A secure credit and signature system based on terminal device blockchain application

Abstract

The present invention discloses a terminal device blockchain application security credit and signature system, the system includes: a background system and a mobile intelligent terminal; the mobile intelligent terminal is used to securely store and manage keys and securely credit and sign blockchain applications through a trusted application TA in a trusted execution environment TEE and a secure application Applet in a secure chip SE, and the secure storage and management of keys includes certificate application, key import and user authentication; the background system is used to manage the life cycle of TA and Applet, and provide key and certificate related services. The present invention uses the TEE and SE of the mobile intelligent terminal to provide security services for blockchain applications, perform secure credit and signature, and ensure the security of blockchain application transactions without adding additional hardware.

Description

Technical Field

[0001] The present invention relates to the field of blockchain applications, and in particular to a terminal device-based blockchain application security credit and signature system. Background Art

[0002] Blockchain has been put to trial use in many fields, such as smart contracts, cross-border clearing, the Internet of Things, supply chain finance, digital currency, etc., and among them, everyone is very concerned about security. Now nearly 50% of blockchain applications are in the financial field, so there will be more attention paid to security.

[0003] As the economic value of blockchain continues to rise, criminals are encouraged to use various attack methods to obtain more sensitive data, "theft", "extortion", etc., making the blockchain security situation more complicated by using blockchain concepts and technologies. According to survey data from the cybersecurity company Carbon Black, in the first half of 2018, digital cryptocurrencies worth about US$1.1 billion were stolen, and the amount of losses caused by blockchain security incidents is still rising worldwide.

[0004] How to securely store and manage keys in blockchain applications and how to provide a secure and reliable encryption, decryption and digital signature system are the most important and critical aspects of blockchain security. Summary of the invention

[0005] In view of the defects existing in the prior art, the purpose of the present invention is to provide a terminal device-based blockchain application security authorization and signature system to achieve blockchain application security authorization and signature.

[0006] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0007] A terminal device blockchain application security credit and signature system, the system comprising: a background system and a mobile smart terminal;

[0008] The mobile intelligent terminal is used to securely store and manage keys and securely grant credit and sign blockchain applications through the trusted application TA in the trusted execution environment TEE and the secure application Applet in the secure chip SE. The secure storage and management of the keys includes certificate application, key import and user authentication;

[0009] The background system is used to manage the life cycle of the TA and the Applet, and provide key and certificate related services.

[0010] Furthermore, in the system as described above, the background system is also used to: deploy the TA and the Applet on the mobile intelligent terminal.

[0011] Furthermore, in the above system, the mobile intelligent terminal is specifically used for:

[0012] Sending an initialization request to the backend system through the application APP;

[0013] Receive the TA installation package sent by the backend system and complete the installation of TA;

[0014] Sending an application Applet request to the backend system through the APP;

[0015] Receive the Applet installation package sent by the backend system and complete the installation of the Applet.

[0016] Further, in the system as described above, the background system is specifically used for:

[0017] Receiving an initialization request sent by the mobile intelligent terminal, and sending the prepared TA installation package to the mobile intelligent terminal;

[0018] Receive the Applet application request sent by the mobile intelligent terminal, and send the prepared Applet installation package to the mobile intelligent terminal.

[0019] Furthermore, in the above system, the mobile intelligent terminal is specifically used for:

[0020] Generate a key pair through the SE, store the private key in the key pair in the SE, and send the public key in the key pair to the backend system to apply for a certificate;

[0021] Receive and store the public key certificate returned by the backend system;

[0022] The background system is specifically used for:

[0023] Receive the public key sent by the mobile smart terminal, generate a public key certificate and return it to the mobile smart terminal.

[0024] Further, in the system as described above, the background system is used for:

[0025] When the application key needs to be imported, the application key is encrypted using the public key certificate;

[0026] The mobile intelligent terminal is used for:

[0027] The encrypted application key is decrypted using the private key in the SE and then written into the application key.

