WO2022100658A1 - 一种更改安全模块中密钥的方法及系统 - Google Patents

一种更改安全模块中密钥的方法及系统 Download PDF

Info

Publication number
WO2022100658A1
WO2022100658A1 PCT/CN2021/130021 CN2021130021W WO2022100658A1 WO 2022100658 A1 WO2022100658 A1 WO 2022100658A1 CN 2021130021 W CN2021130021 W CN 2021130021W WO 2022100658 A1 WO2022100658 A1 WO 2022100658A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
security module
changing
smart device
change
Prior art date
Application number
PCT/CN2021/130021
Other languages
English (en)
French (fr)
Inventor
刘超
杨文伟
康卫昌
Original Assignee
杭州海康威视数字技术股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 杭州海康威视数字技术股份有限公司 filed Critical 杭州海康威视数字技术股份有限公司
Priority to EP21891178.2A priority Critical patent/EP4246873A4/en
Publication of WO2022100658A1 publication Critical patent/WO2022100658A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response

Definitions

  • the present application relates to the field of security technologies, and in particular, to a method and system for changing a key in a security module.
  • the security module (Secure Element, SE) has functions such as symmetric and asymmetric encryption and decryption operations, secure storage and identity authentication, and SE also has the characteristics of small size and convenient installation. Therefore, SE is widely used in various scenarios. For example, SE can be applied to scenarios such as access control devices, mobile payment devices, and financial cards.
  • the SE When applying SE in various scenarios, the SE needs to be welded on the corresponding device to use the SE to store the user's data and files such as keys. In most cases, the key needs to be burned into the SE via a specific card before the device with the SE is shipped from the factory. However, for the user of the device, in order to ensure security, the key stored in the SE may need to be changed when the device is used for the first time, or the key stored in the SE may need to be changed periodically during the use of the device. renew.
  • an embodiment of the present application provides a method for changing a key in a security module, the method is applied to a smart device installed with the security module, and the method includes:
  • the target key in the specified directory in the security module is changed to the new key.
  • the verifying whether the smart device has the first authority to read data from the key changing device includes:
  • performing external authentication on the key changing device includes:
  • the state value of the security state register corresponding to the directory to which the new key belongs is modified to a first state value; wherein, the first state value indicates that the new key under the directory to which the new key belongs can be read.
  • the verifying whether the smart device has the second authority to change the key in the security module includes:
  • performing external authentication on the security module includes:
  • the second ciphertext data generated by the key changing device carry the second ciphertext data in an external authentication instruction and send it to the security module, so that the security module is based on the second ciphertext data
  • the ciphertext data is authenticated externally, and when the external authentication is passed, the state value of the security state register corresponding to the designated directory is modified to a second state value; wherein, the second state value represents the data in the designated directory.
  • the target key can be changed.
  • the key changing device is a central processing unit (Central Processing Unit, CPU) card.
  • CPU Central Processing Unit
  • an embodiment of the present application provides a system for changing a key in a security module, the system including a key changing device and a smart device on which the security module is installed;
  • the key changing device is configured to send, to the intelligent device, a key changing instruction for changing the target key in the specified directory in the security module after establishing a connection with the smart device;
  • the smart device is configured to receive the key change instruction, verify whether the smart device has the first authority to read a new key from the key change device, and verify whether the smart device has access to all the keys.
  • the second authority to change the target key in the security module if the verification result indicates that the smart device has the first authority and the second authority, then read the key to change the device stored in the device new key; change the target key under the specified directory in the security module to the new key; wherein, the new key is pre-written into the key changing device by the card issuer .
  • the smart device is specifically used for:
  • the smart device is specifically used for:
  • the key changing device is further configured to receive the first ciphertext data, perform external authentication based on the first ciphertext data, and when the external authentication passes, change the security status register corresponding to the directory to which the new key belongs.
  • the state value of is modified to a first state value; wherein, the first state value indicates that the new key under the directory to which the new key belongs can be read.
  • the smart device is specifically used for:
  • the smart device is further configured to send the second random number generated by the security module to the key changing device;
  • the key changing device is further configured to encrypt the second random number based on the stored authentication key to obtain second ciphertext data corresponding to the second random number;
  • the intelligent device is further configured to obtain the second ciphertext data generated by the key changing device, and carry the second ciphertext data in an external authentication instruction and send it to the security module, so that all the data are sent to the security module.
  • the security module performs external authentication based on the second ciphertext data, and when the external authentication passes, modifies the state value of the security state register corresponding to the specified directory to a second state value; wherein, the second state The value indicates that the target key under the specified directory can be changed.
  • the key changing device is a CPU card.
  • an embodiment of the present application provides a device for changing a key in a security module, which is applied to a smart device installed with the security module, and the device includes:
  • an obtaining unit configured to obtain the key sent by the key changing device to change the target key in the specified directory in the security module after the connection between the key changing device and the smart device is established change the order;
  • a verification unit for verifying whether the smart device has a first authority to read a new key from the key changing device, and verifying whether the smart device has access to the target key in the security module second authority to make changes;
  • a reading unit configured to read a new key stored in the key change device if the verification result indicates that the smart device has the first authority and the second authority; wherein the new key for changing the device by pre-writing said key with the card issuer;
  • a changing unit configured to change the target key under the specified directory in the security module to the new key.
  • an embodiment of the present application provides a computer device, including a processor, a communication interface, a memory, and a communication bus; wherein, the processor, the communication interface, and the memory communicate with each other through the bus;
  • the memory is used to store a computer program; the processor is used to execute the program stored in the memory to implement any one of the method steps provided in the first aspect.
  • an embodiment of the present application provides a computer-readable storage medium, where a computer program is stored in the storage medium, and when the computer program is executed by a processor, any one of the method steps provided in the first aspect is implemented .
  • an embodiment of the present application provides a computer program, which implements any of the method steps provided in the first aspect when the computer program is executed by a processor.
  • a new key corresponding to the target key that needs to be changed is written in the key changing device in advance, and a connection between the key changing device and the smart device is established.
  • the smart device can obtain the key change instruction triggered by the key change device to change the target key in the specified directory in the security module.
  • the key in the security module is changed based on the new key stored in the key change device.
  • the key stored in the security module can be changed without removing the security module from the smart device, which greatly simplifies the key change operation in the security module. And in the method provided by the embodiment of the present application, by verifying whether the smart device has the authority to read the key from the key changing device, and verifying whether the smart device has the authority to change the target key in the security module, the security module is also guaranteed. Security of keys in .
  • FIG. 1 is a schematic diagram of an application scenario of a method for changing a key in a security module provided by an embodiment of the present application
  • FIG. 2 is a first schematic flowchart of a method for changing a key in a security module provided by an embodiment of the present application
  • 3(a) is a schematic diagram of a directory structure of a key changing device in a method for changing a key in a security module provided by an embodiment of the present application;
  • 3(b) is a schematic diagram of a directory structure of a security module in a method for changing a key in a security module provided by an embodiment of the present application;
  • FIG. 4 is a second schematic flowchart of a method for changing a key in a security module provided by an embodiment of the present application
  • FIG. 5 is a schematic structural diagram of a system for changing a key in a security module provided by an embodiment of the present application
  • FIG. 6 is a schematic diagram of a module composition of a computer device provided in an embodiment of the present application.
  • FIG. 1 shows a schematic diagram of an application scenario of a method for updating a key in a security module provided by an embodiment of the present application.
  • the application scenario includes a key changing device and a smart device with SE installed.
  • the smart device can be any device that applies SE, such as an access control device or a mobile payment device.
  • the new key to which the original key in the SE needs to be changed is stored in the key changing device.
  • the new key stored in the key change device can be written into the key change device by the card issuer. It can also be understood that the card issuer writes the new key into the key changing device.
  • the key change device is a Central Processing Unit (CPU) card as an example for illustration.
  • CPU Central Processing Unit
  • the user can paste the CPU card on the smart device. card identification area to establish the connection between the CPU card and the smart device.
  • the smart device After establishing the connection between the CPU card and the smart device, the smart device verifies whether the smart device has the authority to read the new key from the CPU card, and verifies whether the smart device has the authority to change the key in the security module; If the verification result indicates that the smart device has the above two permissions, the smart device reads the new key stored in the CPU card and changes the key in the SE to the new key.
  • FIG. 1 is only a schematic diagram illustrating a possible application scenario of the method provided by the embodiment of the present application, and does not constitute a limitation to the embodiment of the present application.
  • keys may be stored in the SE, such as an internal authentication key, an external authentication key, a master control key, an encryption key, a decryption key, and an application maintenance key, and so on.
  • keys stored in the SE may be modified by using the method provided by the embodiment of the present application according to actual requirements.
  • Various keys are stored in key files.
  • the method for changing a key in a security module provided by the embodiment of the present application may be designed as: a key changing device is used to change a key in the same subdirectory in the security module or multiple keys.
  • multiple key changing devices may be used to complete the key change, or one key changing device may be used to complete the key change , which is not limited.
  • the security module mentioned in the embodiments of the present application may be a security module (Secure Element, SE) chip.
  • An embodiment of the present application provides a method for changing a key in a security module, and the method is applied to a smart device installed with a security module, that is, the method is performed by an intelligent device installed with a security module.
  • the execution body of the method may be a device installed on the smart device for changing the key in the security module.
  • the smart device mentioned in the embodiments of this application may be an access control device, a mobile payment device, or the like.
  • FIG. 2 is a first schematic flowchart of a method for changing a key in a security module provided by an embodiment of the present application. As shown in FIG. 2 , the method at least includes the following steps:
  • Step 202 after establishing the connection between the key changing device and the smart device, obtain a key changing instruction sent by the key changing device to change the target key in the specified directory in the security module.
  • Step 202 may be: after establishing the connection between the key changing device and the smart device, the key changing device sends a key changing instruction to the smart device, where the key changing instruction is used to change the target encryption in the specified directory in the security module. change the key; the smart device receives the key change instruction sent by the key change device.
  • the key changing device may be a CPU card.
  • the CPU card is equivalent to a microcomputer, and the integrated circuit in the CPU card contains a micro processor CPU, a storage unit, and a chip operating system.
