WO2019037422A1 - 密钥及密钥句柄的生成方法、系统及智能密钥安全设备 - Google Patents

密钥及密钥句柄的生成方法、系统及智能密钥安全设备 Download PDF

Info

Publication number
WO2019037422A1
WO2019037422A1 PCT/CN2018/080232 CN2018080232W WO2019037422A1 WO 2019037422 A1 WO2019037422 A1 WO 2019037422A1 CN 2018080232 W CN2018080232 W CN 2018080232W WO 2019037422 A1 WO2019037422 A1 WO 2019037422A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
handle
identifier
user
security device
Prior art date
Application number
PCT/CN2018/080232
Other languages
English (en)
French (fr)
Inventor
陈柳章
Original Assignee
深圳市文鼎创数据科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市文鼎创数据科技有限公司 filed Critical 深圳市文鼎创数据科技有限公司
Publication of WO2019037422A1 publication Critical patent/WO2019037422A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds

Definitions

  • the present invention belongs to the field of communication technologies, and in particular, to a method and system for generating a key and a key handle, and a smart key security device.
  • This application process specification can be in compliance with the FIDO specification, can also conform to the QKey specification, and can also conform to other similar application specifications.
  • the FIDO USBKey application needs to support the function of unlimited registration, which means that in the registration instruction, the KeyHandle returned by the USBKey can support an unlimited number of keys, but the KeyHandle corresponds to the asymmetric private key, according to the smart key security.
  • the security requirements of the device, the asymmetric private key must be stored in the USBKey, however, the key storage capacity of the smart key security device is limited.
  • the key storage capacity of the smart key security device limits the number of key pairs. Therefore, when the existing key and key handle are generated, when the number of key pairs exceeds the maximum number of restrictions, there is a problem that the registration cannot be re-registered.
  • an embodiment of the present invention provides a method and system for generating a key and a key handle, and a smart key security device, to solve the method for generating a key and a key handle provided by the prior art, when a key pair is used.
  • a key pair is used.
  • a first aspect of the embodiments of the present invention provides a method for generating a key and a key handle, where the method includes:
  • the key storage is full, one of the stored keys is selected, and the selected key identifier is used, combined with the scatter factor, to generate a key handle.
  • the method further includes: if the key storage is not full, generating and storing the user key, using the key identifier as a key handle or processing the key identifier as a key Handle.
  • the key storage is full according to the key storage capacity of the smart key security device, and if the remaining storage capacity of the key storage is insufficient, the key storage is full, otherwise the key storage is not full.
  • the scatter factor is one or more of a currently registered website server identifier, a user identifier, or a random number.
  • the using the selected key identifier, combined with the dispersing factor, generating a key handle includes:
  • the obtained key handle includes:
  • the ciphertext obtained by encrypting the random number and the key identification data using the preset key is used as the key handle.
  • obtaining the key handle includes:
  • a second aspect of an embodiment of the present invention provides a smart key security device including a memory, a processor, and a computer program stored in the memory and operable on the processor, the processor executing the The steps of the method of the first aspect are implemented in a computer program.
  • a third aspect of an embodiment of the present invention provides a computer readable storage medium storing a computer program, the computer program being executed by a processor to implement the steps of the method of the first aspect.
  • a fourth aspect of the embodiments of the present invention provides a system for generating a key and a key handle, including a client and a website server, the system further comprising: the smart key security device according to the second aspect.
  • the smart key security device of the embodiment of the present invention selects one of the stored keys and uses the selected key to identify when the key storage is full.
  • the key handle is generated by combining the scatter factor. Therefore, when the key storage is full, the private key/user key generated during registration is not saved in the smart key security device; according to this method, unlimited registration can be implemented.
  • the requirements also meet the security design requirements; because the average user actually has a limited number of registrations, if the key handle generated when the key storage is not full can meet the customer requirements, security can be guaranteed. There are no problems with the method of generating a key and a key handle.
  • FIG. 1 is a schematic flowchart of a method for generating a key and a key handle according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic block diagram of a smart key security device according to Embodiment 2 of the present invention.
  • FIG. 3 is a schematic block diagram of a smart key security device according to Embodiment 3 of the present invention.
  • FIG. 4 is a schematic block diagram of a system for generating a key and a key handle according to Embodiment 4 of the present invention.
  • FIG. 1 is a schematic flowchart of a method for generating a key and a key handle according to Embodiment 1 of the present invention. As shown in FIG. 1, the method may include the following steps:
  • Step S101 Receive a registration instruction sent by the client.
  • the smart key security device receives a registration instruction sent by the client, where the registration instruction carries related information of the website server.
  • FIDO specification FIDO specification, QKey specification and other similar specifications
  • its core functions are registration and login functions, such as using the USB key supporting FIDO function, and want to use the FIDO fast authentication function of a certain website. Then, you must first register on this website.
  • the registration process is to request the registration function of the website after inserting the USBKey on the client (PC).
  • the website initiates the registration command to the USBKey.
  • the website server responds to the registration request, and returns a response message to the client, where the response message carries information about the website server.
  • the client After receiving the response message, the client generates a registration instruction according to the response message, and sends the registration instruction to the smart key security device.
  • the smart key security device may be FID0 conforming to the FID0 specification.
  • the USBKey can also be a QKey that conforms to the QKey specification, or it can be an intelligent security authentication device that complies with other specifications. No specific restrictions are imposed here.
  • the data transmission channel between the client and the smart key security device may be a channel conforming to the USB protocol, or a Bluetooth channel, an audio channel, an NFC channel, etc., and is not limited herein.
  • step S102 it is determined whether the key storage is full. If the key storage is full, step S103 is performed, otherwise step S104 is performed.
  • the smart key security device when the key generated by the client user registration is an asymmetric key, the smart key security device generates a public-private key pair after receiving the registration instruction sent by the client, and the public-private key pair is obtained.
  • a public key is included, and a private key corresponding to the public key is also included.
  • the smart key security device may send the public key, the key handle corresponding to the private key, the signature result signed by the private key corresponding to the key handle, and the X509 certificate to the client through the client.
  • the website server is authenticated, the user name, the public key, and the key handle corresponding to the private key are saved, and the registration is successful.
  • the key storage is full according to the key storage capacity of the smart key security device may be determined. If the remaining storage capacity of the key storage is insufficient, the key storage is full, otherwise the key storage is not full.
  • a key total threshold may be determined in advance based on the key storage capacity of the smart key security device. After receiving the registration command, the number of generated public-private key pairs is recorded. If the public-private key pair is the N-th public-private key pair, and N is less than or equal to the preset total number of keys, the smart key security device is represented. The private key may also be stored, and the key storage is not full. In this case, step S104 is performed. Otherwise, if the public-private key pair is the N-th public-private key pair, and N is greater than the preset total number of keys, the smart The private key may not be stored in the key security device, and the key storage is full. In this case, step S103 is selected.