[0028] Furthermore, in the above system, the mobile intelligent terminal is specifically used for:

[0029] When the user modifies the PIN code, the modified PIN code is stored in the SE;

[0030] When the user performs PIN code authentication, the PIN code input by the user is received through the trusted interface TUI, and the TA performs user authentication on the PIN code input by the user according to the PIN code in the SE. After the authentication is passed, the user is allowed to use the current service.

[0031] Furthermore, in the above system, the mobile intelligent terminal is specifically used for:

[0032] Sign the original transaction data of the blockchain application transaction using the signature private key in the SE to obtain signature data;

[0033] Broadcasting the original transaction data and the signature data to obtain broadcast data;

[0034] Performing a group signature on the broadcast data using the group signature private key in the SE to obtain group signature data;

[0035] The group signature data is sent to the background system.

[0036] Furthermore, in the system as described above, the mobile smart terminal also includes: a client SDK, which runs on the open operating system of the mobile smart terminal and is used to interact with the TA in the TEE through calling the TEE Client API in the GP TEE specification to perform instructions and data.

[0037] Furthermore, in the system as described above, the SE is also used to provide instruction processing, role authentication, secure storage, random number generation and national secret algorithm functions.

[0038] The beneficial effect of the present invention is that, without adding additional hardware, the present invention utilizes the TEE and SE of the mobile smart terminal to provide security services for blockchain applications, perform secure credit and signature, and ensure the security of blockchain application transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A schematic diagram of the structure of a terminal device blockchain application security credit and signature system provided in an embodiment of the present invention;

[0040] Figure 2 A schematic diagram of a process for deploying a trusted application TA and a secure application Applet in a mobile intelligent terminal by a background system provided in an embodiment of the present invention;

[0041] Figure 3 A schematic diagram of a process for a mobile intelligent terminal to apply for a certificate from a background system provided in an embodiment of the present invention;

[0042] Figure 4 A schematic diagram of a process of importing a key into a mobile intelligent terminal provided in an embodiment of the present invention;

[0043] Figure 5 A schematic diagram of the framework of blockchain application security authorization and signature provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0045] The present invention provides a terminal device blockchain application security credit and signature system, the system comprising: a background system and a mobile intelligent terminal;

[0046] The mobile smart terminal is used to securely store and manage keys and securely grant credit and sign blockchain applications through the trusted application TA in the trusted execution environment TEE and the secure application Applet in the secure chip SE. The secure storage and management of keys includes certificate application, key import and user authentication.

[0047] The backend system is used to manage the life cycle of TA and Applet, and provide key and certificate related services.

[0048] initialization:

[0049] The backend system is also used to deploy TA and Applet on mobile smart terminals.

[0050] Mobile smart terminals are specifically used for:

[0051] Send an initialization request to the backend system through the application APP;

[0052] Receive the TA installation package sent by the backend system and complete the TA installation;

[0053] Send an application Applet request to the backend system through the APP;

[0054] Receive the Applet installation package sent by the backend system and complete the installation of the Applet.

[0055] The backend system is specifically used for:

[0056] Receive the initialization request sent by the mobile smart terminal, and send the prepared TA installation package to the mobile smart terminal;

[0057] Receive the Applet application request sent by the mobile smart terminal, and send the prepared Applet installation package to the mobile smart terminal.

[0058] Before subsequent certificate application, key import and other operations, initialization is required. The trusted application TA and the security application Applet are deployed on the mobile smart terminal through the background system. The Applet generates and stores the corresponding keys and the storage of the combined keys.

[0059] Certificate Application:

[0060] Mobile smart terminals are specifically used for:

[0061] Generate a key pair through SE, store the private key in the key pair in SE, and send the public key in the key pair to the backend system to apply for a certificate;

[0062] Receive and store the public key certificate returned by the backend system;

[0063] The backend system is specifically used for:

[0064] Receive the public key sent by the mobile smart terminal, generate a public key certificate and return it to the mobile smart terminal.

