WO2018127081A1 - 一种加密密钥获取方法及系统 - Google Patents

一种加密密钥获取方法及系统 Download PDF

Info

Publication number
WO2018127081A1
WO2018127081A1 PCT/CN2018/071309 CN2018071309W WO2018127081A1 WO 2018127081 A1 WO2018127081 A1 WO 2018127081A1 CN 2018071309 W CN2018071309 W CN 2018071309W WO 2018127081 A1 WO2018127081 A1 WO 2018127081A1
Authority
WO
WIPO (PCT)
Prior art keywords
public key
signature
information
terminal
key
Prior art date
Application number
PCT/CN2018/071309
Other languages
English (en)
French (fr)
Inventor
李东声
Original Assignee
天地融科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 天地融科技股份有限公司 filed Critical 天地融科技股份有限公司
Publication of WO2018127081A1 publication Critical patent/WO2018127081A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present invention relates to the field of electronic technologies, and in particular, to a method and system for acquiring an encryption key.
  • the signature public key is generated by the local terminal and uploaded to the server
  • the encrypted private key is generated by the server and sent to the local terminal.
  • the server in the existing specification encrypts the encrypted private key by using the signature public key and sends it to the local terminal. Since the signature public key can be obtained by the third party, the third party can simulate the server using the signature public.
  • the key encrypts the data, and sends the ciphertext encrypted by the signature public key to the terminal in a large amount, and monitors the decrypted result of the terminal to obtain the signature private key of the terminal, so that the signature private key in the terminal is leaked.
  • the present invention is directed to solving one of the above problems.
  • the present invention provides an encryption key acquisition method, including the following steps: a terminal generates and saves a signature public key and a signature private key of the terminal based on a first security algorithm, and generates and saves a temporary public key and a temporary based on a second security algorithm. a private key, and sending the first data packet to the server, where the first data packet includes at least: the signature public key and the temporary public key; the server receives the first data packet, and obtains the And signing the public key and the temporary public key, and saving the signature public key of the terminal; the server generates and saves the encrypted public key and the encrypted private key of the terminal according to a third security algorithm, and is generated according to a fourth security algorithm.
  • the server encrypting the encryption private key by using the data encryption password to generate the first encryption information; and using the temporary public key to perform the data decryption password Encrypting operation, generating second encrypted information; and transmitting the second data packet to the terminal, wherein the second data packet includes at least: the first encrypted information And the second encrypted information; the terminal receives the second data packet, acquires the first encrypted information, performs a decryption operation on the second encrypted information by using the temporary private key, and obtains the data decryption password. Decrypting the first encrypted information by using the data decryption password to obtain the encrypted private key; and the terminal saves the encrypted private key.
  • the method further includes: the terminal is configured to perform the signature based on the first private key The public key and the temporary public key perform a signature operation to generate first signature information; the first data packet further includes the first signature information; after the server receives the first data packet, obtain the signature Before the public key and the temporary public key, the server further performs an authentication operation on the first signature information based on the first public key corresponding to the first private key, and the authentication succeeds.
  • the terminal performs a signature operation on the signature public key and the temporary public key based on the first private key to generate first signature information, including: the terminal is configured to perform the signature based on the first private key The public key performs a signature operation to generate signature public key signature information; performing a signature operation on the temporary public key based on the first private key, generating temporary public key signature information, and based on the signature public key signature information and the temporary The public key signature information generates the first signature information; the server performs an authentication operation on the first signature information based on the first public key, including: the server extracting the signature public key in the first signature information The signature information and the temporary public key signature information are used to perform an authentication operation on the signature public key signature information based on the first public key, and perform an authentication operation on the temporary public key signature information based on the first public key.
  • the terminal performs a signature operation on the signature public key and the temporary public key based on the first private key to generate first signature information, including the following steps: the terminal is based on the first private key pair Decoding a public key to perform a signature operation, generating signature public key signature information; performing a signature operation on the temporary public key based on the signature private key, generating temporary public key signature information, and based on the signature public key signature information and the The temporary public key signature information generates the first signature information; the server performs an authentication operation on the first signature information based on the first public key, and the method includes: the server extracting the signature in the first signature information Public key signature information, the temporary public key signature information, and the signature public key, performing an authentication operation on the signature public key signature information based on the first public key, and the temporary public key is based on the signature public key Signature information for authentication operations.
  • the method further includes: the server performing the first encrypted information by using a second private key
  • the second operation information is generated by the signature operation; the second data packet further includes the second signature information; and after the terminal receives the second data packet, and after acquiring the first encryption information, the terminal further includes: The terminal performs an authentication operation on the second signature information based on the second public key corresponding to the second private key. After the authentication succeeds, the first encrypted information is acquired.
  • the method further includes: the server clearing the temporary public key; after the terminal obtains the encrypted private key, the The method also includes the terminal clearing the temporary private key.
  • an encryption key acquisition system including a terminal and a server, wherein the terminal is configured to generate and save a signature public key and a signature private key based on a first security algorithm, based on the second security
  • the algorithm generates and saves a temporary public key and a temporary private key, and sends the first data packet to the server, wherein the first data packet includes at least: the signature public key and the temporary public key; the server And receiving the first data packet, acquiring the signature public key and the temporary public key, and saving the signature public key; generating and saving the encrypted public key and the encryption private of the terminal according to a third security algorithm.
  • the terminal is further configured to receive the second data packet, obtain the first encrypted information, and perform a decryption operation on the second encrypted information by using the temporary private key to obtain the Decrypting the data, decrypting the first encrypted information by using the data decryption password, obtaining the encrypted private key; and saving the encrypted private key.
  • the terminal is further configured to: before the generating the signature public key and the temporary public key, sending the first data packet to the server, before the first private key to the signature The key and the temporary public key perform a signing operation to generate first signature information; the first data packet further includes the first signature information; and the server is further configured to: after receiving the first data packet, Before the signature public key and the temporary public key are obtained, the first signature information is authenticated based on the first public key, and after the authentication succeeds, the signature public key and the temporary public key are acquired.
  • the terminal is specifically configured to generate the first signature information by performing a signature operation on the signature public key based on the first private key to generate signature public key signature information, based on the first
  • the private key performs a signature operation on the temporary public key, generates temporary public key signature information, and generates the first signature information based on the signature public key signature information and the temporary public key signature information
  • the server is specifically used to Performing an authentication letter operation on the first signature information by extracting the signature public key signature information and the temporary public key signature information in the first signature information, based on the first public key pair
  • the signature public key signature information performs an authentication operation, and performs an authentication operation on the temporary public key signature information based on the first public key.
  • the server is specifically configured to: generate the first signature information by performing a signature operation on the signature public key based on the first private key, and generate signature public key signature information;
  • the key performs a signature operation on the temporary public key, generates temporary public key signature information, and generates the first signature information based on the signature public key signature information and the temporary public key signature information;
  • the server is specifically configured to pass Performing an authentication operation on the first signature information by extracting the signature public key signature information, the temporary public key signature information, and the signature public key in the first signature information, based on the first public
  • the key performs an authentication operation on the signature public key signature information, and performs an authentication operation on the temporary public key signature information based on the signature public key.
  • the server is further configured to: after the generating the first encryption information, send the second data packet to the terminal, and perform a signature operation on the first encrypted information by using a second private key Generating second signature information; the second data packet further includes the second signature information; the terminal is further configured to: after receiving the second data packet, before acquiring the first encryption information, based on The second public key performs an authentication operation on the second signature information, and after the authentication succeeds, the first encrypted information is obtained.
  • the server is further configured to: after sending the second data packet to the terminal, clear the temporary public key; the terminal is further configured to: after obtaining the encrypted private key, clear the temporary public The key and the temporary private key.
  • the terminal when the terminal generates the signature public key and the signature private key pair, the terminal simultaneously generates a pair of temporary public key and temporary private key, and the signature public key is generated.
  • the temporary public key sending server after receiving the signed public key and the temporary public key, the server generates a data plus password and a data decryption password when generating the encrypted public key and the encrypted private key of the terminal, and performs the encrypted private key by using the data plus the password. Encryption, and then use the temporary public key to encrypt the data decryption password.
  • the third party does not have a temporary private key to decrypt the encrypted data decryption password.
  • the encrypted encrypted private key cannot be decrypted, thus ensuring the security of the encrypted private key.
  • the server encrypts and decrypts the data decryption password by using the temporary public key, even if the third direction terminal sends a large amount of encrypted ciphertext, the terminal only uses the temporary private key to decrypt the ciphertext, and the third party only monitors.
  • the temporary private key to the terminal can be obtained, thereby protecting the signature private key of the terminal.
  • FIG. 1 is a flowchart of a method for acquiring an encryption key according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic structural diagram of an encryption key acquisition system according to Embodiment 1 of the present invention.
  • This embodiment provides an encryption key acquisition method.
  • FIG. 1 is a flowchart of a method for acquiring an encryption key according to the embodiment. As shown in FIG. 1 , the method for acquiring an encryption key in this embodiment mainly includes the following steps S101 to S108.
  • the terminal generates and stores a signature public key and a signature private key of the terminal according to the first security algorithm, and generates a temporary public key and a temporary private key according to the second security algorithm.
  • the terminal is a terminal device capable of performing asymmetric encryption and decryption, for example, a terminal device such as a USBKEY, a smart card, a mobile phone, or a wearable device, and the first security algorithm and the second security algorithm are both in the terminal.
  • the stored preset asymmetric algorithm is used to generate a public-private key pair.
  • the signature public key and the signature private key generated according to the first security algorithm are the private key and the corresponding public key used by the terminal for the transaction signature, and the signature public key and the signature private
  • the key is the unique public-private key pair used by the terminal for transaction signature and verification.
