to sign the version number and the public key in the certificate template, and put the signature result into the signature item of the certificate template;
  • the process of issuing a certificate includes: presetting a pair of root key pairs in the smart key device, the public key of the root key pair exists on the server side, and the smart key device issues the private key pair of the root key pair to the user key pair A digital certificate; the server can use the root key to verify the validity of the certificate against the public key of the pair to achieve the purpose of mutual authentication;
  • the digital certificate is an X.509 certificate, and the specific format is:
  • Subject Name / / subject information
  • SubjectPublic smart key device Info SubjectPublic smart key device Info, / / certificate holder's public key
  • the certificate signature object in this solution is the content of the TBSCertificate; that is, the content of the TBSCertificate is signed using the private key pre-stored in the smart key device;
  • Step 212 The smart key device saves the generated user key pair according to the key index.
  • the save format of the user key pair is predetermined, specifically: a key handle of a 4-byte user key pair + 32 bytes of registered application parameters + 96 bytes of user key pair +4 Byte counter (0 when registering);
  • the counter is used to indicate the number of times the identity verification operation is performed on the smart key device, and the initial value is 0. Each successful authentication is performed, and the counter is incremented by one;
  • Step 213 The smart key device returns registration response data to the host computer according to the first preset format, and returns to step 204;
  • the registration response data includes a digital certificate and a first signature result
  • the first preset format is specifically:
  • Step 214 The smart key device determines whether the corresponding key handle is registered according to the key handle length and the key handle in the authentication request command, if yes, step 215 is performed; otherwise, an error is reported, and the process returns to step 204;
  • step 214 specifically includes:
  • Step 214-1 The smart key device determines whether the key handle length in the authentication request command is the same as the saved key handle length, if yes, step 214-2 is performed; otherwise, an error is reported, and the process returns to step 204;
  • Step 214-2 The smart key device determines whether the key handle in the authentication request command is the same as the saved key handle, if yes, step 215 is performed; otherwise, the invalid key information is returned, and the process returns to step 204;
  • Step 215 The smart key device determines whether the registered application parameter in the authentication request command is consistent with the saved registration application parameter, if yes, step 216 is performed; otherwise, an error is reported, and the process returns to step 204;
  • the key index, the key handle, the registered application parameter, and the user key pair are saved in one-to-one correspondence;
  • Step 216 The smart key device waits for the user button information, and determines whether the user button information is received within the preset time, if yes, step 217 is performed; otherwise, an error is reported, and the process returns to step 204;
  • Step 217 The smart key device obtains a corresponding user key pair according to the key handle in the authentication request command, and uses the private key in the user key pair according to a preset algorithm to sign the data field of the authentication request command to obtain a second. Signature result;
  • the data field in step 213 includes: 32 bytes of registered application parameters, 1 byte of user presence bytes, 4 bytes of counters, 32 bytes of challenge parameters;
  • Step 218 The smart key device returns the authentication response data to the host computer according to the second preset format, and returns to step 204;
  • the second preset format is:
  • Step 219 The smart key device returns a preset character string, and returns to step 204;
  • the preset character string in the third embodiment is U2F_V2.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Computer Security & Cryptography (AREA)
  • Accounting & Taxation (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Strategic Management (AREA)
  • Finance (AREA)
  • General Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Power Engineering (AREA)
  • Telephone Function (AREA)
  • Storage Device Security (AREA)
  • Input From Keyboards Or The Like (AREA)

Abstract

一种智能密钥设备的工作方法，上位机通过浏览器从信任服务器获取数据，然后将其发送给智能密钥设备；智能密钥设备接收到上位机发送的数据后在用户按键确认后进行签名操作，然后将签名结果返回给上位机；上位机把智能密钥设备响应的数据发送给信任服务器来验证智能密钥设备的合法性。实现了对用户身份的快速认证，从而可以进行高效、安全、快捷的进行网上交易。

