WO2018086515A1 - 可离线验证安全信息标签构造验证方法与装置 - Google Patents

可离线验证安全信息标签构造验证方法与装置 Download PDF

Info

Publication number
WO2018086515A1
WO2018086515A1 PCT/CN2017/109793 CN2017109793W WO2018086515A1 WO 2018086515 A1 WO2018086515 A1 WO 2018086515A1 CN 2017109793 W CN2017109793 W CN 2017109793W WO 2018086515 A1 WO2018086515 A1 WO 2018086515A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
digital certificate
verification
digital
validity
Prior art date
Application number
PCT/CN2017/109793
Other languages
English (en)
French (fr)
Inventor
王栋
Original Assignee
王栋
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 王栋 filed Critical 王栋
Publication of WO2018086515A1 publication Critical patent/WO2018086515A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K17/00—Methods or arrangements for effecting co-operative working between equipments covered by two or more of main groups G06K1/00 - G06K15/00, e.g. automatic card files incorporating conveying and reading operations
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K19/00—Record carriers for use with machines and with at least a part designed to carry digital markings
    • G06K19/06—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code
    • G06K19/06009—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code with optically detectable marking
    • G06K19/06037—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code with optically detectable marking multi-dimensional coding
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K19/00—Record carriers for use with machines and with at least a part designed to carry digital markings
    • G06K19/06—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code
    • G06K19/06009—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code with optically detectable marking
    • G06K19/06046—Constructional details
    • G06K19/06056—Constructional details the marking comprising a further embedded marking, e.g. a 1D bar code with the black bars containing a smaller sized coding
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements

Definitions

  • the present invention relates to the field of information technology and security verification, and in particular to a method and apparatus for verifying the security of a security information tag.
  • the present invention has generality for common information labels such as two-dimensional codes and radio frequency identification codes, and can be applied without substantial differences.
  • common information labels such as two-dimensional codes and radio frequency identification codes
  • a two-dimensional code is a specific geometric figure that records data information by distributing a number of symbols corresponding to binary on a two-dimensional plane according to a certain rule.
  • the QR code uses graphical symbols to represent literal numerical information.
  • the symbol representation technology has developed a variety of code systems, such as QR Code, Data Matrix, Maxi Code, PDF417, and so on.
  • the two-dimensional code is recognized by the image input device or the photoelectric scanning device, and can deal with common problems such as symbol size and scale change, graphic rotation, and partial stain loss, and realize automatic identification of the encoded information, and has large capacity of coding information and fault tolerance and error correction capability. Strong, high decoding reliability, low production cost, easy to use and so on.
  • QR codes are used as an information storage, delivery, identification, and interaction technology in electronic media, newspapers and magazines, commodity packaging, warehousing logistics, and individuals.
  • Business cards, transportation tickets, certificate documents, mobile advertising, social apps, online shopping transactions, online banking payments, mobile payments, etc. have been widely used.
  • the traditional Internet uses IP addresses or domain name URLs as access points, but lengthy textual and digital information is difficult to remember and input, and it is easy to access or mis-access due to input errors.
  • the two-dimensional code encoding information has a large capacity, and can encode various data information such as text, picture, sound, etc., and the most widely used ones include text TXT type and URL URI type.
  • QR code is easy to make, and any unit and individual can create and read QR code information. While having the advantages of being simple and easy to use, security has also become a major obstacle to the popularization of two-dimensional codes. QR codes with malware and virus links are often disguised as gifts, discounts, offers, etc. to promote QR codes, and it is difficult for people to recognize true and false. If these two-dimensional codes are scanned by mistake, the Trojan virus program will be downloaded, which will seriously endanger the security of the user's system and may lead to leakage of personal information and economic loss. For example, some fraudulent websites make their websites into a two-dimensional code counterfeit bank online trading website. If the user scans the QR code and logs into the fake website, the bank account number and password may be leaked.
  • Some Trojan software download URLs are made into two-dimensional code fake links such as gift offers, if the wrong scan download may lead to the leakage of user privacy information, and pose a great hidden danger to the user system security.
  • the two-dimensional code is a clear code. Although it has redundancy check for information fault tolerance, the information is easily modified and forged, and the verification of the release source is difficult.
  • the current verification methods include two types: one is to use an application system similar to the scan code guard, after scanning and identifying the two-dimensional code information, the dedicated server of the application system is connected through the network, and the QR code website information and the database record in the server are retrieved. Comparison: If the matching record can be retrieved in the system database, the source of the QR code can be given according to the recorded attribute; if there is no matching record, the security cannot be judged.
  • the other is to encrypt the QR code information, connect to a dedicated server through the network, read the authentication information, and compare it with the encrypted information in the QR code; such application is a closed system, encrypted
  • the key information is stored in a dedicated server, and the QR code information can only be decrypted by an internal dedicated system, and cannot be read and verified by the mass user.
  • the existing two-dimensional code and other information label security verification methods have the following main problems: they need to be authenticated through a network connection server, and cannot be verified in an environment where there is no network connection or inconvenient network connection; the verification method based on the URL retrieval comparison only It can verify that the tag information such as the two-dimensional code verified by the input has been scanned, and the tag information such as the newly generated two-dimensional code needs to be added to the database before verification.
  • the present invention provides a method and device for verifying the security information label that can be verified offline, and can verify the source of the information label offline without the need of a network connection, and can be safely assured.
  • the information embedded in the application information tag is not limited to the application information tag.
  • the literature [1] mainly deals with the principle of symmetric key and asymmetric public key cryptosystem
  • the literature [2] mainly deals with symmetric key and asymmetric public key algorithm implementation.
  • the embodiments of the present invention provide a method and device for verifying the security information tag offline verification, and verify the release source of the security information tag in a universally applicable environment without network connection, so as to use the information securely and reliably. label.
  • the information tag using the construction verification method of the present invention is called a security information tag.
  • the invention can be applied to the common information label types such as two-dimensional code and radio frequency identification code without substantial difference. The following only uses a two-dimensional code as an example.
  • the coded information it can be read by the public or read by specific users. It can be divided into public information, private information and mixed information types, which are called public information security QR code, private information security QR code and mixed information security. QR code.
  • a first aspect of the embodiments of the present invention provides a method for verifying a secure two-dimensional code structure that can be verified offline.
  • the method includes:
  • the information to be encoded and the type information include but are not limited to:
  • the coding information needs to be any of basic information, extended information, target information, and dynamic information;
  • the basic information is any one of a name, an address, and a domain name information that does not change with a single application;
  • the target information is any one of a destination URL and a publicity information;
  • the dynamic information is a generation time that varies according to a single application, Any of the valid time, transaction information, and application parameter information;
  • the extended information is any of the document number and the contact information;
  • the type information is any one of public information, private information, and mixed information.
  • the combination information includes but is not limited to:
  • Input information encrypted information, digital signatures, digital certificates and their validity information
  • the input information is the input information to be encoded and the type information;
  • the encrypted information is the ciphertext and the encryption algorithm parameter information encrypted by the public key of the specific user or the symmetric key specified by the specific user, and the input information may be input information.
  • the entire combined information is encrypted;
  • the digital signature is the result of the signature operation of the information to be encoded by the publisher private key, and the digital input signature can be performed on the input information or the entire combined information;
  • the digital certificate is digitally signed by the key issuing authority.
  • the digital certificate validity information is the current state information of the digital certificate signed and authenticated by the validity verification authority specified by the key issuing institution root certificate;
  • the structural combination and the analysis deconstruction method of the combined information include, but are not limited to:
  • Preserving information such as security QR code identification, type, combination, compression mode, etc. in the combined information header;
  • the input information, the digital signature, the digital certificate and the validity information thereof are connected by a separator symbol to form combined information; according to the type and combination of the combined information header during deconstruction Mode information, which decomposes the combined information into individual independent information by separating symbols.
  • the two-dimensional code encoding identification and information input and output methods include, but are not limited to:
  • the generated two-dimensional code pattern can embed a secure two-dimensional code identification pattern; using optical image scanning information transmission and optical imaging When the conditions are insufficient, the Bluetooth radio wireless information transmission method is adopted.
  • the method for outputting the verification and verification result judgment information is:
  • the digital certificate information is verified by the digital certificate issuing authority and the root certificate of the designated certificate validity verification institution, and the input information and the digital signature are verified by the digital certificate information; the verification method preferably uses the offline verification method or the specified validity verification institution.
  • the method of verification if the digital certificate, input information and digital signature are all verified correctly, the secure QR code is verified correctly, the source of the encoded information is trusted, otherwise the source of the information is not trusted; the correctness of the secure QR code is displayed, and the encoded information is displayed.
  • the QR code publisher information allowing the application operation related to the QR code; otherwise, the source of the QR code is not trusted, and the application operation related to the QR code is rejected.
  • the cryptographic system used for the digital signature, the signature verification, and the digital certificate includes but is not limited to:
  • Digital signature, signature verification, digital certificate using asymmetric public key cryptosystem using ECC elliptic curve cryptosystem, DSA cryptosystem, RSA cryptosystem;
  • the information encryption and information decryption methods include but are not limited to:
  • Information encryption and information decryption use a symmetric key cryptosystem and an asymmetric public key cryptosystem, using any of AES, 3DES, RC4, IDEA, ECC, RSA, ECDH; using a symmetric key specified by a specific user or its public
  • the key and the private key encrypt and decrypt the information to be encrypted, or encrypt and decrypt the encrypted information with a first symmetric key generated by the user's public key or randomly generated, and use a symmetric key specified by a specific user or
  • the public key and the private key encrypt and decrypt the first symmetric key used.
  • the structural combination and the analysis deconstruction method of the combined information include, but are not limited to:
  • Preserving information such as security QR code identification, type, combination, compression mode, etc. in the combined information header;
  • the ciphertext information, the digital signature, the digital certificate and the validity information of the input information are connected by a delimiter symbol to form combined information; according to the combined information header during deconstruction
  • the type and combination mode information is first decomposed into separate information by the delimiter symbol, and then the ciphertext information is decrypted according to the encryption algorithm parameter in the ciphertext information to obtain the original input information; the input information and the number may also be input first.
  • the signature, the digital certificate and the validity information are connected by the delimiter symbol, and then the connected information is encrypted, and the encrypted information is used as the combined information; when deconstructing, according to the type and combination mode information of the combined information header, the ciphertext information is first passed.
  • the encryption algorithm parameter information decrypts the encrypted information, and then decomposes the decrypted combined information into individual independent information according to the delimiter symbol.
  • the structural combination and the analysis deconstruction method of the combination information include, but are not limited to:
  • Preserving information such as security QR code identification, type, combination, compression mode, etc. in the combined information header;
  • the extended information is subjected to independent signature encryption and verification decryption processing; the extended information and the extended information are Other information can be read by different categories of users.
  • the constructing combination and the analysis deconstruction method of the combined information include, but are not limited to:
  • Preserving information such as security QR code identification, type, combination, compression mode, etc. in the combined information header;
  • the digital certificate may be cached in the digital certificate storage area of the verification device, and the digital certificate information may be omitted or only the digital certificate hash value information may be reserved in the combination information; if the offline verification mode is not used, the digital certificate validity information may be omitted or Only digital certificate hash value information is retained.
  • UTF-8 or UTF-16 format For information containing multi-byte characters, Unicode encoding in UTF-8 or UTF-16 format can be used;
  • the combined information is compressed or Base64 encoded; when decomposed, the compressed combined information is first decompressed or Base64 decoded, and then decomposed according to the combination thereof;
  • a second aspect of the embodiments of the present invention provides an offline verification two-dimensional code structure verification device, where the device includes:
  • An information input unit configured to input information to be encoded and type information
  • An information storage unit configured to store input information and operation result information
  • a security information storage unit for securely storing private key information
  • a digital certificate storage unit for storing a digital certificate and its validity information
  • a root certificate storage unit for storing a root certificate of the key issuing authority and its designated validity verification institution
  • a digital signature and information encryption operation unit for calculating a digital signature, updating digital certificate validity information, and encrypting information
  • An image display information output unit for displaying and outputting the security two-dimensional code information
  • An image scanning information input unit for scanning and inputting secure two-dimensional code information
  • Two-dimensional code recognition and combined information analysis deconstruction operation unit used for two-dimensional code recognition and analysis and deconstruction of combined information
  • Digital signature verification and information decryption unit for digital decryption of information decryption and digital certificate validity and input information
  • the result output information prompting unit is used for the safety two-dimensional code verification result output and the information prompt.
  • the operation functions of the operation unit, the signature unit, and the verification unit are:
  • the method for constructing the operation unit, the signature unit, the verification unit, the storage unit, and the secure storage unit includes but is not limited to:
  • the present invention has the following beneficial effects:
  • the embodiment of the invention provides a method and a device for verifying the security information label structure that can be verified offline.
  • the source of the information label can be verified to use the information label safely and reliably.
  • the security information tag using the construction verification method and apparatus of the present invention has the following advantages:
  • the information of the security information label cannot be falsified, forged or denied
  • Any modification of the information encoded by the security information label cannot be verified by security, and the integrity and consistency of the encoded information can be guaranteed.
  • a third party cannot forge the information source to generate a security information label, and the publisher cannot deny the true source of the security information label.
  • the security information label can be verified offline
  • the integrity, consistency, and authenticity of the information source of the security information tag can be verified offline without connecting to the network. It can also be safely applied in an environment where there is no network or is not convenient for Internet access.
  • the security information label can publish public information read by the public can also publish private information read by a specific user;
  • the security information tag can publish a public information security information tag read by the public. It can also publish private information read by a specific one or more users and a mixed information security information tag, and can verify its security offline. At the same time, the private information security information label is also non-replicable based on the above security. It can only be verified by the specific user specified by the publisher. Other third parties cannot read the content or use the application credentials to copy and clone the private information.
  • the information tag has no practical meaning.
  • Figure 2 is a structural view of the structure verification device of the present invention.
  • Embodiment 3 is a public information security two-dimensional code generated by Embodiment 1 of the present invention.
  • Embodiment 4 is a public information security two-dimensional code generated in Embodiment 2 of the present invention.
  • Embodiment 5 is a public information security two-dimensional code generated in Embodiment 3 of the present invention.
  • Embodiment 8 is a mixed information security two-dimensional code generated in Embodiment 6 of the present invention.
  • FIG. 1 and FIG. 2 The method and device for verifying the security information tag structure that can be offline verified according to the embodiment of the present invention are shown in FIG. 1 and FIG. 2 .
  • the coded information may include any combination of basic information, extended information, target information, and dynamic information.
  • the basic information is generally fixed information such as the publisher's URL, name, and so on. Dynamic information is generated according to the needs of specific applications, such as information generation time, expiration date, transaction number, transaction amount, application parameters and other information.
  • the target information may include information such as a network address, text information, and the like.
  • the extended information is any one of the document number and the contact information; the type information is any one of public information, private information, and mixed information.
  • This function is constituted by an information input unit and an information storage unit in the apparatus of the present invention.
  • the digital signature operation uses an asymmetric public key cryptosystem such as an ECC elliptic curve cryptosystem, a DSA cryptosystem, or an RSA cryptosystem.
  • the asymmetric key cryptosystem uses a pair of key pairs of public and private keys for digital signature verification and encryption and decryption operations; the private key is stored by the key owner and can only be accessed by the owner; the public key is publicly released by the public medium, The public is freely available; generally, the key issuing authority uses its own root certificate to sign the public key and the information such as the owner and the issuer and then publish it as a digital certificate; the public key and the digital certificate are used for encryption and signature verification operations, and the private key is used for the private key. Decryption and digital signature operations.
  • the verification authority specified by the certificate issuing authority root certificate can verify the validity of the certificate, and generate certificate status validity information within a set time period; when applying the digital certificate
  • the validity information shall be checked whether the time limit has expired. If the time limit has expired, the certificate authority designated by the certificate issuing authority shall update the certificate validity information.
  • the digital signature operation consists of two steps: (1) using the commonly used hash functions such as MD5, SHA1, SHA256, etc., to calculate the hash value of the information to be encoded, to form the fingerprint data of the information to be encoded; (2) to use the private key of the publisher Sign the fingerprint data of the information.
  • hash functions such as MD5, SHA1, SHA256, etc.
  • the elliptic curve public key cryptosystem has a shorter key length and faster computational speed.
  • the method of the present invention preferably uses an ECC elliptic curve cryptosystem for digital signature operations.
  • the method of the invention can perform digital signature operation only on the input information, and can also perform digital signature operation on all the combined information.
  • the information encryption operation uses a symmetric key cryptosystem such as AES, 3DES, RC4, IDEA, or an asymmetric public key cryptosystem such as ECC or RSA, and an encryption method combining asymmetric ciphers and asymmetric ciphers such as ECDH and ECIES.
  • a symmetric key cryptosystem such as AES, 3DES, RC4, IDEA, or an asymmetric public key cryptosystem such as ECC or RSA
  • ECC public key cryptosystem
  • RSA public key cryptosystem
  • the present invention preferably uses an AES symmetric encryption method and an ECC asymmetric encryption method.
  • the invention encrypts the information to be encoded when constructing the private information security two-dimensional code read by a specific user; and constructing the public information security two-dimensional code does not need to perform the information encryption operation.
  • the symmetric key algorithm is used for encryption.
  • a specific user has an asymmetric key pair issued by the key issuing authority, a symmetric key or asymmetric may be used. Keys and encryption methods that combine symmetric and asymmetric ciphers.
  • the method of the present invention can perform only the encryption operation on the input information, and can also perform the encryption operation on all the combined information.
  • the present invention can adopt the following two encryption methods: (1) encrypting the information to be encrypted with a symmetric key specified by a specific user or its public key; and (2) using the first symmetric generated by the user's public key or randomly generated.
  • the key pair encrypts the encrypted information and encrypts the first symmetric key used with a symmetric key specified by the specific user or its public key.
  • the encryption method (2) is used, the two-dimensional code of the private information read by one or more specified users can be generated, and the encryption algorithm parameter stores the symmetric key specified by each specific user or its public key pair first symmetric key.
  • the ciphertext that the key encrypts; when the constructed private information security QR code only needs to be read by a specific user, one of the two encryption methods can be arbitrarily selected.
  • This function is composed of a digital signature and information encryption operation unit, a security information storage unit, an information input unit, and an information storage unit in the apparatus of the present invention.
  • the combination information includes the input information, the encryption information, the digital signature, the digital certificate and the validity information thereof in steps 1 and 2;
  • the two-dimensional code type to be published is a public information or a private information two-dimensional code adopts different combinations;
  • the information such as the security QR code identification, type, combination, and compression mode is stored in the combined information header.
  • the information to be encoded is public information that can be read by any user: the input information, the digital signature, the digital certificate, and the validity information thereof are connected by a separator symbol to form combined information.
  • the encrypted information, the digital signature, the digital certificate and the validity information of the input information are connected by a delimiter symbol to form a combined information; or the input information and the digital signature are first input.
  • the digital certificate and the validity information thereof are connected by a delimiter symbol, and then the connected information is encrypted and operated, and the encrypted information is used as the combined information;
  • the extended information is independently signed and encrypted; the extended information and other information other than the extended information Can be read by different categories of users.
  • the combined information may be compressed or Base64 encoded
  • This function is composed of a combined information construction arithmetic unit, an information storage unit, and a digital certificate storage unit in the apparatus of the present invention.
  • QR code, Data Matrix, Maxi Code, PDF417 and other common two-dimensional code encoding methods are used to encode the combined information by using different size codes or multi-code forms to generate a secure two-dimensional code that can be verified offline.
  • a secure two-dimensional code identification graphic can be embedded in the generated two-dimensional code graphic.
  • This function is composed of a two-dimensional code encoding operation unit, an information storage unit, an image display, and an information output unit in the apparatus of the present invention.
  • the public information security QR code can be read by any user, and the public combination information is identified according to the two-dimensional code encoding rule; the private information security two-dimensional code can only be read and identified by the specified user to obtain the encrypted combined information.
  • the input of the security two-dimensional code can be transmitted by optical image scanning mode; when the optical imaging conditions are insufficient, the information transmission method such as Bluetooth radio frequency can also be adopted.
  • This function is composed of an image scanning unit, an information input unit, a two-dimensional code recognition arithmetic unit, and an information storage unit in the apparatus of the present invention.
  • the first combination information is first restored by decompression or Base64 decoding
  • the combined information is decomposed into individual independent information according to the delimiter symbol during deconstruction;
  • the decomposed first decomposes the combined information into individual independent information according to the delimiter symbol, and then uses the specific user private key or its specified according to the encryption algorithm parameter in the ciphertext information.
  • the symmetric key decrypts the ciphertext information to obtain the original input information;
  • the private information security two-dimensional code and the complete combination information are encrypted.
  • the encrypted information is decrypted according to the encryption algorithm parameter in the ciphertext information, and the decrypted combined information is decomposed into independent information by the delimiter symbol.
  • the specific user can separately decrypt and verify the extended information; other users cannot decrypt the extended information;
  • This function is composed of a combined information analysis deconstruction operation unit, an information decryption operation unit, an information input unit, an information storage unit, and a digital certificate storage unit in the apparatus of the present invention.
  • the digital certificate is used to verify the publisher's digital certificate validity information with the digital certificate issuing authority and its designated certificate validity authority, and the digital information is used to verify the input information and the digital signature.
  • the fingerprint data of the digital certificate is calculated by the same hash algorithm, and compared with the fingerprint data in the validity information to determine whether it is consistent; according to the signature algorithm in the validity information of the digital certificate Parameters, using the hash algorithm to calculate the hash value of the validity information, using the signature algorithm and the certificate authority of the certificate validity verification authority to verify the signature; determining the input dynamic information according to the time limit of the validity information of the digital certificate Whether the generation time is within the generation time and expiration time of the validity information; if all the above tests pass, the digital certificate is a valid certificate.
  • This function is composed of a digital signature verification operation unit, an information storage unit, a root certificate storage unit, and a digital certificate storage unit in the apparatus of the present invention.
  • the secure QR code is verified correctly, and the source of the encoded information is trusted. Otherwise, the source of the information is not trusted; for verifying the correct secure QR code, the encoded information and the QR code are displayed.
  • the publisher information allows application operations related to the QR code; otherwise the source of the QR code is not trusted, and the application operation associated with the QR code is rejected.
  • This function is composed of a result output information presenting unit and an information storage unit in the apparatus of the present invention.
  • the names, keys, certificates, and the like of the key issuing center, the publisher, the specific user, and the like in the embodiment are exemplary data.
  • the private key information is also listed in the embodiment; in the actual application, the private key information is stored in the secure storage area, and only the owner can access it.
  • the ECC asymmetric cryptosystem and the AES symmetric cryptosystem are preferably used in the embodiment; the ECC adopts the NIST-recommended prime domain 256-bit standard elliptic cipher curve; the remaining asymmetric public key cryptosystem Similar to the application of the symmetric key cryptosystem, it is only necessary to simply replace the corresponding signature verification and encryption and decryption operations, which will not be described in detail in the embodiments.
  • a public information security QR code that can be read by the public user is generated, and the user can safely scan the code and access the online banking system.
  • the information to be encoded includes basic information, target information, and dynamic information.
  • the basic information is: Base: ⁇ Name: ABC Bank ⁇
  • the target information is: OBJ: ⁇ URI: https://www.abc.com ⁇
  • the dynamic information is: DYN: ⁇ Created: 2016-1-1 12:00:00
  • the type information is a public information security QR code.
  • the private key of the publisher ABC Bank is:
  • the ECDSA signature algorithm is used to perform digital signature calculation on the hash value with the publisher private key, and the signature result is performed.
  • Base64 encoding, getting the digital signature in text format is shown in Table 2.
  • the two-dimensional code constructed in this embodiment is a public information security two-dimensional code, and no encryption operation is performed.
  • the digital certificate of the publisher ABC Bank is shown in Table 3.
  • the digital certificate validity information is shown in Table 4.
  • Expired:2016-1-15 00:00]sha256ECDSA:MEUCIQDna4d8UCzwdRsAOMLRNfw332bfodiQ6gFMPP+6/PYAMAIgbWzfEtARWlxFp4s2427Z9OhCCwefUryCXc98ZGX+Wfk ⁇
  • the security QR code identification, type, combination, and compression mode information are:
  • SQR is the security QR code identifier
  • P is the public information QR code
  • 01 is the compression combination mode
  • 00 For alternate information bits.
  • the QR code format is used to encode the combined information into a two-dimensional code to form a two-dimensional code pattern.
  • a secure two-dimensional code identification graphic can be embedded in the generated two-dimensional code graphic; whether the identification graphic is embedded in the two-dimensional code does not affect the verification and security of the secure two-dimensional code.
  • the secure two-dimensional code as shown in FIG. 3 is scanned and decoded according to the QR encoding rule to obtain combined information as shown in Table 5.
  • the combination information is analyzed and deconstructed by connecting the symbols with vertical lines and parentheses, and the input information, digital signature, digital certificate and the like as shown in Table 1 - Table 4 are obtained. Its validity information.
  • This embodiment is a public information two-dimensional code that does not require a decryption operation.
  • the root certificate of the digital certificate issuing authority and its designated certificate validity verification institution is shown in Table 6 and Table 7.
  • the root certificates shown in Tables 6 and 7 are stored in the trusted root certificate storage area of the verification device.
  • the hash data of the digital certificate information is calculated as:
  • the signature information in the digital certificate validity information is:
  • the hash value of the digital certificate validity information calculated using the SHA256 hash algorithm is:
  • the time limit for digital certificate validity information is shown in Table 4: 2016-1-1 00:00 to 2016-1-15 00:00; the generation time in the input dynamic information is as shown in Table 1: 2016-1-1 12:00:00; the input information generation time is within the time limit of the validity information;
  • the validity of the digital certificate may also use the above-mentioned preferred offline verification method, and the certificate validity verification authority specified by the certificate issuing authority root certificate performs online verification; when the offline verification method is used to verify the validity of the certificate, the certificate in the combined information
  • the validity information may be omitted or only the certificate hash value may be retained;
  • the publisher's digital certificate is a valid certificate.
  • the hash and signature algorithm parameters in the digital signature are sha256ECDSA, as shown in Table 2.
  • the sha256 hash algorithm is used to calculate the input information hash data as:
  • Publisher digital certificate owner CN name is ABC Bank SQR Certificate, enter the basic information name ABC Bank, which is the security QR code special certificate of the organization ABC Bank; the effective time limit for inputting dynamic information is shown in Table 1: 2016-1-1 12:00:00 to 2026-1-1 12:00:00, the current time is within the valid time limit for entering information;
  • the above digital certificate, input information and digital signature are all verified correctly.
  • the security QR code is verified correctly and the source of the encoded information is trusted. Display input information and QR code publisher information, prompting QR code by ABC Bank released, allowing access to online banking websites. If the security QR code has undergone any tampering or forgery, it will not pass the above security verification, indicating that the security QR code may be tampered with or forged, and the access to the encoding related website is denied.
  • the payment platform for the taxi mobile payment application, generates a public information security QR code that can be read by the public user for each taxi operator, and the passenger can safely scan the code to pay the rental fee.
  • the information to be encoded includes basic information, target information, and dynamic information.
  • the basic information is: Base: ⁇ TaxiID: Shanghai A12345
  • the target information is: OBJ: ⁇ URI: https://sqr.abcpay.com/zrk1rjziurlr2w3ira ⁇
  • the dynamic information is: DYN: ⁇ Created:2016-1-1 12:00:00
  • the type information is a public information security QR code.
  • the encoded information needs to include multi-byte character Chinese characters, and the information encoding uses UTF-8 encoding.
  • This embodiment uses another possible combination form to sign the complete combined information.
  • the digital signature process is incorporated into step 3 for illustration.
  • the two-dimensional code constructed in this embodiment is a public information security two-dimensional code, and no encryption operation is performed.
  • the information of the security QR code identification, type, combination and compression method is: SQR . P0200
  • SQR is the security QR code identifier
  • P is the public information QR code
  • 02 is the signature of the overall information
  • 00 For alternate information bits.
  • the digital certificate and its validity information are the CERT and VALID parts respectively.
  • the private key of the publisher ABC Pay is:
  • the sha256ECDSA signature algorithm is used to perform digital signature calculation on the hash value with the publisher private key, and the signature result is performed.
  • Base64 encoding, getting the digital signature in text format is shown in Table 10.
  • the QR code format is used to encode the combined information into a two-dimensional code to form a two-dimensional code pattern, as shown in FIG.
  • the secure two-dimensional code as shown in FIG. 4 is scanned and decoded in accordance with the QR encoding rule to obtain combined information as shown in Table 11.
  • the combination information is analyzed and deconstructed through vertical lines and parentheses, and the input information, the digital certificate, the validity information and the digital signature information are obtained.
  • This embodiment is a public information two-dimensional code that does not require a decryption operation.
  • the overall information signature combination method is adopted.
  • the above steps complete the information combination and the deconstruction operation.
  • the digital certificate validity and the input information verification step are the same as those in the first embodiment.
  • the device of the present invention When the user pays, the device of the present invention generates a public information security QR code including the name, date, amount, and effective time of the payment merchant in real time, and the user scans the code to securely pay.
  • the information to be encoded includes basic information, target information, and dynamic information.
  • the basic information is: Base: ⁇ Name: ABC Mall
  • the target information is: OBJ: ⁇ URI: https://pay.abcpay.com/dkri67zin9oo8tzxy9ojquz8mcaedhzcljix1jeu ⁇
  • the dynamic information is: DYN: ⁇ Created:2016-5-1 12:00:00
  • the type information is a public information security QR code.
  • the private key of the publisher ABC Mall is:
  • the two-dimensional code constructed in this embodiment is a public information security two-dimensional code, and no encryption operation is performed.
  • the information of the security QR code identification, type, combination and compression method is: SQR . P0100
  • the QR code format is used to encode the combined information into a two-dimensional code to form a two-dimensional code pattern, as shown in FIG.
  • Embodiments 1 and 2 have detailed the construction verification process of two different combinations.
  • the verification procedure of this embodiment is the same as that of Embodiment 1, and reference may be made to Embodiment 1, and the detailed description is not repeated.
  • the secure QR code is verified correctly and the source of the encoded information is trusted.
  • the input information and the QR code publisher information are displayed, indicating that the QR code source is trusted, and the scan code payment operation is allowed. If the security QR code has undergone any tampering or forgery, it will not pass the above security verification, indicating that the security QR code may be tampered with or forged, the publishing source is not trusted, and the payment operation is refused.
  • ABC Mall's payment certificate is issued by ABC Pay, ABC Pay.
  • the certificate is issued by the issuing center's root certificate.
  • the method of the invention can verify the digital certificate of the multi-level issuing institution offline, and the combined information only needs to include the digital certificate information of the publisher terminal.
  • the validity of the certificate chain is periodically updated by the validity verification mechanism specified by the issuing institution root certificate by the constructing device of the present invention, and the verification device performs offline verification by using the certificate validity information in the combined information.
  • the multi-level certificate structure of the embodiment can also be used, and the secure payment two-dimensional code including the rental car fee and the like can be generated in real time by the device of the present invention, and the passenger can verify the security scan code payment offline.
  • the musical instrument manufacturing enterprise generates a private information security QR code for each product produced and sold, and the user scans the security QR code to identify the purchased product as a genuine or counterfeit product.
  • the information to be encoded includes basic information, target information, and dynamic information.
  • the basic information is: Base: ⁇ Name: ABC Instrument ⁇
  • the target information is: OBJ: ⁇ URI: https://product.abcinstrument.com/e92eab1319a8cde0dc61636a2ffc8eeb918a554b ⁇
  • the dynamic information is: DYN: ⁇ InstrumentID: DH698JM12345678
  • the type information is a private information security QR code.
  • the private key of the publisher ABC Instrument is:
  • the ECDSA signature algorithm is used to perform digital signature calculation on the hash value with the publisher private key, and the signature result is performed.
  • the manufacturer generates a product feature verification security two-dimensional code when the product production line has not been sold yet. At this time, each product does not have a specific user correspondence, and cannot be encrypted by using a specific user's public key or its specified symmetric key.
  • a randomly generated symmetric key is used in the embodiment, as shown in Table 17. This random password can be created on the product quality certificate together with the generated secure QR code using the password area coating method.
  • the AES128 symmetric key algorithm is used to perform the encryption operation on the information to be encoded shown in Table 15 using the key shown in Table 17.
  • the ciphertext information of the Encrypted operation result after Base64 encoding is as shown in Table 18.
  • the information of the security QR code identification, type, combination and compression method is: SQR . R0100
  • R is the private information security QR code.
  • the QR code format is used to encode the combined information into a two-dimensional code to form a two-dimensional code pattern, as shown in FIG. 6.
  • the security two-dimensional code shown in FIG. 6 in the scan quality certificate is decoded according to the QR encoding rule, and the combined information as shown in Table 19 is obtained.
  • the combination information is analyzed and deconstructed through vertical lines and parentheses to obtain ciphertext information, digital signature, digital certificate and validity information.
  • the ciphertext information is decrypted using the random symmetric key obtained in the quality certificate obtained by the manufacturer, and the ciphertext information is decrypted to obtain the input information as shown in Table 15.
  • the private information is used for the two-dimensional code type, and the input information is encrypted.
  • the main difference is the encryption and decryption processing and the combined deconstruction processing operation.
  • the digital certificate validity and the input information verification step are the same as those in the first embodiment, and can be implemented by reference. Example 1 is implemented and will not be repeated.
  • the secure QR code is verified correctly and the source of the encoded information is trusted.
  • Display input information and QR code publisher information suggest that the QR code source is trusted, allow access to the address published by the manufacturer to view the feature picture corresponding to the instrument and compare with the purchased instrument, and compare the instrument characteristics in the QR code information.
  • the hash value of the image matches the hash value displayed in the URL image to confirm that the purchased item is genuine. If the security QR code has undergone any tampering or forgery, it will not pass the above security verification, suggesting that the security QR code may be tampered with or forged, the publishing source is not trusted, and the URL encoded in the QR code is denied access.
  • the purchased product is Product.
  • the private information security QR code that expresses the identification information such as the performance time and the seat position is generated on the tickets of the performances sold by the organization.
  • the user scans the security QR code to verify the authenticity of the ticket.
  • the company scans the security QR code to achieve fast and safe security. Checking tickets to prevent counterfeit tickets from causing economic losses to users and companies.
  • the information to be encoded includes basic information, target information, and dynamic information.
  • the basic information is: Base: ⁇ Name: ABC Inc
  • the target information is: OBJ: ⁇ TXT: ABC Inc Ticket, Seat 15F, Room A1, 2016-1-10 12:00 ⁇
  • the dynamic information is: DYN: ⁇ TicketSN: 10001234
  • the type information is a private information security QR code.
  • the private key of the publisher ABC Inc is:
  • the ECDSA signature algorithm is used to perform digital signature calculation on the hash value with the publisher private key, and the signature result is performed.
  • Base64 encoding, getting the digital signature in text format is shown in Table 21.
  • the embodiment adopts a two-layer encryption form, and the generated private information security two-dimensional code can be read and recognized by two designated users of the company and the ticket purchase user.
  • the randomly generated first symmetric key is used.
  • the AES128 algorithm is used to encrypt the information to be encoded shown in Table 20.
  • the first ciphertext information after the Base64 encoding of the encryption operation result is shown in Table 23.
  • the symmetric key set when the user purchases a ticket is shown in Table 25.
  • the first symmetric key is encrypted by the AES128 symmetric key algorithm, and the ciphertext information after the Base64 encoding is shown in Table 26.
  • the algorithm parameters and ciphertext information of the above two levels of encryption are connected by a vertical line and a parenthesis, and the ciphertext information of the present embodiment is shown in Table 27.
  • abcinc Elgamal: A0vrl0wByM6LGRA6xxY7RgEUPiSUO6qE + Nm9Z1BoSotaA3Hqw / LHWfVPmLb5S7hh + Eyq / gWaaFpWL + FchLTDE7jU
  • user1: aes128cbc: U2FsdGVkX19nk + kW2oaV0Xzb2VdIlNReTITwxZURkuU [aes128cbc: U2FsdGVkX1 + bVU4RDHGr6FAVxpNqEnRFf3Y5XEoGpkkzHujSgw6g1yVXASsXSYWTHYDeJMNNwgvuu57w1GXvtpM1fxrX // WmEpE5bF3w7VdV4m68AR88kJB55
  • the information of the security QR code identification, type, combination and compression method is: SQR . R0100
  • R is the private information security QR code.
  • the digital certificate and its validity information are the CERT and VALID parts respectively.
  • the QR code format is used to encode the combined information into a two-dimensional code to form a two-dimensional code pattern, as shown in FIG.
  • the secure two-dimensional code as shown in Fig. 7 is scanned and decoded in accordance with the QR encoding rule to obtain combined information as shown in Table 28.
  • the combination information is analyzed and deconstructed through vertical lines and parentheses to obtain ciphertext information, digital signature, digital certificate and validity information.
  • ABC Inc scans the security QR code on the user's ticket, using ABC Inc.'s private key and Elgamal algorithm perform ECC asymmetric key decryption operation on the ciphertext information corresponding to abcinc in the ciphertext information as shown in Table 24, and obtain the first symmetric key as shown in Table 22;
  • the first symmetric key decrypts the first ciphertext information as shown in Table 23 in the ciphertext information, and obtains the input information as shown in Table 20.
  • the user can also input the symmetric key set by the user, and then perform the decryption process in the same process as the user, and obtain the input information as shown in Table 20.
  • the two-dimensional code type of the private information is used, and the input information is encrypted by the two-layer encryption method.
  • the main difference is the encryption and decryption processing and the combined deconstruction processing operation, and then the digital certificate validity and the input information verification step and the embodiment 1
  • the implementation of Embodiment 1 can be referred to, and the detailed description is not repeated.
  • the digital certificate, input information and digital signature are all verified correctly.
  • the security QR code is verified correctly and the source of the encoded information is trusted.
  • the input information and the QR code publisher information are displayed, and the source code of the QR code is trusted, and the ticket is true and can be admitted. If the security QR code has undergone any tampering or forgery, the above security verification cannot be passed, indicating that the security QR code may be tampered with or forged, the source of the distribution is not trusted, the ticket is forged, and the admission is refused.
  • the train ticket generates a safety information QR code for easy ticket checking and verification of passenger status. Tickets such as departure time and seat number of the ticket have been printed on the ticket surface for public information; however, the name and ID card information of the real-name ticket-purchasing user are private information, and the use of public forms such as dropping the ticket after boarding may result in passengers. Privacy information is leaked. Therefore, this embodiment adopts a hybrid information security two-dimensional code type.
  • the hybrid information security QR code is based on the public information security two-dimensional code and the private information security two-dimensional code, and performs separate signature verification and encryption and decryption operations on the extended information in the input information.
  • the algorithm and the processing flow are basically the same. This embodiment will not repeat the same processing procedure, and only the combination information of the different parts and the operation result and the security two-dimensional code pattern are given.
  • the input information is:
  • the EXT part is extended information.
  • the private key of the publisher XYZ Inc is:
  • the EXT information is signed by the sha256ECDSA algorithm, and the signature information is:
  • the obtained ciphertext information is:
  • the hybrid information security QR code can also be constructed on the basis of the private information QR code, and only the specific user can decrypt the verification extension information.
  • the signature verification and encryption and decryption operations of the extended information may also adopt other symmetric keys and asymmetric key algorithms according to the present invention, and will not be further described.
  • Some conventional modified application forms can cache the digital certificate in the digital certificate storage area of the verification device, and the two-dimensional code combination information.
  • the digital certificate part can be omitted; in the case where the shape of the distribution area is limited, it can be distributed in a multi-code format; under the condition that the optical scanning imaging is not satisfied at night or high-speed movement, the transmission mode can be realized by Bluetooth radio frequency wireless transmission or the like. Transmission of code information.
  • Embodiment 7 of an offline verification secure two-dimensional code structure verification apparatus according to the present invention, and is related to Embodiment 1-6.
  • An information input unit S301 configured to input information to be encoded and type information
  • a security information storage unit S302 configured to securely store private key information
  • An information storage unit S303 configured to store input information and operation result information in the device
  • a digital certificate storage unit S304 configured to store the digital certificate and its validity information in the constructing device
  • a digital signature and information encryption operation unit S305 configured to calculate a digital signature, update digital certificate validity information, and encrypt information
  • the coding operation unit S306 is configured to construct combined information and perform information tags such as two-dimensional codes. Coding operation
  • the image display information output unit S307 is configured to display and output the secure two-dimensional code information
  • An image scanning information input unit S401 configured to scan and input secure two-dimensional code information
  • a root certificate storage unit S402 configured to store a key issuing authority and a root certificate of the specified validity verification institution
  • the information storage unit S403 is configured to store the input information and the operation result information in the verification device
  • a digital certificate storage unit S404 configured to verify, in the verification device, the digital certificate and the validity information thereof;
  • Digital signature verification and information decryption unit S405 for digital signature verification of information decryption and digital certificate validity and input information
  • Information tag such as two-dimensional code, identification and combination information analysis deconstruction operation unit S406, for information tags such as two-dimensional code Code recognition and analysis and deconstruction of combined information;
  • the result output information prompting unit S407 is used for the secure two-dimensional code verification result output and the information prompt.
  • the device can be divided into two independent sub-devices: a construction device and a verification device, wherein the construction device is composed of S301-S307 Unit composition, verification device by S401-S407 Unit composition; can also be implemented as a device, including all of the above units, wherein the units for information input, information storage, and information display in the construction and verification sub-devices can be combined to share the same unit.
  • Information input unit S301 and image scanning information input unit S401 can be realized by common components such as keyboard, touch screen, camera, scanner, etc.
  • the security information storage unit S302 can use secret information such as a secure storage chip, a smart card, an FPGA built-in ROM storage area, and the like to store private key information.
  • the secure memory chip needs to cooperate with an external computing unit to operate and read and write a secure memory chip in an encrypted manner, and the security is relatively low; the smart card or the FPGA chip can be stored in the chip with its own internal computing unit, only the private key operation is performed. The input and output of the calculation data and the operation result are performed, and the private key information cannot be read from the chip, and the security of the private key information can be ensured.
  • the information storage units S303, S403, the digital certificate storage units S304, S404, and the root certificate storage unit S402 can be implemented by using a general-purpose storage unit.
  • the method of signature verification, encryption and decryption, combination deconstruction and the like in the embodiments 1-6 can be implemented by using a general-purpose CPU or a GPU operation unit, or by using a DSP, an FPGA, a CPLD, or an ASIC chip.
  • the image display information output unit S307 and the result output information presentation unit S407 can be implemented using a general-purpose liquid crystal panel, a touch screen, a buzzer, an audio output unit, and the like.
  • the method of the invention can be widely used in electronic media, newspapers and magazines, commodity packaging, warehousing logistics, personal business cards, transportation tickets, certificate documents, mobile advertisements, social APPs, online shopping transactions, online banking payments, mobile payment, etc., Internet of Things, mobile Internet related applications
  • the implementation is simple and efficient, the application cost is low, and the industrial use value is high.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本发明实施例提供了一种可离线验证安全信息标签的构造验证方法与装置，包括输入需编码信息和类型信息，根据信息发布类型对输入信息进行数字签名运算和加密运算，构造组合信息，按信息标签编码规则进行编码，生成可离线验证安全信息标签；输入安全信息标签信息并识别内含的组合信息和类型信息，根据信息标签类型信息分析解密组合信息，得到独立子信息，验证数字证书有效性信息、输入信息的数字签名以及输入信息的有效时限；全部验证通过则安全信息标签离线验证正确，其编码信息来源可信，否则其信息发布来源不可信。本发明安全信息标签具有不可篡改、伪造、否认，可发布公开或私密信息，无需网络连接即可离线验证信息标签信息完整性及其来源是否真实等有益效果。