  • the key change device has functions such as data storage, command processing, and data security protection.
  • the above key changing device can be understood as an independent device.
  • the card issuer writes the new key corresponding to the key to be changed into a certain directory of the key changing device in advance.
  • the smart device can change the target key in the security module of the smart device based on the key change device.
  • the user can paste the CPU card on the card identification area of the smart device to establish a radio frequency connection between the key changing device and the smart device.
  • the smart device can read the key change instruction triggered by the key change device through the radio frequency module in the smart device.
  • Step 204 verifying whether the smart device has the first authority to read the new key from the key changing device, and verifying whether the smart device has the second authority to change the target key in the security module; if so, then Go to step 206; otherwise, end.
  • the smart device may verify whether the smart device has the above-mentioned first authority by performing external authentication on the key changing device.
  • the smart device may verify whether the smart device has the above-mentioned second authority by performing external authentication on the security module.
  • the smart device needs to have both the above-mentioned first authority and the second authority before it can perform the operation of changing the key in the security module. In other cases, if the smart device only has the first authority, or only the second authority, or neither the first authority nor the second authority, the smart device cannot execute the key change in the security module. operate.
  • Step 206 read the new key stored in the key change device.
  • Step 208 Change the target key under the specified directory in the security module to the above-mentioned new key.
  • a new key corresponding to the target key that needs to be changed is written in the key changing device in advance, and a connection between the key changing device and the smart device is established.
  • the smart device can obtain the key change instruction triggered by the key change device to change the target key in the specified directory in the security module.
  • the key in the security module is changed based on the new key stored in the key change device.
  • the key stored in the security module can be changed without removing the security module from the smart device, which greatly simplifies the key change operation in the security module. And in the method provided by the embodiment of the present application, by verifying whether the smart device has the authority to read the key from the key changing device, and verifying whether the smart device has the authority to change the target key in the security module, the security module is also guaranteed. Security of keys in .
  • verifying whether the smart device has the first authority to read data from the key changing device may include the following process:
  • the above-mentioned external authentication for the key changing device may be implemented through the following process:
  • the first ciphertext data is carried in the external authentication instruction and sent to the key change device, so that the key change device performs external authentication based on the first ciphertext data, and when the external authentication is passed, the directory corresponding to the new key belongs to.
  • the state value of the security state register is modified to the first state value; wherein, the first state value indicates that the new key under the directory to which the new key belongs can be read.
  • the key changing device when the key changing device needs to be externally authenticated, the key changing device generates a random number.
  • the random number generated by the key changing device in order to distinguish it from the random number generated by the security module, the random number generated by the key changing device is recorded as the first random number.
  • the key changing device After the key changing device generates the first random number, on the one hand, the first random number is temporarily stored in the key changing device, and on the other hand, the first random number is sent to the smart device, so that the smart device can change from the key changing device to the smart device. to obtain the first random number.
  • the smart device obtains the encryption key stored in the security module; encrypts the first random number by using the obtained encryption key to obtain the first ciphertext data corresponding to the first random number; sends an external key to the key changing device An authentication instruction, where the external authentication instruction carries the first ciphertext data.
  • the key changing device receives the external authentication instruction, obtains the first ciphertext data from the external authentication instruction, decrypts the first ciphertext data, and obtains the first plaintext data; if the first plaintext data is the same as the first random number, it is determined The external authentication is passed; if the first plaintext data is different from the first random number, it is determined that the external authentication fails.
  • the key changing device modifies the state value of the security state register corresponding to the directory to which the new key belongs to the first state value.
  • the key changing device when the key changing device needs to be externally authenticated, the key changing device will generate a random number.
  • the random number generated by the key changing device in order to distinguish it from the random number generated by the security module, the random number generated by the key changing device is recorded as the first random number.
  • the key changing device After the key changing device generates the first random number, on the one hand, the first random number is temporarily stored in the key changing device, and on the other hand, the first random number is sent to the smart device, and the smart device sends the first random number to the smart device. It is sent to the security module, so that the security module encrypts the first random number based on the encryption key stored in the security module to obtain the first ciphertext data corresponding to the first random number.
  • the security module returns the first ciphertext data to the smart device.
  • the smart device sends an external authentication instruction to the key changing device, and the external authentication instruction carries the first ciphertext data.
  • the key changing device After receiving the external authentication instruction, the key changing device encrypts the first random number based on the external authentication key in the directory to which the new key belongs, and obtains ciphertext data corresponding to the first random number. The key changing device compares the ciphertext data obtained by self-encryption with the first ciphertext data. If the two are the same, the key changing device determines that the external authentication of the key changing device has passed. At this time, the key changing device changes the state value of the security state register corresponding to the directory to which the new key belongs to the first state value. When the state value of the security state register is the first state value, the file representing the directory to which the new key belongs can be read. In this case, after receiving the new key reading instruction sent by the smart device, the key changing device allows the smart device to read the new key stored in the directory to which the new key belongs.
  • the key changing device determines that the external authentication of the key changing device has not passed.
  • the directory in the key changing device may be divided into a main directory and a subdirectory.
  • one main directory may correspond to one security state register
  • one subdirectory may correspond to one security state register.
  • the directory structure corresponding to the key changing device is shown in Figure 3(a).
  • the changed new key is stored in the binaries under subdirectory 1.
  • the key changing device uses the external authentication key corresponding to the subdirectory 1 to encrypt the first random number.
  • the state value of the security state register corresponding to the subdirectory 1 is changed to the first state value. In this way, the smart device can read the new key stored under subdirectory 1.
  • one subdirectory corresponds to one security status register.
  • the key changing device can only modify the state value of the security status register corresponding to the subdirectory, and all other subdirectories have The state value of the corresponding security state register remains unchanged, thereby ensuring the security of files in other subdirectories.
  • verifying whether the smart device has the second authority to change the key in the security module may include the following process:
  • the smart device can perform external authentication on the security module through the following process:
  • the key changing device sends the second random number generated by the security module to the key changing device, so that the key changing device encrypts the second random number based on the stored authentication key to obtain the second key corresponding to the second random number.
  • obtain the second ciphertext data generated by the key changing device carry the second ciphertext data in the external authentication instruction and send it to the security module, so that the security module can perform external authentication based on the second ciphertext data, and
  • the value of the security state register corresponding to the designated directory is modified to a second state value; wherein, the second state value indicates that the target key in the designated directory can be changed.
  • the security module when the security module needs to be authenticated externally, the security module will generate a random number.
  • the random number generated by the security module is denoted as the second random number.
  • the second random number After the security module generates the second random number, on the one hand, the second random number is temporarily stored in the security module, and on the other hand, the second random number is sent to the smart device.
  • the key changing device receives the second random number, encrypts the second random number based on the stored authentication key, and obtains second ciphertext data corresponding to the second random number.
  • the smart device obtains the second ciphertext data from the key changing device, and sends an external authentication instruction to the security module, where the external authentication instruction carries the second ciphertext data.
  • the security module obtains the second ciphertext data from the external authentication instruction; the security module can decrypt the second ciphertext data to obtain the second plaintext data; if the second plaintext data is the same as the second random number, it is determined that the external authentication is passed; If the second plaintext data is different from the second random number, it is determined that the external authentication fails.
  • the security module modifies the state value of the security state register corresponding to the specified directory to the second state value.
  • the security module when the security module needs to be authenticated externally, the security module will generate a random number.
  • the random number generated by the security module is denoted as the second random number.
  • the second random number is temporarily stored in the security module, and on the other hand, the second random number is sent to the smart device, and the smart device sends the second random number to the key. Change equipment.
  • the key changing device encrypts the second random number based on the stored internal authentication key to obtain second ciphertext data corresponding to the second random number; the key changing device returns the second ciphertext data to the smart device.
  • the smart device sends an external authentication instruction to the security module, and the external authentication instruction carries the second ciphertext data.
  • the security module After receiving the external authentication instruction, the security module encrypts the second random number based on the external authentication key corresponding to the specified directory, and compares the ciphertext data obtained by self-encryption with the second ciphertext data.
  • the security module determines that the external authentication of the security module is passed. At this time, the security module changes the state value of the security state register corresponding to the specified directory to the second state value. When the state value of the security state register is the second state value, the key representing the specified directory can be changed. At this time, if the security module receives the key change instruction sent by the smart device, the security module allows the target key in the specified directory to be changed.
  • the security module determines that the external authentication of the security module fails.
  • the directory in the security module may be divided into a main directory and a subdirectory.
  • a main directory may correspond to a security status register, or a subdirectory may correspond to a security status register.
  • the directory structure corresponding to the security module is shown in FIG. 3(b), and the main directory includes subdirectories 1-3.
  • the security module uses the external authentication key corresponding to the subdirectory 2 to encrypt the second random number.
  • the state value of the security state register corresponding to subdirectory 2 is changed to the second state value.
  • the smart device can change the master key stored in the subdirectory 2.
  • a subdirectory corresponds to a security status register.
  • the security module can only modify the state value of the security state register corresponding to the subdirectory, and the security state corresponding to other subdirectories. The state value of the register remains unchanged, thus ensuring the security of keys in other subdirectories.
  • the security status register is used to represent the security status of the corresponding card (security module or key changing device).