  • the signature public key and the signature private key are only used in the transaction, and in some terminals, for example, USBKEY, since the transaction process requires the user to confirm that the terminal can use the signature private key for signature, therefore, the third party It is also impossible to use the signature public key for encryption to send a large amount of ciphertext to the terminal, and the monitoring terminal obtains the signature private key of the terminal by decrypting a large amount of ciphertext using the signature private key.
  • the temporary public key and the temporary private key are public-private key pairs temporarily generated by the terminal according to the second security algorithm, and the temporary public-private key pair is only used temporarily.
  • the temporary public-private key pair is only in the present embodiment. Used in the secondary key acquisition process and expires after the key acquisition ends. Therefore, even if the temporary private key is stolen externally during the key acquisition process, the subsequent terminal will not use the temporary public-private key pair again, so the illegal person cannot use the generated temporary private key for the next interaction process. , will not affect the security of users.
  • the terminal sends the first data packet to the server, where the first data packet includes at least: a signature public key and a temporary public key.
  • the terminal can send the signature public key and the temporary public key to the server through the data communication channel, and the terminal can transmit data through the wired data communication channel or the wireless data communication channel, including but not limited to the Bluetooth channel, the infrared channel, and the RFID.
  • the wired data communication channel or the wireless data communication channel including but not limited to the Bluetooth channel, the infrared channel, and the RFID.
  • Channels ZigBee channels, UltraWideBand channels, short-range communication (NFC) channels, WiMedia channels, GPS channels, and DECT channels.
  • the server receives the first data packet, obtains the signature public key and the temporary public key, and saves the signature public key of the terminal.
  • the server performs the first data packet reception through the foregoing communication channel, and after receiving the first data packet, extracts the signature public key and the temporary public key in the first data packet, and saves the signature public key as the above.
  • the signature public key of the terminal so that the signature data sent by the terminal can be checked and used in the subsequent transaction process.
  • the server generates and stores the encrypted public key and the encrypted private key of the terminal according to the third security algorithm, and generates and stores the data encryption password and the data decryption password of the terminal according to the fourth security algorithm.
  • the third security algorithm is a preset asymmetric algorithm in the server, and is used to generate a public-private key pair.
  • the fourth security algorithm is a preset security algorithm in the server, and may be an asymmetric algorithm or a symmetric method. algorithm.
  • the server generates the encrypted public key and the encrypted private key of the terminal according to the third security algorithm, and the encrypted public private key can be used when the terminal logs in to the server.
  • the login can be input to the user by using the encrypted private key when the terminal logs in.
  • the server verifies the login password submitted by the user by using the encrypted public key of the terminal according to the login password set by the user.
  • the data encryption password and the data decryption password can be used for encryption and decryption of the transmission data between the server and the terminal.
  • the data encryption password and the data decryption password are used for encrypting the terminal.
  • the encryption and decryption operation of the key, optionally, the data encryption password and the data decryption password may be a set of random numbers randomly generated by the server, and the specific form is not limited in this embodiment.
  • the server encrypts the encrypted private key by using the data plus password to generate the first encrypted information, and encrypts the data decryption by using the temporary public key to generate the second encrypted information.
  • the server encrypts the generated encrypted private key by using a data encryption password to obtain the first encrypted information, and encrypts the data decryption password by using the temporary public key acquired from the terminal to obtain the second encrypted information.
  • the data decryption and encryption private keys are separately encrypted and transmitted to ensure the security of data transmission.
  • the server sends the second data packet to the terminal, where the second data packet includes at least: first encrypted information and second encrypted information.
  • the server may send the second data packet to the terminal through a data communication channel with the terminal, for example, the server may perform data transmission through a wired data communication channel or a wireless data communication channel, including but not limited to a Bluetooth channel.
  • a wireless data communication channel including but not limited to a Bluetooth channel.
  • the terminal receives the second data packet, obtains the first encrypted information, performs a decryption operation on the second encrypted information by using the temporary private key, obtains a data decryption password, and decrypts the first encrypted information by using the data decryption password to obtain the encrypted private key.
  • the terminal after receiving the second data packet, the terminal needs to perform a two-step decryption operation for acquiring the encrypted private key generated by the server.
  • the second encrypted information is decrypted by using the temporary private key generated by the terminal itself.
  • the data decryption password is obtained.
  • the first encrypted information is decrypted by using the data decryption password to obtain the encrypted private key, and the two-step decryption operation greatly enhances the security of the encrypted private key in the transmission process.
  • the server may clear the temporary public key of the terminal.
  • the terminal may clear the temporary private key.
  • the simulation server sends the encrypted private key to the terminal to perform a ciphertext attack on the terminal, and breaks the temporary private key of the terminal, but the terminal is in the terminal. After the encrypted private key is obtained, the temporary public-private key pair is no longer used. Therefore, the user is not caused by security problems and brings security risks to the user.
  • the terminal may save the data decryption password, and in the subsequent interaction with the server, use the The data decryption password decrypts the data sent by the server.
  • the terminal saves the encrypted private key.
  • the terminal when performing step S108, may write the obtained encrypted private key to the secure memory, and the secure memory can ensure that the encrypted private key cannot be obtained externally, that is, the terminal writes the encrypted private key to the terminal once.
  • the secure memory the criminals can not read the encrypted private key from the terminal, thus ensuring the security of the encrypted private key.
  • the method before the terminal sends the first data packet to the server (ie, step S102), in order to ensure that the server can determine that the first data packet is sent by the terminal, the method may further include the following steps: The terminal performs a signature operation on the signature public key and the temporary public key based on the first private key to generate the first signature information, and the first data packet sent in the step S102 may further include the first signature information.
  • the method further includes the step of: the server performing an authentication operation on the first signature information based on the first public key, and authenticating After successful, obtain the signature public key and the temporary public key.
  • the terminal signs the transmitted signature public key and the temporary public key to ensure that the identity of the signature public key and the temporary public key are sent, and the server checks the signature information of the signature public key and the temporary public key. After the verification is passed, the signature public key and the temporary public key sent by the terminal are obtained, so that the reliability of the source of the signature public key and the temporary public key can be ensured, and the third party masquerading terminal can be prevented from sending the signature public key and the temporary public key to the server. Then, the encrypted private key generated by the server for the terminal is obtained, so that the encrypted private key of the terminal is leaked.
  • the first private key may be a private key in the pre-existing terminal, such as a birth certificate private key, and correspondingly, the first public key corresponding to the first private key is pre-stored in the server, and may be The data signed by the first private key is subjected to the verification operation.
  • the terminal performs the signature operation on the signature public key and the temporary public key, including but not limited to the following three schemes:
  • Solution 1 The terminal uses the first private key to perform signature operation on the signature public key, generates signature public key signature information, and performs signature operation on the temporary public key by using the first private key to generate temporary public key signature information, and is based on the signature public key.
  • the signature information and the temporary public key signature information generate first signature information, for example, the first signature information may be composed of signature public key signature information and temporary public key signature information;
  • Solution 2 The terminal uses the first private key to perform signature operation on the signature public key, generates signature public key signature information, and performs signature operation on the temporary public key by using the signature private key, generates temporary public key signature information, and generates signature based on the signature public key.
  • the information and the temporary public key signature information generate first signature information, for example, the first signature information may be composed of signature public key signature information and temporary public key signature information;
  • Solution 3 The terminal uses the first private key to perform a signature operation on the temporary public key, generates a signature public key signature information, and performs a signature operation on the signature public key by using the temporary private key, generates temporary public key signature information, and generates a signature based on the signature public key.
  • the information and the temporary public key signature information generate first signature information, for example, the first signature information may be composed of signature public key signature information and temporary public key signature information;
  • the server when the server performs the authentication operation on the first signature information, the server may perform a corresponding authentication operation by using a signature scheme corresponding to the terminal.
  • the server performs the authentication operation on the first signature information based on the first public key: the server performs the authentication operation on the signature public key signature information based on the first public key, and obtains the signature public key after the authentication succeeds. And performing an authentication operation on the temporary public key signature information based on the first public key, and obtaining the temporary public key after the authentication succeeds;
  • the server performs the authentication operation on the first signature information based on the first public key: the server performs the authentication operation on the signature public key signature information based on the first public key, and obtains the signature public key after the authentication succeeds, based on The signature public key authenticates the temporary public key signature information, and obtains the temporary public key after the authentication succeeds;
  • the server performs the authentication operation on the first signature information based on the first public key: the server performs the authentication operation on the temporary public key signature information based on the first public key, and obtains the temporary public key after the authentication succeeds, based on The temporary public key authenticates the signature public key signature information. After the authentication succeeds, the signature public key is obtained.
  • the method may further include the step of: the server uses the second private key to perform the signature operation on the first encrypted information, Generating the second signature information; the second data packet further includes the second signature information; correspondingly, in step S107, after the terminal receives the second data packet, and before acquiring the first encryption information, the method may further include the following steps: the terminal is based on The second public key performs an authentication operation on the second signature information, and after the authentication succeeds, the first encrypted information is obtained.
  • the second private key is a CA private key of the server, and is pre-stored in the server, and the second public key relative to the second private key may be pre-stored in the terminal, or may be a terminal and
  • the server is sent to the terminal by the server during the interaction.
  • the server performs the signature operation on the first encrypted information by using the second private key, and the terminal authenticates the first encrypted information, and after the authentication succeeds, acquires the first encrypted information, thereby ensuring the first encrypted information.
  • the reliability of the source prevents the third-party analog server from sending the encrypted private key to the terminal, thus posing a security risk to the user.
  • the server before receiving the signature public key sent by the terminal, the server performs an authentication operation on the terminal to ensure the authenticity of the signature public key, and the terminal authenticates the server before receiving the encrypted private key sent by the server. To ensure the authenticity of the encrypted private key, thereby preventing the terminal or the server from judging the information sent by the fake server or the terminal as valid information.
