Key application method and device, electronic device, and computer-readable storage medium

Abstract

The present invention discloses a key application method and device, an electronic device, and a computer-readable storage medium. The method includes: receiving a first application request initiated by a user terminal, generating an identity protection key based on the first application request, and encrypting the identity protection key using a key generation public key; generating a second application request based on user identification information and the encrypted identity protection key, and calculating and generating a first data signature according to the second application request, and sending the second application request containing the first data signature to a key generation unit; receiving first response data returned by the key generation unit, and verifying the second data signature in the first response data, wherein the intermediate key is generated based on the user identification information; after the second data signature is verified, generating a user key according to the intermediate key; and returning the encrypted user key and the third data signature to the user terminal.

Description

Technical Field

[0001] The present invention relates to the field of information network security technology, and in particular to a key application method and device, electronic equipment, and a computer-readable storage medium. Background Art

[0002] In the related art, there are two commonly used methods for key application and authentication: the first is the traditional certificate authentication system, and the second is the SM9-based identification key system.

[0003] The certificate authentication system includes a certificate authentication center (CA), a certificate registration center (RA), a certificate status query system (OCSP), and a key management system (KMS). This certificate authentication system has obvious drawbacks: the overall composition is relatively complex, and as the scope and scale of application expand, the management of certificates also becomes complex; not only is it necessary to apply for keys, but also to apply for personal certificates; users need to keep personal certificates and keys at the same time, and the two parties need to exchange certificates before authentication and authenticate the validity of each other's certificates, making the authentication process relatively complicated; at the same time, the storage of certificates also causes a waste of resources to a certain extent.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a key application method and device, an electronic device, and a computer-readable storage medium, so as to at least solve the technical problem in the related technology that when using certificates for authentication, the two parties to be authenticated need to apply for personal certificates and keys respectively before authentication, and authenticate the validity of the other party's certificate, and the authentication process is relatively complicated.

[0006] According to one aspect of an embodiment of the present invention, a key application method is provided, which is applied to an identification registration unit, wherein the identification registration unit is connected to a key generation unit, and includes: receiving a first application request initiated by a user terminal, and generating an identification protection key based on the first application request, and encrypting the identification protection key using a key generation public key, wherein the first application request includes at least: user identification information and a user protection key encrypted using an identification registration public key; generating a second application request based on the user identification information and the encrypted identification protection key, and calculating and generating a first data signature based on the second application request, and sending the second application request containing the first data signature to the key generation unit; receiving first response data returned by the key generation unit, and verifying the second data signature in the first response data, wherein the first response data includes at least: an encrypted intermediate key and the second data signature, wherein the intermediate key is generated based on the user identification information; after the verification of the second data signature is passed, generating a user key based on the intermediate key, and encrypting the user key using the user protection key; and returning the encrypted user key and a third data signature to the user terminal.

[0007] According to another aspect of an embodiment of the present invention, a key application method is also provided, which is applied to an identification registration unit, and the identification registration unit is connected to a key generation unit, including: receiving a protection key file sent by a system operation terminal, and generating an identification protection key based on the protection key file, and encrypting the identification protection key with a key generation public key, wherein the system operation terminal is a terminal used by an administrative user of an identification management system, and the system operation terminal is connected to at least one user terminal, and the protection key file includes at least: user identification information and a user protection key encrypted with an identification registration public key; generating a target identification protection key based on the user identification information and the encrypted identification protection key; An application request is received, and a first data signature is calculated according to the target application request, and the target application request including the first data signature is sent to the key generation unit; the first response data returned by the key generation unit is received, and the second data signature in the first response data is verified, wherein the first response data at least includes: an encrypted intermediate key and the second data signature, and the intermediate key is generated based on the user identification information; after the verification of the second data signature is passed, a user key is generated according to the intermediate key, and the user key is encrypted with the user protection key; the encrypted user key and the third data signature are returned to the system operation terminal.

[0008] According to another aspect of an embodiment of the present invention, a key application method is also provided, which is applied to a key generation unit, wherein the key generation unit is connected to at least one identification registration unit, and comprises: receiving an application request initiated by the identification registration unit, wherein the application request comprises at least: user identification information, an identification protection key and a first data signature; after the first data signature is verified, generating an intermediate key based on the user identification information; encrypting the intermediate key using the identification protection key; generating first response data based on the encrypted intermediate key, and calculating a second data signature based on the first response data; returning the first response data including the second data signature to the identification registration unit, wherein the identification registration unit, after verifying the second data signature, generates a user key based on the intermediate key, encrypts the user key using the user protection key, and returns the encrypted user key and a third data signature to the user terminal.