  • the security state register may correspond to 16 security states, and the state values corresponding to each security state may be 0XF0 ⁇ 0XFF.
  • a state value corresponds to a permission. For example, the state value corresponding to the permission to read a new key from subdirectory 1 of the key change device is 0XF2, then only the subdirectory 1 of the key change device corresponds to the state value.
  • the smart device can read the new key under subdirectory 1 only when the state value of the security status register is 0XF2.
  • FIG. 4 is a second schematic flowchart of a method for changing a key in a security module provided by an embodiment of the present application. As shown in FIG. 4 , the method may include the following steps:
  • Step 402 the access control device reads a key change instruction triggered by the CPU card attached to the card identification area of the access control device to change the master control key under subdirectory 2 in the SE chip of the access control device.
  • the CPU card is attached to the card identification area of the access control device, and the CPU card triggers a key change instruction for changing the master key under subdirectory 2 in the SE chip.
  • Step 402 may be: the access control device reads the key change instruction triggered by the CPU card.
  • Step 404 the access control device reads the first random number from the CPU card.
  • Step 406 the access control device sends the first random number to the SE chip, and the SE chip encrypts the first random number based on the encryption key to obtain the first ciphertext data.
  • the encryption key used by the SE core to encrypt the first random number may be an internal authentication key.
  • Step 408 the SE chip returns the first ciphertext data to the access control device.
  • Step 410 the access control device sends an external authentication instruction to the CPU card; wherein, the external authentication instruction carries the first ciphertext data.
  • Step 412 the CPU card encrypts the first random number based on the external authentication key corresponding to the subdirectory 1, and compares the encrypted ciphertext data with the first ciphertext data.
  • Step 414 if the two are consistent, the CPU card changes the state value of the security state register corresponding to the subdirectory 1 to the first state value.
  • the first state value indicates that the new key under subdirectory 1 in the CPU card can be read.
  • Step 416 the access control device reads the second random number from the SE chip.
  • Step 418 the access control device sends the second random number to the CPU card, and the CPU card encrypts the second random number based on the internal authentication key stored therein to obtain second ciphertext data.
  • Step 420 the CPU card returns the second ciphertext data to the access control device.
  • Step 422 the access control device sends an external authentication instruction to the SE chip; wherein, the external authentication instruction carries the second ciphertext data.
  • Step 424 the SE chip encrypts the second random number based on the external authentication key corresponding to the subdirectory 2, and compares the encrypted ciphertext data with the second ciphertext data.
  • Step 426 if the two are consistent, the SE chip changes the state value of the security state register corresponding to the subdirectory 2 to the second state value.
  • the second state value indicates that the key under sub-directory 2 in the SE chip can be changed.
  • Step 428 the access control device reads the new key under sub-directory 1 of the CPU card, and modifies the master key under sub-directory 2 in the SE chip to the new key.
  • the process of performing external authentication on the CPU card in steps 402 to 414 can be performed simultaneously with the process of performing external authentication on the SE chip in steps 416 to 426 ; it is also possible to perform external authentication on the CPU card first.
  • the authentication process is performed, and then the external authentication process for the SE chip is performed; the external authentication process for the SE chip may also be performed first, and then the external authentication process for the CPU card is performed.
  • FIG. 4 indicates that the process of simultaneously executing the external authentication of the CPU card and the process of the external authentication of the SE chip is taken as an example for illustrative description, which does not constitute a limitation to the embodiments of the present application.
  • a new key corresponding to the target key that needs to be changed is written in the key changing device in advance, and a connection between the key changing device and the smart device is established.
  • the smart device can obtain the key change instruction triggered by the key change device to change the target key in the specified directory in the security module.
  • the key in the security module is changed based on the new key stored in the key change device.
  • the key stored in the security module can be changed without removing the security module from the smart device, which greatly simplifies the key change operation in the security module. And in the method provided by the embodiment of the present application, by verifying whether the smart device has the authority to read the key from the key changing device, and verifying whether the smart device has the authority to change the target key in the security module, the security module is also guaranteed. Security of keys in .
  • the embodiment of the present application also provides a system for changing the key in the security module, as shown in FIG. key changing device 510 and a smart device 520 with a security module installed;
  • the key changing device 510 is configured to send a key changing instruction for changing the target key in the specified directory in the security module to the smart device after establishing the connection with the smart device;
  • the smart device 520 is used for receiving the key change instruction, verifying whether the smart device has the first authority to read the new key from the key changing device, and verifying whether the smart device has the ability to change the target key in the security module.
  • the second authority if the verification result indicates that the smart device has the first authority and the second authority, then read the new key stored in the key change device; change the target key under the specified directory in the security module to the new key; Among them, the new key is pre-written by the card issuer to change the device.
  • the smart device 520 can be specifically used for:
  • the smart device 520 can be specifically used for:
  • the key changing device 510 can also be used to receive the first ciphertext data, perform external authentication based on the first ciphertext data, and when the external authentication passes, modify the state value of the security state register corresponding to the directory to which the new key belongs is the first state value; wherein, the first state value indicates that the new key in the directory to which the new key belongs can be read.
  • the smart device 520 can be specifically used for:
  • the smart device 520 can also be used for:
  • the key changing device 510 can also be used to encrypt the second random number based on the stored authentication key to obtain the second ciphertext data corresponding to the second random number; obtain the second random number generated by the key changing device Ciphertext data, the second ciphertext data is carried in the external authentication instruction and sent to the security module, so that the security module performs external authentication based on the second ciphertext data, and when the external authentication passes, the security state corresponding to the specified directory
  • the state value of the register is modified to a second state value; wherein, the second state value indicates that the target key under the specified directory can be changed.
  • the key change device is a CPU card.
  • the system for changing the key in the security module provided by the embodiment of the present application, and the specific implementation process of the functions corresponding to the key changing device and the smart device are the same as the specific implementation process of each step in the method embodiment corresponding to FIG. 1 to FIG. 4 . Therefore, for the specific implementation process of the functions corresponding to the key changing device and the smart device, reference may be made to the method embodiments corresponding to FIG. 1 to FIG. 4 , which will not be repeated here.
  • a new key corresponding to the target key to be changed is written in the key changing device in advance, and a connection between the key changing device and the smart device is established. .
  • the smart device can obtain the key change instruction triggered by the key change device to change the target key in the specified directory in the security module.
  • the key in the security module is changed based on the new key stored in the key change device.
  • the key stored in the security module can be changed without removing the security module from the smart device, which greatly simplifies the key change operation in the security module. And in the system provided by the embodiment of the present application, by verifying whether the smart device has the authority to read the key from the key changing device, and verifying whether the smart device has the authority to change the target key in the security module, the security module is also guaranteed. Security of keys in .
  • an embodiment of the present application provides a device for changing a key in a security module, which is applied to a smart device installed with a security module, and is characterized in that the device include:
  • an obtaining unit for obtaining a key change instruction sent by the key change device to change the target key in the specified directory in the security module after the connection between the key change device and the smart device is established;
  • a verification unit for verifying whether the smart device has the first authority to read the new key from the key changing device, and verifying whether the smart device has the second authority to change the target key in the security module
  • the reading unit is used for reading the new key stored in the key change device if the verification result indicates that the smart device has the first authority and the second authority; wherein, the new key is pre-written by the card issuer to change the key equipment;
  • the change unit is used to change the target key under the specified directory in the security module to the new key.
  • a new key corresponding to the target key to be changed is written in the key changing device in advance, and a connection between the key changing device and the smart device is established. .
  • the smart device can obtain the key change instruction triggered by the key change device to change the target key in the specified directory in the security module.
  • the key in the security module is changed based on the new key stored in the key change device.
  • the key stored in the security module can be changed without removing the security module from the smart device, which greatly simplifies the key change operation in the security module. And in the system provided by the embodiment of the present application, by verifying whether the smart device has the authority to read the key from the key changing device, and verifying whether the smart device has the authority to change the target key in the security module, the security module is also guaranteed. Security of keys in .
  • an embodiment of the present application provides a computer device, as shown in FIG. 6 , the computer device includes a processor 610, a transceiver 620, a memory 630, and a bus interface. in:
  • the computer device further includes: a computer program stored on the memory 630 and executable on the processor 610, when the computer program is executed by the processor 610, any one of the above-mentioned methods for changing a key in a security module is implemented.
  • a computer program stored on the memory 630 and executable on the processor 610, when the computer program is executed by the processor 610, any one of the above-mentioned methods for changing a key in a security module is implemented.
  • Each step can achieve the same technical effect. In order to avoid repetition, details are not repeated here.
  • the bus architecture may include any number of interconnected buses and bridges linking together various circuits for one or more processors, represented by processor 610, and memory, represented by memory 630.
  • the bus architecture may also link together various other circuits, such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be described further herein.
  • the bus interface provides an interface to the bus architecture.
  • Transceiver 620 may be a number of elements, including a transmitter and a receiver, that provide a means for communicating with various other devices over a transmission medium.
  • the processor 610 is responsible for managing the bus architecture and general processing, and the memory 630 may store data used by the processor 610 in performing operations.
  • an embodiment of the present application provides a computer device, including a processor, a communication interface, a memory, and a communication bus; wherein the processor, the communication interface, and the memory The communication between each other is completed through the bus; the memory is used to store the computer program; the processor is used to execute the program stored in the memory to realize each step in any of the above methods for changing the key in the security module.
  • Embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, each step of the foregoing method embodiment for changing a key in a security module is implemented, and achieve the same technical effect.
  • the computer-readable storage medium such as read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk, etc.
  • Embodiments of the present application also provide a computer program, which, when executed by a processor, implements each step of any of the foregoing method embodiments for changing a key in a security module, and can achieve the same technical effect. To avoid repetition, details are not repeated here.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Storage Device Security (AREA)
  • Lock And Its Accessories (AREA)