Description

可离线验证安全信息标签构造验证方法与装置 技术领域
本发明涉及 信息技术和安全验证领域 ，特别是涉及一种可离线验证安全信息标签构造验证方法与装置 。
背景技术
本发明对常见信息标签如二维码、射频识别码等具有通用性，可无实质差别进行应用，为便于表述，文中仅以二维码为例进行说明，对其他信息标签类型不再赘述。
二维码是用若干个与二进制相对应的符号按一定规律在二维平面上分布来记录数据信息的特定几何图形。二维码使用图形符号来表示文字数值信息，符号表示技术方面已研制出多种码制，常见的有QR Code、Data Matrix、Maxi Code、PDF417等等。二维码通过图象输入设备或光电扫描设备进行识别，可以处理符号尺寸大小比例变化、图形旋转、局部污损缺失等常见问题实现编码信息的自动识别，具有编码信息容量大，容错纠错能力强，译码可靠性高，制作成本低，简单易用等特点。随着智能手机、平板电脑、互联网、移动网络、物联网等技术的普及，二维码作为一种信息存储、传递、识别和交互技术，在电子媒体、报纸杂志、商品包装、仓储物流、个人名片、交通车票、证书单据、移动广告、社交APP、网购交易、网银支付、移动支付等各个方面已得到广泛应用。传统的互联网以IP地址或域名网址为访问入口，但冗长的文本数字信息难以记忆和输入，容易因输入错误而导致无法访问或错误访问等问题。二维码编码信息容量大，可对文字、图片、声音等各类数据信息进行编码，其中应用最广泛的包括文本TXT类型、网址URI类型等。各类信息存储识别交互等应用主要都是基于这两种编码类型，尤其网络资源统一定位URI已成为移动互联时代的重要网络入口媒介，大量的商业平台、社交软件、银行网站、移动支付系统等都提供了自己的二维码入口。这些二维码可方便地发布于报纸、杂志、电视、地铁、公交等等广告区域，用户无需记忆和输入网址信息，只需要用智能手机扫描二维码即可进入URI指向的地址，访问相关网站平台或执行指定的支付交易。
二维码制作简单，任何单位和个人都可以制作和识读二维码信息。在具有简单易用优点的同时，安全性也成为二维码普及应用的一个主要障碍。带有恶意软件和病毒链接的二维码往往伪装成赠品、折扣、优惠等推广二维码，人们难以识别真假。如果误扫描这些二维码，就会导致下载木马病毒程序等，严重危害用户系统安全，可能导致用户个人信息泄露和经济损失。例如一些诈骗网站将其网址制作成二维码仿冒银行网上交易网站,用户如果误扫描此二维码并登录假冒网站，可能造成银行帐号和密码泄露。一些木马软件的下载网址被制作成二维码假冒成赠送礼品优惠等链接，如果误扫描下载可能导致用户隐私信息泄露，并对用户系统安全带来很大隐患。随着二维码的普及应用，其安全性也引起人们越来越多的关注。二维码的发布来源是否权威可信，是人们对扫码安全性的最大疑虑。二维码是明码编码，虽然具有信息容错性的冗余检验，但信息易被修改伪造，发布来源的验证比较困难。目前的验证方法包括两类：一是采用类似扫码卫士的应用系统，扫描识别出二维码信息后，通过网络连接应用系统的专用服务器，将二维码网址信息与服务器中数据库记录进行检索比对：如系统数据库中可检索到匹配记录，根据记录的属性可以给出此二维码来源是否安全；如果没有匹配的记录，则安全性无法判断。另一类则是对二维码信息进行加密，通过网络连接专用的服务器，读取其中的认证信息，与二维码中加密信息进行比对进行验证；此类应用为封闭式系统，加密密钥信息存储于专用服务器，二维码信息只能由内部专用系统输入解密，无法由大众用户自行读取和验证来源。
现有的二维码等信息标签安全性验证方法存在以下主要问题：需要通过网络连接服务器进行验证，在没有网络连接或不便进行网络连接的环境下无法验证；基于网址检索对比的验证方法，只能验证已经扫描输入验证过的二维码等标签信息，新生成的二维码等标签信息需要先加入数据库中才能进行验证。
为了解决现有二维码等信息标签安全性验证问题，本发明提出一种可离线验证的安全信息标签构造验证方法及装置，无需网络连接即可离线验证信息标签的发布来源，可安全放心的应用信息标签嵌入的信息。
在本发明中用到的对称密钥密码系统和非对称公钥密码系统，其基本原理方法可以参考以下公开文献：
[1] Christof Paar and Jan Pelzl. 深入浅出密码学-常用加密技术原理与应用. 清华大学出版社, 2015
[2] Tom St Denis and Simon Johnson. 程序员密码学.机械工业出版社，2007
其中，文献[1]主要涉及对称密钥以及非对称公钥密码系统的原理，文献[2]主要涉及对称密钥以及非对称公钥算法实现。
 技术问题
随着物联网、移动互联网以及智能终端的普及发展，二维码、射频识别码等信息标签应用日益普及，其安全性也日益引起重视，因为信息标签嵌入的信息被篡改或伪造而导致用户经济损失或隐私信息泄漏等事件频有发生。因信息标签固有的信息容量受限，信息标签均通过在线方式验证信息其安全性 ，存在着未经验证前需要连接网络以及没有网络连接时无法进行验证的不足。
 技术解决方案
有鉴于此，本发明实施例提供了一种可离线验证安全信息标签构造验证方法及装置，在无需网络连接的普遍适用环境下，即可验证安全信息标签的发布来源，以安全可靠的使用信息标签。采用本发明构造验证方法的信息标签，称之为安全信息标签。本发明对二维码、射频识别码等常见信息标签类型可无实质差别实施应用。以下仅以二维码为例进行说明。
根据编码的信息可被公众读取或仅供特定用户读取可以分为公开信息、私密信息和混合信息类型，分别称之为公开信息安全二维码、私密信息安全二维码和混合信息安全二维码。
本发明实施例第一方面提供一种可离线验证安全二维码构造验证方法，所述方法包括：
输入需编码的信息和类型信息；
对需编码信息进行数字签名运算、加密运算；
用输入信息、加密信息、数字签名、数字证书及其有效性信息构造组合信息；
对组合信息进行二维码编码，生成安全二维码；
输入安全二维码信息，按二维码编码规则识别内含的组合信息；
分析解密组合信息，得到输入信息、数字签名、数字证书及其有效性信息；
验证数字证书的有效性，并用数字证书验证输入信息和数字签名；
验证结果判断和信息输出提示 。
本发明实施例第一方面第一种可能的实现方式中,所述需编码信息和类型信息包括但不限于：
需编码信息为基本信息、扩展信息、目标信息、动态信息中的任意几种；
其中，基本信息为不随单次应用变化的名称、地址、域名信息中的任意几种；目标信息为目标网址、公示信息中的任意几种；动态信息为根据单次应用而变化的生成时间、有效时间、交易信息、应用参数信息中的任意几种；扩展信息为证件号码、联系方式信息中的任意几种；类型信息为公开信息、私密信息、混合信息中的任意一种。
本发明实施例第一方面第一种可能的实现方式中,所述组合信息包括但不限于：
输入信息、加密信息、数字签名、数字证书及其有效性信息；
其中，输入信息为输入的需编码的信息和类型信息；加密信息为用特定用户的公钥或者其指定的对称密钥对需编码信息加密后的密文以及加密算法参数信息，可以对输入信息或者整个组合信息进行加密运算；数字签名是用发布者私钥对需编码信息进行签名运算的结果，可以对输入信息或者整个组合信息进行数字签名运算；数字证书是由密钥签发机构数字签名认证的发布者身份及公钥证书；数字证书有效性信息是经密钥签发机构根证书指定的有效性验证机构签名认证的数字证书当前状态信息；
本发明实施例第一方面第一种可能的实现方式中,所述组合信息的构造组合及分析解构方法包括但不限于：
在组合信息头部保存安全二维码标识、类型、组合、压缩方式等信息；
当需要编码的信息为可供任何用户读取的公开信息时：将输入信息、数字签名、数字证书及其有效性信息通过分隔符号连接构成组合信息；解构时根据组合信息头部的类型和组合方式信息，通过分隔符号将组合信息分解为各个独立信息。
本发明实施例第一方面第一种可能的实现方式中,所述二维码编码识别和信息输入输出方法包括但不限于：
采用QR Code、Data Matrix、Maxi Code、PDF417中的任意一种编码识别方法；采用不同大小级别码制以及多码形式表示；生成的二维码图形中可以嵌入一个安全二维码标识图形；采用光学图像扫描信息传输以及光学成像条件不足时采用蓝牙射频无线信息传输方法。
本发明实施例第一方面第一种可能的实现方式中,所述验证和验证结果判断信息输出方法为：
用数字证书签发机构及其指定的证书有效性验证机构的根证书验证数字证书信息，并用数字证书信息验证输入信息和数字签名；验证方法优选使用离线验证方式，也可以使用指定的有效性验证机构验证的方式；数字证书、输入信息和数字签名全部验证正确，则安全二维码验证正确，编码信息来源可信，否则其信息发布来源不可信；对验证正确的安全二维码，显示编码信息和二维码发布者信息，允许进行与此二维码相关的应用操作；否则提示此二维码发布来源不可信，拒绝与此二维码相关的应用操作。
本发明实施例第一方面第二种可能的实现方式中,所述数字签名、签名验证、数字证书所用密码系统包括但不限于：
数字签名、签名验证、数字证书使用非对称公钥密码系统，采用ECC椭圆曲线密码系统、DSA密码系统、RSA密码系统中的任意一种；
本发明实施例第一方面第二种可能的实现方式中,所述信息加密、信息解密方法包括但不限于：
信息加密、信息解密使用对称密钥密码系统及非对称公钥密码系统，采用AES、3DES、RC4、IDEA、ECC、RSA、ECDH中的任意几种；用特定用户指定的对称密钥或其公钥及私钥对需加密信息进行加密和解密运算，或者用由用户公钥产生的或随机产生的第一对称密钥对需加密信息进行加密和解密运算，并用特定用户指定的对称密钥或其公钥及私钥对所用的第一对称密钥进行加密和解密运算。
本发明实施例第一方面第三种可能的实现方式中,所述组合信息的构造组合及分析解构方法包括但不限于：
在组合信息头部保存安全二维码标识、类型、组合、压缩方式等信息；
当需要编码的信息为只由特定用户读取的私密信息时：将输入信息的密文信息、数字签名、数字证书及其有效性信息通过分隔符号连接构成组合信息；解构时根据组合信息头部的类型和组合方式信息，先通过分隔符号将组合信息分解为各个独立信息，再根据密文信息中的加密算法参数对密文信息进行解密运算得到原始输入信息；也可以先将输入信息、数字签名、数字证书及其有效性信息通过分隔符号连接，再对连接后的信息进行加密运算，以加密信息作为组合信息；解构时根据组合信息头部的类型和组合方式信息，先通过密文信息中的加密算法参数信息对加密信息进行解密运算，再根据分隔符号将解密后的组合信息分解为各个独立信息。
本发明实施例第一方面第四种可能的实现方式中,所述组合信息的构造组合及分析解构方法包括但不限于：
在组合信息头部保存安全二维码标识、类型、组合、压缩方式等信息；
当需要编码的信息为可由多类用户读取的混合信息时：在公开信息或私密信息处理方法的基础上，对扩展信息进行独立的签名加密和验证解密处理；扩展信息及扩展信息之外的其它信息可分别由不同类别的用户读取。
本发明实施例第一方面第五种可能的实现方式中,所述组合信息的构造组合及分析解构方法包括但不限于：
在组合信息头部保存安全二维码标识、类型、组合、压缩方式等信息；
对于专用系统，数字证书可以缓存于验证装置的数字证书存储区，组合信息内可以省略数字证书信息或者只保留数字证书散列值信息；如果不使用离线验证方式，数字证书有效性信息可以省略或者只保留数字证书散列值信息。
对包含多字节字符的信息，可以采用UTF-8或者UTF-16形式的Unicode编码；
在组合信息构造完成后，再对组合信息进行压缩运算或者Base64编码；解构时先对压缩的组合信息进行解压缩运算或者Base64解码，再按其组合方式解构；
本发明实施例第二方面提供一种可离线验证二维码构造验证装置，所述装置包括：
信息输入单元，用于输入需编码信息和类型信息；
信息存储单元，用于存储输入信息及运算结果信息；
安全信息存储单元，用于安全存储私钥信息；
数字证书存储单元，用于存储数字证书及其有效性信息；
根证书存储单元，用于存储密钥签发机构及其指定有效性验证机构的根证书；
数字签名和信息加密运算单元，用于计算数字签名、更新数字证书有效性信息和信息加密；
组合信息构造及二维码编码运算单元，用于构造组合信息并进行二维码编码运算；
图像显示信息输出单元，用于显示和输出安全二维码信息；
图像扫描信息输入单元，用于扫描和输入安全二维码信息；
二维码识别及组合信息分析解构运算单元，用于二维码编码识别并对组合信息进行分析解构运算；
数字签名验证和信息解密单元，用于信息解密和数字证书有效性及输入信息的数字签名验证；
结果输出信息提示单元，用于安全二维码验证结果输出和信息提示。
本发明实施例第二方面第一种可能的实现方式中, 所述运算单元、签名单元、验证单元的运算功能为:
本发明第一方面安全二维码构造验证方法所述运算。
本发明实施例第二方面第一种可能的实现方式中,所述运算单元、签名单元、验证单元、存储单元及安全存储单元的构造方法包括但不限于：
通用用途存储及运算器件、DSP芯片、FPGA芯片、CPLD芯片、ASIC芯片中的任意几种。
以上解决方案仅以二维码为例进行说明。本解决方案对其它常见信息标签类型可无实质差别进行实施应用，不再重复说明。
有益效果
由上述内容可知，本发明具有以下有益效果：
本发明实施例提供了一种可离线验证安全信息标签构造验证方法及装置，在无需网络连接的普遍适用环境下，即可验证信息标签的发布来源，以安全可靠的使用信息标签。采用本发明构造验证方法及装置的安全信息标签具有以下优点：
1 、安全信息标签编码信息无法篡改、伪造、否认；
对安全信息标签编码的信息的任何修改都不能通过安全性验证，可以保证编码信息的完整性和一致性。第三方无法伪造信息发布源生成安全信息标签，同时发布者也无法否认安全信息标签的真实发布源。
2 、安全信息标签可离线验证其安全性；
不需要连接网络即可离线验证安全信息标签的信息完整性、一致性和信息来源的真实性。在没有网络或不便于上网的环境下也可以安全应用。
3 、安全信息标签可以发布由公众读取的公开信息也可以发布由特定用户读取的私密信息；
根据应用需要，安全信息标签可以发布由公众读取的公开信息安全信息标签也可以发布由特定一个或多个用户读取的私密信息以及混合信息安全信息标签，并且可以离线验证其安全性。同时私密信息安全信息标签在以上安全性的基础上，还具有不可复制性，其只能由发布者指定的特定用户访问验证，其他第三方无法读取内容或作为应用凭据，复制克隆私密信息安全信息标签没有实际意义。
 附图说明
图 1 是本发明构造验证方法的流程图；
图 2 是本发明构造验证装置的结构图；
图 3 是本发明实施例 1 生成的公开信息安全二维码；
图 4 是本发明实施例 2 生成的公开信息安全二维码；
图 5 是本发明实施例 3 生成的公开信息安全二维码；
图 6 是本发明实施例 4 生成的私密信息安全二维码；
图 7 是本发明实施例 5 生成的私密信息安全二维码；
图 8 是本发明实施例 6 生成的混合信息安全二维码；
 本发明的最佳实施方式
本发明实施例公开的可离线验证安全信息标签构造验证方法与装置，如图1和图2所示。
以二维码信息标签为例，实施步骤如下：
1 、输入需要编码的信息和类型信息
需编码信息可以包括基本信息、扩展信息、目标信息和动态信息中的任意组合。基本信息一般为发布者的网址、名称等固定信息。动态信息根据具体应用的需要生成，例如信息生成时间、有效期限、交易编号、交易金额、应用参数等信息。目标信息可以包括网络地址、文本信息等类型的信息。扩展信息为证件号码、联系方式信息中的任意几种；类型信息为公开信息、私密信息、混合信息中的任意一种。
此功能由本发明装置中的信息输入单元和信息存储单元构成。
2 、对需编码信息进行数字签名运算、加密运算
数字签名运算使用ECC椭圆曲线密码系统、DSA密码系统、RSA密码系统等非对称公钥密码系统。非对称密钥密码系统使用公钥和私钥一对密钥对进行数字签名验证和加密解密运算；私钥由密钥拥有者保存，只有拥有者可以访问；公钥采用公众媒介公开发布，可由公众自由获取；一般由密钥签发机构用自身根证书将公钥以及拥有者和签发者等信息签名后以数字证书形式发布；公钥及数字证书用于加密及签名验证运算，私钥用于解密和数字签名运算。在应用数字证书时，需检验数字证书的当前状态是否有效；可由证书签发机构根证书指定的验证机构检验证书有效性，并生成在设定时间期限内的证书状态有效性信息；应用数字证书时，应检验有效性信息是否超出其设定时间期限，如已超出时间期限，则由证书签发机构指定的验证机构更新证书有效性信息。
数字签名运算包括两个步骤：（1）采用MD5、SHA1、SHA256等常用的散列函数，计算需编码信息的散列值，形成需编码信息的指纹数据；（2）用发布者的私钥对信息的指纹数据进行签名运算。
在同等密码强度下，椭圆曲线公钥密码系统具有更短的密钥长度和更快的运算速度，本发明方法优选使用ECC椭圆曲线密码系统进行数字签名运算。本发明方法可以只对输入信息进行数字签名运算，也可以对全部组合信息进行数字签名运算。
信息加密运算使用AES、3DES、RC4、IDEA等对称密钥密码系统或者ECC、RSA等非对称公钥密码系统以及ECDH、ECIES等结合对称密码和非对称密码的加密方式。在同等密码强度情况下，本发明优选使用AES对称加密方法和ECC非对称加密方法。
本发明在构造由特定用户读取的私密信息安全二维码时，对需编码信息进行加密运算；构造公开信息安全二维码不需要进行信息加密运算。当特定用户没有密钥签发机构签发的非对称密钥对时，采用对称密钥算法进行加密；当特定用户具有密钥签发机构签发的非对称密钥对时，可以选用对称密钥、非对称密钥以及结合对称和非对称密码的加密方法。本发明方法可以只对输入信息进行加密运算，也可以对全部组合信息进行加密运算。
本发明可以采用以下两种加密方式：（1）用特定用户指定的对称密钥或其公钥对需加密信息进行加密运算；(2)用由用户公钥生成的或随机生成的第一对称密钥对需加密信息进行加密，并用特定用户指定的对称密钥或其公钥对所用的第一对称密钥进行加密。采用加密方式(2)时，可以生成由一个或多个指定用户读取的私密信息二维码，加密算法参数里保存用每个特定用户指定的对称密钥或其公钥对第一对称密钥进行加密的密文；当构造的私密信息安全二维码只需由一个特定用户读取时，可以任意选用两种加密方式之一。
此功能由本发明装置中的数字签名及信息加密运算单元、安全信息存储单元、信息输入单元、信息存储单元构成。
3 、用输入信息、加密信息、数字签名、数字证书及其有效性信息构造组合信息
组合信息包括步骤1、2中所述的输入信息、加密信息、数字签名、数字证书及其有效性信息；根据需发布的二维码类型为公开信息或私密信息二维码采用不同组合方式；在组合信息头部保存安全二维码标识、类型、组合、压缩方式等信息。
当需要编码的信息为可供任何用户读取的公开信息时：将输入信息、数字签名、数字证书及其有效性信息通过分隔符号连接构成组合信息。
当需要编码的信息为只由特定用户读取的私密信息时：将输入信息的加密信息、数字签名、数字证书及其有效性信息通过分隔符号连接构成组合信息；或者先将输入信息、数字签名、数字证书及其有效性信息通过分隔符号连接，再对连接后的信息进行加密运算，以加密信息作为组合信息；
当需要编码的信息为可由多类用户读取的混合信息时：在公开信息或私密信息处理方法的基础上，对扩展信息进行独立的签名和加密运算；扩展信息及扩展信息之外的其它信息可分别由不同类别的用户读取。
组合信息构造完成后，可以再对组合信息进行压缩运算或者Base64编码；
此功能由本发明装置中的组合信息构造运算单元、信息存储单元、数字证书存储单元构成。
4 、对组合信息进行二维码编码，生成安全二维码。
采用QR Code、Data Matrix、Maxi Code、PDF417等常用二维码编码方法，采用不同大小级别码制或多码形式对组合信息进行编码，生成可离线验证安全二维码。生成的二维码图形中可以嵌入一个安全二维码标识图形。
此功能由本发明装置中的二维码编码运算单元、信息存储单元、图像显示、信息输出单元构成。
5 、输入安全二维码信息，按二维码编码规则识别内含的组合信息
公开信息安全二维码可由任何用户读取,按二维码编码规则识别得到公开的组合信息;私密信息安全二维码只能由指定的用户读取识别得到加密后的组合信息。安全二维码的输入可以采用光学图像扫描方式进行信息传输；在光学成像条件不足时也可以采用蓝牙射频无线等信息传输方法。
此功能由本发明装置中的图像扫描单元、信息输入单元、二维码识别运算单元、信息存储单元构成。
6 、分析解密组合信息，得到输入信息、数字签名、数字证书及其有效性信息
根据组合信息头部的二维码类型、压缩组合方式等信息：
如组合信息为压缩或Base64编码后信息，则首先通过解压缩或Base64解码还原为原有组合信息；
如为公开信息安全二维码，解构时根据分隔符号将组合信息分解为各个独立信息；
如为私密信息安全二维码并且只对输入信息加密，解构时先根据分隔符号将组合信息分解为各个独立信息，再根据密文信息中的加密算法参数，用特定用户私钥或者其指定的对称密钥对密文信息进行解密运算得到原始输入信息；
如为私密信息安全二维码并且对完整组合信息加密，解构时先根据密文信息中的加密算法参数对加密信息进行解密运算，再通过分隔符号将解密后的组合信息分解为各个独立信息。
如为混合信息安全二维码，在公开信息或私密信息安全二维码的基础上，特定用户可以单独对扩展信息进行解密和签名验证；其它用户不能解密扩展信息；
此功能由本发明装置中的组合信息分析解构运算单元、信息解密运算单元、信息输入单元、信息存储单元、数字证书存储单元构成。
7 、验证数字证书的有效性，并用数字证书验证输入信息和数字签名
用数字证书签发机构及其指定的证书有效性验证机构的根证书验证发布者数字证书有效性信息，并用数字证书信息验证输入信息和数字签名。
根据数字证书有效性信息中的指纹算法参数，通过同样的散列算法计算数字证书的指纹数据，并与有效性信息中的指纹数据比较，判断是否一致；根据数字证书有效性信息中的签名算法参数，使用其中的散列算法计算有效性信息的散列值，使用其中的签名算法和证书有效性验证机构的根证书验证其签名；根据数字证书有效性信息的时间期限，判断输入动态信息中的生成时间是否位于有效性信息的生成时间和过期时间之内；以上检验全部通过，则数字证书为有效证书。