Description

一种智能密钥设备的工作方法 技术领域
本发明涉及一种智能密钥设备的工作方法，属于信息安全领域。
背景技术
随着互联网和电子商务的快速发展，网上银行(简称网银)在线交易金额不断扩大，网络信息安全问题日益凸显，消费者也越来越关注网上交易的安全问题。在现有技术中，可以利用动态口令或USB Key(智能密钥设备)进行网上交易，进行网上交易时需要每次都输入动态口令，过程太过复杂，而后则出现了快捷支付的方式，现有技术中快捷支付过程中需要使用短信认证码，如用户如丢失手机则可能出现恶意者利用该手机以用户名义进行网上交易的情形，这会给用户造成无法挽回的损失，所以，现有技术中的利用短信认证码进行快捷支付是非常不安全的，且每次都需输入短信也非常不便捷。
发明内容
本发明的目的是提供一种智能密钥设备的工作方法，其可实现了对用户身份的快速认证，从而可以进行高效、安全、快捷的进行网上交易。
为此，本发明提供了一种智能密钥设备的工作方法，其包括：
步骤S1：智能密钥设备上电，进行初始化；
步骤S2：当所述智能密钥设备接收到上位机发送的枚举描述符命令时，所述智能密钥设备设置描述符并将其返回给所述上位机；
步骤S3：当所述智能密钥设备接收到上位机发送的命令，判断所述命令的类型，如为注册请求命令则执行步骤S4，如为认证请求命令则执行步骤S7，如为其他命令则根据所述命令执行相应操作，返回步骤S3；
步骤S4：所述智能密钥设备判断是否接收到用户按键信息，是则执行步骤S5，否则报错，返回步骤S3；
步骤S5：所述智能密钥设备将生成的用户密钥对与对应的创建的密钥句柄进行关联，并根据预设算法对所述注册请求命令中的数据域部分进行签名，得到第一签名结果并保存；生成证书序列号，并使用预置的根密钥对的私钥对所述用户密钥对颁发一个与所述证书序列号对应的数字证书；所述注册请求命令中的数据域部分包括挑战参数和注册地应用参数；
步骤S6：所述智能密钥设备根据预定格式保存所述用户密钥对和所述密钥句柄，并根据所述数字证书和所述第一签名结果生成注册响应数据并返回给所述上位机，返回步骤S3；
步骤S7：所述智能密钥设备根据所述认证请求命令判断用户是否合法，是则执行步骤S8，否则报错，返回步骤S3；
步骤S8：所述智能密钥设备等待用户按键信息，并判断是否接收到用户按键信息，是则执行步骤S9，否则报错，返回步骤S3；
步骤S9：所述智能密钥设备根据所述认证请求命令中的密钥句柄获取对应的用户密钥对，根据预设算法使用所述用户密钥对中的私钥，对所述认证请求命令的数据域进行签名得到第二签名结果；以及
步骤S10：所述智能密钥设备根据所述第二签名结果生成认证响应数据并返回给上位机，返回步骤S3。
优选地，所述智能密钥设备设置描述符并将其返回给所述上位机，包括：
步骤S22-1：所述智能密钥设备设置配置描述符内容为HID设备；
步骤S22-2：所述智能密钥设备设置报告描述符；
步骤S22-2：所述智能密钥设备将所述配置描述符和所述报告描述符返回给所述上位机。
优选地，所述步骤S3中如所述智能密钥设备判断所述命令的类型为协议命令则执行步骤 A1；
步骤A1：所述智能密钥设备检测所述命令中的第五个字节，如第五个字节上的数据为第一数据则将接收到的数据返回给所述上位机，返回步骤S3；如第五个字节上的数据为第二数据则将十七个有效字节的数据返回给所述上位机，返回步骤S3。
优选地，所述步骤S3中如所述智能密钥设备判断命令的类型为获取版本号命令则执行步骤B1；
步骤B1：所述智能密钥设备将预设的字符串返回给所述上位机，返回步骤S3。
优选地，所述步骤S3与步骤S4之间包括：
步骤C1：所述智能密钥设备生成用户密钥对和所述密钥句柄，根据所述用户密钥对和所述注册请求命令中的注册地应用参数得到密钥信息，查找空闲的密钥索引，如找到则执行步骤S4，如未找到则执行步骤C2；
步骤C2：所述智能密钥设备判断空间是否有大小合适的剩余空间，是则生成对应的密钥索引，执行步骤S4，否则返回空间不足信息，返回步骤S3；
所述步骤S5还包括：所述智能密钥设备将生成的用户密钥对与所述密钥索引进行关联；
所述步骤S6还包括：所述智能密钥设备根据预定格式保存所述用户密钥对、所述密钥索引和所述注册请求命令中的注册地应用参数。
优选地，所述步骤S4判断为否时还包括：所述智能密钥设备判断等待时间是否到达预设时间，是则报错，返回步骤S3，否则返回步骤S4。
优选地，所述根据预设算法对所述注册请求命令中的数据域部分进行签名，包括：
所述智能密钥设备根据所述预设算法对所述注册请求命令中的数据域部分进行哈希计算得到第一哈希值，使用所述用户密钥对中的私钥对所述第一哈希值进行签名得到所述第一签名结果。
优选地，所述步骤S7判断为是时还包括：
步骤S71：所述智能密钥设备根据所述认证请求命令中的密钥句柄和密钥句柄长度判断对应的密钥句柄是否被注册过，是则执行步骤S72，否则报错，返回步骤S3；
步骤S72：所述智能密钥设备判断所述认证请求命令中的注册地应用参数是否与保存的注册地应用参数一致，是则执行步骤S8，否则报错，返回步骤S3。
优选地，所述步骤S71具体包括：
步骤S71-1：所述智能密钥设备判断所述认证请求命令中的密钥句柄长度是否与保存的密钥句柄长度相同，是则执行步骤S71-2，否则报错，返回步骤S3；
步骤S71-2：所述智能密钥设备判断所述认证请求命令中的密钥句柄是否与保存的密钥句柄相同，是则执行步骤S72，否则报错，返回步骤S3。
优选地，所述智能密钥设备根据预定格式保存所述用户密钥对和所述密钥句柄，包括：所述智能密钥设备根据预定格式保存所述用户密钥对、所述密钥句柄和所述注册请求命令中的注册地应用参数；所述步骤S3与步骤S4之间包括：
步骤D1：所述智能密钥设备根据所述注册地应用参数判断当前用户是否已经注册过了，是则报错，返回步骤S3，否则执行步骤D2；
步骤D2：所述智能密钥设备生成所述用户密钥对，根据所述用户密钥对和所述注册请求命令中的注册地应用参数得到密钥信息，执行步骤S4。