  • the server uses the temporary public key instead of the signature public key for encrypted transmission. Even if it is intercepted and deciphered by the third party during the transmission process, the outside world can only know the temporary private key and cannot know the signature. The private key avoids the security risks caused by selective attacks and ensures the security of the signed private key in the terminal.
  • This embodiment provides an encryption key acquisition system, which can be used to implement the encryption key acquisition method described in Embodiment 1.
  • FIG. 2 is a schematic structural diagram of an encryption key acquisition system according to an embodiment of the present invention. As shown in FIG. 2, the system mainly includes a terminal 201 and a server 202.
  • the terminal 201 is configured to generate and save a signature public key and a signature private key based on the first security algorithm, generate and save the temporary public key and the temporary private key based on the second security algorithm, and send the first data packet.
  • the first data packet includes at least: a signature public key and a temporary public key; the server 202 is configured to receive the first data packet, obtain the signature public key and the temporary public key, and save the signature public key;
  • the security algorithm generates and stores the encrypted public key and the encrypted private key of the terminal, generates and saves the data plus password and the data decryption password based on the fourth security algorithm, and encrypts the encrypted private key by using the data plus the password to generate the first encrypted information.
  • the method further includes receiving a second data packet, acquiring the first encrypted information, and performing a decryption operation on the second encrypted information by using the temporary private key to obtain a data decryption password. Decrypted data using the first operation to decrypt encrypted information to obtain encrypted private key; save private key encryption.
  • the terminal 201 generates and saves the signature public key and the signature private key based on the first security algorithm, and generates and stores the temporary public key and the temporary private key based on the second security algorithm.
  • the terminal 201 is a terminal 201 device capable of performing asymmetric encryption and decryption, and may be a terminal 201 device such as a USBKEY, a smart card, a mobile phone, or a wearable device.
  • the first security algorithm and the second security algorithm are presets stored in the terminal 201.
  • An asymmetric algorithm is used to generate a public-private key pair.
  • the signature public key and the signature private key generated according to the first security algorithm may be a private key used by the terminal 201 for transaction signature and a corresponding public key, and the signature public key and the signature private key are The terminal 201 is used for transaction signature and verification of the unique public-private key pair. That is, in this embodiment, the signature public key and the signature private key are only used in the transaction, and in some terminals, for example, USBKEY, since the transaction process requires the user to confirm the terminal, the signature private key can be used for signature, therefore, The three parties cannot use the signature public key for encryption to send a large amount of ciphertext to the terminal, and the monitoring terminal acquires the signature private key of the terminal by decrypting a large amount of ciphertext using the signature private key.
  • the temporary public key and the temporary private key are public-private key pairs temporarily generated by the terminal 201 according to the second security algorithm, and the temporary public-private key pair is only used temporarily.
  • the temporary public-private key pair is only in the present embodiment. Used during the key acquisition process, it expires after the key acquisition ends. Therefore, even if the temporary private key is stolen externally during the key acquisition process, the subsequent terminal will not use the temporary public-private key pair again, so the illegal person cannot use the generated temporary private key for the next interaction process. , will not affect the security of users.
  • the terminal 201 can send the signature public key and the temporary public key to the server 202 through the data communication channel.
  • the terminal 201 can perform data transmission through a wired data communication channel or a wireless data communication channel, including but not limited to A Bluetooth channel, an infrared channel, an RFID channel, a ZigBee channel, an UltraWideBand channel, a short-range communication (NFC) channel, a WiMedia channel, a GPS channel, a DECT channel, etc.; the server 202 performs the first data packet reception through the communication channel.
  • a wired data communication channel or a wireless data communication channel including but not limited to A Bluetooth channel, an infrared channel, an RFID channel, a ZigBee channel, an UltraWideBand channel, a short-range communication (NFC) channel, a WiMedia channel, a GPS channel, a DECT channel, etc.
  • the third security algorithm is a preset asymmetric algorithm in the server 202, and is used to generate a public-private key pair.
  • the fourth security algorithm is a preset security algorithm in the server 202, and may be an asymmetric algorithm.
  • the server 202 generates an encrypted public key and an encrypted private key according to the third security algorithm.
  • the encrypted public key can be used when the terminal logs in to the server.
  • the login password can be encrypted by using the encrypted private key when the terminal logs in.
  • the server verifies the login password submitted by the user by using the encrypted public key of the terminal according to the login password set by the user.
  • the data encryption password and the data decryption password can be used for encryption and decryption of the transmission data between the server 202 and the terminal 201.
  • the data encryption password and the data decryption password are used for the terminal 201.
  • the encryption and decryption operations of the encrypted private key, optionally, the data encryption password and the data decryption password may be a set of random numbers randomly generated by the server 202. The specific form is not limited in this embodiment.
  • the server 202 in order to ensure that the temporary public-private key pair can only be used once, can clear the temporary public key of the terminal 201 after transmitting the first encrypted information to the terminal 201. After obtaining the encrypted private key, the terminal 201 may clear the temporary private key. In this optional implementation manner, even if the third party obtains the temporary public key and the signature public key of the terminal 201, the simulation server 202 sends the encrypted private key to the terminal 201 to perform a ciphertext attack on the terminal 201, and breaks the temporary private key of the terminal 201. However, since the terminal 201 does not use the temporary public-private key pair after obtaining the encrypted private key, it does not cause security trouble to the user, and brings security risks to the user.
  • the data decryption password may be saved.
  • the data sent by the server 202 is decrypted using the data decryption code.
  • the terminal 201 can write the obtained encrypted private key into the secure memory, and the secure memory can ensure that the encrypted private key cannot be obtained externally, that is, the terminal 201 writes the encrypted private key into the terminal 201 once.
  • the secure memory the illegal agent cannot read the encrypted private key from the terminal 201, thereby ensuring the security of the encrypted private key.
  • the terminal 201 in order to ensure that the server 202 can determine that the first data packet is sent by the terminal 201, the terminal 201 is further configured to use the first private key before sending the first data packet to the server 202. And signing the signature public key and the temporary public key to generate first signature information; the first data packet further includes first signature information; the server 202 is further configured to: before acquiring the signature public key and the temporary public key, based on the first public key The first signature information is authenticated. After the authentication succeeds, the signature public key and the temporary public key are obtained.
  • the first private key is a private key pre-existing in the terminal 201, such as a birth certificate private key, and correspondingly, the server 202 prestores a first public key corresponding to the first private key. Checking the data signed by the first private key.
  • the terminal 201 is specifically configured to obtain the first signature information by signing the signature public key and the temporary public key by using, but not limited to, the following three signature schemes:
  • the terminal 201 performs a signature operation on the signature public key by using the first private key, generates signature public key signature information, and performs a signature operation on the temporary public key by using the first private key to generate temporary public key signature information, and is based on the signature public
  • the first signature information is generated by the key signature information and the temporary public key signature information
  • the terminal 201 performs a signature operation on the signature public key by using the first private key, generates a signature public key signature information, and performs a signature operation on the temporary public key by using the signature private key to generate temporary public key signature information, and is based on the signature public key.
  • the signature information and the temporary public key signature information generate first signature information;
  • Solution 3 The terminal 201 performs a signature operation on the temporary public key by using the first private key, generates signature public key signature information, and performs a signature operation on the signature public key by using the temporary private key to generate temporary public key signature information, and is based on the signature public key.
  • the signature information and the temporary public key signature information generate first signature information.
  • the server 202 is specifically configured to authenticate the first signature information by using, but not limited to, the following three authentication schemes:
  • Solution 1 The server 202 performs the authentication operation on the signature public key signature information based on the first public key. After the authentication succeeds, the server obtains the signature public key, performs the authentication operation on the temporary public key signature information based on the first public key, and obtains the temporary public key after the authentication succeeds. ;
  • Solution 2 The server 202 performs the authentication operation on the signature public key signature information based on the first public key. After the authentication succeeds, the signature public key is obtained, and the temporary public key signature information is authenticated based on the signature public key. After the authentication succeeds, the temporary public key is obtained.
  • Solution 3 The server 202 performs the authentication operation on the temporary public key signature information based on the first public key. After the authentication succeeds, the temporary public key is obtained, and the signature public key signature information is authenticated based on the temporary public key. After the authentication succeeds, the signature public key is obtained.
  • the server 202 in order to ensure the identity of the server, is further configured to perform the signature operation on the first encrypted information by using the second private key before sending the first encrypted information to the terminal 201.
  • the second signature information is generated.
  • the second data packet further includes the second signature information.
  • the terminal 201 is further configured to perform the authentication operation on the second signature information based on the second public key before acquiring the first encryption information.
  • the first encrypted information correspondsly, the terminal 201 is further configured to perform an authentication operation on the second signature information based on the second public key before acquiring the first encrypted information, and obtain the first encrypted information after the authentication succeeds.
  • the second private key may be a CA private key, which is pre-stored in the server 202, and the second public key relative to the second private key may be pre-stored in the terminal 201, or may be the terminal 201 and
  • the server 202 is sent by the server 202 to the terminal 201 during the interaction.
  • the server 202 performs the signature operation on the first encrypted information by using the second private key, and the terminal 201 authenticates the first encrypted information, and after the authentication succeeds, acquires the first encrypted information, thereby ensuring the first The reliability of the source of the encrypted information is avoided, and the third-party analog server 202 is prevented from transmitting the encrypted private key to the terminal 201, thereby posing a security risk to the user.
  • the server 202 before receiving the signature public key sent by the terminal 201, the server 202 performs an authentication operation on the terminal 201 to ensure the authenticity of the signature public key. Before the terminal 201 receives the encrypted private key sent by the server 202, the terminal 201 receives the encrypted public key. The server 202 is authenticated to ensure the authenticity of the encrypted private key, thereby preventing the terminal 201 or the server 202 from judging the information sent by the fake server 202 or the terminal 201 as valid information. In addition, in the solution provided by the embodiment, the server 202 adopts The temporary public key is not encrypted by the signature public key.
  • a "computer-readable medium” can be any apparatus that can contain, store, communicate, propagate, or transport a program for use in an instruction execution system, apparatus, or device, or in conjunction with the instruction execution system, apparatus, or device.
  • portions of the invention may be implemented in hardware, software, firmware or a combination thereof.
  • multiple steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system.
  • a suitable instruction execution system For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques well known in the art: having logic gates for implementing logic functions on data signals. Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种加密密钥获取方法及系统，其中，该方法包括：终端生成并保存终端的签名公钥、签名私钥、保存临时公钥和临时私钥，至少将签名公钥和临时公钥发送给服务器；服务器获取签名公钥和临时公钥，保存签名公钥；服务器生成并保存终端的加密公钥、加密私钥、数据加密码和数据解密码；利用数据加密码对加密私钥进行加密操作，生成第一加密信息；利用临时公钥对数据解密码进行加密操作，生成第二加密信息；并至少将第一加密信息和第二加密信息发送至终端；终端获取第一加密信息，利用临时私钥对第二加密信息进行解密操作，获得数据解密码，利用数据解密码对第一加密信息进行解密操作，获得加密私钥；终端保存加密私钥。