根据数字签名中的散列及签名算法参数信息，计算输入信息的散列数据，并用数字证书验证散列数据的签名信息；如果包含完整组合信息的数字签名，则计算组合信息的散列数据，并用数字证书验证散列数据的签名信息；如果数字证书中包含域名限制等使用限制，验证目标信息中域名是否一致；验证数字证书拥有者名称与输入基本信息中名称是否一致；验证当前日期是否位于输入动态信息的生成时间和过期时间之间；以上验证全部通过，则输入信息数据完整，发布来源与数字证书一致。
此功能由本发明装置中的数字签名验证运算单元、信息存储单元、根证书存储单元、数字证书存储单元构成。
8 、验证结果判断和信息输出提示
数字证书、输入信息和数字签名全部验证正确，则安全二维码验证正确，编码信息来源可信，否则其信息发布来源不可信；对验证正确的安全二维码，显示编码信息和二维码发布者信息，允许进行与此二维码相关的应用操作；否则提示此二维码发布来源不可信，拒绝与此二维码相关的应用操作。
此功能由本发明装置中的结果输出信息提示单元、信息存储单元构成。
以上解决方案仅以二维码为例进行说明。本解决方案对其它常见信息标签类型可无实质差别进行实施应用，不再重复说明。
本发明的实施方式
以二维码信息标签为例，结合实施例对本发明进行具体说明。
实施例中所述密钥签发中心、发布者、特定用户等的名称、密钥、证书等为示例数据。为具体说明实施步骤，在实施例中私钥信息也予以列出；在实际应用中私钥信息存储于安全存储区域，只有拥有者自己可以访问。考虑同等密码强度下的密钥长度和运算速度，实施例中优选使用ECC 非对称密码体系和 AES 对称密码系统； ECC 采用 NIST 推荐的素数域 256位标准椭圆密码曲线；其余非对称公钥密码系统和对称密钥密码系统应用方式与此类似，只需简单替换相应的签名验证及加密解密运算即可，实施例中不再一一赘述。
实施例 1 ：
ABC Bank 对其网上银行入口地址，生成可由公众用户读取的公开信息安全二维码，用户可以安全扫码并访问网上银行系统。
具体实施步骤如下：
1 、 输入需编码的信息和类型信息
需编码信息包括基本信息、目标信息、动态信息。基本信息为： Base:{Name:ABC Bank} ，目标信息为： OBJ:{URI:https://www.abc.com} ，动态信息为： DYN:{Created:2016-1-1 12:00:00|Expired:2026-1-1 12:00:00} 。类型信息为公开信息安全二维码。
将输入信息以竖线和括号符号连接，如表 1 所示。
表 1 实施例 1 需编码信息
[OBJ:{URI:https://www.abc.com}Base:{Name:ABC Bank}DYN:{Created:2016-1-1 12:00:00|Expired:2026-1-1 12:00:00}]
2 、对需编码信息进行数字签名运算、加密运算
采用 SHA256 散列算法，计算表 1 需编码信息的散列值为：
sha256:9f2a8e9ace06537bb1521f5c26e686ac3d9a45ed78fa4dfdb8e8c633141e3734
发布者 ABC Bank 的私钥为：
prime256v1:3174fc59e7c3d5f41fa861448d921f098df1a3bf78838c72dd498375de605d1a
采用 ECDSA 签名算法，用发布者私钥对散列值进行进行数字签名运算，并对签名结果进行 Base64 编码，得到文本格式的数字签名如表 2 所示。
表 2 实施例 1 需编码信息的数字签名
sha256ECDSA:MEUCIEJ4tglE7uvBReg6bWdr1RTAM9BG2gLaduINnDsGX3M4AiEAtXiTSRKc+aKcyJFB8zED44VzDiBOIpVKyK0soGjPZ5A=
本实施例构造的二维码为公开信息安全二维码，不进行加密运算。
3 、用输入信息、加密信息、数字签名、数字证书及其有效性信息构造组合信息
发布者 ABC Bank 的数字证书如表 3 所示。
表 3 实施例 1 发布者数字证书
CERT:{ MIIBnDCCAUMCAQowCQYHKoZIzj0EATBLMQswCQYDVQQGEwJDTjERMA8GA1UECAwIU2hhbmdoYWkxEjAQBgNVBAoMCVJpZGdlIEluYzEVMBMGA1UEAwwMUmlkZ2UgU1FSIENBMB4XDTE1MDEwMTEyMjcwOFoXDTI0MTIyOTEyMjcwOFowazELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMREwDwYDVQQKDAhBQkMgQmFuazETMBEGA1UECwwKU1FSIEJ1cmVhdTEhMB8GA1UEAwwYQUJDIEJhbmsgU1FSIENlcnRpZmljYXRlMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEg1eLbRe1jnm3dBCMK3H+X5If3smKAQBbzFfjpKqhCNxO5mNQwL0FJ5SGlrvAgs6F2mNFw2OLzCVYWnkbDjg7AzAJBgcqhkjOPQQBA0gAMEUCIQDaG6gz9QMpXgaJ32AYqCW+l6sZhGTOCqH+h8PUWkmzHgIgCb+ni4YLVGQGGHx3YuLG//S+Qbgk1PTM9rdoZC0WSHY= }
数字证书有效性信息如表 4 所示。
表 4 实施例 1 发布者数字证书有效性信息
VALID:{[fingerprint:sha1:4206bb0d3b52ecf1810729a5671e031544530588|Status:V|Issue:/C=CN/O=Ridge Inc/OU=SQR CA OCSP/CN=Ridge Inc SQR CA OCSP|url:https://ocsp.ridgeca.com|Created:2016-1-1 00:00|Expired:2016-1-15 00:00]sha256ECDSA:MEUCIQDna4d8UCzwdRsAOMLRNfw332bfodiQ6gFMPP+6/PYAMAIgbWzfEtARWlxFp4s2427Z9OhCCwefUryCXc98ZGX+Wfk=}
安全二维码标识、类型、组合、压缩方式信息为：
SQR . P0100
其中， SQR 是安全二维码标识， P 表示公开信息二维码， 01 为压缩组合方式， 00 为备用信息位 。
用竖线及括号连接以上信息，构成组合信息如表 5 所示。
表 5 实施例 1 组合信息
SQR.P0100{[OBJ:{URI:https://www.abc.com}Base:{Name:ABC Bank}DYN:{Created:2016-1-1 12:00:00|Expired:2026-1-1 12:00:00}]sha256ECDSA:MEUCIEJ4tglE7uvBReg6bWdr1RTAM9BG2gLaduINnDsGX3M4AiEAtXiTSRKc+aKcyJFB8zED44VzDiBOIpVKyK0soGjPZ5A=}CERT:{MIIBnDCCAUMCAQowCQYHKoZIzj0EATBLMQswCQYDVQQGEwJDTjERMA8GA1UECAwIU2hhbmdoYWkxEjAQBgNVBAoMCVJpZGdlIEluYzEVMBMGA1UEAwwMUmlkZ2UgU1FSIENBMB4XDTE1MDEwMTEyMjcwOFoXDTI0MTIyOTEyMjcwOFowazELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMREwDwYDVQQKDAhBQkMgQmFuazETMBEGA1UECwwKU1FSIEJ1cmVhdTEhMB8GA1UEAwwYQUJDIEJhbmsgU1FSIENlcnRpZmljYXRlMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEg1eLbRe1jnm3dBCMK3H+X5If3smKAQBbzFfjpKqhCNxO5mNQwL0FJ5SGlrvAgs6F2mNFw2OLzCVYWnkbDjg7AzAJBgcqhkjOPQQBA0gAMEUCIQDaG6gz9QMpXgaJ32AYqCW+l6sZhGTOCqH+h8PUWkmzHgIgCb+ni4YLVGQGGHx3YuLG//S+Qbgk1PTM9rdoZC0WSHY=}VALID:{[fingerprint:sha1:4206bb0d3b52ecf1810729a5671e031544530588|Status:V|Issue:/C=CN/O=Ridge Inc/OU=SQR CA OCSP/CN=Ridge Inc SQR CA OCSP|url:https://ocsp.ridgeca.com|Created:2016-1-1 00:00|Expired:2016-1-15 00:00]sha256ECDSA:MEUCIQDna4d8UCzwdRsAOMLRNfw332bfodiQ6gFMPP+6/PYAMAIgbWzfEtARWlxFp4s2427Z9OhCCwefUryCXc98ZGX+Wfk=}
4 、对组合信息进行二维码编码，生成安全二维码
采用QR编码格式，对组合信息进行二维码编码，形成二维码图形。如图3所示。生成的二维码图形中可以嵌入一个安全二维码标识图形；二维码中是否嵌入标识图形不影响安全二维码的验证和安全性。
5 、输入安全二维码信息，按二维码编码规则识别内含的组合信息
扫描如图3所示的安全二维码，按照QR编码规则进行解码，得到如表5所示的组合信息。
6 、分析解密组合信息，得到输入信息、数字签名、数字证书及其有效性信息
根据组合信息头部二维码类型、组合方式等信息，通过竖线和括号等连接符号，对组合信息进行分析解构，得到如表1-表4所示的输入信息、数字签名、数字证书及其有效性信息。
此实施例为公开信息二维码，不需要解密运算。
7 、验证数字证书的有效性，并用数字证书验证输入信息和数字签名
数字证书签发机构及其指定的证书有效性验证机构的根证书如表6、表7所示。表6、表7所示的根证书存储于验证装置的受信任根证书存储区域。
表6 数字证书签发机构的根证书
-----BEGIN TRUSTED CERTIFICATE-----
MIIBfDCCASMCAQAwCQYHKoZIzj0EATBLMQswCQYDVQQGEwJDTjERMA8GA1UECAwIU2hhbmdoYWkxEjAQBgNVBAoMCVJpZGdlIEluYzEVMBMGA1UEAwwMUmlkZ2UgU1FSIENBMB4XDTE1MDEwMTEyMTAyMloXDTI0MTIyOTEyMTAyMlowSzELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMRIwEAYDVQQKDAlSaWRnZSBJbmMxFTATBgNVBAMMDFJpZGdlIFNRUiBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABN1iZNfBidKkAm//Y1q1kOIYC6clWqCjUC3STrxZFXePW0pLx/ObPMJGJMs2etwZIpgqvn7lPdGFZJqlaLboQw8wCQYHKoZIzj0EAQNIADBFAiBNVxIayCJUYJo6k296cyvR5u+GPo9Cnx4D1OAn9MyDqwIhAIgZ86v3H7vwiyxaBi27v0TAbAmJSO3wA3868ZtP9KY2
-----END TRUSTED CERTIFICATE-----
表7 数字证书有效性验证机构的根证书
-----BEGIN TRUSTED CERTIFICATE-----
MIIBiTCCAS8CAQEwCQYHKoZIzj0EATBLMQswCQYDVQQGEwJDTjERMA8GA1UECAwIU2hhbmdoYWkxEjAQBgNVBAoMCVJpZGdlIEluYzEVMBMGA1UEAwwMUmlkZ2UgU1FSIENBMB4XDTE1MDEwMTEyMTcyN1oXDTI0MTIyOTEyMTcyN1owVzELMAkGA1UEBhMCQ04xEjAQBgNVBAoMCVJpZGdlIEluYzEUMBIGA1UECwwLU1FSIENBIE9DU1AxHjAcBgNVBAMMFVJpZGdlIEluYyBTUVIgQ0EgT0NTUDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFfl+4xtyRasK6J2kJ9BWnMze1flwxJcwvqxKbLI4tQbgizqV7taTeZsceMD96qqbmO9JXB5tjOQU5m0auSbecUwCQYHKoZIzj0EAQNJADBGAiEA/ifW2onY5OPR/bFFoxbtsM4CadeB7IKBfKZ5V6KswBECIQCb/avLSz2er7EkudMDa9oTTqfeIIPnt02/gwR4O1AV5g==
-----END TRUSTED CERTIFICATE-----
根据数字证书有效性信息中的SHA1散列算法，计算数字证书信息的散列数据为：
sha1: 4206bb0d3b52ecf1810729a5671e031544530588 ，与数字证书有效性信息中的指纹相同。
数字证书有效性信息中的签名信息为：
sha256ECDSA: MEUCIQDna4d8UCzwdRsAOMLRNfw332bfodiQ6gFMPP+6/PYAMAIgbWzfEtARWlxFp4s2427Z9OhCCwefUryCXc98ZGX+Wfk=
使用SHA256散列算法计算数字证书有效性信息的散列值为：
sha256: fbdc67e57284296c300023e8fa10bd6509d017e7e09dcafcb31216a3d519f380
使用ECDSA算法和表6、表7所示的根证书，验证数字证书有效性信息中的数字签名；
数字证书有效性信息的时间期限如表4所示： 2016-1-1 00:00 至2016-1-15 00:00；输入动态信息中的生成时间如表1所示：2016-1-1 12:00:00；输入信息生成时间位于有效性信息的时间期限之内；
数字证书的有效性也可以不使用以上优选的离线验证方式，而通过证书签发机构根证书指定的证书有效性验证机构进行在线验证；不使用离线验证方式验证证书有效性时，组合信息中的证书有效性信息可以省略或者只保留证书散列值；
以上检验全部通过，则发布者的数字证书为有效证书。
数字签名中的散列及签名算法参数为sha256ECDSA,如表2所示。采用sha256散列算法计算输入信息散列数据为：
sha256:9f2a8e9ace06537bb1521f5c26e686ac3d9a45ed78fa4dfdb8e8c633141e3734
用表3所示的发布者数字证书验证散列数据的签名信息；
发布者数字证书拥有者CN名称为ABC Bank SQR Certificate，输入基本信息中名称ABC Bank，是机构ABC Bank的安全二维码专用证书；输入动态信息的有效时限如表1所示：2016-1-1 12:00:00至2026-1-1 12:00:00，当前时间位于输入信息的有效时限之内；
以上验证全部通过，输入信息数据完整，发布来源与数字证书一致。
8 、验证结果判断和信息输出提示
以上数字证书、输入信息和数字签名全部验证正确，此安全二维码验证正确，编码信息来源可信。显示输入信息和二维码发布者信息，提示二维码由ABC Bank发布，允许访问网上银行网址。如果此安全二维码经过任何篡改或伪造，则无法通过以上安全验证，提示此安全二维码可能被篡改或伪造，拒绝访问编码相关网址。
实施例 2 ：
ABC Pay 支付平台，对出租车移动支付应用，为每个出租车运营人员生成可由公众用户读取的公开信息安全二维码，乘客可以安全扫码支付租车费用。
具体实施步骤如下：
1 、 输入需编码的信息和类型信息
需编码信息包括基本信息、目标信息、动态信息。基本信息为： Base:{TaxiID: 沪 A12345|LicenseID:123456|UserID:12345678|Domain:abcpay.com} ，目标信息为： OBJ:{URI:https://sqr.abcpay.com/zrk1rjziurlr2w3ira} ，动态信息为： DYN:{Created:2016-1-1 12:00:00|Expired:2017-1-1 12:00:00} 。类型信息为公开信息安全二维码。
将输入信息以竖线和括号符号连接，如表 8 所示。
表 8 实施例 2 需编码信息
[OBJ:{URI:https://sqr.abcpay.com/zrk1rjziurlr2w3ira}Base:{TaxiID: 沪 A12345|LicenseID:123456|UserID:12345678|Domain:abcpay.com}DYN:{Created:2016-1-1 12:00:00|Expired:2017-1-1 12:00:00}]
本实施例需编码信息包含多字节字符汉字，信息编码采用UTF-8编码。
2 、对需编码信息进行数字签名运算、加密运算
本实施例采用另一种可能的组合形式，对完整的组合信息进行签名。为便于逻辑表述，将数字签名过程合并到步骤 3 进行说明。
本实施例构造的二维码为公开信息安全二维码，不进行加密运算。
3 、用输入信息、加密信息、数字签名、数字证书及其有效性信息构造组合信息
安全二维码标识、类型、组合、压缩方式信息为： SQR . P0200
其中， SQR 是安全二维码标识， P 表示公开信息二维码， 02 表示对整体信息签名， 00 为备用信息位 。
用竖线及括号连接信息头、输入信息、数字证书及其有效性信息，构成待签名信息如表 9 所示。其中，数字证书及其有效性信息分别为 CERT 和 VALID 部分。
表 9 实施例 2 待签名信息
SQR.P0200{[OBJ:{URI:https://sqr.abcpay.com/zrk1rjziurlr2w3ira}Base:{TaxiID: 沪 A12345|LicenseID:123456|UserID:12345678|Domain:abcpay.com}DYN:{Created:2016-1-1 12:00:00|Expired:2017-1-1 12:00:00}]}CERT:{MIIBmjCCAUECAQwwCQYHKoZIzj0EATBLMQswCQYDVQQGEwJDTjERMA8GA1UECAwIU2hhbmdoYWkxEjAQBgNVBAoMCVJpZGdlIEluYzEVMBMGA1UEAwwMUmlkZ2UgU1FSIENBMB4XDTE1MDEwMTEyNTU1NFoXDTI0MTIyOTEyNTU1NFowaTELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMRAwDgYDVQQKDAdBQkMgUGF5MRMwEQYDVQQLDApTUVIgQnVyZWF1MSAwHgYDVQQDDBdBQkMgUGF5IFNRUiBDZXJ0aWZpY2F0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMYWxfwoZix/ktNjsGZ5rxrreWdiMsbrfQJTRfmGcbi2ANcx4gsvXY+VUC8xm4q5T4QeB/8xKkqARKd52tGLoKYwCQYHKoZIzj0EAQNIADBFAiEAjm5i1gbKxLY3O6OsAgmtZ/OZfMGlWVotA+RYeRFcjgkCICXC1x6vdLA/fekE5oof1EWROTqGY70SBRed88EhOPfm}VALID:{[fingerprint:sha1:c8013a7663460284db88b7f5bbb11cc082e4209d|Status:V|Issue:/C=CN/O=Ridge Inc/OU=SQR CA OCSP/CN=Ridge Inc SQR CA OCSP|url:https://ocsp.ridgeca.com|Created:2016-1-1 00:00|Expired:2016-1-15 00:00]sha256ECDSA:MEUCIGFaxrDsRrLGB0STa33X/A7B+AQqkqbO5/9mZ+EA9fNYAiEApb0xXmxFNxGzWhNOga3mooNaCchKFR74jK5TdiVsLHE=}
发布者 ABC Pay 的私钥为：
prime256v1: a52a6adef863f807086ec3d93c127b72a995d5e9a4c6bd14ee2c6d6669d7ee17
采用 sha256ECDSA 签名算法，用发布者私钥对散列值进行进行数字签名运算，并对签名结果进行 Base64 编码，得到文本格式的数字签名如表 10 所示。
表 10 实施例 2 需编码信息的数字签名
sha256ECDSA: MEUCIQCHdsWZRGf4jX3hjSpjBtsitHpCXrg5NDyzhdfAxtAA4AIgWVd+nMtQcYW6iW+HMwX02ecllFjHnm2J82JP2rhY34s=
将表 10 整体信息的签名结果附加在信息尾部，构成的组合信息如表 11 所示。
表 11 实施例 2 的组合信息