[0065] Key import:

[0066] The backend system is used to:

[0067] When you need to import an application key, use the public key certificate to encrypt the application key;

[0068] Mobile smart terminals are used for:

[0069] Use the private key in SE to decrypt the encrypted application key and then write it into the application key.

[0070] When adding some application keys during use, whether importing symmetric keys or asymmetric key pairs, they can be encrypted with certificates in the background, decrypted in the security chip of the mobile smart terminal and then written, thus ensuring the security of the key import process.

[0071] In terms of key management, blockchain applications and certificate issuance are carried out simultaneously. The key pair is generated in the security chip of the mobile smart terminal, and the public key is sent out for certificate production, while the private key is not allowed to be exported, thus ensuring the security of key storage.

[0072] User Authentication:

[0073] Mobile smart terminals are specifically used for:

[0074] When the user modifies the PIN code, the modified PIN code is stored in SE;

[0075] When the user performs PIN code authentication, the PIN code input by the user is received through the trusted interface TUI, and the TA performs user authentication on the PIN code input by the user according to the PIN code in the SE. After the authentication is passed, the user is allowed to use the current service.

[0076] The national secret algorithm is adopted, the key is stored in the SE of the mobile smart device, and TUI is used for PIN verification authority to ensure the security of user input information and the security of PIN user authentication.

[0077] Blockchain application security authorization and signature:

[0078] Mobile smart terminals are specifically used for:

[0079] Sign the original transaction data of the blockchain application transaction using the signature private key in SE to obtain the signature data;

[0080] Broadcast the original transaction data and signature data to obtain broadcast data;

[0081] The broadcast data is group-signed using the group signature private key in the SE to obtain group signature data;

[0082] Send the group signature data to the backend system.

[0083] Get the group signature data from the background system. If you do not have permission, you can only see the ciphertext. Only the group with corresponding permissions can verify the signature and extract the plaintext of the transaction data.

[0084] The mobile smart terminal also includes: a client SDK, which runs on the open operating system of the mobile smart terminal and is used to interact with the TA in the TEE through calling the TEE Client API in the GP TEE specification to perform instructions and data.

[0085] SE is also used to provide instruction processing, role authentication, secure storage, random number generation and national encryption algorithm functions.

[0086] The present invention provides a key protection and management mechanism based on mobile intelligent terminal hardware to defend against various attacks on the user's blockchain application client environment or communication link layer.

[0087] The mobile smart terminal includes a client SDK running in an open operating system (Android), a trusted application (TA) running in a trusted execution environment (TEE), and a secure application Applet in a secure chip (SE). Figure 1As shown, the mobile intelligent terminal includes: a non-secure area and a secure area. The non-secure area is an open operating system (Android), including client applications (Client App) and client SDK. The client SDK includes SKF API, operating environment detection module and TA communication module. The secure area includes cryptographically trusted applications and secure chip applications. Cryptographically trusted applications include access control modules, command processing modules, secure chip communication modules and activation authorization modules. Secure chip applications include identity authentication management modules, life cycle management modules, random number generation modules, secure storage modules and national secret algorithm modules.

[0088] The backend system manages the lifecycle of trusted applications TA in TEE and secure application Applet in SE, and provides key and certificate related services. The backend system includes: application management, system management, and certificate and key system. Application management is used to manage the lifecycle of applications, including the lifecycle of trusted applications TA in TEE and secure application Applet in SE, as well as the application release process. System management is used to uniformly manage the system and visualize operation and maintenance. The certificate and key system is used to provide key management and certificate management.

[0089] Client App

[0090] The client application runs on the open operating system Android, and executes the approved cryptographic functions by calling the APDU API provided by the client SDK of the cryptographic module, sending command APDUs to the cryptographic module and receiving response APDUs.

[0091] Client SDK

[0092] The client SDK runs on the open operating system Android and interacts with the TA in the TEE environment through instructions and data by calling the TEE Client API in the GP TEE specification.