  • the Nth public-private key pair is generated when the Nth registration is performed, and N is a positive integer greater than or equal to 1.
  • the smart key security device When the key generated by the client user registration is a symmetric key, the smart key security device generates a user key after receiving the registration instruction sent by the client, and the smart key security device can use the key corresponding to the user key.
  • the handle and the signature result signed by the user key corresponding to the key handle, and the X509 certificate and the like are sent to the website server through the client, and after the website server passes the verification, the user name, the user key and the user key are saved. The corresponding key handle, the registration is successful.
  • Step S103 selecting one of the stored keys, using the selected key identifier, and combining the dispersing factors to generate a key handle.
  • one of the stored keys may be selected, and the selected key identifier is used, combined with the dispersing factor, to generate a key handle, and the key handle is guaranteed. safety.
  • the smart key security device When the key generated by the client user registration is an asymmetric key, the smart key security device generates a public-private key pair of the user. If the user registers on the Nth website, the generated public-private key pair is the Nth. Public-private key pair. When N is greater than the preset total number of key thresholds, one of the stored private keys may be selected, and the selected private key identifier may be used to generate a key handle in combination with the dispersing factor.
  • the selected private keys are the same, each time the registration, the selected private key can be encrypted using different encryption factors, and the encrypted result is used as a key handle through the client.
  • the output is output to the web server. Because the encryption factor is different, the key handle generated during each registration is different, which not only ensures the security of the key handle, but also meets the requirements of relevant application specifications.
  • the smart key security device When the key generated by the client user registration is a symmetric key, the smart key security device generates a user key. If the user registers on the Nth website, the generated user key is the Nth user key. . When N is greater than the preset total number of key thresholds, one of the stored user keys may be selected, and the selected user key identifier may be used to generate a key handle in combination with the dispersing factor.
  • the selected user keys are the same.
  • the selected user key can be encrypted using different encryption factors, and the encrypted result is used as a key handle. Output to the web server through the client. Because the encryption factor is different, the key handle generated during each registration is different, which not only ensures the security of the key handle, but also meets the requirements of relevant application specifications.
  • the scatter factor may be one or more of a currently registered website server identifier, a user identifier, or a random number.
  • the using the selected key identifier, combined with the dispersing factor, generating a key handle includes:
  • the cryptographic factor is used to encrypt the key identifier, and the key handle is obtained by:
  • the website server identifier may be used as a scatter factor
  • the key identifier non-zero data
  • the website server identifier or the hash value of the website server identifier
  • the result of the exclusive OR operation may be used as the key handle KeyHandle. Output.
  • the scatter factor and the key identifier are encrypted by using a preset key, and the key handle is obtained:
  • the ciphertext obtained by encrypting the random number and the key identification data using the preset key is used as the key handle.
  • the smart key security device has a pair of asymmetric algorithm keys (such as ECC), and the ciphertext obtained by encrypting Data1 using the asymmetric algorithm public key can be output as the key handle KeyHandle.
  • the cryptographic algorithm or the asymmetric algorithm may be used to encrypt the private key or the user key, and the encryption algorithm is specifically used in the embodiment of the present invention.
  • the asymmetric algorithm is preferred to encrypt the private key or the user key.
  • the client user can log in to the website.
  • the key generated by the client user registration is a symmetric key
  • the client can send a login request to the website server, and the website server receives the same.
  • the related information such as the key handle is found according to the client user name, and the information is sent to the client, and the client generates a login instruction according to the related information, where the login instruction is generated.
  • Carrying relevant information of the website server and the key handle, and then sending the login instruction to the smart key security device after receiving the login instruction, the smart key security device verifies the legality of the key handle and passes the client Send the user signature and other information to the website server.
  • the website server verifies that the key handle is valid, the user can be allowed to log in.
  • the smart key security device can also use the private key corresponding to the key handle to sign and pass the The client sends the signature result to the web server. After the web server verifies the signature result using the public key, the user can log in.
  • step S104 the user key is generated and stored, and the key identifier is used as a key handle or the key identifier is processed as a key handle.
  • the smart key security device when the key generated by the client user registration is an asymmetric key, the smart key security device generates a public-private key pair of the user, and if the user registers on the Nth website, the generated key
  • the public-private key pair is the Nth public-private key pair.
  • N is less than or equal to the preset total number of keys
  • the Nth private key may be stored in the smart key security device, and the private key may be stored in the smart key security device to ensure security requirements and private use.
  • the index value of the key (eg 1, 2, 3, etc.) is organized into a key handle by a predetermined format and sent to the web server through the client.
  • the smart key security device When the key generated by the client user registration is a symmetric key, the smart key security device generates the user key of the user. If the user registers on the Nth website, the generated user key is the Nth user. Key. When N is less than or equal to the preset total number of keys, the Nth user key may be stored in the smart key security device, and the user key may be stored in the smart key security device to ensure security requirements.
  • the index value of the user key (for example, 1, 2, 3, etc.) is organized into a key handle through a predetermined format and sent to the website server through the client.
  • the smart key security device of the embodiment of the present invention selects one of the stored keys when the key storage is full, uses the selected key identifier, and combines the dispersing factors to generate a key handle. Therefore, in the key storage When it is full, the private key/user key generated during registration is no longer saved in the smart key security device; according to this method, the requirement of unlimited registration can be realized, and the security design requirements are also met; because the average user actually The number of registrations is limited. If the key handle generated when the key storage is not full can satisfy the customer's requirements, security can be guaranteed. Compared with the existing key and key handle generation methods, there is no registration. The problem.
  • FIG. 2 is a schematic block diagram of a smart key security device according to Embodiment 2 of the present invention. For convenience of description, only parts related to the embodiment of the present invention are shown.
  • the smart key security device 2 includes a registration instruction receiving module 21, a determining module 22, a first key handle generating module 23, and a second key handle generating module 24.
  • the registration instruction receiving module 21 is configured to receive a registration instruction sent by the client.
  • the determining module 22 is configured to determine whether the key storage is full