优选地，所述步骤D1包括：
所述智能密钥设备判断是否保存了所述注册地应用参数，是则当前用户已经注册过了，否则当前用户未注册。
优选地，所述步骤S8判断为否时还包括：所述智能密钥设备判断等待时间是否到达预设时间，是则报错，返回步骤S3，否则返回步骤S8。
优选地，所述步骤S3中判断所述命令的类型，具体包括：所述智能密钥设备根据所述命令中数据域的第二字节判断所述命令的类型，如数据域的第二字节上的数据为第一数值则为 注册请求命令，如数据域的第二字节上的数据为第二数值则为认证请求命令。
根据本发明，实现了对用户身份的快速认证，从而可以进行高效、安全、快捷的进行网上交易。
附图说明
图1为根据本发明实施例1的一种智能密钥设备的工作方法流程图；
图2为根据本发明实施例2的一种智能密钥设备的工作方法流程图；
图3为根据本发明实施例3的一种智能密钥设备的工作方法流程图。
具体实施方式
下面将结合本发明的附图，对本发明进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域的技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
实施例1：
本发明实施例1提供一种智能密钥设备的工作方法，如图1所示，包括：
步骤S1：智能密钥设备上电，进行初始化；
步骤S2：当智能密钥设备接收到上位机发送的枚举描述符命令时，智能密钥设备设置描述符并将其返回给上位机；
步骤S3：当智能密钥设备接收到上位机发送的命令，判断该命令的类型是否为功能命令，是则执行步骤S4，否则根据命令执行相应操作，返回步骤S3；
步骤S4：智能密钥设备判断功能命令的类型，如为注册请求命令则执行步骤S5，如为认证请求命令则执行步骤S9；
步骤S5：智能密钥设备判断是否接收到用户按键信息，是则执行步骤S6，否则报错，返回步骤S3；
步骤S6：智能密钥设备将生成的用户密钥对与对应的创建的密钥句柄进行关联，并根据预设算法对注册请求命令中的数据域部分进行签名，得到第一签名结果并保存；
在本实施例1中，注册请求命令中的数据域部分包括挑战参数和注册地应用参数；
步骤S7：智能密钥设备生成证书序列号，并使用预置的根密钥对的私钥对用户密钥对颁发一个与该证书序列号对应的数字证书；
步骤S8：智能密钥设备根据预定格式保存用户密钥对和对应的密钥句柄，并根据数字证书和第一签名结果生成注册响应数据并返回给上位机，返回步骤S3；
步骤S9：智能密钥设备根据认证请求命令判断用户是否合法，是则执行步骤S10，否则报错，返回步骤S3；
步骤S10：智能密钥设备等待用户按键信息，并判断是否在预设时间内接收到用户按键信息，是则执行步骤S11，否则报错，返回步骤S3；
步骤S11：智能密钥设备根据认证请求命令中的密钥句柄获取对应的用户密钥对，根据预设算法使用用户密钥对中的私钥，对认证请求命令的数据域进行签名得到第二签名结果；
步骤S12：智能密钥设备根据第二签名结果生成认证响应数据并返回给上位机，返回步骤S3。
实施例2：
本发明实施例2提供一种智能密钥设备的工作方法，在本实施例2中，允许重复进行注册然后再进行身份认证，如图2所示，本实施例2的方法包括：
步骤101：智能密钥设备上电，进行初始化；
步骤102：当智能密钥设备接收到上位机发送的枚举描述符命令时，智能密钥设备设置 描述符；
具体地，在本实施例2中，智能密钥设备设置描述符具体为：
步骤102-1：设置配置描述符内容为HID设备；
步骤102-2：设置报告描述符；
在本实施例2中，报告描述符格式具体为：
Usage Page,//用途页
Usage,//用途
Collection,//应用集合
//Input Report结构
Usage(X),Usage(Y),//用途X/Y
Logical Minimum(0),//逻辑最小值0
Logical Maximum(255),//逻辑最大值255
Feature Size(8),//报告大小是8bit
Feature Count(64),//报告数目64bit
Input(Data,Variable,Relative),//输入用
//Output Report结构
Usage(X),Usage(Y),//用途X/Y
Logical Minimum(0),//逻辑最小值0
Logical Maximum(255),//逻辑最大值255
Feature Size(8),//报告大小是8bit
Feature Count(64),//报告数目64bit
Input(Data,Variable,Relative),//输出用
End Collection//应用集合结束
设置报告描述符具体为：将全局Usage Page设为0x d0 f1，将局部Usage设为0x01，将在Input Report结构中的Usage设为0x20，将Output Report结构中的Usage设为0x21；报告描述符中的其他参数为可变值，可根据需求进行设置；
例如，本发明实施例2中的报告描述符设置为：
06 d0 f1//Usage Page
09 01//Usage
a1 01//Collection
//Input Report
09 20//Usage
15 00//logical minimum(0)
26 ff//logical maximum(255)
00 75 08//Feature Size(8bits)
95 40//Feature Count(64field,64bytes)
81 02//Input
//Output Report
09 21//Usage
15 00//logical minimum(0)
26 ff//logical maximum(255)
00 75 08//Feature Size(8bits)
