Secret key management method and secret key management system

Abstract

The invention relates to a secret key management method and a secret key management system. The secret key management method comprises the following steps: a step of generating a to-be-decomposed private key, generating the to-be-decomposed private key (SKS1, SKE)) by an identification secret key management system; a step of decomposing, decomposing the to-be-decomposed private key into a first private subkey (d1) and a second private subkey (d2) by the identification secret key management system; a step of distributing the private subkeys, respectively distributing the first private subkey and the second private subkey securely to a user terminal and a joint administration party by the identification secret key management system; and a step of obtaining the private subkeys, respectively performing secure storage after receiving the first private subkey and the second private subkey by the user terminal and the joint administration party, wherein the first private subkey and the secondprivate subkey are stored for follow-up secret key usage operations, such as signing and encryption. According to the method and the system provided by the invention, since the secret key cannot appear completely at any party, namely, any party taking participate in operation cannot get the complete secret key, an attacker cannot realize administration to the secret key even if the attacker hijacks one of the parties.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to an identification key-based management method and system suitable for user terminals. Background technique [0002] The IKI identity key management system is a data structure that signs the trusted identity (the trusted identity is the private key calculated by IKI based on the entity identity), including the entity identity, encryption public key, signature public key, valid date, and extended information. ) is a security system for full lifecycle management, consisting of a trusted identity management center IMC, a registration management system RA, and a trusted identity authentication query system IPA. It is based on the basic idea of ​​the ECC public key cryptosystem, generates encryption keys through entity identification calculations, and proves signature public keys and encryption public keys through entity identification and system public paramet...

AI Technical Summary

Problems solved by technology

One method is to use a security chip or a password device, such as the storage of the identification code smart key disclosed in the invention patent application No. 201710627995.8, but the use of a security chip requires a major modification of the smart terminal. It is also extremely inconvenient to use

Another method, such as the method disclosed in the invention patent application with the application number 201710918807.7, decomposes the private key and stores them in the cloud and the client respectively, and recombines them when used. Complete appearance, malicious attackers can obtain private keys to forge signatures or decrypt

Images