Description

一种加密密钥获取方法及系统
相关申请的交叉引用
本申请基于申请号为201710003528.8，申请日为2017年1月4日，发明名称为数一种加密密钥获取方法及系统的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本发明涉及一种电子技术领域，尤其涉及一种加密密钥获取方法及系统。
背景技术
2012年11月22日，中华人民共和国国家质量监督检验检疫总局颁布了《GM-T0016-2012智能密码钥匙密码应用接口规范》，规定了基于PKI密码体制的智能密码钥匙密码应用接口，描述了密码应用接口的函数、数据类型、参数的定义和设备的安全要求，适用于智能密码钥匙产品的研制、使用和检测。
然而在上述现有规范《GM-T0016-2012智能密码钥匙密码应用接口规范》中，目前存在以下风险：签名公钥由本地终端生成并上传至服务器，加密私钥由服务器生成并发送至本地终端，但在下载过程中，现有规范中的服务器利用签名公钥对加密私钥进行加密后发送至本地终端，由于签名公钥可被第三方获取，这就导致第三方能够模拟服务器使用签名公钥对数据进行加密，大量地向终端发送签名公钥加密的密文，通过能终端的解密结果进行监控，从而获得终端的签名私钥，导致终端中的签名私钥被泄漏。
发明内容
本发明旨在解决上述问题之一。
为达到上述目的，本发明的技术方案具体是这样实现的：
本发明提供了一种加密密钥获取方法，包括以下步骤：终端基于第一安全算法生成并保存所述终端的签名公钥和签名私钥，基于第二安全算法生成并保存临时公钥和临时私钥，并将第一数据包发送至服务器，其中，所述第一数据包至少包括：所述签名公钥和所述临时公钥；所述服务器接收所述第一数据包，获取所述签名公钥和所述临时公钥，保存所述终端的所述签名公钥；所述服务器基于第三安全算法生成并保存所述终端的加密公钥和加密私钥，基于第四安全算法生成并保存终端的数据加密码和数据解密码；所述服务器利用所述数据加密码对所述加密私钥进行加密操作，生成第一加密信息；利用所述临时公钥对所述数据解密 码进行加密操作，生成第二加密信息；并将第二数据包发送至所述终端，其中，所述第二数据包至少包括：所述第一加密信息和所述第二加密信息；所述终端接收所述第二数据包，获取所述第一加密信息，利用所述临时私钥对所述第二加密信息进行解密操作，获得所述数据解密码，利用所述数据解密码对所述第一加密信息进行解密操作，获得所述加密私钥；所述终端保存所述加密私钥。
可选地，所述终端生成所述签名公钥和所述临时公钥之后，将所述第一数据包发送至所述服务器之前，还包括：所述终端基于第一私钥对所述签名公钥和所述临时公钥进行签名操作，生成第一签名信息；所述第一数据包还包括所述第一签名信息；所述服务器接收到所述第一数据包之后，获取所述签名公钥和所述临时公钥之前，还包括：所述服务器基于所述第一私钥对应的第一公钥对所述第一签名息进行认证操作，且认证成功。
可选地，所述终端基于第一私钥对所述签名公钥和所述临时公钥进行签名操作，生成第一签名信息，包括：所述终端基于所述第一私钥对所述签名公钥进行签名操作，生成签名公钥签名信息；基于所述第一私钥对所述临时公钥进行签名操作，生成临时公钥签名信息，并基于所述签名公钥签名信息和所述临时公钥签名信息生成所述第一签名信息；所述服务器基于第一公钥对所述第一签名信息进行认证操作，包括：所述服务器提取所述第一签名信息中的所述签名公钥签名信息和所述临时公钥签名信息，基于所述第一公钥对所述签名公钥签名信息进行认证操作，基于所述第一公钥对所述临时公钥签名信息进行认证操作。
可选地，所述终端基于第一私钥对所述签名公钥和所述临时公钥进行签名操作，生成第一签名信息，包括以下步骤：所述终端基于所述第一私钥对所述签名公钥进行签名操作，生成签名公钥签名信息；基于所述签名私钥对所述临时公钥进行签名操作，生成临时公钥签名信息，并基于所述签名公钥签名信息和所述临时公钥签名信息生成所述第一签名信息；所述服务器基于第一公钥对所述第一签名信息进行认证操作，包括步骤：所述服务器提取所述第一签名信息中的所述签名公钥签名信息、所述临时公钥签名信息和所述签名公钥，基于所述第一公钥对所述签名公钥签名信息进行认证操作，基于所述签名公钥对所述临时公钥签名信息进行认证操作。
可选地，所述服务器生成所述第一加密信息之后，将所述第二数据包发送至所述终端之前，还包括步骤：所述服务器利用第二私钥对所述第一加密信息进行签名操作，生成第二签名信息；所述第二数据包还包括所述第二签名信息；所述终端接收到所述第二数据包之后，获取所述第一加密信息之前，还包括：所述终端基于与所述第二私钥对应的第二公钥对所述第二签名信息进行认证操作，认证成功后，获取所述第一加密信息。
可选地，在所述服务器将第二数据包发送至所述终端之后，所述方法还包括：所述服务 器清除所述临时公钥；在所述终端获得所述加密私钥之后，所述方法还包括：所述终端清除所述临时私钥。
根据本发明另一个方面，提供了一种加密密钥获取系统，包括终端和服务器，其中，所述终端，用于基于第一安全算法生成并保存签名公钥和签名私钥，基于第二安全算法生成并保存临时公钥和临时私钥，并将第一数据包发送至所述服务器，其中，所述第一数据包至少包括：所述签名公钥和所述临时公钥；所述服务器，用于接收所述第一数据包，获取所述签名公钥和所述临时公钥，并保存所述签名公钥；基于第三安全算法生成并保存所述终端的加密公钥和加密私钥，基于第四安全算法生成并保存数据加密码和数据解密码；利用所述数据加密码对所述加密私钥进行加密操作，生成第一加密信息；利用所述临时公钥对所述数据解密码进行加密操作，生成第二加密信息；将第二数据包发送至所述终端，其中，所述第二数据包至少包括：所述第一加密信息和所述第二加密信息；所述终端，还用于接收所述第二数据包，获取所述第一加密信息，利用所述临时私钥对所述第二加密信息进行解密操作，获得所述数据解密码，利用所述数据解密码对所述第一加密信息进行解密操作，获得所述加密私钥；保存所述加密私钥。
可选地，所述终端，还用于在生成所述签名公钥和所述临时公钥之后，将所述第一数据包发送至所述服务器之前，基于第一私钥对所述签名公钥和所述临时公钥进行签名操作，生成第一签名信息；所述第一数据包还包括所述第一签名信息；所述服务器，还用于在接收到所述第一数据包之后，获取所述签名公钥和所述临时公钥之前，基于所述第一公钥对所述第一签名信息进行认证操作，认证成功后，获取所述签名公钥和所述临时公钥。
可选地，所述终端具体用于通过以下方式生成所述第一签名信息：基于所述第一私钥对所述签名公钥进行签名操作，生成签名公钥签名信息；基于所述第一私钥对所述临时公钥进行签名操作，生成临时公钥签名信息，并基于所述签名公钥签名信息和所述临时公钥签名信息生成所述第一签名信息；所述服务器具体用于通过以下方式对所述第一签名信息进行认证信操作：提取所述第一签名信息中的所述签名公钥签名信息和所述临时公钥签名信息，基于所述第一公钥对所述签名公钥签名信息进行认证操作，基于所述第一公钥对所述临时公钥签名信息进行认证操作。
可选地，所述服务器具体用于通过以下方式生成所述第一签名信息：基于所述第一私钥对所述签名公钥进行签名操作，生成签名公钥签名信息；基于所述签名私钥对所述临时公钥进行签名操作，生成临时公钥签名信息，并基于所述签名公钥签名信息和所述临时公钥签名信息生成所述第一签名信息；所述服务器具体用于通过以下方式对所述第一签名信息进行认证操作：提取所述第一签名信息中的所述签名公钥签名信息、所述临时公钥签名信息和所述 签名公钥，基于所述第一公钥对所述签名公钥签名信息进行认证操作，基于所述签名公钥对所述临时公钥签名信息进行认证操作。
可选地，所述服务器，还用于在生成所述第一加密信息之后，将所述第二数据包发送至所述终端之前，利用第二私钥对所述第一加密信息进行签名操作，生成第二签名信息；所述第二数据包还包括所述第二签名信息；所述终端，还用于在接收到所述第二数据包之后，获取所述第一加密信息之前，基于第二公钥对所述第二签名信息进行认证操作，认证成功后，获取所述第一加密信息。
可选地，所述服务器还用于在将第二数据包发送至所述终端之后，清除所述临时公钥；所述终端还用于在获得所述加密私钥之后，清除所述临时公钥和所述临时私钥。
由上述本发明提供的技术方案可以看出，在本实施例提供的方案中，终端在生成签名公钥和签名私钥对时，同时生成一对临时公钥和临时私钥，将签名公钥和临时公钥发送服务器，服务器在接收签名公钥和临时公钥之后，在生成终端的加密公钥和加密私钥时，生成数据加密码和数据解密码，使用数据加密码对加密私钥进行加密，再使用临时公钥对数据解密码进行加密，因此，即使加密的加密私钥在传输过程中被第三方截取，但由于第三方没有临时私钥无法对加密的数据解密码进行解密，从而无法对加密的加密私钥进行解密，从而保证了加密私钥的安全。另外，由于服务器采用临时公钥对数据解密码进行加密并外发，因此，即使第三方向终端大量发送加密密文，终端也只会使用临时私钥对密文进行解密，第三方通过监控只能获得到终端的临时私钥，从而保护了终端的签名私钥。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他附图。
图1为本发明实施例1提供的一种加密密钥获取方法的流程图；以及
图2为本发明实施例1提供的一种加密密钥获取系统的架构示意图。
具体实施方式
下面结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明的保护范围。
下面将结合附图和实施例对本发明进行详细描述。
实施例1
本实施例提供一种加密密钥获取方法。
图1为本实施例提供的一种加密密钥获取方法的流程图，如图1所示，本实施例的加密密钥获取方法主要包括以下步骤S101至步骤S108。
S101，终端基于第一安全算法生成并保存终端的签名公钥和签名私钥，基于第二安全算法生成临时公钥和临时私钥。