SQR.P0200{[OBJ:{URI:https://sqr.abcpay.com/zrk1rjziurlr2w3ira}Base:{TaxiID: 沪 A12345|LicenseID:123456|UserID:12345678|Domain:abcpay.com}DYN:{Created:2016-1-1 12:00:00|Expired:2017-1-1 12:00:00}]}CERT:{MIIBmjCCAUECAQwwCQYHKoZIzj0EATBLMQswCQYDVQQGEwJDTjERMA8GA1UECAwIU2hhbmdoYWkxEjAQBgNVBAoMCVJpZGdlIEluYzEVMBMGA1UEAwwMUmlkZ2UgU1FSIENBMB4XDTE1MDEwMTEyNTU1NFoXDTI0MTIyOTEyNTU1NFowaTELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMRAwDgYDVQQKDAdBQkMgUGF5MRMwEQYDVQQLDApTUVIgQnVyZWF1MSAwHgYDVQQDDBdBQkMgUGF5IFNRUiBDZXJ0aWZpY2F0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMYWxfwoZix/ktNjsGZ5rxrreWdiMsbrfQJTRfmGcbi2ANcx4gsvXY+VUC8xm4q5T4QeB/8xKkqARKd52tGLoKYwCQYHKoZIzj0EAQNIADBFAiEAjm5i1gbKxLY3O6OsAgmtZ/OZfMGlWVotA+RYeRFcjgkCICXC1x6vdLA/fekE5oof1EWROTqGY70SBRed88EhOPfm}VALID:{[fingerprint:sha1:c8013a7663460284db88b7f5bbb11cc082e4209d|Status:V|Issue:/C=CN/O=Ridge Inc/OU=SQR CA OCSP/CN=Ridge Inc SQR CA OCSP|url:https://ocsp.ridgeca.com|Created:2016-1-1 00:00|Expired:2016-1-15 00:00]sha256ECDSA:MEUCIGFaxrDsRrLGB0STa33X/A7B+AQqkqbO5/9mZ+EA9fNYAiEApb0xXmxFNxGzWhNOga3mooNaCchKFR74jK5TdiVsLHE=}sha256ECDSA:MEUCIQCHdsWZRGf4jX3hjSpjBtsitHpCXrg5NDyzhdfAxtAA4AIgWVd+nMtQcYW6iW+HMwX02ecllFjHnm2J82JP2rhY34s=
4 、对组合信息进行二维码编码，生成安全二维码
采用QR编码格式，对组合信息进行二维码编码，形成二维码图形，如图4所示。
5 、输入安全二维码信息，按二维码编码规则识别内含的组合信息
扫描如图4所示的安全二维码，按照QR编码规则进行解码，得到如表11所示的组合信息。
6 、分析解密组合信息，得到输入信息、数字签名、数字证书及其有效性信息
根据组合信息头部二维码类型、组合方式等信息，通过竖线和括号等连接符号，对组合信息进行分析解构，得到输入信息、数字证书及其有效性信息、数字签名信息。
此实施例为公开信息二维码，不需要解密运算。
本实施例采用对整体信息签名组合方式，以上步骤完成信息组合和解构运算，之后数字证书有效性及输入信息的验证步骤与实施例1相同，可以参考实施例1实施，不再重复赘述。
经验证，当数字证书、输入信息和数字签名全部验证正确，此安全二维码验证正确，编码信息来源可信。显示输入信息和二维码发布者信息，提示二维码来源可信，允许通过ABC Pay平台支付费用。如果此安全二维码经过任何篡改或伪造，则无法通过以上安全验证，提示此安全二维码可能被篡改或伪造，发布来源不可信，拒绝进行支付操作。
实施例 3:
ABC Mall 购物中心 ，在用户付款时，用本发明装置实时产生一个包含收款商家名称、日期、金额、有效时间等信息的公开信息安全二维码，用户扫码即可安全支付。
具体实施步骤如下：
1 、 输入需编码的信息和类型信息
需编码信息包括基本信息、目标信息、动态信息。基本信息为： Base:{Name:ABC Mall|Addr:No.1288,ABC Rd.,Shanghai|Domain:abcpay.com} ，目标信息为： OBJ:{URI:https://pay.abcpay.com/dkri67zin9oo8tzxy9ojquz8mcaedhzcljix1jeu} ，动态信息为： DYN:{Created:2016-5-1 12:00:00|Expired:2016-5-1 12:10:00|PaymentID:e7db7c48642c78a669fd|Total:580.00RMB} 。类型信息为公开信息安全二维码。
将输入信息以竖线和括号符号连接，如表 12 所示。
表 12 实施例 3 需编码信息
[OBJ:{URI:https://pay.abcpay.com/dkri67zin9oo8tzxy9ojquz8mcaedhzcljix1jeu}Base:{Name:ABC Mall|Addr:No.1288,ABC Rd.,Shanghai|Domain:abcpay.com}DYN:{Created:2016-5-1 12:00:00|Expired:2016-5-1 12:10:00|PaymentID:e7db7c48642c78a669fd|Total:580.00RMB}]
2 、对需编码信息进行数字签名运算、加密运算
发布者 ABC Mall 的私钥为：
prime256v1:04fb934882d6e980367d7d74aa97f67b4503e8972caa0fcdf60904cb859be54c
采用 sha256ECDSA 签名算法，对输入信息进行签名运算，经 Base64 编码后的签名结果如表 13 所示。
表 13 实施例 3 需编码信息的数字签名
sha256ECDSA:MEYCIQDpCQGQXaj6Pv5FImHBmv13PRr0KzZRxtF0t7s0f0BFlwIhALR+F7IEFM2l3WDgmQZAwms/RpPr+nXx6P8Nmuxnph8J
本实施例构造的二维码为公开信息安全二维码，不进行加密运算。
3 、用输入信息、加密信息、数字签名、数字证书及其有效性信息构造组合信息
安全二维码标识、类型、组合、压缩方式信息为： SQR . P0100
用竖线及括号连接输入信息、数字签名、数字证书及其有效性信息，构成组合信息如表 14 所示。其中，数字证书及其有效性信息分别为 CERT 和 VALID 部分。
表 14 实施例 3 组合信息
SQR.P0100{[OBJ:{URI:https://pay.abcpay.com/dkri67zin9oo8tzxy9ojquz8mcaedhzcljix1jeu}Base:{Name:ABC Mall|Addr:No.1288,ABC Rd.,Shanghai|Domain:abcpay.com}DYN:{Created:2016-5-1 12:00:00|Expired:2016-5-1 12:10:00|PaymentID:e7db7c48642c78a669fd|Total:580.00RMB}]sha256ECDSA:MEYCIQDpCQGQXaj6Pv5FImHBmv13PRr0KzZRxtF0t7s0f0BFlwIhALR+F7IEFM2l3WDgmQZAwms/RpPr+nXx6P8Nmuxnph8J}CERT:{MIIBsTCCAVgCARAwCQYHKoZIzj0EATBgMQswCQYDVQQGEwJDTjERMA8GA1UECAwIU2hhbmdoYWkxEDAOBgNVBAoMB0FCQyBQYXkxEzARBgNVBAsMClNRUiBCdXJlYXUxFzAVBgNVBAMMDkFCQyBQYXkgU1FSIENBMB4XDTE1MDEwMTEyMTIwM1oXDTI0MTIyOTEyMTIwM1owazELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMREwDwYDVQQKDAhBQkMgTWFsbDETMBEGA1UECwwKU1FSIEJ1cmVhdTEhMB8GA1UEAwwYQUJDIE1hbGwgU1FSIENlcnRpZmljYXRlMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEmHTPYJbPpvDSEwOnRsKHaPty7b2VGppJk1P3H6XIPeTVWod63nkAuwKmftLGR8hTwjruJKXJh34K+RghoIkXizAJBgcqhkjOPQQBA0gAMEUCIFOdSlTG9VzOaHlPeDHeHVRFgWqmjqvHYnKgfOzJmO2jAiEAo3ab+zXyzi5AY6NdAve8HAFa97kyS5GTmAAQfRmhmhM=}VALID:{[fingerprint:sha1:ab0004a74fb4d04bb7f2cb3f079ea0104ac7a715|Status:V|Issue:/C=CN/O=Ridge Inc/OU=SQR CA OCSP/CN=Ridge Inc SQR CA OCSP|url:https://ocsp.ridgeca.com|Created:2016-4-30 00:00|Expired:2016-5-10 00:00]sha256ECDSA:MEYCIQCUffga2TZHhB3ZahNcqKS3bPfRfPEcscmkkGKo1gJRWAIhANxNJ1/HESRCq9abOG20XQhXw4MfSQ6OeL7WKCN5JROz}
4 、对组合信息进行二维码编码，生成安全二维码
采用QR编码格式，对组合信息进行二维码编码，形成二维码图形，如图5所示。
实施例 1 、 2 已详细说明了两种不同组合方式的构造验证过程， 本实施例的验证步骤与实施例1相同，可参考实施例1，不再重复赘述。
经验证，当数字证书、输入信息和数字签名全部验证正确，此安全二维码验证正确，编码信息来源可信。显示输入信息和二维码发布者信息，提示二维码来源可信，允许扫码支付操作。如果此安全二维码经过任何篡改或伪造，则无法通过以上安全验证，提示此安全二维码可能被篡改或伪造，发布来源不可信，拒绝支付操作。
本实施例中 ABC Mall 的支付证书由 ABC Pay 签发， ABC Pay 的证书由签发中心的根证书签发。本发明方法可以离线验证多级签发机构的数字证书，组合信息中只需包含发布者终端数字证书信息。证书链的有效性由本发明构造装置定期通过签发机构根证书指定的有效性验证机构更新，验证装置中通过组合信息中的证书有效性信息进行离线验证。实施例 2 中也可以采用本实施例的多级证书结构，利用本发明装置实时生成包含租车费用等信息的安全支付二维码，乘客可以离线验证安全扫码付款。
实施例 4 ：
ABC Instrument 乐器生产企业，对其生产销售的每个产品产生表述其识别特征的私密信息安全二维码，用户扫描此安全二维码识别所购买产品为正品或仿冒产品。
具体实施步骤如下：
1 、 输入需编码的信息和类型信息
需编码信息包括基本信息、目标信息、动态信息。基本信息为： Base:{Name:ABC Instrument} ，目标信息为： OBJ:{URI:https://product.abcinstrument.com/e92eab1319a8cde0dc61636a2ffc8eeb918a554b} ，动态信息为： DYN:{InstrumentID:DH698JM12345678|Created:2016-1-1 12:00:00|Expired:2046-1-1 12:00:00|FeatureID:ae978e952021aa32a00ce4b615bee64531d14b74} 。类型信息为私密信息安全二维码。
将输入信息以竖线和括号符号连接，如表 15 所示。
表 15 实施例 4 需编码信息
[OBJ:{URI:https://product.abcinstrument.com/e92eab1319a8cde0dc61636a2ffc8eeb918a554b}Base:{Name:ABC Instrument}DYN:{InstrumentID:DH698JM12345678|Created:2016-1-1 12:00:00|Expired:2046-1-1 12:00:00|FeatureID:ae978e952021aa32a00ce4b615bee64531d14b74}]
2 、对需编码信息进行数字签名运算、加密运算；
发布者 ABC Instrument 的私钥为：
prime256v1: da2b5da79b3f71e76b57c7fb4e533f3b134007945ed4764fb09730b4a8a87026
采用 ECDSA 签名算法，用发布者私钥对散列值进行进行数字签名运算，并对签名结果进行 Base64 编码，得到文本格式的数字签名如表 16 所示。
表 16 实施例 4 需编码信息的数字签名
sha256ECDSA:MEQCIAwe4bAXkEXjVAd2HO/YbUx78TMds2Ko4lyWBU54JQB9AiB5l916Id5bY+2VHgT+NTlS0U27OctHu4pKsrl1b7/TeA==
本实施例为厂家在产品生产下线尚未销售时即生成产品特征验证安全二维码。此时每个产品并没有特定的用户对应，不能采用特定用户的公钥或其指定的对称密钥进行加密。实施例中采用随机产生的对称密钥，如表17所示。此随机密码可以采用密码区涂层刮码方式与生成的安全二维码一起制作在产品质量证书上。
表17 实施例4采用的随机对称密钥
8c6116c72bdb9bd9582b
采用AES128对称密钥算法用表17所示密钥对表15所示需编码信息进行加密运算。加密运算结果经Base64编码后的密文信息，如表18所示。
表18 实施例4密文信息
aes128cbc:U2FsdGVkX1+q+7J62SECOtx5m+HYwIZYRgTdbWdtPm1/rTJnEYn9k//y/LiuYtmjKOAky2SV+hGlI+F5ZXq1K0+O+YVevLCNWLAE1bjSPFDJvN5PiIX8X2XiqH6yEYwpB+t3fnogW9z/3MYeZEGIYN4vuIwqA1g4mNCEIhBizGTL6vkP7QSsWs2W/CiQ7dhoN3cHNPNdZXJVZTB8g9j1y8sFocBwg3rgJtOmd/iCUcjGFtQECEu59ZJIOTMIomD+TZbCoAv8xJ9Sgz/S8z3OnXOskY3tVROQwe1IxkBi7IE46aRUCWODFqQbqTf+pghmAIoeLE7YX2O0vNYgafAdccRz8TpuS2gOCXnMQiseJxc=
3 、用输入信息、加密信息、数字签名、数字证书及其有效性信息构造组合信息；
安全二维码标识、类型、组合、压缩方式信息为： SQR . R0100
其中， R 表示私密信息安全二维码。
用竖线及括号连接二维码头信息、密文信息、数字签名、数字证书及其有效性信息，构成组合信息如表 19 所示。其中，数字证书及其有效性信息分别为 CERT 和 VALID 部分。
表 19 实施例 4 组合信息
SQR.R0100{[aes128cbc:U2FsdGVkX1+q+7J62SECOtx5m+HYwIZYRgTdbWdtPm1/rTJnEYn9k//y/LiuYtmjKOAky2SV+hGlI+F5ZXq1K0+O+YVevLCNWLAE1bjSPFDJvN5PiIX8X2XiqH6yEYwpB+t3fnogW9z/3MYeZEGIYN4vuIwqA1g4mNCEIhBizGTL6vkP7QSsWs2W/CiQ7dhoN3cHNPNdZXJVZTB8g9j1y8sFocBwg3rgJtOmd/iCUcjGFtQECEu59ZJIOTMIomD+TZbCoAv8xJ9Sgz/S8z3OnXOskY3tVROQwe1IxkBi7IE46aRUCWODFqQbqTf+pghmAIoeLE7YX2O0vNYgafAdccRz8TpuS2gOCXnMQiseJxc=]sha256ECDSA:MEQCIAwe4bAXkEXjVAd2HO/YbUx78TMds2Ko4lyWBU54JQB9AiB5l916Id5bY+2VHgT+NTlS0U27OctHu4pKsrl1b7/TeA==}CERT:{MIIBqDCCAU8CAQ8wCQYHKoZIzj0EATBLMQswCQYDVQQGEwJDTjERMA8GA1UECAwIU2hhbmdoYWkxEjAQBgNVBAoMCVJpZGdlIEluYzEVMBMGA1UEAwwMUmlkZ2UgU1FSIENBMB4XDTE1MDEwMTEyNTgwM1oXDTI0MTIyOTEyNTgwM1owdzELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMRcwFQYDVQQKDA5BQkMgSW5zdHJ1bWVudDETMBEGA1UECwwKU1FSIEJ1cmVhdTEnMCUGA1UEAwweQUJDIEluc3RydW1lbnQgU1FSIENlcnRpZmljYXRlMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1YXYafrzOlt1AYBgPnmHX9cXxduzoKIVRQpi96LMZEM6RZTCe+FaUTDULSJIXUsJwnnSDj9YdnEQwkgAMu94fjAJBgcqhkjOPQQBA0gAMEUCIHrQz+x2CAAkXkMAXRffudb6ZL2VlgUU2gS/I2TJ9++xAiEAwwwdjABwxJyI4mpsIKWwHK5Gl4Ks0s2AW7UXAScQunw=}VALID:{[fingerprint:sha1:b16238e819adefb88161424c924905ccbdbed7c5:|Status:V|Issue:/C=CN/O=Ridge Inc/OU=SQR CA OCSP/CN=Ridge Inc SQR CA OCSP|url:https://ocsp.ridgeca.com|Created:2016-1-1 00:00|Expired:2016-1-7 00:00]sha256ECDSA:MEQCICu2xZItmaDIcur2IpUgtLQG00ymljX95UM0h36fAK6bAiBeHxiEpmFJPfXFNoeEcFNC+V8Rr1CNA9mm2LOpG4XMvA==}
4 、对组合信息进行二维码编码，生成安全二维码
采用QR编码格式，对组合信息进行二维码编码，形成二维码图形，如图6所示。
5 、输入安全二维码信息，按二维码编码规则识别内含的组合信息
用户购买产品后，扫描质量证书中如图6所示的安全二维码，按照QR编码规则进行解码，得到如表19所示的组合信息。
6 、分析解密组合信息，得到输入信息、数字签名、数字证书及其有效性信息
根据组合信息头部二维码类型、组合方式等信息，通过竖线和括号等连接符号，对组合信息进行分析解构，得到密文信息、数字签名、数字证书及其有效性信息。
用厂家提供的获得质量证书中得到的随机对称密钥，采用密文信息中的算法参数信息，对密文信息进行解密运算，得到如表15所示的输入信息。
本实施例采用私密信息二维码类型，对输入信息进行加密运算，主要区别在于加解密处理和组合解构处理运算，之后数字证书有效性及输入信息的验证步骤与实施例1相同，可以参考实施例1实施，不再重复赘述。
经验证，当数字证书、输入信息和数字签名全部验证正确，此安全二维码验证正确，编码信息来源可信。显示输入信息和二维码发布者信息，提示二维码来源可信，允许访问厂家发布的地址查看此乐器对应的特征图片与所购买乐器进行对比，并比较二维码编码信息中的乐器特征图片的散列值与网址图片显示的散列值一致，以确认所购商品是否为正品。如果此安全二维码经过任何篡改或伪造，则无法通过以上安全验证，提示此安全二维码可能被篡改或伪造，发布来源不可信，拒绝访问二维码中编码的网址，所购产品为赝品。
实施例 5 ：
ABC Inc 公司 ，在其组织销售的演出门票上生成表述演出时间场次座位等标识信息的私密信息安全二维码，用户扫描此安全二维码可验证门票真伪，公司扫描此安全二维码可以实现快速安全检票，防止伪造门票给用户和公司造成经济损失。
具体实施步骤如下：
1 、 输入需编码的信息和类型信息
需编码信息包括基本信息、目标信息、动态信息。基本信息为： Base:{Name:ABC Inc|URI:http://www.abcinc.com} ，目标信息为： OBJ:{TXT:ABC Inc Ticket,Seat 15F,Room A1,2016-1-10 12:00} ，动态信息为： DYN:{TicketSN:10001234|Created:2016-1-1 12:00:00|Expired:2016-1-10 13:00:00} 。类型信息为私密信息安全二维码。
将输入信息以竖线和括号符号连接，如表 20 所示。
表 20 实施例 5 需编码信息
[OBJ:{TXT:ABC Inc Ticket,Seat 15F,Room A1,2016-1-10 12:00}Base:{Name:ABC Inc|URI:http://www.abcinc.com}DYN:{TicketSN:10001234|Created:2016-1-1 12:00:00|Expired:2016-1-10 13:00:00}]
2 、对需编码信息进行数字签名运算、加密运算；