95 40//Feature Count(64field,64bytes)
91 02//Output
c0//Application Collection End
步骤103：智能密钥设备将描述符返回给上位机，执行步骤104；
步骤104：当智能密钥设备接收到上位机发送的命令，判断该命令的类型，如为协议命令则执行步骤105，如为功能命令则执行步骤106；
在本实施例2中，根据命令中的第5个字节进行判断，如该字节为83H则表示为功能命令，如为81H或86H则为协议命令；
步骤105：智能密钥设备将相应的数据返回，返回步骤104；
在本实施例2中，如命令中的第五个字节为第一数据则返回接收到的数据；如命令中的第五个字节为第二数据则返回十七个有效字节的数据；优选地，第一数据为81H，第二数据为86H；
步骤106：智能密钥设备判断功能命令的类型，如为注册请求命令则执行步骤107，如为认证请求命令则执行步骤114，如为获取版本号命令则执行步骤119；
具体地，在本实施例2中，智能密钥设备根据命令中数据域的第二字节判断功能命令的类型，如数据域的第二字节上的数据为第一数值则为注册请求命令，如数据域的第二字节上的数据为第二数值则为认证请求命令，如数据域的第二字节上的数据为第三数值则为获取版本号命令；优选地，第一数值为01，第二数值为02，第三数值为03；
在本实施例2中，注册请求命令的数据域包括32字节的挑战参数和32字节的注册地应用参数，其中，挑战参数是客户信任端数据；注册地应用参数是由用户注册域名与注册用户信息进行摘要计算得到的注册地摘要值；认证请求命令数据域包括32字节的挑战参数、32字节的注册地应用参数、1字节的密钥句柄长度和密钥句柄；认证请求命令符合APDU格式，具体为：CL IN P1 P2 Lc数据域Le，具体地，在本实施例2中，P1表示控制字符，如P1的值为0x07则表示智能密钥设备必须返回身份验证响应信息；如P1的值为0x03则表示智能密钥设备进行签名与身份验证操作并返回响应消息；
步骤107：智能密钥设备生成用户密钥对和对应的密钥句柄，根据生成的用户密钥对和注册请求命令中的注册地应用参数得到密钥信息，查找空闲的密钥索引，如找到则执行步骤109，如未找到则执行步骤108；
在本实施例2中，每一个密钥索引对应于密钥句柄、注册地应用参数、用户密钥对和计数器；
在本实施例2中，密钥句柄用于在智能密钥设备外部进行查询对应的用户密钥对，密钥索引用于在智能密钥设备内部查询对应的用户密钥对；
步骤108：智能密钥设备判断空间是否有大小合适的剩余空间，是则生成对应的密钥索引，执行步骤109，否则报错，返回步骤104；
步骤109：智能密钥设备判断是否在预设时间内接收到用户按键信息，是则执行步骤110，否则报错，返回步骤104；
在本实施例2中的预设时间优选为5秒；
步骤110：智能密钥设备将生成的用户密钥对与密钥索引、密钥句柄进行关联，并根据预设算法对注册请求命令中的数据域部分进行签名，得到第一签名结果并保存；
优选地，在本实施例2中，用户密钥对为ECC密钥对，长度为96字节；预设算法为ECDSA算法，还可以为SM2算法；
具体地，本实施例2中进行签名的待签名数据包括：1字节的保留字符(例如0x00)、32字节应答参数、32字节注册地应用参数、用户密钥对的密钥句柄和65字节的用户公钥；
具体地，在本实施例2中，进行签名的具体实现过程为：根据预设算法对注册请求命令中的数据域部分进行哈希计算得到第一哈希值，使用用户密钥对中的私钥对第一哈希值进行签名得到第一签名结果；
步骤111：智能密钥设备使用预置的根密钥对的私钥对用户密钥对颁发一个数字证书；
具体地，本实施例2中的数字证书中包括：用户信息、用户公钥等注册地应用参数；
在本实施例2中，生成数字证书的过程具体为：智能密钥设备内部保存一个证书模板，然后智能密钥设备生成证书序列号，用该证书序列号和用户公钥更新证书中的序列号、用户公钥，使用智能密钥设备内预存的私钥对证书模板中的版本号和公钥等数据进行签名操作，把签名结果放到证书模板的签名项中；
颁发证书的过程包括：智能密钥设备内预置一对根密钥对，该根密钥对的公钥存在服务器端，智能密钥设备使用根密钥对的私钥对用户密钥对颁发一个数字证书；服务器端可以使用根密钥对的公钥验证这个证书的合法性，达到双向认证的目的；
在本实施2中，优选地，数字证书为X.509证书，具体格式为：
[Certificate::＝SEQUENCE{
tbsCertificate TBSCertificate,//证书信息，结构见下
signatureAlgorithm AlgorithmIdentifier,//办法者签名算法标识
signature BIT STRING//颁发者的签名
}
其中，第一项TBSCertificate的结构：
TBSCertificate::＝SEQUENCE{
version[0]EXPLICIT Version DEFAULT v1,//X.509版本号
serialNumber CertificateSerialNumber,//证书序列号
signature AlgorithmIdentifier,//签名算法标示符
issuer Name,//证书的颁发者名称
validity Validity,//证书有效日期
subject Name,//主题信息
subjectPublic智能密钥设备Info SubjectPublic智能密钥设备Info,//证书持有人的公钥
extensions[3]EXPLICIT Extensions OPTIONAL//证书扩展项，可选
}
本方案中的证书签名对象就是TBSCertificate的内容；即使用智能密钥设备内预存的私钥对TBSCertificate的内容进行签名操作；
步骤112：智能密钥设备根据密钥索引保存生成的用户密钥对；
在本实施例2中，用户密钥对的保存格式是预定的，具体为：4字节用户密钥对的密钥句柄+32字节注册地应用参数+96字节用户密钥对+4字节计数器(注册时为0)；