Abstract

本申请实施例提供了一种更改安全模块中密钥的方法及系统，该方法应用于安装有安全模块的智能设备。包括：建立密钥更改设备与智能设备的连接后，获取密钥更改设备发送的密钥更改指令；验证智能设备是否具有从密钥更改设备读取新密钥及对安全模块中的目标密钥进行更改的权限；若是，则读取密钥更改设备内存储的新密钥，并将安全模块中指定目录下的目标密钥更改为新密钥。本申请实施例中，在不需要将安全模块从智能设备拆卸下来的情况下，实现了对安全模块中所存储的密钥的更改，大大简化了安全模块中密钥更改操作，并且通过验证智能设备是否具备从密钥更改设备读取密钥以及更改安全模块中的目标密钥的权限，还保证了安全模块中密钥的安全性。

Description

一种更改安全模块中密钥的方法及系统
本申请要求于2020年11月16日提交中国专利局、申请号为202011282164.X发明名称为“一种更改安全模块中密钥的方法及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及安全技术领域，尤其涉及一种更改安全模块中密钥方法及系统。
背景技术
安全模块(Secure Element，SE)具有对称及非对称加解密运算、安全存储和身份认证等功能，并且SE还具有体积小和安装方便等特点，因此，SE被广泛的应用在各种场景中，例如，可以将SE应用于门禁设备、移动支付设备和金融卡等场景中。
在各种场景下应用SE时，需要将SE焊接在相应的设备上，以使用SE来存储用户的数据以及密钥等文件。大多数情况下，在安装有SE的设备出厂之前，需要通过特定卡片将密钥烧录至SE中。但是对于设备的使用者而言，为了保证安全性，在初次使用设备时可能需要对SE中所存储的密钥进行更改，或者在设备使用过程中，定期对SE中所存储的密钥进行定期更新。
由于在将密钥烧录至设备上的SE中时需要使用特定卡片，但是，对于该设备而言，其上可能并不存在该特定卡片。因此，在更改SE中所存储的密钥时，需要将SE从设备上拆卸下，这样无疑增加了密钥更改的操作复杂性。
由此可知，利用相关技术对SE中存储的密钥进行更改时，需要改动设备结构，操作比较复杂。
发明内容
本申请实施例采用下述技术方案：
第一方面，本申请实施例提供一种更改安全模块中密钥的方法，该方法应用于安装有所述安全模块的智能设备，该方法包括：
在建立密钥更改设备与所述智能设备之间的连接后，获取所述密钥更改设备发送的对所述安全模块中的指定目录下的目标密钥进行更改的密钥更改指令；
验证所述智能设备是否具有从所述密钥更改设备读取新密钥的第一权限，以及，验证所述智能设备是否具有对所述安全模块中的所述目标密钥进行更改的第二权限；
若验证结果指示所述智能设备具有所述第一权限和所述第二权限，则读取所述密钥更改设备内存储的新密钥；其中，所述新密钥为通过发卡器预先写入所述密钥更改设备的；
将所述安全模块中所述指定目录下的所述目标密钥更改为所述新密钥。
可选地，所述验证所述智能设备是否具有从所述密钥更改设备读取数据的第一权限，包括：
对所述密钥更改设备进行外部认证；若所述密钥更改设备的外部认证通过，则确定所述智能设备具有从所述密钥更改设备读取数据的第一权限。
可选地，所述对所述密钥更改设备进行外部认证，包括：
基于所述安全模块中所存储的加密密钥，对所述密钥更改设备所产生的第一随机数进行加密，得到所述第一随机数所对应的第一密文数据；
将所述第一密文数据携带在外部认证指令中发送给所述密钥更改设备，以使所述密钥更改设备基于所述第一密文数据进行外部认证，以及在外部认证通过时，将新密钥所属目录所对应的安全状态寄存器的状态值修改为第一状态值；其中，所述第一状态值表征所述新密钥所属目录下的所述新密钥可被读取。
可选地，所述验证所述智能设备是否具有对所述安全模块中的密钥进行更改的第二权限，包括：
对所述安全模块进行外部认证；若所述安全模块的外部认证通过，则确定所述智能设备具有对所述安全模块中的密钥进行更改的第二权限。
可选地，所述对所述安全模块进行外部认证，包括：
将所述安全模块所产生的第二随机数发送给所述密钥更改设备，以使所述密钥更改设备基于其所存储的认证密钥，对所述第二随机数进行加密，得到所述第二随机数所对应的第二密文数据；
获取所述密钥更改设备所产生的所述第二密文数据，将所述第二密文数据携带在外部认证指令中发送给所述安全模块，以使所述安全模块基于所述第二密文数据进行外部认证，以及在外部认证通过时，将所述指定目录所对应的安全状态寄存器的状态值修改为第二状态值；其中，所述第二状态值表征所述指定目录下的所述目标密钥可被更改。
可选地，所述密钥更改设备为中央处理器(Central Processing Unit，CPU)卡。
第二方面，本申请实施例提供了一种更改安全模块中密钥的系统，所述系统包括密钥更改设备和安装有所述安全模块的智能设备；
所述密钥更改设备，用于在建立与所述智能设备之间的连接后，向所述智能设备发送对所述安全模块中的指定目录下的目标密钥进行更改的密钥更改指令；
所述智能设备，用于接收所述密钥更改指令，验证所述智能设备是否具有从所述密钥更改设备读取新密钥的第一权限，以及，验证所述智能设备是否具有对所述安全模块中的所述目标密钥进行更改的第二权限；若验证结果指示所述智能设备具有所述第一权限和所述第二权限，则读取所述密钥更改设备内存储的新密钥；将所述安全模块中所述指定目录下的所述目标密钥更改为所述新密钥；其中，所述新密钥为通过发卡器预先写入所述密钥更改设备的。
可选地，所述智能设备，具体用于：
对所述密钥更改设备进行外部认证；若所述密钥更改设备的外部认证通过，则确定所述智能设备具有从所述密钥更改设备读取数据的第一权限。
可选地，所述智能设备，具体用于：
基于所述安全模块中所存储的加密密钥，对所述密钥更改设备所产生的第一随机数进行加密，得到所述第一随机数所对应的第一密文数据；将所述第一密文数据携带在外部认证指令中发送给所述密钥更改设备；
所述密钥更改设备还用于，接收所述第一密文数据，基于所述第一密文数据进行外部认证，以及在外部认证通过时，将新密钥所属目录所对应的安全状态寄存器的状态值修改为第一状态值；其中，所述第一状态值表征所述新密钥所属目录下的所述新密钥可被读取。
可选地，所述智能设备，具体用于：
对所述安全模块进行外部认证；若所述安全模块的外部认证通过，则确定所述智能设备具有对所述安全模块中的密钥进行更改的第二权限。
可选地，所述智能设备，还用于将所述安全模块所产生的第二随机数发送给所述密钥更改设备；
所述密钥更改设备，还用于基于其所存储的认证密钥，对所述第二随机数进行加密，得到所述第二随机数所对应的第二密文数据；
所述智能设备，还用于获取所述密钥更改设备所产生的所述第二密文数据，将所述第二密文数据携带在外部认证指令中发送给所述安全模块，以使所述安全模块基于所述第二密文数据进行外部认证，以及在外部认证通过时，将所述指定目录所对应的安全状态寄存器的状态值修改为第二状态值；其中，所述第二状态值表征所述指定目录下的所述目标密钥可被更改。
可选地，所述密钥更改设备为CPU卡。
第三方面，本申请实施例提供了一种更改安全模块中密钥的装置，应用于安装有所述安全模块的智能设备，所述装置包括：
获取单元，用于在建立密钥更改设备与所述智能设备之间的连接后，获取所述密钥更改设备发送的对所述安全模块中的指定目录下的目标密钥进行更改的密钥更改指令；
验证单元，用于验证所述智能设备是否具有从所述密钥更改设备读取新密钥的第一权限，以及，验证所述智能设备是否具有对所述安全模块中的所述目标密钥进行更改的第二权限；
读取单元，用于若验证结果指示所述智能设备具有所述第一权限和所述第二权限，则读取所述密钥更改设备内存储的新密钥；其中，所述新密钥为通过发卡器预先写入所述密钥更改设备的；
更改单元，用于将所述安全模块中所述指定目录下的所述目标密钥更改为所述新密钥。
第四方面，本申请实施例提供了一种计算机设备，包括处理器、通信接口、存储器和通信总线；其中，所述处理器、所述通信接口以及所述存储器通过总线完成相互间的通信；所述存储器，用于存放计算机程序；所述处理器，用于执行所述存储器上所存放的程序，实现第一方面提供的任一所述的方法步骤。
第五方面，本申请实施例提供了一种计算机可读存储介质，所述存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现第一方面提供的任一所述的方法步骤。
第六方面，本申请实施例提供了一种计算机程序，所述计算机程序被处理器执行时实现第一方面提供的任一所述的方法步骤。
本申请实施例采用的上述至少一个技术方案能够达到以下有益效果：
采用本申请实施例提供的技术方案，预先在密钥更改设备中写入需要更改的目标密钥 所对应的新密钥，并建立密钥更改设备与智能设备之间的连接。这样，智能设备可以获取到密钥更改设备触发的对安全模块中指定目录下的目标密钥进行更改的密钥更改指令，在验证智能设备具有从密钥更改设备读取新密钥的第一权限，以及智能设备具有对安全模块中指定目录下的目标密钥进行更改的第二权限后，则基于密钥更改设备内存储的新密钥对安全模块中的密钥进行更改。
通过本申请实施例提供的方法，在不需要将安全模块从智能设备上拆卸下来的情况下，实现了对安全模块中所存储的密钥的更改，大大简化了安全模块中密钥更改操作。并且本申请实施例提供的方法中，通过验证智能设备是否具备从密钥更改设备读取密钥的权限，以及验证智能设备是否具备更改安全模块中的目标密钥的权限，还保证了安全模块中密钥的安全性。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请实施例提供的更改安全模块中密钥的方法的应用场景示意图；
图2为本申请实施例提供的更改安全模块中密钥的方法的第一种流程示意图；
图3(a)为本申请实施例提供的更改安全模块中密钥的方法中密钥更改设备的一种目录结构示意图；
图3(b)为本申请实施例提供的更改安全模块中密钥的方法中安全模块的一种目录结构示意图；
图4为本申请实施例提供的更改安全模块中密钥的方法的第二种流程示意图；
图5为本申请实施例提供的更改安全模块中密钥的系统的结构示意图；
图6为本申请实施例提供的计算机设备的模块组成示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
以下结合附图，详细说明本申请各实施例提供的技术方案。
图1示出了本申请实施例提供的更新安全模块中密钥的方法的应用场景示意图，如图1所示，该应用场景包括密钥更改设备和安装有SE的智能设备。其中，该智能设备可以为门禁设备或移动支付设备等任意应用SE的设备。其中，密钥更改设备中存储有SE中的原密钥需要更改为的新密钥。密钥更改设备中所存储的新密钥可以为通过发卡器写入密钥更改设备中。也可以理解为，发卡器将新密钥写入密钥更改设备中。
这样，当需要对安装在智能设备上的SE中的密钥进行更改时，建立密钥更改设备与智能设备之间的连接。针对图1所示场景，则以密钥更改设备为中央处理器(Central Processing Unit，CPU)卡为例进行示例性说明，在SE中的更改密钥时，用户可以将CPU卡贴在智能设备的卡片识别区域，以建立CPU卡与智能设备之间的连接。在建立了CPU 卡与智能设备之间的连接后，智能设备验证智能设备是否具备从CPU卡读取新密钥的权限，以及验证智能设备是否具备对安全模块中的密钥进行更改的权限；若验证结果指示智能设备具备上述两种权限，则智能设备读取CPU卡中所存储的新密钥，并将SE中的密钥更改为该新密钥。
另外，上述图1只是示例性介绍本申请实施例所提供方法的一种可能的应用场景示意图，并不构成对本申请实施例的限定。
可选的，在SE中可能会存储有多种密钥，如内部认证密钥、外部认证密钥、主控密钥、加密密钥、解密密钥、和应用维护密钥等等。在具体实施时，可以依据实际需求采用本申请实施例提供的方法对SE中所存储的某一种或者几种密钥进行更改。多种密钥存储在密钥文件中。
可选的，在一种可选的实施方式中，本申请实施例提供的更改安全模块中密钥方法可以设计为：一个密钥更改设备用于更改安全模块中的同一个子目录下的一个或者多个密钥。