发布者 ABC Inc 的私钥为：
prime256v1: d6dd233bd29ba2c1db1a22ce7621a65edca83c60ab1534b4ab6a2274cbb680dd
采用 ECDSA 签名算法，用发布者私钥对散列值进行进行数字签名运算，并对签名结果进行 Base64 编码，得到文本格式的数字签名如表 21 所示。
表 21 实施例 5 需编码信息的数字签名
sha256ECDSA:MEUCICK5jWrBaKMX7/uOX0AFjQuRhk+e740Dj1A/nB7j8dRJAiEA9Ye8ZRu9A3DsCzi4vlYWwG0dUGJoK+BgFjrAKtRa4D8=
为便于公司验票和用户验证门票真伪，本实施例采用两层加密形式，生成的私密信息安全二维码可由公司和购票用户两个指定用户读取识别。
首先采用随机产生的第一对称密钥，如表22所示，用AES128算法对表20所示需编码信息进行加密运算。
表22 实施例5采用的第一对称密钥
xJkJTonV4i50A
加密运算结果经Base64编码后的第一密文信息如表23所示。
表23 实施例5第一密文信息 U2FsdGVkX1+bVU4RDHGr6FAVxpNqEnRFf3Y5XEoGpkkzHujSgw6g1yVXASsXSYWTHYDeJMNNwgvuu57w1GXvtpM1fxrX//WmEpE5bF3w7VdV4m68AR88kJB55GnRRK31w8b/LbjiygeB7b2lzCChbswukY1HlwMt2ZGkzETTfjE/UHeJ8dGRjBuD3Qbp6FjtMnO5JGE+EroBXGnmAAcQp044ao35bkFrrfNo8c083L95n06M4+1iQCtlD2eHtaKuMvtw1eidM2Gdw5dMs/1syA==
然后用Elgamal非对称密钥ECC加密算法，用ABC Inc公司的安全二维码公钥对以上所用的第一对称密钥进行加密运算。加密运算结果经Base64编码的密文信息如表24所示。
表24 实施例5 ABC公司验票密钥的密文信息
A0vrl0wByM6LGRA6xxY7RgEUPiSUO6qE+Nm9Z1BoSotaA3Hqw/LHWfVPmLb5S7hh+Eyq/gWaaFpWL+FchLTDE7jU
用户购票时设置的对称密钥如表25所示。用此对称密钥，采用AES128对称密钥算法对第一对称密钥进行加密运算，运算结果经Base64编码后的密文信息如表26所示。
表25 实施例5 用户设定的对称密钥
user12345678
表26 实施例5 用户验票密钥的密文信息
U2FsdGVkX19nk+kW2oaV0Xzb2VdIlNReTITwxZURkuU=
用竖线和括号连接以上两级加密的算法参数及密文信息，得到本实施例的密文信息如表27所示。
表27 实施例5密文信息
abcinc:Elgamal:A0vrl0wByM6LGRA6xxY7RgEUPiSUO6qE+Nm9Z1BoSotaA3Hqw/LHWfVPmLb5S7hh+Eyq/gWaaFpWL+FchLTDE7jU|user1:aes128cbc:U2FsdGVkX19nk+kW2oaV0Xzb2VdIlNReTITwxZURkuU=[aes128cbc:U2FsdGVkX1+bVU4RDHGr6FAVxpNqEnRFf3Y5XEoGpkkzHujSgw6g1yVXASsXSYWTHYDeJMNNwgvuu57w1GXvtpM1fxrX//WmEpE5bF3w7VdV4m68AR88kJB55GnRRK31w8b/LbjiygeB7b2lzCChbswukY1HlwMt2ZGkzETTfjE/UHeJ8dGRjBuD3Qbp6FjtMnO5JGE+EroBXGnmAAcQp044ao35bkFrrfNo8c083L95n06M4+1iQCtlD2eHtaKuMvtw1eidM2Gdw5dMs/1syA==]
3 、用输入信息、加密信息、数字签名、数字证书及其有效性信息构造组合信息；
安全二维码标识、类型、组合、压缩方式信息为： SQR . R0100
其中， R 表示私密信息安全二维码。
用竖线及括号连接二维码头信息、密文信息、数字签名、数字证书及其有效性信息，构成组合信息如表 28 所示。其中，数字证书及其有效性信息分别为 CERT 和 VALID 部分。
表 28 实施例 5 组合信息
SQR.R0100{abcinc:Elgamal:A0vrl0wByM6LGRA6xxY7RgEUPiSUO6qE+Nm9Z1BoSotaA3Hqw/LHWfVPmLb5S7hh+Eyq/gWaaFpWL+FchLTDE7jU|user1:aes128cbc:U2FsdGVkX19nk+kW2oaV0Xzb2VdIlNReTITwxZURkuU=[aes128cbc:U2FsdGVkX1+bVU4RDHGr6FAVxpNqEnRFf3Y5XEoGpkkzHujSgw6g1yVXASsXSYWTHYDeJMNNwgvuu57w1GXvtpM1fxrX//WmEpE5bF3w7VdV4m68AR88kJB55GnRRK31w8b/LbjiygeB7b2lzCChbswukY1HlwMt2ZGkzETTfjE/UHeJ8dGRjBuD3Qbp6FjtMnO5JGE+EroBXGnmAAcQp044ao35bkFrrfNo8c083L95n06M4+1iQCtlD2eHtaKuMvtw1eidM2Gdw5dMs/1syA==]sha256ECDSA:MEUCICK5jWrBaKMX7/uOX0AFjQuRhk+e740Dj1A/nB7j8dRJAiEA9Ye8ZRu9A3DsCzi4vlYWwG0dUGJoK+BgFjrAKtRa4D8=}CERT:{MIIBmjCCAUECAQMwCQYHKoZIzj0EATBLMQswCQYDVQQGEwJDTjERMA8GA1UECAwIU2hhbmdoYWkxEjAQBgNVBAoMCVJpZGdlIEluYzEVMBMGA1UEAwwMUmlkZ2UgU1FSIENBMB4XDTE2MTAxNjE4MTA1NVoXDTI2MTAxNDE4MTA1NVowaTELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMRAwDgYDVQQKDAdBQkMgSW5jMRMwEQYDVQQLDApTUVIgQnVyZWF1MSAwHgYDVQQDDBdBQkMgSW5jIFNRUiBDZXJ0aWZpY2F0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNElX97H5p9wPULirnYwBFYww9NiTagRit49ZCaSYgILKGZQIt9zokVZkDoofP5yiveBU9m/uuvV3S6hlxLl8b0wCQYHKoZIzj0EAQNIADBFAiBESaHU4yzdWgGI+jyZORKSg6I2nJRYL1QK8cg9v3J+AQIhALH5vt6Lve4kLS8RvycZMtlCy4H3HRMzgKTc1AihM/ik}VALID:{[fingerprint:sha1:5ed29e05630b433aafb67ab6e0a13db142f6ca78|Status:V|Issue:/C=CN/O=Ridge Inc/OU=SQR CA OCSP/CN=Ridge Inc SQR CA OCSP|url:https://ocsp.ridgeca.com|Created:2016-1-1 00:00|Expired:2016-1-15 00:00]sha256ECDSA:MEYCIQCVYVe33cR1louQS/WmByjdlcCgDcGfbzcFJsIEHtSuNQIhAI+hVtd/fCyZ0e5uWpp6/Up9nu6GTBu0VqONDB4+rHly}
4 、对组合信息进行二维码编码，生成安全二维码
采用QR编码格式，对组合信息进行二维码编码，形成二维码图形，如图7所示。
5 、输入安全二维码信息，按二维码编码规则识别内含的组合信息
扫描如图7所示的安全二维码，按照QR编码规则进行解码，得到如表28所示的组合信息。
6 、分析解密组合信息，得到输入信息、数字签名、数字证书及其有效性信息
根据组合信息头部二维码类型、组合方式等信息，通过竖线和括号等连接符号，对组合信息进行分析解构，得到密文信息、数字签名、数字证书及其有效性信息。
用户购票后自己扫描安全二维码验证门票真伪时，输入如表25所示用户自己设定的对称密钥和aes128cbc算法，对密文信息中user1对应的如表26所示的密文进行解密运算，得到如表22所示的第一对称密钥；然后用此第一对称密钥对密文信息中如表23所示的第一密文信息进行解密运算，得到如表20所示输入信息。
用户观看演出入场时，ABC Inc公司扫描用户门票上的安全二维码，用ABC Inc公司的私钥和Elgamal算法，对密文信息中abcinc对应的如表24所示的密文信息进行ECC非对称密钥解密运算，得到如表22所示的第一对称密钥；然后用此第一对称密钥对密文信息中如表23所示的第一密文信息进行解密运算，得到如表20所示输入信息。
ABC Inc 公司验票时，扫描用户门票上的安全二维码后，也可以由用户输入其所设定的对称密钥，然后采用与用户同样流程进行解密处理，得到如表20所示输入信息。
本实施例采用私密信息二维码类型，采用两层加密方式对输入信息进行加密运算，主要区别在于加解密处理和组合解构处理运算，之后数字证书有效性及输入信息的验证步骤与实施例1相同，可以参考实施例1实施，不再重复赘述。
经验证，数字证书、输入信息和数字签名全部验证正确，此安全二维码验证正确，编码信息来源可信。显示输入信息和二维码发布者信息，提示二维码来源可信，门票为真，可以入场。如果此安全二维码经过任何篡改或伪造，则无法通过以上安全验证，提示此安全二维码可能被篡改或伪造，发布来源不可信，门票为伪造，拒绝入场。
实施例 6 ：
XYZ Inc 对 出售 的火车票生成安全信息二维码，便于移动检票和和验证乘客身份。车票的发车时间、车次席位等信息票面上已有印制，为公开信息；但实名制乘车购票用户的姓名和身份证信息为私密信息，采用公开形式如乘车后丢弃车票可能会造成乘客隐私信息泄漏。因此，本实施例采用混合信息安全二维码类型。
混合信息安全二维码是在公开信息安全二维码及私密信息安全二维码的基础上，对输入信息中的扩展信息进行单独的签名验证和加密解密运算，算法及处理流程基本相同。本实施例不再赘述其相同处理过程，只给出其不同部分和运算结果的组合信息及安全二维码图形。
本实施例中，输入信息为：
[OBJ:{TXT: G7032,Economy Class,Seat 15A,Coach 10,2016-1-5 06:18|From:Shanghai|To:Nanjing}Base:{Name:XYZ Inc|URI:http://www.xyzinc.com}DYN:{TicketSN:300000012345678|Created:2016-1-1 12:00:00|Expired:2016-1-6 00:00:00}EXT:{IDNo:31011111111111888X|Name:LiMing}]
其中， EXT 部分为扩展信息。
发布者 XYZ Inc 的私钥为：
prime256v1: 185f17ca500c3ee115e0d31b51d8314751a2c9325777f640030d17ee9dcf7ad2
对 EXT 信息采用 sha256ECDSA 算法进行签名，得到签名信息为：
sha256ECDSA:MEUCIQCez9GDoZa/daNdVGSlzAfQmj4MgS8o9gDRf4riGicq1wIgE0Lv56FtxxUkXczWrRQAPiLOjKkgLjG2vFoxgJfcu50=
用用户购票时设定的对称密钥 LM12345678 进行加密，得到的密文信息为：
aes128cbc:U2FsdGVkX186kV9MQ1CyCi+h26dmFhTYDr7kBK6GjsST7NBs8Lnh+CJV7kUk/xkP6xRpBrZdor39GgaM1MOeEw==
用竖线及括号连接以上信息，得到本实施例需编码信息如表 29 所示。
表 29 实施例 6 需编码信息
[OBJ:{TXT:G7032,Economy Class,Seat 15A,Coach 10,2016-1-5 06:18|From:Shanghai|To:Nanjing}Base:{Name:XYZ Inc|URI:http://www.xyzinc.com}DYN:{TicketSN:300000012345678|Created:2016-1-1 12:00:00|Expired:2016-1-6 00:00:00}EXT:{[aes128cbc:U2FsdGVkX186kV9MQ1CyCi+h26dmFhTYDr7kBK6GjsST7NBs8Lnh+CJV7kUk/xkP6xRpBrZdor39GgaM1MOeEw==]sha256ECDSA:MEUCIQCez9GDoZa/daNdVGSlzAfQmj4MgS8o9gDRf4riGicq1wIgE0Lv56FtxxUkXczWrRQAPiLOjKkgLjG2vFoxgJfcu50=}]
计算表 29 所示需编码信息的数字签名为：
sha256ECDSA:MEUCIGUXsg9exiigUucj5mHNIno8+DYZHRIj/PEHvY5qDnc6AiEAteH7pLT0x17Pt9EwwvTDZkdhNruyEPeSnAuQeY93IHU=
其余构造步骤与公开信息安全二维码相同，得到本实施例的组合信息如表 30 所示，其中信息头 H 符号表示混合信息安全二维码。
表 30 实施例 6 组合信息
SQR.H0100{[OBJ:{TXT:G7032,Economy Class,Seat 15A,Coach 10,2016-1-5 06:18|From:Shanghai|To:Nanjing}Base:{Name:XYZ Inc|URI:http://www.xyzinc.com}DYN:{TicketSN:300000012345678|Created:2016-1-1 12:00:00|Expired:2016-1-6 00:00:00}EXT:{[aes128cbc:U2FsdGVkX186kV9MQ1CyCi+h26dmFhTYDr7kBK6GjsST7NBs8Lnh+CJV7kUk/xkP6xRpBrZdor39GgaM1MOeEw==]sha256ECDSA:MEUCIQCez9GDoZa/daNdVGSlzAfQmj4MgS8o9gDRf4riGicq1wIgE0Lv56FtxxUkXczWrRQAPiLOjKkgLjG2vFoxgJfcu50=}]sha256ECDSA:MEUCIGUXsg9exiigUucj5mHNIno8+DYZHRIj/PEHvY5qDnc6AiEAteH7pLT0x17Pt9EwwvTDZkdhNruyEPeSnAuQeY93IHU=}CERT:{MIIBmzCCAUECAQ4wCQYHKoZIzj0EATBLMQswCQYDVQQGEwJDTjERMA8GA1UECAwIU2hhbmdoYWkxEjAQBgNVBAoMCVJpZGdlIEluYzEVMBMGA1UEAwwMUmlkZ2UgU1FSIENBMB4XDTE1MDEwMTEyNTgwMFoXDTI0MTIyOTEyNTgwMFowaTELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMRAwDgYDVQQKDAdYWVogSW5jMRMwEQYDVQQLDApTUVIgQnVyZWF1MSAwHgYDVQQDDBdYWVogSW5jIFNRUiBDZXJ0aWZpY2F0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAvAW5SS36lQ0dP+O67irIJugBvKbfFVSev1/bW5NBXkP7CPHYpE6aBoQLpqj0etID6fR/rjlEJsNB12f43wg6MwCQYHKoZIzj0EAQNJADBGAiEArsYQR7OjyRHePvXEphNO+fZH/ho6E046ALEAcv/W3WwCIQCKclH4J+Uv438i3p3SSFj9owg5Hyw267QbIn9tsGar7A==}VALID:{[fingerprint:sha1:7b8d23eca88b092db080c98a443572f142560424|Status:V|Issue:/C=CN/O=Ridge Inc/OU=SQR CA OCSP/CN=Ridge Inc SQR CA OCSP|url:https://ocsp.ridgeca.com|Created:2016-1-1 00:00|Expired:2016-1-7 00:00]sha256ECDSA:MEQCIFEfIoGnL0oBLUf6hcDYJUm1+YzQkTlzo0M9PGCljtixAiABxG4XtQFNyXU9CLfi32mBO0V8gsFk9XrXm7fd7Yo0ow==}
对表 30 所示组合信息生成二维码图形，如图 8 所示。
车票验证时，可以按照实施例 1 公开信息安全二维码流程验证，扩展信息为密文可以忽略；需要验证乘客身份信息时，扫描如图 8 所示的混合信息安全二维码后，由用户输入其设定的对称密钥，对扩展信息密文进行解密得到输入的扩展信息原文，并验证扩展信息的数字签名；验证通过则说明扩展信息由 XYZ Inc 发布，信息完整未被修改，进而查验乘客的实名身份证件等是否与扩展信息一致。
混合信息安全二维码同样可以在私密信息二维码基础上构建，只有特定用户才可解密验证扩展信息。扩展信息的签名验证和加密解密运算同样可以采用本发明所述其他对称密钥和非对称密钥算法，不再一一赘述。
以上仅为本发明构造验证方法的优选实现形式，一些常规的变形应用形式，例如在物流仓储管理等内部系统应用时，可以把数字证书缓存于验证装置数字证书存储区，二维码组合信息中数字证书部分可以省略；在发布区域形状受限的情况下，可以采用多码形式发布；在夜间或高速移动等不满足光学扫描成像的条件下，可以采用蓝牙射频无线等传输方式实现安全二维码信息的传输。
实施例 7 ：
图 2 为本发明可离线验证安全二维码构造验证装置实施例 7 结构示意图，是与实施例 1-6 所述方法对应的装置，所述装置包括：
信息输入单元S301，用于输入需编码信息和类型信息；
安全信息存储单元S302，用于安全存储私钥信息；
信息存储单元S303，用于构造装置中存储输入信息及运算结果信息；
数字证书存储单元S304，用于构造装置中存储数字证书及其有效性信息；
数字签名和信息加密运算单元S305，用于计算数字签名、更新数字证书有效性信息和信息加密；
组合信息构造及二维码等信息标签 编码运算单元S306，用于构造组合信息并进行二维码等信息标签 编码运算；
图像显示信息输出单元S307，用于显示和输出安全二维码信息；
图像扫描信息输入单元S401，用于扫描和输入安全二维码信息；
根证书存储单元S402，用于存储密钥签发机构及其指定有效性验证机构的根证书；
信息存储单元S403，用于验证装置中存储输入信息及运算结果信息；
数字证书存储单元S404，用于验证装置中存储数字证书及其有效性信息；
数字签名验证和信息解密单元S405，用于信息解密和数字证书有效性及输入信息的数字签名验证；
二维码等信息标签 识别及组合信息分析解构运算单元S406，用于二维码等信息标签 编码识别并对组合信息进行分析解构运算；
结果输出信息提示单元S407，用于安全二维码验证结果输出和信息提示。
所述装置可以分为构造装置和验证装置两个独立子装置，其中构造装置由 S301-S307 单元组成，验证装置由 S401-S407 单元组成；也可以实现为一个装置，包括以上所有单元，其中构造和验证子装置中用于信息输入、信息存储和信息显示的单元合并后可以共用同一单元。
信息输入单元 S301 和 图像扫描信息输入单元S401 ，可以采用键盘、触摸屏、摄像头、扫描器等通用部件实现。
安全信息存储单元S302，可以采用安全存储芯片、智能卡、FPGA内置ROM存储区等存储私钥信息等保密信息。其中安全存储芯片需要配合外部计算单元运行，采用加密方式读写安全存储芯片，安全性相对较低；智能卡或FPGA芯片存储，可以用其内部自带的计算单元在芯片内部进行私钥运算，只进行计算数据和运算结果的输入输出，私钥信息不能从芯片中读出，可以保证私钥信息的安全性。
信息存储单元S303、S403，数字证书存储单元S304、S404，根证书存储单元S402，可以采用通用存储单元实现。
数字签名和信息加密运算单元S305、数字签名验证和信息解密单元S405、组合信息构造及二维码等信息标签编码运算单元S306、二维码等信息标签识别及组合信息分析解构运算单元S406实现本发明方法实施例1-6中所述签名验证、加密解密、组合解构等运算，可以采用通用CPU、GPU运算单元，也可以采用DSP、FPGA、CPLD、ASIC芯片实现。
图像显示信息输出单元S307和结果输出信息提示单元S407可以采用通用液晶屏、触摸屏、蜂鸣器、音频输出单元等实现。
以上发明内容、实施方式及实施例仅以二维码为例进行说明。本发明方法及装置 对其它常见信息标签类型可无实质差别进行实施应用，不再赘述。
以上所述仅为本发明的较佳实施例而已，并不用于限制本发明，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
 工业实用性
本发明方法可广泛用于电子媒体、报纸杂志、商品包装、仓储物流、个人名片、交通车票、证书单据、移动广告、社交APP、网购交易、网银支付、移动支付等物联网、移动互联网相关应用，实施简单高效，应用成本低廉，具有很高的工业使用价值。
 序列表自由内容