其中，在本实施例中，终端为能够进行非对称加解密的终端设备，例如，可以为USBKEY、智能卡、手机、可穿戴设备等终端设备，第一安全算法与第二安全算法均为终端内存储的预设非对称算法，用于产生公私钥对，根据第一安全算法生成的签名公钥和签名私钥为终端用于交易签名的私钥及相应公钥，且签名公钥和签名私钥为终端用于交易签名及验签的唯一公私钥对。在本实施例中，签名公钥和签名私钥只在交易中使用，并且，在某些终端中，例如，USBKEY，由于交易过程需要用户确认终端才能使用签名私钥进行签名，因此，第三方也无法使用签名公钥进行加密向终端发送大量密文，而通过监测终端对使用签名私钥对大量密文进行解密而获取终端的签名私钥。
在本实施例中，临时公钥和临时私钥为终端根据第二安全算法临时生成的公私钥对，该临时公私钥对只作为临时使用，在本实施例中，临时公私钥对只在本次密钥获取过程中使用，在密钥获取结束之后失效。因此，即使在密钥获取过程中临时私钥被外部窃取，由于后续终端不会再使用该临时公私钥对，因此，所以不法人员也无法将本次生成的临时私钥用于下次交互过程，不会对用户的安全造成影响。
S102，终端将第一数据包发送至服务器，其中，第一数据包至少包括：签名公钥和临时公钥。
在具体应用中，终端可以通过数据通信通道将签名公钥和临时公钥发送至服务器，终端可以通过有线数据通信通道或无线数据通信通道进行数据传输，包括但不限于蓝牙通道、红外通道、RFID通道、ZigBee通道、超宽频(UltraWideBand)通道、短距通信(NFC)通道、WiMedia通道、GPS通道、以及DECT通道等。
S103，服务器接收第一数据包，获取签名公钥和临时公钥，并保存终端的签名公钥。
在本实施例中，服务器通过上述通信通道进行第一数据包接收，并在接收到第一数据包之后，提取第一数据包中的签名公钥和临时公钥，将签名公钥保存为上述终端的签名公钥，从而可以在后续交易过程中，使用该签名公钥对终端发送的签名数据进行验签。
S104，服务器基于第三安全算法生成并保存终端的加密公钥和加密私钥，基于第四安全算法生成并保存终端的数据加密码和数据解密码。
在本实施例中，第三安全算法为服务器中预设的非对称算法，用于产生公私钥对，第四安全算法为服务器中预设的安全算法，可以为非对称算法，也可以为对称算法。
在本实施例中，服务器根据第三安全算法生成终端的加密公钥和加密私钥，加密公私钥可以在终端登录服务器时使用，例如，可以在终端登录时使用加密私钥对用户输入的登录密码进行加密，提交到服务器之后，服务器根据用户设置的登录密码，使用该终端的加密公钥，对用户提交的登录密码进行验证。
另外，在本实施例中，数据加密码和数据解密码可以用于服务器与终端之间的传输数据的加解密，在本实施例中，数据加密码和数据解密码用于对终端的加密私钥的加解密操作，可选地，数据加密码和数据解密码可以为服务器随机生成的一组随机数，具体形式本实施例不作限定。
S105，服务器利用数据加密码对加密私钥进行加密操作，生成第一加密信息；利用临时公钥对数据解密码进行加密操作，生成第二加密信息。
在本实施例中，服务器利用数据加密码将生成的加密私钥进行加密操作，获得第一加密信息，并利用从终端获取的临时公钥对数据解密码进行加密操作，获得第二加密信息，通过对数据解密码和加密私钥分别进行加密后进行传输，保证数据传输的安全性。
S106，服务器将第二数据包发送至终端，其中，第二数据包至少包括：第一加密信息、第二加密信息。
在本实施例中，服务器可以通过与所述终端的数据通信通道将第二数据包发送至终端，例如，服务器可以通过有线数据通信通道或无线数据通信通道进行数据传输，包括但不限于蓝牙通道、红外通道、RFID通道、ZigBee通道、超宽频(UltraWideBand)通道、短距通信(NFC)通道、WiMedia通道、GPS通道、DECT通道等。
S107，终端接收第二数据包，获取第一加密信息，利用临时私钥对第二加密信息进行解密操作，获得数据解密码，利用数据解密码对第一加密信息进行解密操作，获得加密私钥。
在本实施例中，终端接收到第二数据包后，为获取服务器生成的加密私钥，需要进行两步解密操作，第一，利用终端自身生成的临时私钥对第二加密信息进行解密操作，获得数据解密码；第二，利用数据解密码对第一加密信息进行解密操作，获得加密私钥，通过两步解密操作，大大增强了加密私钥在传输过程中的安全性。
在本发明实施例的一个可选实施方案中，为了保证临时公私钥对只能被使用一次，在步骤S106之后，服务器可以清除该终端的临时公钥。而在步骤S107中，终端在获取加密私钥 之后，可以清除所述临时私钥。通过该可选实施方式中，即使第三方获取到终端的临时公钥和签名公钥，模拟服务器向终端发送加密私钥进而对终端进行密文攻击，攻破终端的临时私钥，但由于终端在获取到加密私钥之后，不会再使用该临时公私钥对，因此，不会对用户造成安全困扰，给用户带来安全隐患。
在本发明实施例的一个可选实施方案中，终端利用临时私钥对第二加密信息进行解密操作得到数据解密码之后，可以保存该数据解密码，在后续与服务器的交互过程中，使用该数据解密码对服务器发送的数据进行解密。
S108，终端保存加密私钥。
在具体应用中，在执行步骤S108时，终端可以将获得的加密私钥写入安全存储器，安全存储器能够保证加密私钥不可被外部获取，也就是说，终端一旦将加密私钥写入终端内部的安全存储器，不法分子无法从终端读取加密私钥，从而保证了加密私钥的安全性。
在本发明实施例的一个可选实施方案中，在终端向服务器发送第一数据包(即步骤S102)之前，为了保证服务器可以确定第一数据包是终端发送的，该方法还可以包括步骤：终端基于第一私钥对签名公钥和临时公钥进行签名操作，生成第一签名信息；而步骤S102发送的第一数据包中还可以包括第一签名信息。相应地，在步骤S103中，在服务器接收到第一数据包之后，在服务器获取签名公钥和临时公钥之前，还包括步骤：服务器基于第一公钥对第一签名信息进行认证操作，认证成功后，获取签名公钥和临时公钥。通过该可选实施方式，终端对发送的签名公钥和临时公钥进行签名，以保证发送签名公钥和临时公钥的身份，而服务器对签名公钥和临时公钥的签名信息进行验签，在验证通过之后，再获取终端发送的签名公钥和临时公钥，从而可以保证签名公钥和临时公钥来源的可靠性，避免第三方伪装终端向服务器发送签名公钥和临时公钥，进而获取到服务器为终端生成的加密私钥，从而导致终端的加密私钥被泄漏。
在上述可选实施方式中，第一私钥可以为预存在终端中的私钥，例如出生证私钥，相应地，服务器中预存有与第一私钥相对应的第一公钥，可对第一私钥签名后的数据进行验签操作。
在本实施例中，终端对签名公钥和临时公钥进行签名操作包括但不限于以下三种方案：
方案一：终端利用第一私钥对签名公钥进行签名操作，生成签名公钥签名信息，并利用第一私钥对临时公钥进行签名操作，生成临时公钥签名信息，并基于签名公钥签名信息和临时公钥签名信息生成第一签名信息，例如，第一签名信息可以由签名公钥签名信息和临时公钥签名信息组成；
方案二：终端利用第一私钥对签名公钥进行签名操作，生成签名公钥签名信息，并利用 签名私钥对临时公钥进行签名操作，生成临时公钥签名信息，并基于签名公钥签名信息和临时公钥签名信息生成第一签名信息，例如，第一签名信息可以由签名公钥签名信息和临时公钥签名信息组成；
方案三：终端利用第一私钥对临时公钥进行签名操作，生成签名公钥签名信息，并利用临时私钥对签名公钥进行签名操作，生成临时公钥签名信息，并基于签名公钥签名信息和临时公钥签名信息生成第一签名信息，例如，第一签名信息可以由签名公钥签名信息和临时公钥签名信息组成；
相应地，服务器在对第一签名信息进行认证操作时，可以采用与终端对应的签名方案进行相应的认证操作。
例如，与上述方案一相对应，服务器基于第一公钥对第一签名信息进行认证操作的方案为：服务器基于第一公钥对签名公钥签名信息进行认证操作，认证成功后获取签名公钥，并基于第一公钥对临时公钥签名信息进行认证操作，认证成功后获取临时公钥；
与上述方案二相对应，服务器基于第一公钥对第一签名信息进行认证操作的方案为：服务器基于第一公钥对签名公钥签名信息进行认证操作，认证成功后获取签名公钥，基于签名公钥对临时公钥签名信息进行认证操作，认证成功后获取临时公钥；
与上述方案三相对应，服务器基于第一公钥对第一签名信息进行认证操作的方案为：服务器基于第一公钥对临时公钥签名信息进行认证操作，认证成功后获取临时公钥，基于临时公钥对签名公钥签名信息进行认证操作，认证成功后获取签名公钥。
在本发明实施例的一个可选实施方案中，为了保证服务器的身份，在步骤S105之后，步骤S106之前，该方法还可以包括步骤：服务器利用第二私钥对第一加密信息进行签名操作，生成第二签名信息；第二数据包还包括第二签名信息；相应地，在步骤S107中，终端接收到第二数据包之后，获取第一加密信息之前，该方法还可以包括步骤：终端基于第二公钥对第二签名信息进行认证操作，认证成功后，获取第一加密信息。其中，在该可选实施方式中，第二私钥为服务器的CA私钥，预存于服务器中，与第二私钥相对于的第二公钥可以是预存于终端中，也可以是终端与服务器交互过程中由服务器发送至终端。在该可选实施方式中，服务器通过利用第二私钥对第一加密信息进行签名操作，终端对第一加密信息进行认证，在认证成功之后，获取第一加密信息，从而保证第一加密信息来源的可靠性，避免第三方模拟服务器向终端发送加密私钥，从而给用户带来安全隐患。
通过本实施例提供的加密密钥获取方法，服务器接收终端发送的签名公钥之前，对终端进行认证操作，保证签名公钥的真实性，终端接收服务器发送的加密私钥之前，对服务器进行认证，保证加密私钥的真实性，从而避免终端或服务器将虚假服务器或终端发送的信息判 断为有效信息。此外，在本实施例提供的方案中，服务器采用临时公钥而非签名公钥进行加密传输，即使在传输过程中被第三方截取并破译，外界也仅能够得知临时私钥，无法获知签名私钥，从而避免了选择性攻击带来的安全隐患，保证终端中签名私钥的安全性。