  • the first key handle generating module 23 is configured to: if the key storage is full, select one of the stored keys, use the selected key identifier, and combine the scatter factor to generate a key handle.
  • the second key handle generating module 24 is configured to generate and store the user key if the key storage is not full, and use the key identifier as a key handle or process the key identifier as a key handle.
  • the judging module 22 judges whether the key storage is full according to the key storage capacity of the smart key security device, and if the key storage remaining capacity is insufficient, the key storage is full, otherwise the key storage is not full.
  • the scatter factor is one or more of a currently registered website server identifier, a user identifier, or a random number.
  • the using the selected key identifier, combined with the dispersing factor, generating a key handle includes:
  • the using the scatter factor to encrypt the key identifier, and obtaining the key handle includes:
  • the using the preset key to encrypt the scatter factor and the key identifier, and obtaining the key handle includes:
  • the ciphertext obtained by encrypting the random number and the key identification data using the preset key is used as the key handle.
  • the smart key security device provided by the embodiment of the present invention can be applied to the foregoing corresponding method embodiment 1. For details, refer to the description of the first embodiment, and details are not described herein again.
  • FIG. 3 is a schematic block diagram of a smart key security device according to Embodiment 3 of the present invention.
  • the smart key security device 3 of this embodiment includes a processor 30, a memory 31, and a computer program 32, such as a key, stored in the memory 31 and operable on the processor 30. And the program of the key handle generation method.
  • the processor 30 executes the computer program 32, the steps in the embodiment of the method for generating the key and the key handle are implemented, for example, steps 101 to 104 shown in FIG.
  • the processor 30 executes the computer program 32, the functions of the modules/units in the embodiment of the smart key security device shown in FIG. 2 are implemented, such as the functions of the modules 21 to 24 shown in FIG. 2.
  • the computer program 32 can be partitioned into one or more modules/units that are stored in the memory 31 and executed by the processor 30 to complete this invention.
  • the one or more modules/units may be a series of computer program instruction segments capable of performing a particular function, the instruction segments being used to describe the execution of the computer program 32 in the smart key security device 3.
  • the computer program 32 can be divided into a registration instruction receiving module, a determination module, a first key handle generation module, and a second key handle generation module.
  • the registration instruction receiving module is configured to receive a registration instruction sent by the client;
  • a determining module configured to determine whether the key storage is full
  • the first key handle generating module is configured to: if the key storage is full, select one of the stored keys, use the selected key identifier, and combine the dispersing factors to generate a key handle.
  • the second key handle generating module is configured to generate and store the user key if the key storage is not full, and use the key identifier as a key handle or process the key identifier as a key handle.
  • the judging module 22 judges whether the key storage is full according to the key storage capacity of the smart key security device, and if the key storage remaining capacity is insufficient, the key storage is full, otherwise the key storage is not full.
  • the scatter factor is one or more of a currently registered website server identifier, a user identifier, or a random number.
  • the using the selected key identifier, combined with the dispersing factor, generating a key handle includes:
  • the key handle is obtained by using the scatter factor encryption key identifier; or the cryptographic factor and the key identifier are encrypted by using the preset key, and the key handle is obtained.
  • the cryptographic key is used to identify the key identifier, and the key handle includes:
  • the using the preset key to encrypt the scatter factor and the key identifier, and obtaining the key handle includes:
  • the smart key security device may include, but is not limited to, a processor 30, a memory 31. It will be understood by those skilled in the art that FIG. 3 is merely an example of the smart key security device 3, does not constitute a limitation on the smart key security device 3, may include more or less components than illustrated, or may combine certain Components, or different components, such as the smart key security device, may also include input and output devices, network access devices, buses, and the like.
  • the so-called processor 30 can be a central processing unit (Central Processing Unit, CPU), can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the memory 31 may be an internal storage unit of the smart key security device 3, such as a hard disk or memory of the smart key security device 3.
  • the memory 31 may also be an external storage device of the smart key security device 3, such as a plug-in hard disk equipped with the smart key security device 3, a smart memory card (SMC), and a secure digital device. (Secure Digital, SD) card, flash card (Flash Card) and so on.
  • SMC smart memory card
  • a secure digital device Secure Digital, SD
  • flash card flash card
  • the memory 31 may also include both an internal storage unit of the smart key security device 3 and an external storage device.
  • the memory 31 is used to store the computer program and other programs and data required by the smart key security device 3.
  • the memory 31 can also be used to temporarily store data that has been output or is about to be output.
  • the smart key security device provided by the embodiment of the present invention can be applied to the foregoing corresponding method embodiment 1.
  • the key and key handle generation system 4 includes a client 41, a website server 42, and a smart key security device 43 as described in the second or third embodiment.
  • the system for generating a key and a key handle provided by the embodiment of the present invention can be applied to the foregoing first embodiment of the method.
  • each functional unit and module in the foregoing system may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit, and the integrated unit may be implemented by hardware.
  • Formal implementation can also be implemented in the form of software functional units.
  • the specific names of the respective functional units and modules are only for the purpose of facilitating mutual differentiation, and are not intended to limit the scope of protection of the present application.
  • the disclosed apparatus/terminal device and method may be implemented in other manners.
  • the device/terminal device embodiments described above are merely illustrative.
  • the division of the modules or units is only a logical function division.
  • there may be another division manner for example, multiple units.
  • components may be combined or integrated into another system, or some features may be omitted or not performed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated modules/units if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium. Based on such understanding, the present invention implements all or part of the processes in the foregoing embodiments, and may also be completed by a computer program to instruct related hardware.
  • the computer program may be stored in a computer readable storage medium. The steps of the various method embodiments described above may be implemented when the program is executed by the processor. .
  • the computer program comprises computer program code, which may be in the form of source code, object code form, executable file or some intermediate form.
  • the computer readable medium can include any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a removable hard drive, a magnetic disk, an optical disk, a computer memory, a read only memory (ROM, Read-Only) Memory), random access memory (RAM, Random) Access Memory), electrical carrier signals, telecommunications signals, and software distribution media.
  • ROM Read Only memory
  • RAM Random Access Memory
  • electrical carrier signals telecommunications signals
  • telecommunications signals and software distribution media. It should be noted that the content contained in the computer readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in a jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, computer readable media It does not include electrical carrier signals and telecommunication signals.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephone Function (AREA)
  • Lock And Its Accessories (AREA)
  • Storage Device Security (AREA)