其中，计数器用于表示对使用智能密钥设备对身份进行验证操作的次数，初始值为0，每成功认证一次，计数器加1；
步骤113：智能密钥设备按照第一预设格式给上位机返回注册响应数据，返回步骤104；
在本实施例2中，注册响应数据包括数字证书和第一签名结果，第一预设格式具体为：
Figure PCTCN2016080630-appb-000001
步骤114：智能密钥设备根据认证请求命令中的密钥句柄长度和密钥句柄判断对应的密钥句柄是否被注册过，是则执行步骤115，否则报错，返回步骤104；
在本实施例2中，步骤114具体包括：
步骤114-1：智能密钥设备判断认证请求命令中的密钥句柄长度是否与保存的密钥句柄长度相同，是则执行步骤114-2，否则报错，返回步骤104；
步骤114-2：智能密钥设备判断认证请求命令中的密钥句柄是否与保存的密钥句柄相同，是则执行步骤115，否则报错，返回步骤104；
步骤115：智能密钥设备判断认证请求命令中的注册地应用参数是否与保存的注册地应用参数一致，是则执行步骤116，否则报错，返回步骤104；
具体地，本实施例2中，密钥索引、密钥句柄、注册地应用参数、用户密钥对一一对应保存；
步骤116：智能密钥设备等待用户按键信息，并判断是否在预设时间内接收到用户按键信息，是则执行步骤117，否则报错，返回步骤104；
步骤117：智能密钥设备根据认证请求命令中的密钥句柄获取对应的用户密钥对，根据 预设算法使用用户密钥对中的私钥，对认证请求命令的数据域进行签名得到第二签名结果；
在本实施例2中，步骤117中的数据域包括：32字节的注册地应用参数、1字节的用户存在字节、4字节的计数器、32字节的挑战参数；
步骤118：智能密钥设备按照第二预设格式给上位机返回认证响应数据，返回步骤104。
在本实施例2中，第二预设格式为：
用户存在字节 计数器 第二签名结果
1 4  
步骤119：智能密钥设备返回预设的字符串，返回步骤104；
具体地，本实施例2中的预设的字符串为U2F_V2。
实施例3
本发明实施例3提供一种智能密钥设备的工作方法，在本实施例3中，只能注册一次(即不允许重复进行注册)，然后再进行身份认证，如图3所示，本实施例3的方法包括：
步骤201：智能密钥设备上电，进行初始化；
步骤202：当智能密钥设备接收到上位机发送的枚举描述符命令时，智能密钥设备设置描述符；
具体地，在本实施例3中，智能密钥设备设置描述符具体为：
步骤202-1：设置配置描述符内容为HID设备；
步骤202-2：设置报告描述符；
在本实施例3中，报告描述符格式具体为：
Usage Page,//用途页
Usage,//用途
Collection,//应用集合
//Input Report结构
Usage(X),Usage(Y),//用途X/Y
Logical Minimum(0),//逻辑最小值0
Logical Maximum(255),//逻辑最大值255
Feature Size(8),//报告大小是8bit
Feature Count(64),//报告数目64bit
Input(Data,Variable,Relative),//输入用
//Output Report结构
Usage(X),Usage(Y),//用途X/Y
Logical Minimum(0),//逻辑最小值0
Logical Maximum(255),//逻辑最大值255
Feature Size(8),//报告大小是8bit
Feature Count(64),//报告数目64bit
Input(Data,Variable,Relative),//输出用
End Collection//应用集合结束
设置报告描述符具体为：将全局Usage Page设为0x d0 f1，将局部Usage设为0x01，将在Input Report结构中的Usage设为0x20，将Output Report结构中的Usage设为0x21；
步骤203：智能密钥设备将描述符返回给上位机，执行步骤204；
步骤204：当智能密钥设备接收到上位机发送的命令，判断该命令的类型，如为协议命令则执行步骤205，如为功能命令则执行步骤206；
在本实施例3中，根据命令中的第5个字节进行判断，如该字节为83H则表示为功能命令，如为81H或86H则为协议命令；
步骤205：智能密钥设备将相应的数据返回，返回步骤204；
在本实施例3中，如令中的第五个字节为第一数据则返回接收到的数据；如令中的第五个字节为第二数据则返回十七个有效字节的数据；优选地，第一数据为81H，第二数据为86H；
步骤206：智能密钥设备判断功能命令的类型，如为注册请求命令则执行步骤207，如为认证请求命令则执行步骤214，如为获取版本号命令则执行步骤219；
具体地，在本实施例3中，智能密钥设备根据命令中数据域的第二字节判断功能命令的类型，如数据域的第二字节上的数据为01则为注册请求命令，如数据域的第二字节上的数据为02则为认证请求命令，如数据域的第二字节上的数据为03则为获取版本号命令；
在本实施例3中，注册请求命令的数据域包括32字节的挑战参数和32字节的注册地应用参数，其中，挑战参数是客户信任端数据；注册地应用参数是注册用户信息；认证请求命令数据域包括32字节的挑战参数、32字节的注册地应用参数、1字节的密钥句柄长度和密钥句柄；认证请求命令符合APDU格式，具体为：CL IN P1 P2 Lc数据域Le，具体地，在本实施例3中，P1表示控制字符，如P1的值为0x07则表示智能密钥设备必须返回身份验证响应信息；如P1的值为0x03则表示智能密钥设备进行签名与身份验证操作并返回响应消息；
步骤207：智能密钥设备判断当前用户是否已经注册过，是则报错，返回步骤204，否则执行步骤208；