[0009] According to another aspect of an embodiment of the present invention, a key application method is also provided, which is applied to an identification management system. The identification management system includes: a user terminal, an identification registration unit and a key generation unit, including: the user terminal initiates a first application request to the identification registration unit, wherein the first application request includes at least: user identification information and a user protection key encrypted using an identification registration public key; the identification registration unit generates an identification protection key based on the first application request, and encrypts the identification protection key using a key generation public key; the identification registration unit generates a second application request based on the user identification information and the encrypted identification protection key, calculates a first data signature based on the second application request, and sends the second application request containing the first data signature to the key generation unit; the key generation unit generates an intermediate key based on the user identification information, and uses a key generation public key to encrypt the identification protection key. The intermediate key is encrypted with the identification protection key, a first response data is generated based on the encrypted intermediate key, and a second data signature is calculated according to the first response data; the key generation unit sends the first response data including the second data signature to the identification registration unit; the identification registration unit receives the first response data returned by the key generation unit, and verifies the second data signature in the first response data; after the verification of the second data signature is passed, the identification registration unit generates a user key according to the intermediate key, and encrypts the user key with the user protection key; the identification registration unit returns the encrypted user key and the third data signature to the user terminal; after the verification of the third data signature is passed, the user terminal decrypts the user key with the user protection key to obtain the user key.

[0010] According to another aspect of an embodiment of the present invention, a key application device is also provided, which is applied to an identification registration unit, and the identification registration unit is connected to a key generation unit, including: a first receiving unit, used to receive a first application request initiated by a user terminal, and generate an identification protection key based on the first application request, and encrypt the identification protection key using a key generation public key, wherein the first application request at least includes: user identification information and a user protection key encrypted using an identification registration public key; a first generating unit, used to generate a second application request based on the user identification information and the encrypted identification protection key, and calculate and generate a first data signature according to the second application request, and send the second application request containing the first data signature to the key generation unit; a second receiving unit, used to receive the first response data returned by the key generation unit, and verify the second data signature in the first response data, wherein the first response data at least includes: an encrypted intermediate key and the second data signature, and the intermediate key is generated based on the user identification information; a second generating unit, used to generate a user key according to the intermediate key after the verification of the second data signature passes, and encrypt the user key using the user protection key; a first sending unit, used to return the encrypted user key and the third data signature to the user terminal.

[0011] According to another aspect of an embodiment of the present invention, a key application device is also provided, which is applied to an identification registration unit, and the identification registration unit is connected to a key generation unit, and includes: a third receiving unit, which is used to receive a protection key file sent by a system operation terminal, and generate an identification protection key based on the protection key file, and encrypt the identification protection key using a key generation public key, wherein the system operation terminal is a terminal used by an administrative user of an identification management system, and the system operation terminal is connected to at least one user terminal, and the protection key file includes at least: user identification information and a user protection key encrypted using an identification registration public key; a third generation unit, which is used to generate a target application request based on the user identification information and the encrypted identification protection key, And calculate a first data signature according to the target application request, and send the target application request including the first data signature to the key generation unit; a fourth receiving unit, used to receive the first response data returned by the key generation unit, and verify the second data signature in the first response data, wherein the first response data at least includes: an encrypted intermediate key and the second data signature, and the intermediate key is generated based on the user identification information; a fourth generating unit, used to generate a user key according to the intermediate key after the verification of the second data signature is passed, and encrypt the user key with the user protection key; a second sending unit, used to return the encrypted user key and the third data signature to the system operation terminal.

[0012] According to another aspect of an embodiment of the present invention, a key application device is also provided, which is applied to a key generation unit, and the key generation unit is connected to at least one identification registration unit, including: a fifth receiving unit, used to receive an application request initiated by the identification registration unit, wherein the application request includes at least: user identification information, an identification protection key and a first data signature; a fifth generating unit, used to generate an intermediate key based on the user identification information after the first data signature is verified; a first encryption unit, used to encrypt the intermediate key using the identification protection key; a sixth generating unit, used to generate first response data based on the encrypted intermediate key, and calculate a second data signature based on the first response data; a third sending unit, used to return the first response data containing the second data signature to the identification registration unit, wherein the identification registration unit, after verifying the second data signature, generates a user key based on the intermediate key, encrypts the user key using the user protection key, and returns the encrypted user key and the third data signature to the user terminal.

[0013] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned key application methods by executing the executable instructions.

[0014] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the key application methods described above.