Abstract

一种密钥及密钥句柄的生成方法、系统及智能密钥安全设备，所述方法包括：接收客户端发送的注册指令；判断密钥存储是否已满；若密钥存储已满，则选取已存储密钥中的一个，使用选取的密钥标识，结合分散因子，生成密钥句柄。可有效解决现有技术提供的密钥及密钥句柄的生成方法，当密钥对个数超出最大限制个数时，会出现无法再注册的问题。

Description

密钥及密钥句柄的生成方法、系统及智能密钥安全设备 技术领域
本发明属于通信技术领域，尤其涉及一种密钥及密钥句柄的生成方法、系统及智能密钥安全设备。
 背景技术
目前，相关应用规范有无限次注册的要求，这种应用流程规范，可以是符合FIDO规范，也可以符合QKey规范，还可以符合其他相似的应用规范。
例如，根据FIDO规范的要求，FIDO USBKey应用需要支持无限次注册的功能，意味着FIDO在注册指令中，USBKey返回的KeyHandle可以支持无限个，然而KeyHandle对应的是非对称私钥，根据智能密钥安全设备的安全性要求，非对称私钥都必须保存在USBKey内，然而，智能密钥安全设备的密钥存储容量是有限的。
因此，智能密钥安全设备的密钥存储容量限制了密钥对的个数。所以，现有的密钥及密钥句柄的生成方法，当密钥对个数超出最大限制个数时，会出现无法再注册的问题。
 技术问题
有鉴于此，本发明实施例提供一种密钥及密钥句柄的生成方法、系统及智能密钥安全设备，以解决现有技术提供的密钥及密钥句柄的生成方法，当密钥对个数超出最大限制个数时，会出现无法再注册的问题。
 技术解决方案
本发明实施例的第一方面，提供一种密钥及密钥句柄的生成方法，所述方法包括：
接收客户端发送的注册指令；
判断密钥存储是否已满；
若密钥存储已满，则选取已存储密钥中的一个，使用选取的密钥标识，结合分散因子，生成密钥句柄。
进一步地，所述判断密钥存储是否已满后，还包括：若密钥存储未满，则生成并存储用户密钥，将密钥标识作为密钥句柄或者将密钥标识处理后作为密钥句柄。
进一步地，根据智能密钥安全设备的密钥存储容量判断密钥存储是否已满，若密钥存储剩余容量不足，则密钥存储已满，否则密钥存储未满。
进一步地，所述分散因子是当前注册的网站服务器标识、用户标识或随机数中的一种或多种。
进一步地，所述使用选取的密钥标识，结合分散因子，生成密钥句柄包括：
使用分散因子加密密钥标识，得到密钥句柄；或者使用预置密钥加密分散因子和密钥标识，得到密钥句柄。
进一步地，使用预置密钥加密分散因子和密钥标识，得到密钥句柄包括：
生成随机数；
将使用预置密钥加密随机数和密钥标识拼接成的数据得到的密文作为密钥句柄。
进一步地，使用分散因子加密密钥标识，得到密钥句柄包括：
将分散因子与密钥标识进行异或得到密钥句柄；或者使用预置密钥加密分散因子得到分散密钥，再使用分散密钥加密密钥标识得到密钥句柄。
本发明实施例的第二方面提供了一种智能密钥安全设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现第一方面所述方法的步骤。
本发明实施例的第三方面提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时实现第一方面所述方法的步骤。
本发明实施例的第四方面提供了一种密钥及密钥句柄的生成系统，包括客户端和网站服务器，所述系统还包括：如第二方面所述的智能密钥安全设备。
 有益效果
本发明实施例与现有技术相比存在的有益效果是：本发明实施例的智能密钥安全设备，在密钥存储已满时，选取已存储密钥中的一个，使用选取的密钥标识，结合分散因子，生成密钥句柄，因此，在密钥存储已满时，智能密钥安全设备内不再保存注册时生成的私钥/用户密钥；按照这种方法，可以实现无限次注册的要求，也达到了安全性设计要求；因为一般用户实际上对于注册的次数是有限的，如果密钥存储未满时生成的密钥句柄能满足客户要求，就能保证安全性，相比现有的密钥及密钥句柄的生成方法，不存在无法注册的问题。
 附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例一提供的密钥及密钥句柄的生成方法的示意流程图；
图2是本发明实施例二提供的智能密钥安全设备的示意性框图；
图3是本发明实施例三提供的智能密钥安全设备的示意性框图；
图4是本发明实施例四提供的密钥及密钥句柄的生成系统的示意性框图。
 本发明的实施方式
以下描述中，为了说明而不是为了限定，提出了诸如特定系统结构、技术之类的具体细节，以便透彻理解本发明实施例。然而，本领域的技术人员应当清楚，在没有这些具体细节的其它实施例中也可以实现本发明。在其它情况中，省略对众所周知的系统、装置、电路以及方法的详细说明，以免不必要的细节妨碍本发明的描述。
为了说明本发明所述的技术方案，下面通过具体实施例来进行说明。
参见图1，是本发明实施例一提供的密钥及密钥句柄的生成方法的示意流程图，如图1所示该方法可以包括以下步骤：
步骤S101，接收客户端发送的注册指令。
在本发明实施例中，智能密钥安全设备接收客户端发送的注册指令，所述注册指令中携带网站服务器的相关信息。
具体的，按照相关应用规范（FIDO规范、QKey规范以及其他类似规范），其核心功能是注册和登录两个功能，例如使用支持FIDO功能的USBKey，想使用某个网站的FIDO快速身份验证的功能，那么先要在这个网站上注册，注册流程是在客户端（PC）上插入USBKey后，请求网站的注册功能，网站通过向USBKey发起注册指令。
具体的，客户端发送注册请求至网站服务器后，网站服务器响应所述注册请求，返回响应消息至客户端，所述响应消息中携带网站服务器的相关信息。客户端接收到所述响应消息后，根据所述响应消息生成注册指令，并发送所述注册指令至智能密钥安全设备。
其中，智能密钥安全设备可以是符合FID0规范的FID0 USBKey，也可以是符合QKey规范的QKey，也可以是符合其他规范的智能安全认证设备，在此不做具体限制。
具体的，客户端和智能密钥安全设备之间的数据传输通道，可以是符合USB协议的通道，也可以蓝牙通道、音频通道、NFC通道等等，在此不做限制。
步骤S102，判断密钥存储是否已满，若密钥存储已满，则执行步骤S103，否则执行步骤S104。
在本发明实施例中，当客户端用户注册生成的密钥为非对称密钥时，智能密钥安全设备接收到客户端发送的注册指令后，生成一个公私钥对，所述公私钥对中包括一个公钥，还包括一个与所述公钥对应的私钥。生成公私钥对后，智能密钥安全设备可以将公钥、私钥对应的密钥句柄以及用所述密钥句柄对应的私钥进行签名的签名结果、X509证书等相关信息通过客户端发送给网站服务器，网站服务器验证通过后，会保存用户名、公钥和私钥对应的密钥句柄等相关信息，注册成功。
具体的，可以根据智能密钥安全设备的密钥存储容量判断密钥存储是否已满，若密钥存储剩余容量不足，则密钥存储已满，否则密钥存储未满。
详细地，可以预先根据智能密钥安全设备的密钥存储容量确定一个密钥总数阈值。每次接收到注册指令后，记录生成的公私钥对的数量，若所述公私钥对是第N个公私钥对，且N小于等于预设的密钥总数阈值，则表示智能密钥安全设备中还可以存储私钥，密钥存储未满，这时选择执行步骤S104，否则，若所述公私钥对是第N个公私钥对，且N大于预设的密钥总数阈值，则表示智能密钥安全设备中不可以再存储私钥，密钥存储已满，这时选择执行步骤S103。
其中，第N个公私钥对是第N次注册时生成的，N是大于等于1的正整数。