实施例2
本实施例提供一种加密密钥获取系统，该系统可以用于实现实施例1所述的加密密钥获取方法。
图2为本实施例提供的一种加密密钥获取系统的架构示意图，如图2所示，该系统主要包括终端201和服务器202。
在本实施例中，终端201，用于基于第一安全算法生成并保存签名公钥和签名私钥，基于第二安全算法生成并保存临时公钥和临时私钥，并将第一数据包发送至服务器202，其中，第一数据包至少包括：签名公钥和临时公钥；服务器202，用于接收第一数据包，获取签名公钥和临时公钥，并保存签名公钥；基于第三安全算法生成并保存所述终端的加密公钥和加密私钥，基于第四安全算法生成并保存数据加密码和数据解密码；利用数据加密码对加密私钥进行加密操作，生成第一加密信息；利用临时公钥对数据解密码进行加密操作，生成第二加密信息；并将第二数据包发送至终端201，其中，第二数据包至少包括：第一加密信息、第二加密信息；终端201，还用于接收第二数据包，获取第一加密信息，利用临时私钥对第二加密信息进行解密操作，获得数据解密码，利用数据解密码对第一加密信息进行解密操作，获得加密私钥；保存加密私钥。
在本实施例中，终端201基于第一安全算法生成并保存签名公钥和签名私钥，基于第二安全算法生成并保存临时公钥和临时私钥。其中，终端201为能够进行非对称加解密的终端201设备，可以为USBKEY、智能卡、手机、可穿戴设备等终端201设备，第一安全算法与第二安全算法均为终端201内存储的预设非对称算法，用于产生公私钥对，根据第一安全算法生成的签名公钥和签名私钥可以为终端201用于交易签名的私钥及相应公钥，且签名公钥和签名私钥为终端201用于交易签名及验签的唯一公私钥对。即在本实施例中，签名公钥和签名私钥只在交易中使用，并且，在某些终端中，例如，USBKEY，由于交易过程需要用户确认终端才能使用签名私钥进行签名，因此，第三方也无法使用签名公钥进行加密向终端发送大量密文，而通过监测终端对使用签名私钥对大量密文进行解密而获取终端的签名私钥。
在本实施例中，临时公钥和临时私钥为终端201根据第二安全算法临时生成的公私钥对，该临时公私钥对只作为临时使用，在本实施例中，临时公私钥对只在本次密钥获取过程中使用，在密钥获取结束之后失效。因此，即使在密钥获取过程中临时私钥被外部窃取，由于后续终端不会再使用该临时公私钥对，因此，所以不法人员也无法将本次生成的临时私钥 用于下次交互过程，不会对用户的安全造成影响。
在本实施例中，终端201可以通过数据通信通道将签名公钥和临时公钥发送至服务器202，具体地，终端201可以通过有线数据通信通道或无线数据通信通道进行数据传输，包括但不限于蓝牙通道、红外通道、RFID通道、ZigBee通道、超宽频(UltraWideBand)通道、短距通信(NFC)通道、WiMedia通道、GPS通道、DECT通道等；服务器202通过上述通信通道进行第一数据包接收。
在本实施例中，第三安全算法为服务器202中预设的非对称算法，用于产生公私钥对，第四安全算法为服务器202中预设的安全算法，可以为非对称算法，也可以为对称算法；服务器202根据第三安全算法生成加密公钥和加密私钥，加密公私钥可以在终端登录服务器时使用，例如，可以在终端登录时使用加密私钥对用户输入的登录密码进行加密，提交到服务器之后，服务器根据用户设置的登录密码，使用该终端的加密公钥，对用户提交的登录密码进行验证。
另外，在本实施例中，数据加密码和数据解密码可以用于服务器202与终端201之间的传输数据的加解密，在本实施例中，数据加密码和数据解密码用于对终端201的加密私钥的加解密操作，可选地，数据加密码和数据解密码可以为服务器202随机生成的一组随机数，具体形式本实施例不作限定。
在本发明实施例的一个可选实施方案中，为了保证临时公私钥对只能被使用一次，服务器202在向终端201发送第一加密信息之后，可以清除终端201的临时公钥。终端201在获取加密私钥之后，可以清除所述临时私钥。通过该可选实施方式中，即使第三方获取到终端201的临时公钥和签名公钥，模拟服务器202向终端201发送加密私钥进而对终端201进行密文攻击，攻破终端201的临时私钥，但由于终端201在获取到加密私钥之后，不会再使用该临时公私钥对，因此，不会对用户造成安全困扰，给用户带来安全隐患。
在本发明实施例的一个可选实施方案中，终端201利用临时私钥对第二加密信息进行解密操作得到数据解密码之后，可以保存该数据解密码，在后续与服务器202的交互过程中，使用该数据解密码对服务器202发送的数据进行解密。
终端201在保存加密私钥时，可以将获得的加密私钥写入安全存储器，安全存储器能够保证加密私钥不可被外部获取，也就是说，终端201一旦将加密私钥写入终端201内部的安全存储器，不法份子无法从终端201读取加密私钥，从而保证了加密私钥的安全性。
在本发明实施例的一个可选实施方案中，为了保证服务器202可以确定第一数据包是终端201发送的，终端201还用于在向服务器202发送第一数据包之前，基于第一私钥对签名公钥和临时公钥进行签名操作，生成第一签名信息；第一数据包还包括第一签名信息；服务 器202还用于在获取签名公钥和临时公钥之前，基于第一公钥对第一签名信息进行认证操作，认证成功后，才获取签名公钥和临时公钥。
在上述可选实施方式中，第一私钥为预存在终端201中的私钥，例如出生证私钥，相应地，服务器202中预存有与第一私钥相对应的第一公钥，可对第一私钥签名后的数据进行验签操作。
在本发明实施例的一个可选实施方案中，终端201具体用于通过但不限于以下三种签名方案对所述签名公钥和临时公钥进行签名得到第一签名信息：
方案一：终端201利用第一私钥对签名公钥进行签名操作，生成签名公钥签名信息，并利用第一私钥对临时公钥进行签名操作，生成临时公钥签名信息，并基于签名公钥签名信息和临时公钥签名信息生成第一签名信息；
方案二：终端201利用第一私钥对签名公钥进行签名操作，生成签名公钥签名信息，并利用签名私钥对临时公钥进行签名操作，生成临时公钥签名信息，并基于签名公钥签名信息和临时公钥签名信息生成第一签名信息；
方案三：终端201利用第一私钥对临时公钥进行签名操作，生成签名公钥签名信息，并利用临时私钥对签名公钥进行签名操作，生成临时公钥签名信息，并基于签名公钥签名信息和临时公钥签名信息生成第一签名信息。
对应于终端201基于第一私钥对签名公钥和临时公钥进行签名操作的三种方案，服务器202具体用于通过但不限于以下三种认证方案对第一签名信息进行认证：
方案一：服务器202基于第一公钥对签名公钥签名信息进行认证操作，认证成功后获取签名公钥，基于第一公钥对临时公钥签名信息进行认证操作，认证成功后获取临时公钥；
方案二：服务器202基于第一公钥对签名公钥签名信息进行认证操作，认证成功后获取签名公钥，基于签名公钥对临时公钥签名信息进行认证操作，认证成功后获取临时公钥；
方案三：服务器202基于第一公钥对临时公钥签名信息进行认证操作，认证成功后获取临时公钥，基于临时公钥对签名公钥签名信息进行认证操作，认证成功后获取签名公钥。
在本发明实施例的一个可选实施方案中，为了保证服务器的身份，服务器202，还用于在向终端201发送第一加密信息之前，利用第二私钥对第一加密信息进行签名操作，生成第二签名信息；第二数据包还包括第二签名信息；终端201，还用于在获取第一加密信息之前，基于第二公钥对第二签名信息进行认证操作，认证成功后，获取第一加密信息。相应地，终端201还用于在接收到第二数据包之后，获取第一加密信息之前，基于第二公钥对第二签名信息进行认证操作，认证成功后，获取第一加密信息。
在上述可选实施方式中，第二私钥可以为CA私钥，预存于服务器202中，与第二私钥 相对于的第二公钥可以是预存于终端201中，也可以是终端201与服务器202交互过程中由服务器202发送至终端201。在该可选实施方式中，服务器202通过利用第二私钥对第一加密信息进行签名操作，终端201对第一加密信息进行认证，在认证成功之后，获取第一加密信息，从而保证第一加密信息来源的可靠性，避免第三方模拟服务器202向终端201发送加密私钥，从而给用户带来安全隐患。
通过本实施例提供的密钥生成系统，服务器202接收终端201发送的签名公钥之前，对终端201进行认证操作，保证签名公钥的真实性，终端201接收服务器202发送的加密私钥之前，对服务器202进行认证，保证加密私钥的真实性，从而避免终端201或服务器202将虚假服务器202或终端201发送的信息判断为有效信息，此外，在本实施例提供的方案中，服务器202采用临时公钥而非签名公钥进行加密传输，即使在传输过程中被第三方截取并破译，外界也仅能够得知临时私钥，无法获知签名私钥，从而避免了选择性攻击带来的安全隐患，保证终端201中签名私钥的安全性。
在流程图中表示或在此以其他方式描述的逻辑和/或步骤，例如，可以被认为是用于实现逻辑功能的可执行指令的定序列表，可以具体实现在任何计算机可读介质中，以供指令执行系统、装置或设备(如基于计算机的系统、包括处理器的系统或其他可以从指令执行系统、装置或设备取指令并执行指令的系统)使用，或结合这些指令执行系统、装置或设备而使用。就本说明书而言，"计算机可读介质"可以是任何可以包含、存储、通信、传播或传输程序以供指令执行系统、装置或设备或结合这些指令执行系统、装置或设备而使用的装置。
应当理解，本发明的各部分可以用硬件、软件、固件或它们的组合来实现。在上述实施方式中，多个步骤或方法可以用存储在存储器中且由合适的指令执行系统执行的软件或固件来实现。例如，如果用硬件来实现，和在另一实施方式中一样，可用本领域公知的下列技术中的任一项或他们的组合来实现：具有用于对数据信号实现逻辑功能的逻辑门电路的离散逻辑电路，具有合适的组合逻辑门电路的专用集成电路，可编程门阵列(PGA)，现场可编程门阵列(FPGA)等。