[0093] Trusted Execution Environment (TEE)

[0094] TEE is a secure area residing on the main processor of a mobile smart terminal. It provides a running environment that coexists with the Rich OS (such as Android) on the device, and provides security services to the Rich OS, such as secure storage of sensitive data, approved cryptographic algorithms, and trusted user interfaces. TEE provides a secure execution environment for TA (Trusted Application): it provides both confidentiality and data integrity protection, provides access rights control for TA to access resources and data, and isolates the running environment and sensitive data between multiple TAs. To ensure that TEE has a credible root of trust, during the secure boot process, TEE is first authenticated and then isolated from the Rich OS.

[0095] Trusted Application (TA)

[0096] The cryptographic module TA runs in the TEE trusted execution environment. TA obtains access rights to security resources and security services through the TEE InternalAPI in the GP TEE specification. TA receives command APDUs from client applications and returns response APDUs.

[0097] Security chip (SE)

[0098] All key-related functions are implemented in SE. The main functional modules include instruction processing module, role identification module, secure storage module, random number generation module and national secret algorithm module.

[0099] Backend system

[0100] The backend system manages the lifecycle of trusted applications TA in TEE and secure application Applets in SE, and provides key and certificate related services.

[0101] 1. Initialization

[0102] The trusted application TA and the secure application Applet are deployed on the mobile intelligent terminal through the background system, and the Applet realizes the generation and storage of the corresponding keys and the storage of the combined keys. Figure 2 As shown, the specific process is as follows:

[0103] 1) The user initiates an initialization request using a mobile smart terminal APP;

[0104] 2) The backend system prepares TA and sends it to the mobile smart terminal;

[0105] 3) The mobile intelligent terminal completes the installation of TA;

[0106] 4) The mobile smart terminal APP initiates an Applet application request;

[0107] 5) The background system prepares the applet (including the combined key seed key) and establishes a secure channel with the mobile intelligent terminal SE, and sends it to the mobile intelligent terminal in a secure manner;

[0108] 6) The mobile smart terminal completes the installation of the Applet application and prompts the user.

[0109] 2. Certificate application

[0110] The security chip of the mobile smart terminal generates a key pair, and sends the public key to the background system to apply for a certificate. The background system generates a public key certificate based on the public key and returns it to the mobile smart terminal. The private key is stored in the security chip and cannot be exported, thus ensuring the security of key storage. Figure 3 As shown, the specific process is as follows:

[0111] 1) The security chip SE of the mobile smart terminal generates a public-private key pair, stores the private key in the SE, returns the public key information, and applies for a certificate;

[0112] 2) The backend system generates a public key certificate based on the certificate application sent by the mobile smart terminal and returns it to the mobile smart terminal;

[0113] 3) The mobile smart terminal stores the public key certificate.

[0114] 3. Key import

[0115] When adding some application keys during use, whether importing symmetric keys or asymmetric key pairs, they can be encrypted with certificates in the background, decrypted in the mobile smart terminal security chip and then written, thus ensuring the security of the key import process. Figure 4 As shown, the specific process is as follows:

[0116] 1) The backend system uses the certificate public key to encrypt the application key;

[0117] 2) The mobile smart terminal performs decryption and signature verification, and writes the application key after the signature verification passes.

[0118] 4. Blockchain Applications

[0119] Assume that the user's initial PIN code is set to 123456. After the user changes it, the PIN code is stored in SE. When the user uses it, he enters the PIN code through the trusted interface TUI. TA verifies the user based on the PIN code stored by SE and the PIN code entered by the user. After the verification is passed, the user is allowed to use the service.

[0120] like Figure 5As shown, the original transaction data Data0 is signed by SM2 through the SM2 private key to obtain the signature data Data1, and then the original transaction data Data0 and the signature data Data1 are broadcast encrypted to obtain the broadcast data Data2, and the broadcast data Data2 is group signed through the group signature private key to obtain the group signature data Data3. Submit the signed data Data3 to the server, and those without permission can only see the ciphertext. Only the group with the corresponding permission can verify the signature and extract the plaintext of the transaction data.

