PKI (Public Key Infrastructure) implementation method based on safety certificate

Abstract

The invention discloses a PKI (Public Key Infrastructure) implementation method based on a safety certificate. The method comprises the following steps of: deploying an encryption card or encryption equipment hardware equipment on the end part of a CA (Certificate Authority); encrypting all final entity CA certificates in the CA into a cipher text for storing; storing each middle-class CA certificate and root CA certificate in a CA encryption card or a chip of the encryption equipment; generating a key in a safety protocol of the PKI and calling the key to encrypt or decrypt the certificate in the chip; establishing a 'chip-class' PKI safety protocol between a user terminal and a CA terminal; establishing a certificate safety detection protocol in the CA; and detecting the CA certificate in a full trusted link in the CA timely to prevent an attacker from tampering the CA certificate to establish a PKI system based on the safety certificate.

Description

Technical field: [0001] The invention relates to the field of network information security. Background technique: [0002] At present, domestic network security systems all use PKI / CA, and PKI / CA technology uses asymmetric cryptographic algorithms and symmetric cryptographic algorithms to jointly establish user identity authentication, data integrity verification, and data encryption transmission systems. However, in PKI's CA In the certification center, various certificates of users are stored in the certificate database in plain text. The storage of certificates in plain text is vulnerable to external hacker attacks or prying by internal management personnel. Attackers can obtain and replace all end-entity CA certificates of the CA certification center. , various intermediate CA certificates and root CA certificates, to carry out "flanking attacks" on the CA certification center. In short, the existing PKI products have security risks and cannot meet the market's demand fo...

AI Technical Summary

Problems solved by technology

[0002] At present, domestic network security systems all use PKI / CA, and PKI / CA technology uses asymmetric cryptographic algorithms and symmetric cryptographic algorithms to jointly establish user identity authentication, data integrity verification, and data encryption transmission systems. However, in PKI's CA In the certification center, various certificates of users are stored in the certificate database in plain text. The storage of certificates in plain text is vulnerable to external hacker attacks or prying by internal management personnel. Attackers can obtain and replace all end-entity CA certificates of the CA certification center. , various intermediate CA certificates and root CA certificates, to carry out "flanking attacks" on the CA certification center. In short, the existing PKI products have security risks and cannot meet the market's demand for network information security.

Images