当客户端用户注册生成的密钥为对称密钥时，智能密钥安全设备接收到客户端发送的注册指令后，生成一个用户密钥，智能密钥安全设备可以将用户密钥对应的密钥句柄以及用所述密钥句柄对应的用户密钥进行签名的签名结果、X509证书等相关信息通过客户端发送给网站服务器，网站服务器验证通过后，会保存用户名、用户密钥和用户密钥对应的密钥句柄，注册成功。
步骤S103，选取已存储密钥中的一个，使用选取的密钥标识，结合分散因子，生成密钥句柄。
在本发明实施例中，若注册的次数超过密钥总数阈值，则可以选取已存储密钥中的一个，使用选取的密钥标识，结合分散因子，生成密钥句柄，保证了密钥句柄的安全性。
当客户端用户注册生成的密钥为非对称密钥时，智能密钥安全设备生成用户的公私钥对，如果用户在第N个网站上进行注册，那么所产生的公私钥对是第N个公私钥对。当N大于预设的密钥总数阈值时，可以选取已存储私钥中的一个，使用选取的私钥标识，结合分散因子，生成密钥句柄。
若第N至第N+n次注册时，所选取的私钥均相同，每次注册时，可以使用不同的加密因子对所选取的私钥进行加密，并将加密结果作为密钥句柄通过客户端输出至网站服务器。由于加密因子不同，因此，每次注册时生成的密钥句柄不同，既保证了密钥句柄的安全性，又符合相关应用规范的要求。
当客户端用户注册生成的密钥为对称密钥时，智能密钥安全设备生成用户密钥，如果用户在第N个网站上进行注册，那么所产生的用户密钥是第N个用户密钥。当N大于预设的密钥总数阈值时，可以选取已存储用户密钥中的一个，使用选取的用户密钥标识，结合分散因子，生成密钥句柄。
若第N至第N+n次注册时，所选取的用户密钥均相同，每次注册时，可以使用不同的加密因子对所选取的用户密钥进行加密，并将加密结果作为密钥句柄通过客户端输出至网站服务器。由于加密因子不同，因此，每次注册时生成的密钥句柄不同，既保证了密钥句柄的安全性，又符合相关应用规范的要求。
具体的，所述分散因子可以是当前注册的网站服务器标识、用户标识或随机数中的一种或多种。
具体的，所述使用选取的密钥标识，结合分散因子，生成密钥句柄包括：
使用分散因子加密密钥标识，得到密钥句柄；或者使用预置密钥加密分散因子和密钥标识，得到密钥句柄。
具体的，使用分散因子加密密钥标识，得到密钥句柄包括：
将分散因子与密钥标识进行异或得到密钥句柄；或者使用预置密钥加密分散因子得到分散密钥，再使用分散密钥加密密钥标识得到密钥句柄。
例如，可以将网站服务器标识作为分散因子，将密钥标识（非0数据）与网站服务器标识（或者网站服务器标识的Hash值）进行异或运算，将异或运算得到的结果作为密钥句柄KeyHandle输出。
具体的，使用预置密钥加密分散因子和密钥标识，得到密钥句柄包括：
生成随机数；
将使用预置密钥加密随机数和密钥标识拼接成的数据得到的密文作为密钥句柄。
假如，可以生成长度为L2字节的随机数Rand，密钥标识Index（非0数据）的长度为L1字节，Rand和Index可以拼接成数据块Data1=Index+Rand，长度N=L1+L2；智能密钥安全设备内设一对非对称算法密钥(例如ECC)，使用非对称算法公钥加密Data1后得到的密文可以作为密钥句柄KeyHandle输出。
具体的，可以采用对称算法或者非对称算法对私钥或者用户密钥进行加密，具体采用何种加密算法，本发明实施例不做限制。但是考虑到非对称算法的安全性较高，可以防止被人破解、攻击，因此优先选用非对称算法对私钥或者用户密钥进行加密。
另外，当注册成功后，客户端用户可以登录网站，具体的，当客户端用户注册生成的密钥为对称密钥时，登录网站时，客户端可以发送登录请求至网站服务器，网站服务器接收到所述登录请求后，响应所述登录请求，根据客户端用户名查找到相应的密钥句柄等相关信息，并发送这些信息给客户端，客户端根据这些相关信息生成登录指令，所述登录指令中携带网站服务器的相关信息以及密钥句柄，然后发送所述登录指令至智能密钥安全设备，智能密钥安全设备接收到所述登录指令后，验证密钥句柄的合法性，并通过客户端发送用户签名等信息至网站服务器，网站服务器验证密钥句柄合法后，即可允许用户登录。
当客户端用户注册生成的密钥为非对称密钥时，登录网站时，在验证密钥句柄的合法性后，智能密钥安全设备还可以使用密钥句柄对应的私钥进行签名，并通过客户端发送签名结果至网站服务器，网站服务器使用公钥验证签名结果合法后，即可允许用户登录。
步骤S104，生成并存储用户密钥，将密钥标识作为密钥句柄或者将密钥标识处理后作为密钥句柄。
在本发明实施例中，当客户端用户注册生成的密钥为非对称密钥时，智能密钥安全设备生成用户的公私钥对，如果用户在第N个网站上进行注册，那么所产生的公私钥对是第N个公私钥对。当N小于等于预设的密钥总数阈值时，可以将第N个私钥存储在智能密钥安全设备内，可以保证私钥存储在智能密钥安全设备中，保证了安全性要求，并用私钥的索引值(例如1，2，3等等) 通过预定的格式组织成密钥句柄通过客户端发送至网站服务器。
当客户端用户注册生成的密钥为对称密钥时，智能密钥安全设备生成用户的用户密钥，如果用户在第N个网站上进行注册，那么所产生的用户密钥是第N个用户密钥。当N小于等于预设的密钥总数阈值时，可以将第N个用户密钥存储在智能密钥安全设备内，可以保证用户密钥存储在智能密钥安全设备中，保证了安全性要求，并将用户密钥的索引值(例如1，2，3等等) 通过预定的格式组织成密钥句柄通过客户端发送至网站服务器。
本发明实施例的智能密钥安全设备，在密钥存储已满时，选取已存储密钥中的一个，使用选取的密钥标识，结合分散因子，生成密钥句柄，因此，在密钥存储已满时，智能密钥安全设备内不再保存注册时生成的私钥/用户密钥；按照这种方法，可以实现无限次注册的要求，也达到了安全性设计要求；因为一般用户实际上对于注册的次数是有限的，如果密钥存储未满时生成的密钥句柄能满足客户要求，就能保证安全性，相比现有的密钥及密钥句柄的生成方法，不存在无法注册的问题。
应理解，上述实施例中各步骤的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
参见图2，是本发明实施例二提供的智能密钥安全设备的示意框图，为了便于说明，仅示出了与本发明实施例相关的部分。所述智能密钥安全设备2包括：注册指令接收模块21、判断模块22、第一密钥句柄生成模块23和第二密钥句柄生成模块24。
其中，注册指令接收模块21，用于接收客户端发送的注册指令；
判断模块22，用于判断密钥存储是否已满；
第一密钥句柄生成模块23，用于若密钥存储已满，则选取已存储密钥中的一个，使用选取的密钥标识，结合分散因子，生成密钥句柄。
第二密钥句柄生成模块24，用于若密钥存储未满，则生成并存储用户密钥，将密钥标识作为密钥句柄或者将密钥标识处理后作为密钥句柄。
具体的，判断模块22根据智能密钥安全设备的密钥存储容量判断密钥存储是否已满，若密钥存储剩余容量不足，则密钥存储已满，否则密钥存储未满。
具体的，所述分散因子是当前注册的网站服务器标识、用户标识或随机数中的一种或多种。
具体的，所述使用选取的密钥标识，结合分散因子，生成密钥句柄包括：
使用分散因子加密密钥标识，得到密钥句柄；或者使用预置密钥加密分散因子和密钥标识，得到密钥句柄。
具体的，所述使用分散因子加密密钥标识，得到密钥句柄包括：
将分散因子与密钥标识进行异或得到密钥句柄；或者使用预置密钥加密分散因子得到分散密钥，再使用分散密钥加密密钥标识得到密钥句柄。
具体的，所述使用预置密钥加密分散因子和密钥标识，得到密钥句柄包括：
生成随机数；
将使用预置密钥加密随机数和密钥标识拼接成的数据得到的密文作为密钥句柄。本发明实施例提供的智能密钥安全设备可以应用在前述对应的方法实施例一中，详情参见上述实施例一的描述，在此不再赘述。