本申请实施例中，当需要对安全模块中的多个密钥进行更改时，可以使用多个密钥更改设备来完成密钥的更改，也可以使用一个密钥更改设备来完成密钥的更改，对此不进行限定。
其中，本申请实施例中所提及到的安全模块可以为安全模块(Secure Element，SE)芯片。
本申请实施例提供了一种更改安全模块中密钥的方法，该方法应用于安装有安全模块的智能设备，也即，该方法的执行主体为安装有安全模块的智能设备。可选的，该方法的执行主体可以为安装在该智能设备上的更改安全模块中密钥的装置。其中，本申请实施例中所提及到的智能设备可以为门禁设备、或移动支付设备等。
图2为本申请实施例提供的更改安全模块中密钥的方法的第一种流程示意图，如图2所示，该方法至少包括如下步骤：
步骤202，在建立密钥更改设备与智能设备之间的连接后，获取密钥更改设备发送的对安全模块中的指定目录下的目标密钥进行更改的密钥更改指令。
步骤202可以为：在建立密钥更改设备与智能设备之间的连接后，密钥更改设备向智能设备发送密钥更改指令，该密钥更改指令用于对安全模块中指定目录下的目标密钥进行更改；智能设备接收密钥更改设备发送的密钥更改指令。
其中，密钥更改设备可以为CPU卡。CPU卡相当于一台微型计算机，CPU卡内的集成电路中带有微型处理器CPU、存储单元以及芯片操作系统等。密钥更改设备具有数据存储功能、命令处理以及数据安全保护等功能。
上述密钥更改设备可以理解为独立的设备。发卡器预先将需要更改的密钥所对应的新密钥写入该密钥更改设备的某个目录下。这样，智能设备就可以基于密钥更改设备对智能设备的安全模块中的目标密钥进行更改。
可选的，在一种实施方式中，若密钥更改设备为CPU卡，则用户可以将CPU卡贴在智能设备的卡片识别区域，从而建立密钥更改设备与智能设备之间的射频连接。
在上述步骤202中，智能设备可以通过智能设备中的射频模块读取密钥更改设备触发 的密钥更改指令。
步骤204，验证该智能设备是否具有从密钥更改设备读取新密钥的第一权限，以及，验证该智能设备是否具有对安全模块中的目标密钥进行更改的第二权限；若是，则执行步骤206；否则，结束。
可选的，在一种实施方式中，智能设备可以采用对密钥更改设备进行外部认证的方式，验证智能设备是否具有上述第一权限。
可选的，在一种实施方式中，智能设备可以采用对安全模块进行外部认证的方式，验证智能设备是否具有上述第二权限。
其中，智能设备需要同时具备上述第一权限和第二权限，才可以执行对安全模块中的密钥进行更改的操作。其余情况，如智能设备只具备第一权限，或者只具备第二权限，或者既不具备第一权限，也不具备第二权限，则智能设备均不能执行对安全模块中的密钥进行更改的操作。
步骤206，读取密钥更改设备内存储的新密钥。
其中，上述新密钥为通过发卡器预先写入密钥更改设备的。
步骤208，将安全模块中指定目录下的目标密钥更改为上述新密钥。
本申请实施例提供的更改安全模块中密钥的方法，预先在密钥更改设备中写入需要更改的目标密钥所对应的新密钥，并建立密钥更改设备与智能设备之间的连接。这样，智能设备可以获取到密钥更改设备触发的对安全模块中指定目录下的目标密钥进行更改的密钥更改指令，在验证智能设备具有从密钥更改设备读取新密钥的第一权限，以及智能设备具有对安全模块中指定目录下的目标密钥进行更改的第二权限后，则基于密钥更改设备内存储的新密钥对安全模块中的密钥进行更改。
通过本申请实施例提供的方法，在不需要将安全模块从智能设备上拆卸下来的情况下，实现了对安全模块中所存储的密钥的更改，大大简化了安全模块中密钥更改操作。并且本申请实施例提供的方法中，通过验证智能设备是否具备从密钥更改设备读取密钥的权限，以及验证智能设备是否具备更改安全模块中的目标密钥的权限，还保证了安全模块中密钥的安全性。
为便于理解本申请实施例提供的方法，下述将一一介绍上述各个步骤的具体实现过程。
可选的，在一种实施方式中，上述步骤204中，验证智能设备是否具有从密钥更改设备读取数据的第一权限，可以包括如下过程：
对密钥更改设备进行外部认证；若密钥更改设备的外部认证通过，则确定智能设备具有上述第一权限。
可选的，上述对密钥更改设备进行外部认证，可以通过如下过程实现：
基于安全模块中所存储的加密密钥，对密钥更改设备所产生的第一随机数进行加密，得到第一随机数所对应的第一密文数据；
将第一密文数据携带在外部认证指令中发送给密钥更改设备，以使密钥更改设备基于第一密文数据进行外部认证，以及在外部认证通过时，将新密钥所属目录所对应的安全状态寄存器的状态值修改为第一状态值；其中，第一状态值表征新密钥所属目录下的新密钥 可被读取。
可选的，在一种实施方式中，当需要对密钥更改设备进行外部认证时，密钥更改设备产生一个随机数。在本申请实施例中，为便于与安全模块产生的随机数进行区分，将密钥更改设备所产生的随机数记为第一随机数。
密钥更改设备在产生了第一随机数后，一方面将第一随机数临时保存在密钥更改设备内，另外一方面将第一随机数发送给智能设备，实现智能设备从密钥更改设备中获取第一随机数。
智能设备获取安全模块中所存储的加密密钥；利用所获取的加密密钥，对第一随机数进行加密，得到第一随机数所对应的第一密文数据；向密钥更改设备发送外部认证指令，该外部认证指令携带第一密文数据。
密钥更改设备接收外部认证指令，从外部认证指令中获取第一密文数据，对第一密文数据进行解密，得到第一明文数据；若第一明文数据与第一随机数相同，则确定外部认证通过；若第一明文数据与第一随机数不同，则确定外部认证未通过。
在外部认证通过时，密钥更改设备将新密钥所属目录所对应的安全状态寄存器的状态值修改为第一状态值。
可选的，在一种实施方式中，当需要对密钥更改设备进行外部认证时，密钥更改设备会产生一个随机数。在本申请实施例中，为便于与安全模块产生的随机数进行区分，将密钥更改设备所产生的随机数记为第一随机数。
密钥更改设备在产生了第一随机数后，一方面将第一随机数临时保存在密钥更改设备内，另外一方面将第一随机数发送给智能设备，由智能设备将第一随机数发送给安全模块，以使安全模块基于其所存储的加密密钥对第一随机数进行加密，得到第一随机数所对应的第一密文数据。
安全模块将第一密文数据返回给智能设备。智能设备向密钥更改设备发送外部认证指令，该外部认证指令中携带有第一密文数据。
密钥更改设备在接收到外部认证指令后，基于新密钥所属目录下的外部认证密钥，对第一随机数进行加密，得到第一随机数所对应的密文数据。密钥更改设备将自身加密得到的密文数据与第一密文数据进行比对。若两者相同，则密钥更改设备确定密钥更改设备外部认证通过。这时，密钥更改设备将新密钥所属目录所对应的安全状态寄存器的状态值更改为第一状态值。当该安全状态寄存器的状态值为第一状态值时，表征新密钥所属目录下的文件可被读取。这种情况下，若接收到智能设备发送的新密钥读取指令后，则密钥更改设备允许智能设备读取该新密钥所属目录下所存储的新密钥。
若密钥更改设备加密得到的密文数据与第一密文数据不同，则密钥更改设备确定密钥更改设备外部认证未通过。
本申请实施例中，密钥更改设备中的目录可以分为主目录和子目录。对于密钥更改设备而言，可以一个主目录对应一个安全状态寄存器，也可以一个子目录对应一个安全状态寄存器。
例如，在一种实施方式中，密钥更改设备所对应的目录结构如图3(a)所示，在图3 (a)所示目录结构下，用于对安全模块中的目标密钥进行更改的新密钥存储在子目录1下的二进制文件中。
针对该种情况，密钥更改设备在对第一随机数进行加密时，则使用子目录1所对应的外部认证密钥对第一随机数进行加密。另外，针对图3(a)所示情况，在密钥更改设备外部认证通过后，将子目录1所对应的安全状态寄存器的状态值更改为第一状态值。这样，智能设备可以读取子目录1下所存储的新密钥。
本申请实施例中，对于密钥更改设备而言，一个子目录对应一个安全状态寄存器。这样，在使用某个子目录所对应的外部认证密钥，对密钥更改设备进行外部认证通过后，密钥更改设备只能修改该子目录所对应的安全状态寄存器的状态值，其他子目录所对应的安全状态寄存器的状态值保持不变，从而保证了其他子目录下的文件的安全性。
可选的，在一种实施方式中，上述步骤204中，验证智能设备是否具有对安全模块中的密钥进行更改的第二权限，可以包括如下过程：
对安全模块进行外部认证；若安全模块的外部认证通过，则确定智能设备具有上述第二权限。
可选的，智能设备可以通过如下过程，对安全模块进行外部认证：
将安全模块所产生的第二随机数发送给密钥更改设备，以使密钥更改设备基于其所存储的认证密钥对第二随机数进行加密，得到第二随机数所对应的第二密文数据；获取密钥更改设备所产生的第二密文数据，将第二密文数据携带在外部认证指令中发送给安全模块，以使安全模块基于第二密文数据进行外部认证，以及在外部认证通过时，将指定目录所对应的安全状态寄存器的值修改为第二状态值；其中，第二状态值表征该指定目录下的目标密钥可被更改。
可选的，在一种实施方式中，当需要对安全模块进行外部认证时，安全模块会产生一个随机数。在本申请实施例中，为便于与密钥更改设备所产生的随机数进行区分，将安全模块所产生的随机数记为第二随机数。安全模块在产生了第二随机数后，一方面将第二随机数临时保存在安全模块中，另一方面将第二随机数发送给智能设备。
密钥更改设备接收到第二随机数，基于其所存储的认证密钥，对第二随机数进行加密，得到第二随机数所对应的第二密文数据。智能设备从密钥更改设备中获取第二密文数据，向安全模块发送外部认证指令，该外部认证指令携带第二密文数据。
安全模块从外部认证指令中获取第二密文数据；安全模块可以对第二密文数据进行解密，得到第二明文数据；若第二明文数据与第二随机数相同，则确定外部认证通过；若第二明文数据与第二随机数不同，则确定外部认证未通过。
在外部认证通过时，安全模块将指定目录所对应的安全状态寄存器的状态值修改为第二状态值。
可选的，在一种实施方式中，当需要对安全模块进行外部认证时，安全模块会产生一个随机数。在本申请实施例中，为便于与密钥更改设备所产生的随机数进行区分，将安全模块所产生的随机数记为第二随机数。安全模块在产生了第二随机数后，一方面将第二随机数临时保存在安全模块中，另一方面将第二随机数发送给智能设备，由智能设备将第二 随机数发送给密钥更改设备。
密钥更改设备基于其所存储的内部认证密钥对第二随机数进行加密，得到第二随机数所对应的第二密文数据；密钥更改设备将第二密文数据返回给智能设备。
智能设备向安全模块发送外部认证指令，该外部认证指令中携带有第二密文数据。安全模块在接收到外部认证指令后，基于指定目录所对应的外部认证密钥对该第二随机数进行加密，将自身加密得到的密文数据与第二密文数据进行比对。
若两者相同，则安全模块确定安全模块外部认证通过。这时，安全模块将指定目录所对应的安全状态寄存器的状态值更改为第二状态值。当该安全状态寄存器的状态值为第二状态值时，表征该指定目录下的密钥可被更改。这时，若安全模块接收到智能设备发送的密钥更改指令后，则安全模块允许对该指定目录下的目标密钥进行更改。
若安全模块加密得到的密文数据与第二密文数据不同，则安全模块确定安全模块外部认证未通过。
本申请实施例中，安全模块中的目录可以分为主目录和子目录。对于安全模块而言，可以一个主目录对应一个安全状态寄存器，也可以一个子目录对应一个安全状态寄存器。
例如，在一种实施方式中，安全模块所对应的目录结构如图3(b)所示，主目录下包括子目录1-3。在本申请实施例中，则需要对安全模块所对应目录中的子目录2下的主控密钥进行更改。在这种情况下，安全模块在对第二随机数进行加密时，则使用子目录2所对应的外部认证密钥对第二随机数进行加密。
针对图3(b)所示的情况，在安全模块外部认证通过后，将子目录2所对应的安全状态寄存器的状态值更改为第二状态值。这样，智能设备可以对子目录2下所存储的主控密钥进行更改。
对于安全模块而言，一个子目录对应一个安全状态寄存器。这样，在使用某个子目录所对应的外部认证密钥，对安全模块进行外部认证通过后，安全模块只能修改该子目录所对应的安全状态寄存器的状态值，其他子目录所对应的安全状态寄存器的状态值保持不变，从而保证了其他子目录下的密钥的安全性。