步骤208：智能密钥设备生成用户密钥对，根据生成的用户密钥对和注册请求命令中的注册地应用参数得到密钥信息，获取空闲的密钥索引；
在本实施例3中，每一个密钥索引对应于密钥句柄、注册地应用参数、密钥对、计数器；
步骤209：智能密钥设备判断是否在预设时间内接收到用户按键信息，是则执行步骤210，否则报错，返回步骤204；
在本实施例3中的预设时间优选为5秒；
步骤210：智能密钥设备将生成的用户密钥对与密钥索引进行关联，并根据预设算法对注册请求命令中的数据域部分进行签名，得到第一签名结果并保存；
优选地，在本实施例3中，用户密钥对为ECC密钥对，长度为96字节；预设算法为ECDSA算法，还可以为SM2算法；
具体地，本实施例3中进行签名的待签名数据包括：1字节的保留字符(例如0x00)、32字节应答参数、32字节注册地应用参数、用户密钥对的密钥句柄和65字节的用户公钥；
具体地，在本实施例3中，进行签名的具体实现过程为：根据预设算法对注册请求命令中的数据域部分进行哈希计算得到第一哈希值，使用用户密钥对中的私钥对第一哈希值进行签名得到第一签名结果；
步骤211：智能密钥设备使用预置的根密钥对的私钥对用户密钥对颁发一个数字证书；
具体地，本实施例3中的数字证书中包括：用户信息、用户公钥等注册地应用参数；
在本实施例3中，生成数字证书的过程具体为：智能密钥设备内部保存一个证书模板，然后智能密钥设备生成证书序列号，用该证书序列号和用户公钥更新证书中的序列号、用户公钥，使用智能密钥设备内预存的私钥对证书模板中的版本号和公钥等数据进行签名操作，把签名结果放到证书模板的签名项中；
颁发证书的过程包括：智能密钥设备内预置一对根密钥对，该根密钥对的公钥存在服务器端，智能密钥设备使用根密钥对的私钥对用户密钥对颁发一个数字证书；服务器端可以使用根密钥对对的公钥验证这个证书的合法性，达到双向认证的目的；
在本实施中，优选地，数字证书为X.509证书，具体格式为：
[Certificate::＝SEQUENCE{
tbsCertificate TBSCertificate,//证书信息，结构见下
signatureAlgorithm AlgorithmIdentifier,//办法者签名算法标识
signature BIT STRING//颁发者的签名
}
其中，第一项TBSCertificate的结构：
TBSCertificate::＝SEQUENCE{
version[0]EXPLICIT Version DEFAULT v1,//X.509版本号
serialNumber CertificateSerialNumber,//证书序列号
signature AlgorithmIdentifier,//签名算法标示符
issuer Name,//证书的颁发者名称
validity Validity,//证书有效日期
subject Name,//主题信息
subjectPublic智能密钥设备Info SubjectPublic智能密钥设备Info,//证书持有人的公钥
extensions[3]EXPLICIT Extensions OPTIONAL//证书扩展项，可选
}
本方案中的证书签名对象就是TBSCertificate的内容；即使用智能密钥设备内预存的私钥对TBSCertificate的内容进行签名操作；
步骤212：智能密钥设备根据密钥索引保存生成的用户密钥对；
在本实施例3中，用户密钥对的保存格式是预定的，具体为：4字节用户密钥对的密钥句柄+32字节注册地应用参数+96字节用户密钥对+4字节计数器(注册时为0)；
其中，计数器用于表示对使用智能密钥设备对身份进行验证操作的次数，初始值为0，每成功认证一次，计数器加1；
步骤213：智能密钥设备按照第一预设格式给上位机返回注册响应数据，返回步骤204；
在本实施例3中，注册响应数据包括数字证书和第一签名结果，第一预设格式具体为：
Figure PCTCN2016080630-appb-000002
步骤214：智能密钥设备根据认证请求命令中的密钥句柄长度和密钥句柄判断对应的密钥句柄是否被注册过，是则执行步骤215，否则报错，返回步骤204；
在本实施例3中，步骤214具体包括：
步骤214-1：智能密钥设备判断认证请求命令中的密钥句柄长度是否与保存的密钥句柄长度相同，是则执行步骤214-2，否则报错，返回步骤204；
步骤214-2：智能密钥设备判断认证请求命令中的密钥句柄是否与保存的密钥句柄相同，是则执行步骤215，否则返回无效密钥信息，返回步骤204；
步骤215：智能密钥设备判断认证请求命令中的注册地应用参数是否与保存的注册地应用参数一致，是则执行步骤216，否则报错，返回步骤204；
具体地，本实施例3中，密钥索引、密钥句柄、注册地应用参数、用户密钥对一一对应保存；
步骤216：智能密钥设备等待用户按键信息，并判断是否在预设时间内接收到用户按键信息，是则执行步骤217，否则报错，返回步骤204；
步骤217：智能密钥设备根据认证请求命令中的密钥句柄获取对应的用户密钥对，根据预设算法使用用户密钥对中的私钥，对认证请求命令的数据域进行签名得到第二签名结果；
在本实施例3中，步骤213中的数据域包括：32字节的注册地应用参数、1字节的用户存在字节、4字节的计数器、32字节的挑战参数；
步骤218：智能密钥设备按照第二预设格式给上位机返回认证响应数据，返回步骤204；
在本实施例3中，第二预设格式为：
用户存在字节 计数器 第二签名结果
1 4  
步骤219：智能密钥设备返回预设的字符串，返回步骤204；
具体地，本实施例3中的预设的字符串为U2F_V2。
以上所述，仅为本发明较佳的具体实施方式，但本发明的保护范围并不局限于此，本领 域的技术人员在本发明公开的技术范围内，可轻易想到的变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应该以所附权利要求书的保护范围为准。