Claims (10)

  1. 可离线验证安全信息标签构造验证方法，其特征在于,所述方法包括：
    输入需编码的信息和类型信息；
    对需编码信息进行数字签名运算、加密运算；
    用输入信息、加密信息、数字签名、数字证书及其有效性信息构造组合信息；
    对组合信息进行信息编码，生成安全信息标签；
    输入安全信息标签信息，按信息标签编码规则识别内含的组合信息；
    分析解密组合信息，得到输入信息、数字签名、数字证书及其有效性信息；
    验证数字证书的有效性，并用数字证书验证输入信息和数字签名；
    验证结果判断和信息输出提示；
    所述方法包含在组合信息中的数字证书有效性信息是经数字证书密钥签发机构根证书指定的有效性验证机构签名认证的数字证书当前状态信息，此有效性信息可以离线验证多级签发结构的数字证书,组合信息中只需包含发布者终端数字证书信息；验证时用数字证书签发机构及其指定的证书有效性验证机构的根证书验证数字证书信息，并用数字证书信息验证输入信息和数字签名。
  2. 根据权利要求1所述的方法,其特征在于,所述输入的需编码信息和类型信息包括但不限于：
    需编码信息为基本信息、扩展信息、目标信息、动态信息中的任意几种；
    其中，基本信息为不随单次应用变化的名称、地址、域名信息中的任意几种；目标信息为目标网址、公示信息中的任意几种；动态信息为根据单次应用而变化的生成时间、有效时间、交易信息、应用参数信息中的任意几种；扩展信息为证件号码、联系方式信息中的任意几种；类型信息为公开信息、私密信息、混合信息中的任意一种。
  3. 根据权利要求1所述的方法,其特征在于,所述数字签名、签名验证、数字证书所用的密码系统包括但不限于：
    数字签名、签名验证、数字证书使用非对称公钥密码系统，采用ECC椭圆曲线密码系统、DSA密码系统、RSA密码系统中的任意一种。
  4. 根据权利要求1所述的方法,其特征在于,所述信息加密、信息解密所用的密码系统包括但不限于：
    信息加密、信息解密使用对称密钥密码系统及非对称公钥密码系统，采用AES、3DES、RC4、IDEA、ECC、RSA、ECDH中的任意几种；用特定用户指定的对称密钥或其公钥及私钥对需加密信息进行加密和解密运算，或者用由用户公钥产生的或随机产生的对称密钥对需加密信息进行加密和解密运算，并用特定用户指定的对称密钥或其公钥及私钥对所用的由用户公钥产生的或随机产生的对称密钥进行加密和解密运算。
  5. 根据权利要求1-4任意一项所述的方法,其特征在于,所述组合信息包括但不限于：
    输入信息、加密信息、数字签名、数字证书及其有效性信息；
    其中，输入信息为输入的需编码的信息和类型信息；加密信息为用特定用户的公钥或者其指定的对称密钥对需加密信息加密后的密文以及加密算法参数信息，可以对输入信息或者整个组合信息进行加密运算；数字签名是用发布者私钥对需认证信息进行签名运算的结果，可以对输入信息或者整个组合信息进行数字签名运算；数字证书是由密钥签发机构数字签名认证的发布者身份及公钥证书；数字证书有效性信息是经密钥签发机构根证书指定的有效性验证机构签名认证的数字证书当前状态信息；
    对于专用系统，数字证书可以缓存于验证装置的数字证书存储区，组合信息内可以省略数字证书信息或者只保留数字证书散列值信息；数字证书有效性信息可以离线验证多级签发结构的数字证书,组合信息中只需包含发布者终端数字证书信息；如果不使用优选的离线验证方式，数字证书有效性信息可以省略或者只保留数字证书散列值信息。
  6. 根据权利要求1-5所述的方法，其特征在于，所述组合信息的构造组合及分析解构方法包括但不限于：
    在组合信息头部保存安全信息标签标识、类型、组合、压缩方式等信息；
    当需要编码的信息为可供任何用户读取的公开信息时：将输入信息、数字签名、数字证书及其有效性信息通过分隔符号连接构成组合信息；解构时根据组合信息头部的类型和组合方式信息，通过分隔符号将组合信息分解为各个独立信息；
    当需要编码的信息为只由特定用户读取的私密信息时：将输入信息的密文信息、数字签名、数字证书及其有效性信息通过分隔符号连接构成组合信息；解构时根据组合信息头部的类型和组合方式信息，先通过分隔符号将组合信息分解为各个独立信息，再根据密文信息中的加密算法参数，对密文信息进行解密运算得到原始输入信息；也可以先将输入信息、数字签名、数字证书及其有效性信息通过分隔符号连接，再对连接后的信息进行加密运算，以加密信息作为组合信息；解构时根据组合信息头部的类型和组合方式信息，先通过密文信息中的加密算法参数对密文信息进行解密运算，再根据分隔符号将解密后的组合信息分解为各个独立信息；
    当需要编码的信息为可由多类用户读取的混合信息时：在以上公开信息或私密信息处理方法的基础上，对扩展信息进行独立的签名加密和验证解密处理；扩展信息及扩展信息之外的其它信息可分别由不同类别的用户读取；
    对包含多字节字符的信息，可以采用UTF-8或者UTF-16形式的Unicode编码；
    组合信息构造完成后，可以再对组合信息进行压缩运算或者转换为Base64编码；解构时先对压缩的组合信息进行解压缩运算或者Base64解码，再按其组合方式解构。
  7. 根据权利要求1所述的方法，其特征在于，所述信息标签编码识别和信息输入输出方法包括但不限于：
    采用二维码、射频识别码中任意一种编码识别方法；采用不同大小级别码制或者多码形式表示；生成的信息标签图形中可以嵌入一个安全信息标签标识图形；采用光学图像传输、蓝牙射频无线传输中任意一种信息传输方法。
  8. 根据权利要求1-6所述的方法，其特征在于，所述验证和结果判断信息输出方法为：
    用数字证书签发机构及其指定的证书有效性验证机构的根证书验证数字证书信息，并用数字证书信息验证输入信息和数字签名；验证方法优选使用离线验证方式，也可以使用指定的有效性验证机构验证的方式；数字证书、输入信息和数字签名全部验证正确，则安全信息标签验证正确，编码信息来源可信，否则其信息发布来源不可信；对验证正确的安全信息标签，显示编码信息和信息标签发布者信息，允许进行与此信息标签相关的应用操作；否则提示此信息标签发布来源不可信，拒绝与此信息标签相关的应用操作。
  9. 可离线验证安全信息标签构造验证装置，其特征在于，所述装置包括：
    信息输入单元，用于输入需编码信息和类型信息；
    信息存储单元，用于存储输入信息及运算结果信息；
    安全信息存储单元，用于安全存储私钥信息；
    数字证书存储单元，用于存储数字证书及其有效性信息；
    根证书存储单元，用于存储密钥签发机构及其指定有效性验证机构的根证书；
    数字签名和信息加密运算单元，用于计算数字签名、更新数字证书有效性信息和信息加密；
    组合信息构造及信息标签编码运算单元，用于构造组合信息并进行信息标签编码运算；
    图像显示信息输出单元，用于显示和输出安全信息标签信息；
    图像扫描信息输入单元，用于扫描和输入安全信息标签信息；
    信息标签识别及组合信息分析解构运算单元，用于信息标签编码识别并对组合信息进行分析解构运算；
    数字签名验证和信息解密单元，用于信息解密和数字证书有效性及输入信息的数字签名验证；
    结果输出信息提示单元，用于安全信息标签验证结果输出和信息提示；
    所述装置存储在在组合信息中的数字证书有效性信息是经数字证书密钥签发机构根证书指定的有效性验证机构签名认证的数字证书当前状态信息，此有效性信息可以离线验证多级签发结构的数字证书,组合信息中只需包含发布者终端数字证书信息；所述装置验证运算时用数字证书签发机构及其指定的证书有效性验证机构的根证书验证数字证书信息，并用数字证书信息验证输入信息和数字签名。
  10. 根据权利要求9所述的装置，其特征在于，所述运算单元、签名单元、验证单元、存储单元及安全存储单元的运算功能和构造方式包括但不限于：
    信息编码解码、签名验证、加密解密、构造解构运算单元运算功能为权利要求3-8所述运算；单元构造方式包括通用用途存储及运算器件、DSP芯片、FPGA芯片、CPLD芯片、ASIC芯片中的任意几种。
PCT/CN2017/109793 2016-11-08 2017-11-07 可离线验证安全信息标签构造验证方法与装置 WO2018086515A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610979974.8A CN106452756B (zh) 2016-11-08 2016-11-08 可离线验证安全二维码构造验证方法与装置
CN201610979974.8 2016-11-08