图3是本发明实施例三提供的智能密钥安全设备的示意框图。如图3所示，该实施例的智能密钥安全设备3包括：处理器30、存储器31以及存储在所述存储器31中并可在所述处理器30上运行的计算机程序32，例如密钥及密钥句柄的生成方法的程序。所述处理器30执行所述计算机程序32时实现上述密钥及密钥句柄的生成方法实施例中的步骤，例如图1所示的步骤101至104。或者，所述处理器30执行所述计算机程序32时实现图2所示智能密钥安全设备实施例中各模块/单元的功能，例如图2所示模块21至24的功能。
示例性的，所述计算机程序32可以被分割成一个或多个模块/单元，所述一个或者多个模块/单元被存储在所述存储器31中，并由所述处理器30执行，以完成本发明。所述一个或多个模块/单元可以是能够完成特定功能的一系列计算机程序指令段，该指令段用于描述所述计算机程序32在所述智能密钥安全设备3中的执行过程。例如，所述计算机程序32可以被分割成注册指令接收模块、判断模块、第一密钥句柄生成模块和第二密钥句柄生成模块。
各模块具体功能如下：
其中，注册指令接收模块，用于接收客户端发送的注册指令；
判断模块，用于判断密钥存储是否已满；
第一密钥句柄生成模块，用于若密钥存储已满，则选取已存储密钥中的一个，使用选取的密钥标识，结合分散因子，生成密钥句柄。
第二密钥句柄生成模块，用于若密钥存储未满，则生成并存储用户密钥，将密钥标识作为密钥句柄或者将密钥标识处理后作为密钥句柄。
具体的，判断模块22根据智能密钥安全设备的密钥存储容量判断密钥存储是否已满，若密钥存储剩余容量不足，则密钥存储已满，否则密钥存储未满。
具体的，所述分散因子是当前注册的网站服务器标识、用户标识或随机数中的一种或多种。
具体的，所述使用选取的密钥标识，结合分散因子，生成密钥句柄包括：
使用分散因子加密密钥标识，得到密钥句柄；或者使用预置密钥加密分散因子和密钥标识，得到密钥句柄具体的，所述使用分散因子加密密钥标识，得到密钥句柄包括：
将分散因子与密钥标识进行异或得到密钥句柄；或者使用预置密钥加密分散因子得到分散密钥，再使用分散密钥加密密钥标识得到密钥句柄。
具体的，所述使用预置密钥加密分散因子和密钥标识，得到密钥句柄包括：
生成随机数；
将使用预置密钥加密随机数和密钥标识拼接成的数据得到的密文作为密钥句柄。所述智能密钥安全设备可包括，但不仅限于，处理器30、存储器31。本领域技术人员可以理解，图3仅仅是智能密钥安全设备3的示例，并不构成对智能密钥安全设备3的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件，例如所述智能密钥安全设备还可以包括输入输出设备、网络接入设备、总线等。
所称处理器30可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器 (Digital Signal Processor，DSP)、专用集成电路 (Application Specific Integrated Circuit，ASIC)、现成可编程门阵列 (Field-Programmable Gate Array，FPGA) 或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
所述存储器31可以是所述智能密钥安全设备3的内部存储单元，例如智能密钥安全设备3的硬盘或内存。所述存储器31也可以是所述智能密钥安全设备3的外部存储设备，例如所述智能密钥安全设备3上配备的插接式硬盘，智能存储卡（Smart Media Card, SMC），安全数字（Secure Digital, SD）卡，闪存卡（Flash Card）等。进一步地，所述存储器31还可以既包括所述智能密钥安全设备3的内部存储单元也包括外部存储设备。所述存储器31用于存储所述计算机程序以及所述智能密钥安全设备3所需的其他程序和数据。所述存储器31还可以用于暂时地存储已经输出或者将要输出的数据。
本发明实施例提供的智能密钥安全设备可以应用在前述对应的方法实施例一中，详情参见上述实施例一的描述，在此不再赘述。
图4是本发明实施例四提供的密钥及密钥句柄的生成系统的示意框图，为了便于说明，仅示出了与本发明实施例相关的部分。所述密钥及密钥句柄的生成系统4包括客户端41、网站服务器42和实施例二或三中所述的智能密钥安全设备43。
本发明实施例提供的密钥及密钥句柄的生成系统可以应用在前述对应的方法实施例一中，详情参见上述实施例一的描述，在此不再赘述。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，仅以上述各功能单元、模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能单元、模块完成，即将所述装置的内部结构划分成不同的功能单元或模块，以完成以上描述的全部或者部分功能。实施例中的各功能单元、模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中，上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。另外，各功能单元、模块的具体名称也只是为了便于相互区分，并不用于限制本申请的保护范围。上述系统中单元、模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述或记载的部分，可以参见其它实施例的相关描述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
在本发明所提供的实施例中，应该理解到，所揭露的装置/终端设备和方法，可以通过其它的方式实现。例如，以上所描述的装置/终端设备实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通讯连接可以是通过一些接口，装置或单元的间接耦合或通讯连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的模块/单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实现上述实施例方法中的全部或部分流程，也可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一计算机可读存储介质中，该计算机程序在被处理器执行时，可实现上述各个方法实施例的步骤。。其中，所述计算机程序包括计算机程序代码，所述计算机程序代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读介质可以包括：能够携带所述计算机程序代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器（ROM，Read-Only Memory）、随机存取存储器（RAM，Random Access Memory）、电载波信号、电信信号以及软件分发介质等。需要说明的是，所述计算机可读介质包含的内容可以根据司法管辖区内立法和专利实践的要求进行适当的增减，例如在某些司法管辖区，根据立法和专利实践，计算机可读介质不包括是电载波信号和电信信号。
以上所述实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围，均应包含在本发明的保护范围之内。