Claims (14)

  1. 一种智能密钥设备的工作方法，其特征在于，
    上位机通过浏览器从信任服务器获取数据，然后将其发送给智能密钥设备；
    智能密钥设备接收到上位机发送的数据后在用户按键确认后进行签名操作，然后将签名结果返回给上位机；并且
    上位机把智能密钥设备响应的数据发送给信任服务器来验证智能密钥设备的合法性。
  2. 一种智能密钥设备的工作方法，其特征在于，包括下列步骤：
    S1)智能密钥设备上电，进行初始化；
    S2)当所述智能密钥设备接收到上位机发送的枚举描述符命令时，所述智能密钥设备设置描述符并将其返回给所述上位机；
    S3)当所述智能密钥设备接收到上位机发送的命令，判断所述命令的类型，如为注册请求命令则执行步骤S4，如为认证请求命令则执行步骤S7，如为其他命令则根据所述命令执行相应操作，返回步骤S3；
    S4)所述智能密钥设备判断是否接收到用户按键信息，是则执行步骤S5，否则报错，返回步骤S3；
    S5)所述智能密钥设备将生成的用户密钥对与对应的创建的密钥句柄进行关联，并根据预设算法对所述注册请求命令中的数据域部分进行签名，得到第一签名结果并保存；生成证书序列号，并使用预置的根密钥对的私钥对所述用户密钥对颁发一个与所述证书序列号对应的数字证书；所述注册请求命令中的数据域部分包括挑战参数和注册地应用参数；
    S6)所述智能密钥设备根据预定格式保存所述用户密钥对和所述密钥句柄，并根据所述数字证书和所述第一签名结果生成注册响应数据并返回给所述上位机，返回步骤S3；
    S7)所述智能密钥设备根据所述认证请求命令判断用户是否合法，是则执行步骤S8，否则报错，返回步骤S3；
    S8)所述智能密钥设备等待用户按键信息，并判断是否接收到用户按键信息，是则执行步骤S9，否则报错，返回步骤S3；
    S9)所述智能密钥设备根据所述认证请求命令中的密钥句柄获取对应的用户密钥对，根据预设算法使用所述用户密钥对中的私钥，对所述认证请求命令的数据域进行签名得到第二签名结果；以及
    S10)所述智能密钥设备根据所述第二签名结果生成认证响应数据并返回给上位机，返回步骤S3。
  3. 如权利要求2所述的方法，其特征在于，所述智能密钥设备设置描述符并将其返回给所述上位机，包括下列步骤：
    S22-1)所述智能密钥设备设置配置描述符内容为HID设备；
    S22-2)所述智能密钥设备设置报告描述符；以及
    S22-2)所述智能密钥设备将所述配置描述符和所述报告描述符返回给所述上位机。
  4. 如权利要求2所述的方法，其特征在于，所述步骤S3中如所述智能密钥设备判断所述命令的类型为协议命令则执行步骤A1；
    A1)所述智能密钥设备检测所述命令中的第五个字节，如第五个字节上的数据为第一数据则将接收到的数据返回给所述上位机，返回步骤S3；如第五个字节上的数据为第二数据则将十七个有效字节的数据返回给所述上位机，返回步骤S3。
  5. 如权利要求2所述的方法，其特征在于，所述步骤S3中如所述智能密钥设备判断命令的类型为获取版本号命令则执行步骤B1；
    B1)所述智能密钥设备将预设的字符串返回给所述上位机，返回步骤S3。
  6. 如权利要求2所述的方法，其特征在于，所述步骤S3与步骤S4之间包括下列步骤：
    C1)所述智能密钥设备生成用户密钥对和所述密钥句柄，根据所述用户密钥对和所述注 册请求命令中的注册地应用参数得到密钥信息，查找空闲的密钥索引，如找到则执行步骤S4，如未找到则执行步骤C2；
    C2)所述智能密钥设备判断空间是否有大小合适的剩余空间，是则生成对应的密钥索引，执行步骤S4，否则返回空间不足信息，返回步骤S3；
    所述步骤S5还包括：所述智能密钥设备将生成的用户密钥对与所述密钥索引进行关联；
    所述步骤S6还包括：所述智能密钥设备根据预定格式保存所述用户密钥对、所述密钥索引和所述注册请求命令中的注册地应用参数。
  7. 如权利要求2所述的方法，其特征在于，所述步骤S4判断为否时还包括：所述智能密钥设备判断等待时间是否到达预设时间，是则报错，返回步骤S3，否则返回步骤S4。
  8. 如权利要求2所述的方法，其特征在于，所述根据预设算法对所述注册请求命令中的数据域部分进行签名，包括：
    所述智能密钥设备根据所述预设算法对所述注册请求命令中的数据域部分进行哈希计算得到第一哈希值，使用所述用户密钥对中的私钥对所述第一哈希值进行签名得到所述第一签名结果。
  9. 如权利要求2所述的方法，其特征在于，所述步骤S7判断为是时还包括下列步骤：
    S71)所述智能密钥设备根据所述认证请求命令中的密钥句柄和密钥句柄长度判断对应的密钥句柄是否被注册过，是则执行步骤S72，否则报错，返回步骤S3；
    S72)所述智能密钥设备判断所述认证请求命令中的注册地应用参数是否与保存的注册地应用参数一致，是则执行步骤S8，否则报错，返回步骤S3。
  10. 如权利要求9所述的方法，其特征在于，所述步骤S71具体包括下列步骤：
    S71-1)所述智能密钥设备判断所述认证请求命令中的密钥句柄长度是否与保存的密钥句柄长度相同，是则执行步骤S71-2，否则报错，返回步骤S3；
    S71-2)所述智能密钥设备判断所述认证请求命令中的密钥句柄是否与保存的密钥句柄相同，是则执行步骤S72，否则报错，返回步骤S3。
  11. 如权利要求2所述的方法，其特征在于，所述智能密钥设备根据预定格式保存所述用户密钥对和所述密钥句柄，包括：所述智能密钥设备根据预定格式保存所述用户密钥对、所述密钥句柄和所述注册请求命令中的注册地应用参数；
    所述步骤S3与步骤S4之间包括下列步骤：
    D1)所述智能密钥设备根据所述注册地应用参数判断当前用户是否已经注册过了，是则报错，返回步骤S3，否则执行步骤D2；
    D2)所述智能密钥设备生成所述用户密钥对，根据所述用户密钥对和所述注册请求命令中的注册地应用参数得到密钥信息，执行步骤S4。
  12. 如权利要求11所述的方法，其特征在于，所述步骤D1包括：
    所述智能密钥设备判断是否保存了所述注册地应用参数，是则当前用户已经注册过了，否则当前用户未注册。
  13. 如权利要求2所述的方法，其特征在于，
    所述步骤S8判断为否时还包括：所述智能密钥设备判断等待时间是否到达预设时间，是则报错，返回步骤S3，否则返回步骤S8。
  14. 如权利要求2所述的方法，其特征在于，所述步骤S3中判断所述命令的类型，具体包括：所述智能密钥设备根据所述命令中数据域的第二字节判断所述命令的类型，如数据域的第二字节上的数据为第一数值则为注册请求命令，如数据域的第二字节上的数据为第二数值则为认证请求命令。
PCT/CN2016/080630 2015-06-16 2016-04-29 一种智能密钥设备的工作方法 WO2016202106A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/561,779 US10263985B2 (en) 2015-06-16 2016-04-29 Work method for smart key device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510332534.9 2015-06-16
CN201510332534.9A CN105184566B (zh) 2015-06-16 2015-06-16 一种智能密钥设备的工作方法