Publications (1)

Publication Number Publication Date
WO2018086515A1 true WO2018086515A1 (zh) 2018-05-17

Family

ID=58207738

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/109793 WO2018086515A1 (zh) 2016-11-08 2017-11-07 可离线验证安全信息标签构造验证方法与装置

Country Status (2)

Country Link
CN (1) CN106452756B (zh)
WO (1) WO2018086515A1 (zh)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111740839A (zh) * 2020-05-26 2020-10-02 深圳市共进电子股份有限公司 一种证书验证方法、装置、终端设备及介质
CN112100983A (zh) * 2020-08-14 2020-12-18 许继集团有限公司 一种用于系统中的标识码以及标识码的生成方法
CN112257046A (zh) * 2020-11-06 2021-01-22 新大陆（福建）公共服务有限公司 一种用软件库实现可信数字身份解密和验签的方法、系统和设备
CN113704814A (zh) * 2021-07-26 2021-11-26 维沃移动通信（杭州）有限公司 信息管理方法及装置
CN114900365A (zh) * 2022-05-20 2022-08-12 帕特思科技咨询(杭州)有限公司 一种创新服务资源数据处理及安全交互方法
WO2022241531A1 (pt) * 2021-05-21 2022-11-24 Pixcard Plataforma De Inovações Financeiras Ltda Sistema de captura de pagamentos eletrônicos via aplicativo vendedor adquirente
CN116862204A (zh) * 2023-08-31 2023-10-10 山东浪潮数字商业科技有限公司 一种质量检验的计划排程方法及工具
US11915077B2 (en) 2021-08-31 2024-02-27 Cisco Technology, Inc. URL validation and redirection for scannable codes
CN117971029A (zh) * 2024-03-26 2024-05-03 安擎计算机信息股份有限公司 一种服务器系统和服务器

Families Citing this family (48)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106452756B (zh) * 2016-11-08 2018-03-30 王栋 可离线验证安全二维码构造验证方法与装置
CN106897761A (zh) * 2017-03-06 2017-06-27 山东渔翁信息技术股份有限公司 一种二维码生成方法及装置
CN107133526A (zh) * 2017-04-06 2017-09-05 深圳奥联信息安全技术有限公司 应用数据保护方法及装置
CN107248919A (zh) * 2017-06-23 2017-10-13 阿里巴巴集团控股有限公司 生成及应用图形编码的方法和装置
CN107301230A (zh) * 2017-06-23 2017-10-27 广州聪明云软件科技有限公司 基于物联网物品标识的生成方法及系统、解析方法及系统
CN107276746A (zh) * 2017-07-19 2017-10-20 河南神州数码索贝科技有限公司 一种中文字符加解密方法
CN107484032B (zh) * 2017-09-08 2018-08-03 武汉斗鱼网络科技有限公司 防止被刷的验证方法及装置
CN107835079A (zh) * 2017-11-02 2018-03-23 广州佳都数据服务有限公司 一种基于数字证书的二维码认证方法和设备
CN107682161B (zh) * 2017-11-02 2020-12-22 广州佳都数据服务有限公司 一种二维码的离线认证方法和设备
CN107909133B (zh) * 2017-11-15 2021-01-19 深圳大学 二维码生成方法、二维码解码方法以及终端
WO2019095170A1 (zh) * 2017-11-15 2019-05-23 深圳大学 二维码生成方法、二维码解码方法以及终端
CN108257226B (zh) * 2018-01-12 2020-11-27 深圳市海东青软件科技股份有限公司 扫码检票方法、系统、装置、计算机设备和存储介质
CN108256863A (zh) * 2018-01-26 2018-07-06 鼎讯网络安全技术有限公司 基于se的二维码生成、存储、识别和相关加解密的方法
CN108462699A (zh) * 2018-02-09 2018-08-28 苏州酷豆物联科技有限公司 基于时序加密的二维码生成及验证方法和系统
CN108777617B (zh) * 2018-04-17 2021-04-06 新大陆（福建）公共服务有限公司 一种可扩展的结构化安全二维码生成方法以及系统
CN108734248A (zh) * 2018-04-17 2018-11-02 新大陆（福建）公共服务有限公司 一种快速生成安全二维码的方法以及二维码的扫码方法
CN108712383A (zh) * 2018-04-17 2018-10-26 新大陆（福建）公共服务有限公司 一种离线安全二维码的生成方法及计算机可读存储介质
CN108737394B (zh) * 2018-05-08 2020-05-22 腾讯科技（深圳）有限公司 离线验证系统、扫码设备和服务器
CN108846650A (zh) * 2018-05-24 2018-11-20 北京比特大陆科技有限公司 一种实现交易信息验证的方法和装置
CN108960385A (zh) * 2018-06-29 2018-12-07 苏州酷豆物联科技有限公司 基于多重秘钥加密的二维码生成及验证方法和系统
CN109086621B (zh) * 2018-07-23 2022-05-13 深圳市科陆精密仪器有限公司 电能表检定报告数据防篡改方法和系统、存储介质
CN109087085A (zh) * 2018-07-26 2018-12-25 深圳市万通顺达科技股份有限公司 一种公交二维码的脱机支付方法及支付系统
CN109379181A (zh) * 2018-08-10 2019-02-22 航天信息股份有限公司 生成、验证二维码的方法和装置，存储介质和电子设备
CN109447623A (zh) * 2018-09-19 2019-03-08 新开普电子股份有限公司 一种基于二维码支付安全认证方法
CN109302292B (zh) * 2018-11-01 2022-02-01 北京冠群信息技术股份有限公司 文件检验方法、装置、电子设备及存储介质
CN109766973A (zh) * 2018-12-17 2019-05-17 南京熊猫电子股份有限公司 公共交通自动售检票系统移动支付的二维码
US11303450B2 (en) * 2018-12-19 2022-04-12 Visa International Service Association Techniques for securely performing offline authentication
CN109740717A (zh) * 2018-12-30 2019-05-10 尤尼泰克(嘉兴)信息技术有限公司 一种数据自我核验的编码、解码方法
WO2020143567A1 (zh) * 2019-01-07 2020-07-16 尤尼泰克(嘉兴)信息技术有限公司 一种自我核验的二维码及其编码方法
CN109862020A (zh) * 2019-02-22 2019-06-07 金邦达有限公司 信息展示和验证方法、智能卡、服务器和系统
CN109886006A (zh) * 2019-02-28 2019-06-14 尤尼泰克(嘉兴)信息技术有限公司 一种基于二维码的信息源核验方法和装置
CN111787369B (zh) * 2019-04-03 2022-05-03 深圳Tcl数字技术有限公司 一种智能电视root权限控制方法、系统及存储介质
CN110400137B (zh) * 2019-04-03 2020-12-18 深圳刷宝科技有限公司 免密支付验证系统
CN110008683A (zh) * 2019-04-17 2019-07-12 尤尼泰克(嘉兴)信息技术有限公司 一种基于二维码的证书识别方法及设备
CN110197245B (zh) * 2019-04-28 2023-06-09 新大陆（福建）公共服务有限公司 一种双码制二维码及其跨平台交互方法
CN110210270B (zh) * 2019-05-28 2024-04-09 中国电力科学研究院有限公司 二维码信息安全加固方法及系统和二维码图像解析方法及系统
CN110189126A (zh) * 2019-06-03 2019-08-30 飞天诚信科技股份有限公司 一种动态二维码的生成方法及装置
CN110533410B (zh) * 2019-07-30 2022-02-15 河南兄弟科技发展有限公司 一种支付方法
CN110391914B (zh) * 2019-09-18 2019-12-31 尤尼泰克(嘉兴)信息技术有限公司 一种基于二维码的文件获取方法及设备、二维码生成方法
CN110798319A (zh) * 2019-10-25 2020-02-14 北京国信京宁信息安全科技有限公司 电子证照离线验真系统及方法
CN110930147B (zh) * 2019-11-01 2021-12-03 北京三快在线科技有限公司 离线支付方法、装置、电子设备及计算机可读存储介质
CN111091430B (zh) * 2019-11-29 2024-04-09 航天信息股份有限公司 一种开票二维码处理方法及系统
CN111160505A (zh) * 2020-03-24 2020-05-15 绿漫科技有限公司 一种智慧社区通用二维码实现方法
CN111523867B (zh) * 2020-07-06 2020-10-09 和宇健康科技股份有限公司 人员信息管理方法、计算机设备和存储介质
CN112200286B (zh) * 2020-08-25 2023-10-03 中国物品编码中心 字符串编码的方法和装置
CN112861109B (zh) * 2021-02-07 2022-03-25 新大陆（福建）公共服务有限公司 一种基于ctid平台和前置系统生成的数字身份码及交互方法
CN113312534B (zh) * 2021-05-28 2022-08-05 中铁十一局集团第五工程有限公司 一种工程测量智慧管理平台
CN113610588A (zh) * 2021-06-25 2021-11-05 惠州学院 一种二维码加密验证方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050138527A1 (en) * 1999-02-24 2005-06-23 Datastrip (Iom) Limited Two-dimensional printed code for storing biometric information and integrated offline apparatus for reading same
CN102202051A (zh) * 2011-04-07 2011-09-28 华南农业大学 一种可信二维码系统及其应用方法
CN102779263A (zh) * 2012-06-19 2012-11-14 袁开国 基于pki和数字签名的可信二维码方案
CN105024824A (zh) * 2014-11-05 2015-11-04 祝国龙 基于非对称加密算法的可信标签的生成与验证方法及系统
CN106452756A (zh) * 2016-11-08 2017-02-22 王栋 可离线验证安全二维码构造验证方法与装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102932148B (zh) * 2012-10-25 2016-05-11 成都市易恒信科技有限公司 基于cpk认证的安全二维码防伪系统与方法
KR20140108749A (ko) * 2013-02-27 2014-09-15 한국전자통신연구원 프라이버시 보호형 문서 인증 정보 생성 장치 및 이를 이용한 프라이버시 보호형 문서 인증 방법

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050138527A1 (en) * 1999-02-24 2005-06-23 Datastrip (Iom) Limited Two-dimensional printed code for storing biometric information and integrated offline apparatus for reading same
CN102202051A (zh) * 2011-04-07 2011-09-28 华南农业大学 一种可信二维码系统及其应用方法
CN102779263A (zh) * 2012-06-19 2012-11-14 袁开国 基于pki和数字签名的可信二维码方案
CN105024824A (zh) * 2014-11-05 2015-11-04 祝国龙 基于非对称加密算法的可信标签的生成与验证方法及系统
CN106452756A (zh) * 2016-11-08 2017-02-22 王栋 可离线验证安全二维码构造验证方法与装置

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111740839A (zh) * 2020-05-26 2020-10-02 深圳市共进电子股份有限公司 一种证书验证方法、装置、终端设备及介质
CN111740839B (zh) * 2020-05-26 2023-02-17 深圳市共进电子股份有限公司 一种证书验证方法、装置、终端设备及介质
CN112100983A (zh) * 2020-08-14 2020-12-18 许继集团有限公司 一种用于系统中的标识码以及标识码的生成方法
CN112100983B (zh) * 2020-08-14 2024-05-10 许继集团有限公司 一种用于系统中的标识码以及标识码的生成方法
CN112257046A (zh) * 2020-11-06 2021-01-22 新大陆（福建）公共服务有限公司 一种用软件库实现可信数字身份解密和验签的方法、系统和设备
WO2022241531A1 (pt) * 2021-05-21 2022-11-24 Pixcard Plataforma De Inovações Financeiras Ltda Sistema de captura de pagamentos eletrônicos via aplicativo vendedor adquirente
CN113704814A (zh) * 2021-07-26 2021-11-26 维沃移动通信（杭州）有限公司 信息管理方法及装置
US11915077B2 (en) 2021-08-31 2024-02-27 Cisco Technology, Inc. URL validation and redirection for scannable codes
CN114900365A (zh) * 2022-05-20 2022-08-12 帕特思科技咨询(杭州)有限公司 一种创新服务资源数据处理及安全交互方法
CN116862204A (zh) * 2023-08-31 2023-10-10 山东浪潮数字商业科技有限公司 一种质量检验的计划排程方法及工具
CN117971029A (zh) * 2024-03-26 2024-05-03 安擎计算机信息股份有限公司 一种服务器系统和服务器
CN117971029B (zh) * 2024-03-26 2024-06-07 安擎计算机信息股份有限公司 一种服务器系统和服务器

Also Published As

Publication number Publication date
CN106452756A (zh) 2017-02-22
CN106452756B (zh) 2018-03-30

Similar Documents

Publication Publication Date Title
WO2018086515A1 (zh) 可离线验证安全信息标签构造验证方法与装置
WO2020235782A1 (ko) 분산 환경에서의 신원 인증 방법
WO2014139403A1 (zh) 一种终端主密钥tmk安全下载方法及系统
WO2011149214A2 (ko) 오티피를 생성하기 위해 홍채정보를 이용한 쓰리-팩터 사용자 인증방식과 무선통신단말기의 오티피 인증모듈을 이용한 안전한 상호인증시스템
WO2017043904A1 (en) Method and apparatus for performing payment
WO2016126052A2 (ko) 인증 방법 및 시스템
WO2018008800A1 (ko) 블록체인을 기반으로 하는 공인인증서 인증시스템과 이를 이용한 블록체인을 기반으로 하는 공인인증서 인증방법
WO2011066704A1 (zh) 一种公交一卡通业务系统及其实现方法
WO2011079753A1 (zh) 认证方法、认证交易系统和认证装置
WO2013067935A1 (zh) 用于对用户身份进行认证的方法、系统及其使用的设备
WO2014139342A1 (zh) 密钥下载方法、管理方法、下载管理方法及装置和系统
WO2017035695A1 (zh) 信息传输方法及移动设备
US20030115468A1 (en) Assignment of user certificates/private keys in token enabled public key infrastructure system
WO2014139344A1 (zh) 密钥下载方法、管理方法、下载管理方法及装置和系统
US20020098830A1 (en) Method for verifying in a mobile device the authenticity of electronic certificates issued by a certification authority and corresponding identification module
WO2010074383A1 (ko) 물품관리방법
WO2019001110A1 (zh) 权限认证方法、系统、设备及计算机可读存储介质
WO2019132555A1 (ko) 이모지가 포함된 메시지를 송수신하는 전자 장치 및 그 전자 장치를 제어하는 방법
WO2021075867A1 (ko) 블록체인 기반 시스템을 위한 키의 저장 및 복구 방법과 그 장치
WO2023106759A1 (ko) Qr코드 스캔·셀픽형 웹중개제어로 이루어진 하이브리드식 사진인화키오스크형 오프라인 이지 결제장치 및 방법
WO2018120459A1 (zh) 验证图像真伪的方法、装置、设备、存储介质及服务端
WO2006132143A1 (ja) 認証システム、認証装置、端末装置及び検証装置
WO2017188497A1 (ko) 무결성 및 보안성이 강화된 사용자 인증방법
WO2020105892A1 (ko) 디바이스가 디지털 키를 공유하는 방법
WO2017135537A1 (ko) 근거리 통신을 이용한 결제 시스템 및 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17869196

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17869196

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 01.10.2019)

122 Ep: pct application non-entry in european phase

Ref document number: 17869196

Country of ref document: EP

Kind code of ref document: A1