[0121] The advantages of the present invention are as follows:

[0122] 1. Without adding additional hardware, use mobile smart terminal TEE and SE facilities to provide security services to ensure the security of blockchain application data and communication links.

[0123] 2. Use the national secret algorithm to store the key in the SE of the mobile smart device, use TUI for PIN verification authority to ensure the security of user input information.

[0124] 3. Use mobile smart terminal SE to store keys and certificates to implement blockchain application security authorization and signature, and ensure the security of blockchain application transactions.

[0125] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A secure credit authorization and signature system based on terminal device blockchain application, characterized in that: The system includes: a background system and a mobile intelligent terminal; The mobile intelligent terminal is used to securely store and manage keys and securely grant credit and sign blockchain applications through the trusted application TA in the trusted execution environment TEE and the secure application Applet in the secure chip SE. The secure storage and management of the keys includes certificate application, key import and user authentication; The background system is used to manage the life cycle of the TA and the Applet, and provide key and certificate related services; The mobile intelligent terminal is specifically used for: Generate a key pair through the SE, store the private key in the key pair in the SE, and send the public key in the key pair to the backend system to apply for a certificate; Receive and store the public key certificate returned by the backend system; The background system is specifically used for: Receive the public key sent by the mobile smart terminal, generate a public key certificate and return it to the mobile smart terminal; The backend system is used to: When the application key needs to be imported, the application key is encrypted using the public key certificate; The mobile intelligent terminal is used for: Decrypt the encrypted application key using the private key in the SE and then write it into the application key; In terms of key management, blockchain application and certificate issuance are carried out simultaneously. The mobile smart terminal is specifically used for: Sign the original transaction data of the blockchain application transaction using the signature private key in the SE to obtain signature data; Broadcasting the original transaction data and the signature data to obtain broadcast data; Performing a group signature on the broadcast data using the group signature private key in the SE to obtain group signature data; The group signature data is sent to the backend system; the group signature data is obtained from the backend system. If there is no permission, only the ciphertext can be seen. Only the group with corresponding permission can verify the signature and extract the plaintext of the transaction data.

2. The system according to claim 1, characterized in that The background system is also used to: deploy the TA and the Applet on the mobile intelligent terminal.

3. The system according to claim 2, characterized in that The mobile intelligent terminal is specifically used for: Sending an initialization request to the backend system through the application APP; Receive the TA installation package sent by the backend system and complete the installation of TA; Sending an application Applet request to the backend system through the APP; Receive the Applet installation package sent by the backend system and complete the installation of the Applet.

4. The system according to claim 3, characterized in that The background system is specifically used for: Receiving an initialization request sent by the mobile intelligent terminal, and sending the prepared TA installation package to the mobile intelligent terminal; Receive the Applet application request sent by the mobile intelligent terminal, and send the prepared Applet installation package to the mobile intelligent terminal.

5. The system according to claim 1, characterized in that The mobile intelligent terminal is specifically used for: When the user modifies the PIN code, the modified PIN code is stored in the SE; When the user performs PIN code authentication, the PIN code input by the user is received through the trusted interface TUI, and the TA performs user authentication on the PIN code input by the user according to the PIN code in the SE. After the authentication is passed, the user is allowed to use the current service.

6. The system according to any one of claims 1 to 5, characterized in that: The mobile intelligent terminal further includes: a client SDK, which runs on an open operating system of the mobile intelligent terminal and is used to perform instruction and data interaction with the TA in the TEE by calling the TEE Client API in the GP TEE specification.

7. The system according to any one of claims 1 to 5, characterized in that: The SE is also used to provide instruction processing, role authentication, secure storage, random number generation and national secret algorithm functions.

Images