在本申请实施例中，安全状态寄存器用于表征其所对应卡片(安全模块或者密钥更改设备)的安全状态。在一种实施方式中，安全状态寄存器可以对应16种安全状态，各个安全状态所对应的状态值可以为0XF0～0XFF。一种状态值对应一种权限，例如，可以将从密钥更改设备的子目录1下读取新密钥的权限所对应的状态值为0XF2，则只有密钥更改设备中子目录1所对应的安全状态寄存器的状态值为0XF2时，智能设备才可以读取子目录1下的新密钥。
为便于理解本申请实施例提供的方法，下述将以更改某门禁设备的SE芯片内的子目录2下的主控密钥为例，介绍本申请实施例提供的方法，且所采用的密钥更改设备为CPU卡，CPU卡中的新密钥存储在CPU卡的子目录1下。图4为本申请实施例提供的更改安全模块中密钥的方法的第二种流程示意图，如图4所示，该方法可以包括如下步骤：
步骤402，门禁设备读取贴在门禁设备的卡片识别区域内的CPU卡触发的对门禁设备的SE芯片中子目录2下的主控密钥进行更改的密钥更改指令。
本申请实施例中，CPU卡贴在门禁设备的卡片识别区域内，CPU卡触发对SE芯片中子目录2下的主控密钥进行更改的密钥更改指令。
步骤402可以为：门禁设备读取CPU卡触发的密钥更改指令。
步骤404，门禁设备从CPU卡读取第一随机数。
步骤406，门禁设备将第一随机数发送给SE芯片，SE芯片基于加密密钥对第一随机数进行加密，得到第一密文数据。
步骤406中，SE芯对第一随机数进行加密所采用的加密密钥可以为内部认证密钥。
步骤408，SE芯片将第一密文数据返回给门禁设备。
步骤410，门禁设备向CPU卡发送外部认证指令；其中，该外部认证指令中携带有第一密文数据。
步骤412，CPU卡基于子目录1所对应的外部认证密钥，对第一随机数进行加密，将加密得到的密文数据与第一密文数据进行比对。
步骤414，若两者一致，则CPU卡将子目录1所对应的安全状态寄存器的状态值更改为第一状态值。
其中，第一状态值表征CPU卡内子目录1下的新密钥可以被读取。
步骤416，门禁设备从SE芯片读取第二随机数。
步骤418，门禁设备将第二随机数发送给CPU卡，CPU卡基于其所存储的内部认证密钥对第二随机数进行加密，得到第二密文数据。
步骤420，CPU卡将第二密文数据返回给门禁设备。
步骤422，门禁设备向SE芯片发送外部认证指令；其中，该外部认证指令中携带有第二密文数据。
步骤424，SE芯片基于子目录2所对应的外部认证密钥对第二随机数进行加密，将加密得到的密文数据与第二密文数据进行比对。
步骤426，若两者一致，则SE芯片将子目录2所对应的安全状态寄存器的状态值更改为第二状态值。
其中，第二状态值表征SE芯片内子目录2下的密钥可以被更改。
步骤428，门禁设备读取CPU卡子目录1下的新密钥，并将SE芯片内子目录2下的主控密钥修改为该新密钥。
其中，图4所示实施例中各个步骤所对应的具体实现过程可参考图1所示实施例，此处不再赘述。
在图4所示实施例中，步骤402～步骤414对CPU卡进行外部认证的过程，与步骤416～步骤426对SE芯片进行外部认证的过程可以同时执行；也可以先执行对CPU卡进行外部认证的过程，再执行对SE芯片进行外部认证的过程；还可以先执行对SE芯片进行外部认证的过程，再执行对CPU卡进行外部认证的过程。上述图4指示以同时执行CPU卡外部认证的过程和SE芯片外部认证的过程为例进行示例性说明，并不构成对本申请实施例的限定。
本申请实施例提供的更改安全模块中密钥的方法，预先在密钥更改设备中写入需要更 改的目标密钥所对应的新密钥，并建立密钥更改设备与智能设备之间的连接。这样，智能设备可以获取到密钥更改设备触发的对安全模块中指定目录下的目标密钥进行更改的密钥更改指令，在验证智能设备具有从密钥更改设备读取新密钥的第一权限，以及智能设备具有对安全模块中指定目录下的目标密钥进行更改的第二权限后，则基于密钥更改设备内存储的新密钥对安全模块中的密钥进行更改。
通过本申请实施例提供的方法，在不需要将安全模块从智能设备上拆卸下来的情况下，实现了对安全模块中所存储的密钥的更改，大大简化了安全模块中密钥更改操作。并且本申请实施例提供的方法中，通过验证智能设备是否具备从密钥更改设备读取密钥的权限，以及验证智能设备是否具备更改安全模块中的目标密钥的权限，还保证了安全模块中密钥的安全性。
对应于本申请实施例提供的更改安全模块中密钥的方法，基于相同的思路，本申请实施例还提供了一种更改安全模块中密钥的系统，如图5所示，该系统包括密钥更改设备510和安装有安全模块的智能设备520；
密钥更改设备510，用于在建立与智能设备之间的连接后，向智能设备发送对安全模块中的指定目录下的目标密钥进行更改的密钥更改指令；
智能设备520，用于接收密钥更改指令，验证智能设备是否具有从密钥更改设备读取新密钥的第一权限，以及，验证智能设备是否具有对安全模块中的目标密钥进行更改的第二权限；若验证结果指示智能设备具有第一权限和第二权限，则读取密钥更改设备内存储的新密钥；将安全模块中指定目录下的目标密钥更改为新密钥；其中，新密钥为通过发卡器预先写入密钥更改设备的。
可选地，智能设备520，具体可以用于：
对密钥更改设备进行外部认证；若密钥更改设备的外部认证通过，则确定智能设备具有从密钥更改设备读取数据的第一权限。
可选地，智能设备520，具体可以用于：
基于安全模块中所存储的加密密钥，对密钥更改设备所产生的第一随机数进行加密，得到第一随机数所对应的第一密文数据；将第一密文数据携带在外部认证指令中发送给密钥更改设备；
密钥更改设备510，还可以用于接收第一密文数据，基于第一密文数据进行外部认证，以及在外部认证通过时，将新密钥所属目录所对应的安全状态寄存器的状态值修改为第一状态值；其中，第一状态值表征新密钥所属目录下的新密钥可被读取。
可选地，智能设备520，具体可以用于：
对安全模块进行外部认证；若安全模块的外部认证通过，则确定智能设备具有对安全模块中的密钥进行更改的第二权限。
可选地，智能设备520，还可以用于：
将安全模块所产生的第二随机数发送给密钥更改设备；
密钥更改设备510，还可以用于基于其所存储的认证密钥对第二随机数进行加密，得到第二随机数所对应的第二密文数据；获取密钥更改设备所产生的第二密文数据，将第二 密文数据携带在外部认证指令中发送给安全模块，以使安全模块基于第二密文数据进行外部认证，以及在外部认证通过时，将指定目录所对应的安全状态寄存器的状态值修改为第二状态值；其中，第二状态值表征指定目录下的目标密钥可被更改。
可选地，密钥更改设备为CPU卡。
本申请实施例所提供的更改安全模块中密钥的系统，密钥更改设备和智能设备所对应功能的具体实现过程，与图1-图4所对应方法实施例中各个步骤的具体实现过程相同，因此，密钥更改设备和智能设备所对应功能的具体实现过程可参考图1-图4所对应方法实施例，此处不再赘述。
本申请实施例提供的更改安全模块中密钥的系统，预先在密钥更改设备中写入需要更改的目标密钥所对应的新密钥，并建立密钥更改设备与智能设备之间的连接。这样，智能设备可以获取到密钥更改设备触发的对安全模块中指定目录下的目标密钥进行更改的密钥更改指令，在验证智能设备具有从密钥更改设备读取新密钥的第一权限，以及智能设备具有对安全模块中指定目录下的目标密钥进行更改的第二权限后，则基于密钥更改设备内存储的新密钥对安全模块中的密钥进行更改。
通过本申请实施例提供的系统，在不需要将安全模块从智能设备上拆卸下来的情况下，实现了对安全模块中所存储的密钥的更改，大大简化了安全模块中密钥更改操作。并且本申请实施例提供的系统中，通过验证智能设备是否具备从密钥更改设备读取密钥的权限，以及验证智能设备是否具备更改安全模块中的目标密钥的权限，还保证了安全模块中密钥的安全性。
相应于本申请实施例提供的一种更改安全模块中密钥的方法，本申请实施例提供一种更改安全模块中密钥的装置，应用于安装有安全模块的智能设备，其特征在于，装置包括：
获取单元，用于在建立密钥更改设备与智能设备之间的连接后，获取密钥更改设备发送的对安全模块中的指定目录下的目标密钥进行更改的密钥更改指令；
验证单元，用于验证智能设备是否具有从密钥更改设备读取新密钥的第一权限，以及，验证智能设备是否具有对安全模块中的目标密钥进行更改的第二权限；
读取单元，用于若验证结果指示智能设备具有第一权限和第二权限，则读取密钥更改设备内存储的新密钥；其中，新密钥为通过发卡器预先写入密钥更改设备的；
更改单元，用于将安全模块中指定目录下的目标密钥更改为新密钥。
本申请实施例提供的更改安全模块中密钥的系统，预先在密钥更改设备中写入需要更改的目标密钥所对应的新密钥，并建立密钥更改设备与智能设备之间的连接。这样，智能设备可以获取到密钥更改设备触发的对安全模块中指定目录下的目标密钥进行更改的密钥更改指令，在验证智能设备具有从密钥更改设备读取新密钥的第一权限，以及智能设备具有对安全模块中指定目录下的目标密钥进行更改的第二权限后，则基于密钥更改设备内存储的新密钥对安全模块中的密钥进行更改。
通过本申请实施例提供的系统，在不需要将安全模块从智能设备上拆卸下来的情况下，实现了对安全模块中所存储的密钥的更改，大大简化了安全模块中密钥更改操作。并且本申请实施例提供的系统中，通过验证智能设备是否具备从密钥更改设备读取密钥的权限， 以及验证智能设备是否具备更改安全模块中的目标密钥的权限，还保证了安全模块中密钥的安全性。
相应于本申请实施例提供的一种更改安全模块中密钥的方法，本申请实施例提供一种计算机设备，参见图6所示，计算机设备包括处理器610、收发机620、存储器630和总线接口。其中：
计算机设备还包括：存储在存储器630上并可在所述处理器610上运行的计算机程序，所述计算机程序被所述处理器610执行时实现上述任一更改安全模块中密钥的方法中的各个步骤，且能达到相同的技术效果。为避免重复，这里不再赘述。
在图6中，总线架构可以包括任意数量的互联的总线和桥，用于处理器610代表的一个或多个处理器和存储器630代表的存储器的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供总线架构的接口。收发机620可以是多个元件，即包括发送机和接收机，提供用于在传输介质上与各种其他装置通信的单元。
处理器610负责管理总线架构和通常的处理，存储器630可以存储处理器610在执行操作时所使用的数据。
相应于本申请实施例提供的一种更改安全模块中密钥的方法，本申请实施例提供一种计算机设备，包括处理器、通信接口、存储器和通信总线；其中，处理器、通信接口以及存储器通过总线完成相互间的通信；存储器，用于存放计算机程序；处理器，用于执行存储器上所存放的程序，实现上述任一更改安全模块中密钥的方法中的各个步骤。
本申请实施例还提供一种计算机可读存储介质，计算机可读存储介质内存储有计算机程序，该计算机程序被处理器执行时实现上述更改安全模块中密钥的方法实施例的各个步骤，且能达到相同的技术效果。为避免重复，这里不再赘述。其中，所述的计算机可读存储介质，如只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等。
本申请实施例还提供一种计算机程序，该计算机程序被处理器执行时实现上述任一更改安全模块中密钥的方法实施例的各个步骤，且能达到相同的技术效果。为避免重复，这里不再赘述。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对相关技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如 ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本申请各个实施例所述的方法。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本申请的保护之内。