Claims (13)

  1. 一种加密密钥获取方法，其特征在于，包括以下步骤：
    终端基于第一安全算法生成并保存所述终端的签名公钥和签名私钥，基于第二安全算法生成并保存临时公钥和临时私钥，并将第一数据包发送至服务器，其中，所述第一数据包至少包括：所述签名公钥和所述临时公钥；
    所述服务器接收所述第一数据包，获取所述签名公钥和所述临时公钥，保存所述终端的所述签名公钥；所述服务器基于第三安全算法生成并保存所述终端的加密公钥和加密私钥，基于第四安全算法生成并保存终端的数据加密码和数据解密码；
    所述服务器利用所述数据加密码对所述加密私钥进行加密操作，生成第一加密信息；利用所述临时公钥对所述数据解密码进行加密操作，生成第二加密信息；并将第二数据包发送至所述终端，其中，所述第二数据包至少包括：所述第一加密信息和所述第二加密信息；
    所述终端接收所述第二数据包，获取所述第一加密信息，利用所述临时私钥对所述第二加密信息进行解密操作，获得所述数据解密码，利用所述数据解密码对所述第一加密信息进行解密操作，获得所述加密私钥；所述终端保存所述加密私钥。
  2. 根据权利要求1所述的方法，其特征在于，
    所述终端生成所述签名公钥和所述临时公钥之后，将所述第一数据包发送至所述服务器之前，还包括：所述终端基于第一私钥对所述签名公钥和所述临时公钥进行签名操作，生成第一签名信息；所述第一数据包还包括所述第一签名信息；
    所述服务器接收到所述第一数据包之后，获取所述签名公钥和所述临时公钥之前，还包括：所述服务器基于所述第一私钥对应的第一公钥对所述第一签名息进行认证操作，且认证成功。
  3. 根据权利要求2所述的方法，其特征在于，
    所述终端基于第一私钥对所述签名公钥和所述临时公钥进行签名操作，生成第一签名信息，包括：所述终端基于所述第一私钥对所述签名公钥进行签名操作，生成签名公钥签名信息；基于所述第一私钥对所述临时公钥进行签名操作，生成临时公钥签名信息，并基于所述签名公钥签名信息和所述临时公钥签名信息生成所述第一签名信息；
    所述服务器基于第一公钥对所述第一签名信息进行认证操作，包括：所述服务器提取所述第一签名信息中的所述签名公钥签名信息和所述临时公钥签名信息，基于所述第一公钥对所述签名公钥签名信息进行认证操作，基于所述第一公钥对所述临时公钥签名信息进行认证 操作。
  4. 根据权利要求2所述的方法，其特征在于，
    所述终端基于第一私钥对所述签名公钥和所述临时公钥进行签名操作，生成第一签名信息，包括以下步骤：
    所述终端基于所述第一私钥对所述签名公钥进行签名操作，生成签名公钥签名信息；基于所述签名私钥对所述临时公钥进行签名操作，生成临时公钥签名信息，并基于所述签名公钥签名信息和所述临时公钥签名信息生成所述第一签名信息；
    所述服务器基于第一公钥对所述第一签名信息进行认证操作，包括步骤：
    所述服务器提取所述第一签名信息中的所述签名公钥签名信息、所述临时公钥签名信息和所述签名公钥，基于所述第一公钥对所述签名公钥签名信息进行认证操作，基于所述签名公钥对所述临时公钥签名信息进行认证操作。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，
    所述服务器生成所述第一加密信息之后，将所述第二数据包发送至所述终端之前，还包括步骤：所述服务器利用第二私钥对所述第一加密信息进行签名操作，生成第二签名信息；所述第二数据包还包括所述第二签名信息；
    所述终端接收到所述第二数据包之后，获取所述第一加密信息之前，还包括：所述终端基于与所述第二私钥对应的第二公钥对所述第二签名信息进行认证操作，认证成功后，获取所述第一加密信息。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，
    在所述服务器将第二数据包发送至所述终端之后，所述方法还包括：所述服务器清除所述临时公钥；
    在所述终端获得所述加密私钥之后，所述方法还包括：所述终端清除所述临时私钥。
  7. 一种加密密钥获取系统，其特征在于，包括终端和服务器，其中，
    所述终端，用于基于第一安全算法生成并保存签名公钥和签名私钥，基于第二安全算法生成并保存临时公钥和临时私钥，并将第一数据包发送至所述服务器，其中，所述第一数据包至少包括：所述签名公钥和所述临时公钥；
    所述服务器，用于接收所述第一数据包，获取所述签名公钥和所述临时公钥，并保存所述签名公钥；基于第三安全算法生成并保存所述终端的加密公钥和加密私钥，基于第四安全算法生成并保存数据加密码和数据解密码；利用所述数据加密码对所述加密私钥进行加密操作，生成第一加密信息；利用所述临时公钥对所述数据解密码进行加密操作，生成第二加密信息；将第二数据包发送至所述终端，其中，所述第二数据包至少包括：所述第一加密信息 和所述第二加密信息；
    所述终端，还用于接收所述第二数据包，获取所述第一加密信息，利用所述临时私钥对所述第二加密信息进行解密操作，获得所述数据解密码，利用所述数据解密码对所述第一加密信息进行解密操作，获得所述加密私钥；保存所述加密私钥。
  8. 根据权利要求7所述的系统，其特征在于，
    所述终端，还用于在生成所述签名公钥和所述临时公钥之后，将所述第一数据包发送至所述服务器之前，基于第一私钥对所述签名公钥和所述临时公钥进行签名操作，生成第一签名信息；所述第一数据包还包括所述第一签名信息；
    所述服务器，还用于在接收到所述第一数据包之后，获取所述签名公钥和所述临时公钥之前，基于所述第一公钥对所述第一签名信息进行认证操作，认证成功后，获取所述签名公钥和所述临时公钥。
  9. 根据权利要求8所述的系统，其特征在于，
    所述终端具体用于通过以下方式生成所述第一签名信息：基于所述第一私钥对所述签名公钥进行签名操作，生成签名公钥签名信息；基于所述第一私钥对所述临时公钥进行签名操作，生成临时公钥签名信息，并基于所述签名公钥签名信息和所述临时公钥签名信息生成所述第一签名信息；
    所述服务器具体用于通过以下方式对所述第一签名信息进行认证信操作：提取所述第一签名信息中的所述签名公钥签名信息和所述临时公钥签名信息，基于所述第一公钥对所述签名公钥签名信息进行认证操作，基于所述第一公钥对所述临时公钥签名信息进行认证操作。
  10. 根据权利要求8所述的系统，其特征在于，
    所述服务器具体用于通过以下方式生成所述第一签名信息：基于所述第一私钥对所述签名公钥进行签名操作，生成签名公钥签名信息；基于所述签名私钥对所述临时公钥进行签名操作，生成临时公钥签名信息，并基于所述签名公钥签名信息和所述临时公钥签名信息生成所述第一签名信息；
    所述服务器具体用于通过以下方式对所述第一签名信息进行认证操作：提取所述第一签名信息中的所述签名公钥签名信息、所述临时公钥签名信息和所述签名公钥，基于所述第一公钥对所述签名公钥签名信息进行认证操作，基于所述签名公钥对所述临时公钥签名信息进行认证操作。
  11. 根据权利要求7至10任一项所述的系统，其特征在于，
    所述服务器，还用于在生成所述第一加密信息之后，将所述第二数据包发送至所述终端之前，利用第二私钥对所述第一加密信息进行签名操作，生成第二签名信息；所述第二数据 包还包括所述第二签名信息；
    所述终端，还用于在接收到所述第二数据包之后，获取所述第一加密信息之前，基于第二公钥对所述第二签名信息进行认证操作，认证成功后，获取所述第一加密信息。
  12. 根据权利要求7至11任一项所述的系统，其特征在于，
    所述服务器还用于在将第二数据包发送至所述终端之后，清除所述临时公钥；
    所述终端还用于在获得所述加密私钥之后，清除所述临时公钥和所述临时私钥。
  13. 一种计算机可读存储介质，具有存储于其中的指令，当终端的处理器执行所述指令时，所述终端执行如权利要求1至6任一项所述的加密密钥获取方法。
PCT/CN2018/071309 2017-01-04 2018-01-04 一种加密密钥获取方法及系统 WO2018127081A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710003528.8 2017-01-04
CN201710003528.8A CN106656510B (zh) 2017-01-04 2017-01-04 一种加密密钥获取方法及系统