Publications (1)

Publication Number Publication Date
WO2016202106A1 true WO2016202106A1 (zh) 2016-12-22

Family

ID=54906628

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/080630 WO2016202106A1 (zh) 2015-06-16 2016-04-29 一种智能密钥设备的工作方法

Country Status (3)

Country Link
US (1) US10263985B2 (zh)
CN (1) CN105184566B (zh)
WO (1) WO2016202106A1 (zh)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105184566B (zh) * 2015-06-16 2018-07-17 飞天诚信科技股份有限公司 一种智能密钥设备的工作方法
CN105827655B (zh) * 2016-05-27 2019-04-16 飞天诚信科技股份有限公司 一种智能密钥设备及其工作方法
CN107395350B (zh) * 2017-08-22 2019-12-20 深圳市文鼎创数据科技有限公司 密钥及密钥句柄的生成方法、系统及智能密钥安全设备
CN108199844B (zh) * 2018-04-09 2022-05-13 北京无字天书科技有限公司 一种支持离线sm9算法密钥首次申请下载方法
CN109257332B (zh) * 2018-08-15 2020-06-02 飞天诚信科技股份有限公司 数字货币硬件钱包应用更新的安全通道的创建方法及装置
CN110740042B (zh) * 2019-10-21 2022-03-18 飞天诚信科技股份有限公司 一种智能密钥设备及其验证方法
CN110830168B (zh) * 2019-11-11 2021-11-02 飞天诚信科技股份有限公司 一种usb通讯的实现方法及装置
CN111414638B (zh) * 2020-04-23 2023-03-24 飞天诚信科技股份有限公司 一种区分密钥生成方式的实现方法及装置
CN111917551B (zh) * 2020-06-23 2021-10-01 深圳奥联信息安全技术有限公司 一种基于无证书公钥的句柄访问保护方法和系统
CN112787996B (zh) * 2020-12-25 2022-03-15 郑州信大捷安信息技术股份有限公司 一种密码设备管理方法及系统
CN114785505B (zh) * 2022-06-22 2022-08-23 中科雨辰科技有限公司 一种获取异常设备的数据处理系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101051907A (zh) * 2007-05-14 2007-10-10 北京握奇数据系统有限公司 面向签名数据的安全认证方法及其系统
CN101820346A (zh) * 2010-05-04 2010-09-01 北京飞天诚信科技有限公司 一种安全数字签名方法
CN102521186A (zh) * 2011-11-22 2012-06-27 飞天诚信科技股份有限公司 一种USB Key及其与终端进行通信的方法
CN105184566A (zh) * 2015-06-16 2015-12-23 飞天诚信科技股份有限公司 一种智能密钥设备的工作方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070106897A1 (en) * 2005-11-07 2007-05-10 Michael Kulakowski Secure RFID authentication system
GB0615428D0 (en) * 2006-08-03 2006-09-13 Iti Scotland Ltd Workflow assurance and authentication system
US20120173873A1 (en) * 2011-01-04 2012-07-05 Ray Bell Smart grid device authenticity verification
US8769304B2 (en) * 2011-06-16 2014-07-01 OneID Inc. Method and system for fully encrypted repository
US9621356B2 (en) * 2014-03-06 2017-04-11 Apple Inc. Revocation of root certificates

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101051907A (zh) * 2007-05-14 2007-10-10 北京握奇数据系统有限公司 面向签名数据的安全认证方法及其系统
CN101820346A (zh) * 2010-05-04 2010-09-01 北京飞天诚信科技有限公司 一种安全数字签名方法
CN102521186A (zh) * 2011-11-22 2012-06-27 飞天诚信科技股份有限公司 一种USB Key及其与终端进行通信的方法
CN105184566A (zh) * 2015-06-16 2015-12-23 飞天诚信科技股份有限公司 一种智能密钥设备的工作方法

Also Published As

Publication number Publication date
US10263985B2 (en) 2019-04-16
US20180091509A1 (en) 2018-03-29
CN105184566B (zh) 2018-07-17
CN105184566A (zh) 2015-12-23

Similar Documents

Publication Publication Date Title
WO2016202106A1 (zh) 一种智能密钥设备的工作方法
US10637654B2 (en) Smart key device and working method thereof
WO2018121555A1 (zh) 一种硬件钱包及其持有者身份验证方法
CN108377190B (zh) 一种认证设备及其工作方法
WO2017045539A1 (zh) 一种身份认证方法和设备
JP6472513B2 (ja) 検証情報を送信するための方法および端末
US11151571B2 (en) Method and system for processing resource exchange information
CN103873440B (zh) 一种应用程序的升级方法和系统
CN102648610A (zh) 能够与多个独立的应用提供者一起使用的强认证令牌
TWI797738B (zh) 資料獲取方法、裝置、設備和介質
CN101834946A (zh) 一种进行安全手机支付的方法和进行安全支付的手机
US10439809B2 (en) Method and apparatus for managing application identifier
CN104008351A (zh) Windows应用程序完整性校验系统、方法及装置
WO2022193594A1 (zh) 绑卡方法、终端设备、认证服务器及存储介质
WO2020057314A1 (zh) 一种在线签发eSIM证书的方法、装置及系统
CN106656993B (zh) 一种动态验证码验证方法及装置
WO2019210612A1 (zh) 身份认证方法及装置
TW201601083A (zh) 一次性密碼生成的方法、裝置及認證方法、認證系統
WO2019114431A1 (zh) 一种具有指纹验证功能的金融卡及其工作方法
CN104579686B (zh) 一种用于手机令牌的种子匹配方法
CN114157434A (zh) 登录验证方法、装置、电子设备及存储介质
KR101494838B1 (ko) 거래연동 오티피를 이용한 계좌 이체 방법 및 시스템
WO2016086708A1 (zh) 支付验证方法、装置及系统
WO2016065739A1 (zh) 一种智能终端及身份认证方法
TWI675579B (zh) 網路身份驗證系統與方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16810847

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15561779

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16810847

Country of ref document: EP

Kind code of ref document: A1