Claims (16)

  1. 一种更改安全模块中密钥的方法，应用于安装有所述安全模块的智能设备，其特征在于，所述方法包括：
    在建立密钥更改设备与所述智能设备之间的连接后，获取所述密钥更改设备发送的对所述安全模块中的指定目录下的目标密钥进行更改的密钥更改指令；
    验证所述智能设备是否具有从所述密钥更改设备读取新密钥的第一权限，以及，验证所述智能设备是否具有对所述安全模块中的所述目标密钥进行更改的第二权限；
    若验证结果指示所述智能设备具有所述第一权限和所述第二权限，则读取所述密钥更改设备内存储的新密钥；其中，所述新密钥为通过发卡器预先写入所述密钥更改设备的；
    将所述安全模块中所述指定目录下的所述目标密钥更改为所述新密钥。
  2. 如权利要求1所述的方法，其特征在于，所述验证所述智能设备是否具有从所述密钥更改设备读取数据的第一权限，包括：
    对所述密钥更改设备进行外部认证；若所述密钥更改设备的外部认证通过，则确定所述智能设备具有从所述密钥更改设备读取数据的第一权限。
  3. 如权利要求2所述的方法，其特征在于，所述对所述密钥更改设备进行外部认证，包括：
    基于所述安全模块中所存储的加密密钥，对所述密钥更改设备所产生的第一随机数进行加密，得到所述第一随机数所对应的第一密文数据；
    将所述第一密文数据携带在外部认证指令中发送给所述密钥更改设备，以使所述密钥更改设备基于所述第一密文数据进行外部认证，以及在外部认证通过时，将新密钥所属目录所对应的安全状态寄存器的状态值修改为第一状态值；其中，所述第一状态值表征所述新密钥所属目录下的所述新密钥可被读取。
  4. 如权利要求1所述的方法，其特征在于，所述验证所述智能设备是否具有对所述安全模块中的密钥进行更改的第二权限，包括：
    对所述安全模块进行外部认证；若所述安全模块的外部认证通过，则确定所述智能设备具有对所述安全模块中的密钥进行更改的第二权限。
  5. 如权利要求4所述的方法，其特征在于，所述对所述安全模块进行外部认证，包括：
    将所述安全模块所产生的第二随机数发送给所述密钥更改设备，以使所述密钥更改设备基于其所存储的认证密钥，对所述第二随机数进行加密，得到所述第二随机数所对应的第二密文数据；
    获取所述密钥更改设备所产生的所述第二密文数据，将所述第二密文数据携带在外部认证指令中发送给所述安全模块，以使所述安全模块基于所述第二密文数据进行外部认证，以及在外部认证通过时，将所述指定目录所对应的安全状态寄存器的状态值修改为第二状态值；其中，所述第二状态值表征所述指定目录下的所述目标密钥可被更改。
  6. 如权利要求1-5任一项所述的方法，其特征在于，所述密钥更改设备为中央处理器CPU卡。
  7. 一种更改安全模块中密钥的系统，其特征在于，所述系统包括密钥更改设备和安装有所述安全模块的智能设备；
    所述密钥更改设备，用于在建立与所述智能设备之间的连接后，向所述智能设备发送对所述安全模块中的指定目录下的目标密钥进行更改的密钥更改指令；
    所述智能设备，用于接收所述密钥更改指令，验证所述智能设备是否具有从所述密钥更改设备读取新密钥的第一权限，以及，验证所述智能设备是否具有对所述安全模块中的所述目标密钥进行更改的第二权限；若验证结果指示所述智能设备具有所述第一权限和所述第二权限，则读取所述密钥更改设备内存储的新密钥；将所述安全模块中所述指定目录下的所述目标密钥更改为所述新密钥；其中，所述新密钥为通过发卡器预先写入所述密钥更改设备的。
  8. 如权利要求7所述的系统，其特征在于，所述智能设备，具体用于：
    对所述密钥更改设备进行外部认证；若所述密钥更改设备的外部认证通过，则确定所述智能设备具有从所述密钥更改设备读取数据的第一权限。
  9. 如权利要求8所述的系统，其特征在于，所述智能设备，具体用于：
    基于所述安全模块中所存储的加密密钥，对所述密钥更改设备所产生的第一随机数进行加密，得到所述第一随机数所对应的第一密文数据；将所述第一密文数据携带在外部认证指令中发送给所述密钥更改设备；
    所述密钥更改设备，还用于接收所述第一密文数据，基于所述第一密文数据进行外部认证，以及在外部认证通过时，将新密钥所属目录所对应的安全状态寄存器的状态值修改为第一状态值；其中，所述第一状态值表征所述新密钥所属目录下的所述新密钥可被读取。
  10. 如权利要求7所述的系统，其特征在于，所述智能设备，具体用于：
    对所述安全模块进行外部认证；若所述安全模块的外部认证通过，则确定所述智能设备具有对所述安全模块中的密钥进行更改的第二权限。
  11. 如权利要求10所述的系统，其特征在于，所述智能设备，还用于将所述安全模块所产生的第二随机数发送给所述密钥更改设备；
    所述密钥更改设备，还用于基于其所存储的认证密钥，对所述第二随机数进行加密，得到所述第二随机数所对应的第二密文数据；
    所述智能设备，还用于获取所述密钥更改设备所产生的所述第二密文数据，将所述第二密文数据携带在外部认证指令中发送给所述安全模块，以使所述安全模块基于所述第二密文数据进行外部认证，以及在外部认证通过时，将所述指定目录所对应的安全状态寄存器的状态值修改为第二状态值；其中，所述第二状态值表征所述指定目录下的所述目标密钥可被更改。
  12. 如权利要求7-11任一项所述的系统，其特征在于，所述密钥更改设备为中央处理器CPU卡。
  13. 一种更改安全模块中密钥的装置，应用于安装有所述安全模块的智能设备，其特征在于，所述装置包括：
    获取单元，用于在建立密钥更改设备与所述智能设备之间的连接后，获取所述密钥更 改设备发送的对所述安全模块中的指定目录下的目标密钥进行更改的密钥更改指令；
    验证单元，用于验证所述智能设备是否具有从所述密钥更改设备读取新密钥的第一权限，以及，验证所述智能设备是否具有对所述安全模块中的所述目标密钥进行更改的第二权限；
    读取单元，用于若验证结果指示所述智能设备具有所述第一权限和所述第二权限，则读取所述密钥更改设备内存储的新密钥；其中，所述新密钥为通过发卡器预先写入所述密钥更改设备的；
    更改单元，用于将所述安全模块中所述指定目录下的所述目标密钥更改为所述新密钥。
  14. 一种计算机设备，其特征在于，包括处理器、通信接口、存储器和通信总线；其中，所述处理器、所述通信接口以及所述存储器通过总线完成相互间的通信；所述存储器，用于存放计算机程序；所述处理器，用于执行所述存储器上所存放的程序，实现权利要求1-6任一所述的方法步骤。
  15. 一种计算机可读存储介质，其特征在于，所述存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1-6任一所述的方法步骤。
  16. 一种计算机程序，其特征在于，所述计算机程序被处理器执行时实现权利要求1-6任一所述的方法步骤。
PCT/CN2021/130021 2020-11-16 2021-11-11 一种更改安全模块中密钥的方法及系统 WO2022100658A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP21891178.2A EP4246873A4 (en) 2020-11-16 2021-11-11 METHOD AND SYSTEM FOR CHANGING KEYS IN A SECURITY MODULE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011282164.XA CN112422281B (zh) 2020-11-16 2020-11-16 一种更改安全模块中密钥的方法及系统
CN202011282164.X 2020-11-16