Publications (1)

Publication Number Publication Date
WO2018127081A1 true WO2018127081A1 (zh) 2018-07-12

Family

ID=58843666

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/071309 WO2018127081A1 (zh) 2017-01-04 2018-01-04 一种加密密钥获取方法及系统

Country Status (2)

Country Link
CN (1) CN106656510B (zh)
WO (1) WO2018127081A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111130803A (zh) * 2019-12-26 2020-05-08 信安神州科技(广州)有限公司 数字签名的方法、系统及装置
CN112019351A (zh) * 2020-09-03 2020-12-01 杭州天宽科技有限公司 基于SDKey的移动终端信息交互方法
CN114398602A (zh) * 2022-01-11 2022-04-26 国家计算机网络与信息安全管理中心 一种基于边缘计算的物联网终端身份认证方法
CN114499871A (zh) * 2021-12-23 2022-05-13 成都卫士通信息产业股份有限公司 一种签名加密方法、装置、系统及计算机可读存储介质
CN115001782A (zh) * 2022-05-26 2022-09-02 爱驰汽车有限公司 接口请求参数的处理方法、装置、设备及存储介质
CN117118759A (zh) * 2023-10-24 2023-11-24 四川省数字证书认证管理中心有限公司 用户控制服务器端密钥可靠使用的方法

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106656510B (zh) * 2017-01-04 2019-07-30 天地融科技股份有限公司 一种加密密钥获取方法及系统
JP6754325B2 (ja) * 2017-06-20 2020-09-09 国立大学法人東海国立大学機構 車載認証システム、車載認証装置、コンピュータプログラム及び通信装置の認証方法
CN109981284B (zh) * 2019-03-11 2022-04-29 三未信安科技股份有限公司 一种椭圆曲线数字签名的实现方法及装置
CN110190964B (zh) * 2019-05-16 2022-03-15 苏州科达科技股份有限公司 身份认证方法及电子设备
CN110519050B (zh) * 2019-08-19 2021-12-17 中国电子科技集团公司第三十研究所 基于量子真随机数交换与黑盒映射的密钥协商方法
CN111082923A (zh) * 2019-11-21 2020-04-28 山东爱城市网信息技术有限公司 一种基于区块链的私钥加解密托管方法及设备、介质
CN111769940B (zh) * 2020-07-09 2023-02-03 天翼物联科技有限公司 一种密钥在线分发方法、系统及介质
CN112002043B (zh) * 2020-09-03 2022-02-11 云南电网有限责任公司信息中心 一种基于nb-iot的智能锁控制方法及系统
CN114040221B (zh) * 2021-11-25 2023-09-22 国芯科技(广州)有限公司 基于机顶盒服务器端双签名的安全认证的防拷贝方法
CN116980123A (zh) * 2023-07-31 2023-10-31 中移互联网有限公司 密钥生成方法、加密方法和会话协商方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101483518A (zh) * 2009-02-20 2009-07-15 北京天威诚信电子商务服务有限公司 一种用户数字证书私钥管理方法和系统
US7698565B1 (en) * 2000-03-30 2010-04-13 Digitalpersona, Inc. Crypto-proxy server and method of using the same
CN105743654A (zh) * 2016-02-02 2016-07-06 上海动联信息技术股份有限公司 一种pos机密钥远程下载的服务系统以及密钥下载方法
CN105991539A (zh) * 2014-11-07 2016-10-05 天地融科技股份有限公司 数据交互方法及系统
CN106656510A (zh) * 2017-01-04 2017-05-10 天地融科技股份有限公司 一种加密密钥获取方法及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101470789A (zh) * 2007-12-28 2009-07-01 中国长城计算机深圳股份有限公司 一种计算机的加解密方法及装置
US8301883B2 (en) * 2009-08-28 2012-10-30 Alcatel Lucent Secure key management in conferencing system
CN104038472A (zh) * 2014-04-29 2014-09-10 广州华多网络科技有限公司 一种传输信息的方法及装置
CN104967612A (zh) * 2015-05-27 2015-10-07 李明 一种数据加密存储方法、服务器及系统
CN105701390A (zh) * 2016-03-08 2016-06-22 中国联合网络通信集团有限公司 加密终端远程管理的方法、加密终端及管理器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7698565B1 (en) * 2000-03-30 2010-04-13 Digitalpersona, Inc. Crypto-proxy server and method of using the same
CN101483518A (zh) * 2009-02-20 2009-07-15 北京天威诚信电子商务服务有限公司 一种用户数字证书私钥管理方法和系统
CN105991539A (zh) * 2014-11-07 2016-10-05 天地融科技股份有限公司 数据交互方法及系统
CN105743654A (zh) * 2016-02-02 2016-07-06 上海动联信息技术股份有限公司 一种pos机密钥远程下载的服务系统以及密钥下载方法
CN106656510A (zh) * 2017-01-04 2017-05-10 天地融科技股份有限公司 一种加密密钥获取方法及系统

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111130803A (zh) * 2019-12-26 2020-05-08 信安神州科技(广州)有限公司 数字签名的方法、系统及装置
CN111130803B (zh) * 2019-12-26 2023-02-17 信安神州科技(广州)有限公司 数字签名的方法、系统及装置
CN112019351A (zh) * 2020-09-03 2020-12-01 杭州天宽科技有限公司 基于SDKey的移动终端信息交互方法
CN112019351B (zh) * 2020-09-03 2023-05-16 杭州天宽科技有限公司 基于SDKey的移动终端信息交互方法
CN114499871A (zh) * 2021-12-23 2022-05-13 成都卫士通信息产业股份有限公司 一种签名加密方法、装置、系统及计算机可读存储介质
CN114499871B (zh) * 2021-12-23 2024-01-09 成都卫士通信息产业股份有限公司 一种签名加密方法、装置、系统及计算机可读存储介质
CN114398602A (zh) * 2022-01-11 2022-04-26 国家计算机网络与信息安全管理中心 一种基于边缘计算的物联网终端身份认证方法
CN114398602B (zh) * 2022-01-11 2024-05-10 国家计算机网络与信息安全管理中心 一种基于边缘计算的物联网终端身份认证方法
CN115001782A (zh) * 2022-05-26 2022-09-02 爱驰汽车有限公司 接口请求参数的处理方法、装置、设备及存储介质
CN117118759A (zh) * 2023-10-24 2023-11-24 四川省数字证书认证管理中心有限公司 用户控制服务器端密钥可靠使用的方法
CN117118759B (zh) * 2023-10-24 2024-01-30 四川省数字证书认证管理中心有限公司 用户控制服务器端密钥可靠使用的方法

Also Published As

Publication number Publication date
CN106656510B (zh) 2019-07-30
CN106656510A (zh) 2017-05-10

Similar Documents

Publication Publication Date Title
WO2018127081A1 (zh) 一种加密密钥获取方法及系统
US11757662B2 (en) Confidential authentication and provisioning
EP3529965B1 (en) System and method for configuring a wireless device for wireless network access
CN109150548B (zh) 一种数字证书签名、验签方法及系统、数字证书系统
WO2018076365A1 (zh) 密钥协商方法及装置
WO2019020051A1 (zh) 一种安全认证的方法及装置
CN107679847B (zh) 一种基于近场通信双向身份认证的移动交易隐私保护方法
CN109949461B (zh) 开锁方法及装置
US20180219688A1 (en) Information Transmission Method and Mobile Device
WO2016058404A1 (zh) 基于预共享密钥的实体鉴别方法及装置
CN109618334B (zh) 控制方法及相关设备
WO2015161689A1 (zh) 一种基于协商密钥的数据处理方法
CN107733636B (zh) 认证方法以及认证系统
WO2015158172A1 (zh) 一种用户身份识别卡
WO2016054905A1 (zh) 一种数据处理方法
CN109474419A (zh) 一种活体人像照片加密、解密方法及加解密系统
WO2015149658A1 (zh) 一种实体鉴别方法及装置
WO2018133675A1 (zh) 一种密钥更新方法、装置及系统
CN111031061A (zh) 一种验证方法及网关设备
WO2015158228A1 (zh) 一种服务器、用户设备以及用户设备与服务器的交互方法
CN114650173A (zh) 一种加密通讯方法及系统
CN108401494B (zh) 一种传输数据的方法及系统
CN112487380A (zh) 一种数据交互方法、装置、设备及介质
WO2017020530A1 (zh) 一种增强的wlan证书鉴别方法、装置及系统
WO2015109958A1 (zh) 一种基于协商密钥的数据处理方法和手机

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18735986

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18735986

Country of ref document: EP

Kind code of ref document: A1