Claims (13)

  1. 一种密钥及密钥句柄的生成方法，其特征在于，所述方法包括：
    接收客户端发送的注册指令；
    判断密钥存储是否已满；
    若密钥存储已满，则选取已存储密钥中的一个，使用选取的密钥标识，结合分散因子，生成密钥句柄。
  2. 根据权利要求1所述的方法，其特征在于，所述判断密钥存储是否已满后，还包括：若密钥存储未满，则生成并存储用户密钥，将密钥标识作为密钥句柄或者将密钥标识处理后作为密钥句柄。
  3. 根据权利要求2所述的方法，其特征在于，所述生成并存储用户密钥，将密钥标识作为密钥句柄或者将密钥标识处理后作为密钥句柄的步骤包括：
    当客户端用户注册生成的密钥为非对称密钥时，智能密钥安全设备接收到注册指令后，生成用户的公私钥对，并将公钥、私钥对应的密钥句柄以及用所述密钥句柄对应的私钥进行签名的签名结果、X509证书通过客户端发送给网站服务器。
  4. 根据权利要求2所述的方法，其特征在于，所述生成并存储用户密钥，将密钥标识作为密钥句柄或者将密钥标识处理后作为密钥句柄的步骤包括：
    当客户端用户注册生成的密钥为对称密钥时，智能密钥安全设备接收到注册指令后，生成一个用户密钥，将用户密钥对应的密钥句柄以及用所述密钥句柄对应的用户密钥进行签名的签名结果、X509证书通过客户端发送给网站服务器。
  5. 根据权利要求1所述的方法，其特征在于，根据智能密钥安全设备的密钥存储容量判断密钥存储是否已满，若密钥存储剩余容量不足，则密钥存储已满，否则密钥存储未满。
  6. 根据权利要求1所述的方法，其特征在于，所述分散因子是当前注册的网站服务器标识、用户标识或随机数中的一种或多种。
  7. 根据权利要求1所述的方法，其特征在于，所述使用选取的密钥标识，结合分散因子，生成密钥句柄包括：
    使用分散因子加密密钥标识，得到密钥句柄；或者使用预置密钥加密分散因子和密钥标识，得到密钥句柄。
  8. 根据权利要求7所述的方法，其特征在于，所述使用预置密钥加密分散因子和密钥标识，得到密钥句柄包括：
    生成随机数；
    将使用预置密钥加密随机数和密钥标识拼接成的数据得到的密文作为密钥句柄。
  9. 根据权利要求7所述的方法，其特征在于，所述使用分散因子加密密钥标识，得到密钥句柄包括：
    将分散因子与密钥标识进行异或得到密钥句柄；或者使用预置密钥加密分散因子得到分散密钥，再使用分散密钥加密密钥标识得到密钥句柄。
  10. 根据权利要求1所述的方法，其特征在于，所述客户端与智能密钥案例设备之间的数据传输通道为符合USB协议的通道、蓝牙通道、音频通道或NFC通道。
  11. 一种智能密钥安全设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如权利要求1至10任一项所述方法的步骤。
  12. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求1至10任一项所述方法的步骤。
  13. 一种密钥及密钥句柄的生成系统，包括客户端和网站服务器，其特征在于，所述系统还包括：如权利要求11所述的智能密钥安全设备。
PCT/CN2018/080232 2017-08-22 2018-03-23 密钥及密钥句柄的生成方法、系统及智能密钥安全设备 WO2019037422A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710726999.1A CN107395350B (zh) 2017-08-22 2017-08-22 密钥及密钥句柄的生成方法、系统及智能密钥安全设备
CN201710726999.1 2017-08-22