Publications (1)

Publication Number Publication Date
WO2022100658A1 true WO2022100658A1 (zh) 2022-05-19

Family

ID=74831365

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/130021 WO2022100658A1 (zh) 2020-11-16 2021-11-11 一种更改安全模块中密钥的方法及系统

Country Status (3)

Country Link
EP (1) EP4246873A4 (zh)
CN (1) CN112422281B (zh)
WO (1) WO2022100658A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112422281B (zh) * 2020-11-16 2023-03-24 杭州海康威视数字技术股份有限公司 一种更改安全模块中密钥的方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109448197A (zh) * 2018-12-18 2019-03-08 杭州高锦科技有限公司 一种基于多重加密模式的云智能锁系统及密钥管理方法
CN110782567A (zh) * 2019-09-09 2020-02-11 珠海格力电器股份有限公司 一种智能锁开锁方法及设置方法
CN111582422A (zh) * 2020-04-10 2020-08-25 全景智联(武汉)科技有限公司 一种cpu卡防复制加密方法
CN112422281A (zh) * 2020-11-16 2021-02-26 杭州海康威视数字技术股份有限公司 一种更改安全模块中密钥的方法及系统

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6757832B1 (en) * 2000-02-15 2004-06-29 Silverbrook Research Pty Ltd Unauthorized modification of values in flash memory
EP1289326A1 (en) * 2001-08-30 2003-03-05 Motorola, Inc. Method of verifying downloaded software and corresponding device
CN101729247B (zh) * 2008-10-22 2012-07-18 中兴通讯股份有限公司 密钥更新方法和系统
CN103595530B (zh) * 2012-08-17 2017-04-26 华为技术有限公司 软件密钥更新方法和装置
CN104917614A (zh) * 2015-04-21 2015-09-16 中国建设银行股份有限公司 一种智能卡和受理终端的双向验证方法和装置
EP3664362B1 (en) * 2018-10-12 2021-06-09 Shenzhen Goodix Technology Co., Ltd. Key generation method, acquisition method, private key update method, chip and server
CN111200491A (zh) * 2018-11-20 2020-05-26 千寻位置网络有限公司 密钥的更新、数据解密方法及装置、客户端及交互系统
CN110650478B (zh) * 2019-10-12 2023-11-28 捷德(江西)技术有限公司 Ota方法、系统、设备、se模块、程序服务器和介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109448197A (zh) * 2018-12-18 2019-03-08 杭州高锦科技有限公司 一种基于多重加密模式的云智能锁系统及密钥管理方法
CN110782567A (zh) * 2019-09-09 2020-02-11 珠海格力电器股份有限公司 一种智能锁开锁方法及设置方法
CN111582422A (zh) * 2020-04-10 2020-08-25 全景智联(武汉)科技有限公司 一种cpu卡防复制加密方法
CN112422281A (zh) * 2020-11-16 2021-02-26 杭州海康威视数字技术股份有限公司 一种更改安全模块中密钥的方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4246873A4

Also Published As

Publication number Publication date
CN112422281B (zh) 2023-03-24
EP4246873A4 (en) 2024-05-22
CN112422281A (zh) 2021-02-26
EP4246873A1 (en) 2023-09-20

Similar Documents

Publication Publication Date Title
US7844819B2 (en) Application authentication system
US9979703B2 (en) Updating software on a secure element
KR101712784B1 (ko) 글로벌 플랫폼 규격을 사용하는 발행자 보안 도메인에 대한 키 관리 시스템 및 방법
CN110569658B (zh) 基于区块链网络的用户信息处理方法、装置、电子设备及存储介质
DE112017002044T5 (de) Plattformattestierung und registrierung für server
BR112016003676B1 (pt) Método implantado por computador, dispositivo e sistema para controle de acesso de nfc em uma arquitetura de nfc centrada em elemento seguro
DE102014204713A1 (de) Erzeugung von Schlüsseln unter Verwendung sicherer Hardware
US9906518B2 (en) Managing exchanges of sensitive data
WO2021190197A1 (zh) 生物支付设备的认证方法、装置、计算机设备和存储介质
EP3048553B1 (en) Method for distributing applets, and entities for distributing applets
WO2022100658A1 (zh) 一种更改安全模块中密钥的方法及系统
WO2015007184A1 (zh) 多应用智能卡及智能卡多应用管理方法
US20240193255A1 (en) Systems and methods of protecting secrets in use with containerized applications
EP3942770B1 (en) Chained trusted platform modules (tpms) as a secure bus for pre-placement of device capabilities
CN110852756A (zh) 一种数据处理方法及设备
US11893550B2 (en) System and method for hosting and remotely provisioning a payment HSM by way of out-of-band management
JP7211472B2 (ja) データ書き込み方法
Tamrakar et al. On rehoming the electronic id to TEEs
WO2024095755A1 (ja) 管理サーバ、情報処理システム、及び、情報処理装置
US20230155842A1 (en) Method and apparatus for certifying an application-specific key and for requesting such certification
US20220353073A1 (en) Method for authenticating an end-user account, method for single authenticating within a cluster of hsm, and method for implementing access control
DE102023112860A1 (de) Authentifizierungsmechanismus für ein Rechenspeicher-Download-Programm
CN116167766A (zh) 一种资产通证化方法及相关装置
CN110059489A (zh) 安全电子设备
CN103152177A (zh) 一种利用手机自动完成认证的方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21891178

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2021891178

Country of ref document: EP

Effective date: 20230616