Publications (1)

Publication Number Publication Date
WO2019037422A1 true WO2019037422A1 (zh) 2019-02-28

Family

ID=60354165

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/080232 WO2019037422A1 (zh) 2017-08-22 2018-03-23 密钥及密钥句柄的生成方法、系统及智能密钥安全设备

Country Status (2)

Country Link
CN (1) CN107395350B (zh)
WO (1) WO2019037422A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107395350B (zh) * 2017-08-22 2019-12-20 深圳市文鼎创数据科技有限公司 密钥及密钥句柄的生成方法、系统及智能密钥安全设备
CN108365952A (zh) * 2018-01-25 2018-08-03 深圳市文鼎创数据科技有限公司 一种注册的方法、系统及智能密钥安全设备

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101075870A (zh) * 2006-05-16 2007-11-21 华为技术有限公司 一种移动ip密钥的产生及分发方法
CN102194063A (zh) * 2010-03-12 2011-09-21 北京路模思科技有限公司 一种基于虚拟机技术安全管理使用密钥证书的方法和系统
WO2014030706A1 (ja) * 2012-08-23 2014-02-27 日本電気株式会社 暗号化データベースシステム、クライアント装置およびサーバ、暗号化データ加算方法およびプログラム
CN104158807A (zh) * 2014-08-14 2014-11-19 四川九成信息技术有限公司 一种基于PaaS的安全云计算方法和系统
CN105184566A (zh) * 2015-06-16 2015-12-23 飞天诚信科技股份有限公司 一种智能密钥设备的工作方法
CN105516195A (zh) * 2016-01-19 2016-04-20 上海众人网络安全技术有限公司 一种基于应用平台登录的安全认证系统及其认证方法
CN106465106A (zh) * 2014-05-02 2017-02-22 皇家Kpn公司 用于从无线电接入网络提供安全性的方法和系统
CN107395350A (zh) * 2017-08-22 2017-11-24 深圳市文鼎创数据科技有限公司 密钥及密钥句柄的生成方法、系统及智能密钥安全设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8300829B2 (en) * 2008-06-23 2012-10-30 Nokia Corporation Verification key handling
CN103414555B (zh) * 2013-08-15 2016-08-10 成都卫士通信息产业股份有限公司 阵列基于io块加密的密钥管理方法
CN105407091A (zh) * 2015-10-30 2016-03-16 深圳云聚汇数码有限公司 数据处理方法
CN205430310U (zh) * 2015-10-30 2016-08-03 南京秦杜明视信息技术有限公司 一种数据存储装置

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101075870A (zh) * 2006-05-16 2007-11-21 华为技术有限公司 一种移动ip密钥的产生及分发方法
CN102194063A (zh) * 2010-03-12 2011-09-21 北京路模思科技有限公司 一种基于虚拟机技术安全管理使用密钥证书的方法和系统
WO2014030706A1 (ja) * 2012-08-23 2014-02-27 日本電気株式会社 暗号化データベースシステム、クライアント装置およびサーバ、暗号化データ加算方法およびプログラム
CN106465106A (zh) * 2014-05-02 2017-02-22 皇家Kpn公司 用于从无线电接入网络提供安全性的方法和系统
CN104158807A (zh) * 2014-08-14 2014-11-19 四川九成信息技术有限公司 一种基于PaaS的安全云计算方法和系统
CN105184566A (zh) * 2015-06-16 2015-12-23 飞天诚信科技股份有限公司 一种智能密钥设备的工作方法
CN105516195A (zh) * 2016-01-19 2016-04-20 上海众人网络安全技术有限公司 一种基于应用平台登录的安全认证系统及其认证方法
CN107395350A (zh) * 2017-08-22 2017-11-24 深圳市文鼎创数据科技有限公司 密钥及密钥句柄的生成方法、系统及智能密钥安全设备

Also Published As

Publication number Publication date
CN107395350A (zh) 2017-11-24
CN107395350B (zh) 2019-12-20

Similar Documents

Publication Publication Date Title
US11218323B2 (en) Method and system for producing a secure communication channel for terminals
US11070542B2 (en) Systems and methods for certificate chain validation of secure elements
CN107810617B (zh) 机密认证和供应
CN108809646B (zh) 安全共享密钥共享系统
US10154018B2 (en) Method and system for facilitating network joining
CN111756533B (zh) 用于安全密码生成的系统、方法和存储介质
TWI497336B (zh) 用於資料安全之裝置及電腦程式
EP3255832B1 (en) Dynamic encryption method, terminal and server
CN101828357B (zh) 用于证书提供的方法和装置
CN107358441B (zh) 支付验证的方法、系统及移动设备和安全认证设备
US9253162B2 (en) Intelligent card secure communication method
US20200014538A1 (en) Methods and systems to facilitate authentication of a user
EP2597591A2 (en) Secure key generation
CN110149209B (zh) 物联网设备及其提高数据传输安全性的方法和装置
CN103546289A (zh) 一种基于USBKey的安全传输数据的方法及系统
JP5827692B2 (ja) バインドされたデータカード及び移動ホストの認証方法、装置及びシステム
CN110598429B (zh) 数据加密存储和读取的方法、终端设备及存储介质
CN112823503B (zh) 一种数据访问方法、数据访问装置及移动终端
WO2022048318A1 (zh) 一种建立通信信道的方法及用户终端
CN106656955A (zh) 一种通信方法及系统、客户端
CN111241492A (zh) 一种产品多租户安全授信方法、系统及电子设备
CN114095277A (zh) 配电网安全通信方法、安全接入设备及可读存储介质
WO2019037422A1 (zh) 密钥及密钥句柄的生成方法、系统及智能密钥安全设备
CN114338091B (zh) 数据传输方法、装置、电子设备及存储介质
CN114358932A (zh) 认证处理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18847808

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18847808

Country of ref document: EP

Kind code of ref document: A1