[0015] In the present invention, an intermediate key is obtained based on user identification information, and a user key is directly generated through the intermediate key. There is no need to use a personal certificate, and there is no need to authenticate the personal certificate subsequently. Only basic user personal information needs to be submitted, and the corresponding identification key information needs to be applied for securely. In the subsequent authentication process, the receiver only needs to calculate the sender's public key data based on the sender's identification and public key base, and verify the signature data to complete the identity authentication. The identity authentication is significantly simplified, thereby solving the technical problem that when using certificates for authentication in related technologies, the two parties to be authenticated need to apply for personal certificates and keys respectively before authentication, and authenticate the validity of the other party's certificate, and the authentication process is relatively complicated. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 is a schematic diagram of an optional identification key management system according to an embodiment of the present invention;

[0018] Figure 2 is a flow chart of an optional key application method according to an embodiment of the present invention;

[0019] Figure 3 Another optional key application method according to an embodiment of the present invention is as follows: Figure 1 ;

[0020] Figure 4 Another optional key application method according to an embodiment of the present invention is as follows: Figure 2 ;

[0021] Figure 5 Another optional key application method according to an embodiment of the present invention is as follows: Figure 3 ;

[0022] Figure 6is a flow chart of initializing various devices of an optional system according to an embodiment of the present invention;

[0023] Figure 7 is a schematic diagram of an optional online registration process of an identifier according to an embodiment of the present invention;

[0024] Figure 8 is a schematic diagram of an optional offline registration process of an identifier according to an embodiment of the present invention;

[0025] Fig. 9 is a schematic diagram of an optional key application device according to an embodiment of the present invention;

[0026] Fig.10 Schematic diagram of another optional key application device according to an embodiment of the present invention Figure 1 ;

[0027] Fig.11 is a schematic diagram of another optional key application device according to an embodiment of the present invention Figure 2 . DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] To facilitate those skilled in the art to understand the present invention, some terms or nouns involved in the embodiments of the present invention are explained below:

[0030] KMC, key generation center, high-performance identification key system subsystem, provides identification services and application management services. Among them, identification service refers to providing key application services for user terminals, including online identification registration services and offline identification services, while application management services are unified management of user terminals.

[0031] RMC, identification registration center, provides key services and provides related key services for RMC.

[0032] The key base, a key matrix consisting of SM2 key pairs, is initialized and generated by KMC.

[0033] Public key base, which is the public key data consisting of the public keys of all key pairs in the key base, is used to identify cryptographic operations.

[0034] B / S architecture, browser and server architecture mode.

[0035] System protection key, RMC system protection key, is used for data encryption when RMC saves sensitive data.

[0036] Protection key: a temporarily generated SM4 key used for encryption during data transmission and destroyed immediately after the request is completed.

[0037] Intermediate key, a pair of SM2 keys generated by the KMC calling the cryptographic device.

[0038] User key, a pair of SM2 keys generated by RMC after extending the intermediate key.

[0039] Data signature: the complete data of the request or response before sending the data, signed with its own private key to generate signature data.

[0040] This embodiment can be applied to various key application systems / key authentication systems / key management systems. This system can realize the identification key application of multiple users in a specified environment (that is, based on the user's personal identification information, the user key can be applied for). The user can use the personal identification key and the public key base to complete identity authentication, key negotiation, data encryption transmission and other usage scenarios with other users.

[0041] Figure 1 is a schematic diagram of an optional identification key management system according to an embodiment of the present invention, such as Figure 1 As shown, the management system includes:

[0042] One key generation center KMC (ie key generation unit) and multiple identity registration centers RMC (ie identity registration units). The identity key management system in this embodiment has only one KMC, and there can be multiple RMCs.

[0043] Table 1 below schematically illustrates the system functions of the identification key management system:

[0044] Table 1

[0045]

[0046]

[0047] The present invention is schematically described below in conjunction with the above identification key management system.

[0048] In an embodiment of the present invention, a key application method is provided, and the key application method can be applied to an identification key management system. The identification key management system in this embodiment is mainly responsible for the full life cycle management of identification keys, including registration, reporting loss, unreporting, cancellation and key download, update and recovery based on identification information. The system adopts a B / S architecture, and the system software is deployed on the server. The administrator accesses the management system through a browser to use the various functions of the system. The identification key management system is first schematically explained below.

[0049] In the following implementations, the key application process is schematically explained from the perspective of the implementation entity of the identity registration center / unit and the key generation unit.

[0050] The following is a schematic illustration using the identification registration unit as the implementation entity.

[0051] According to an embodiment of the present invention, a key application method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0052] The embodiment of the present invention provides a key application method, which is applied to an identification registration unit, and the identification registration unit is connected to a key generation unit.

[0053] This embodiment first describes an online registration process based on user identification information, that is, the user terminal and the identification registration unit have established a communication connection in advance and are in an online state. At this time, the user terminal can directly transmit data, request messages, etc. to the identification registration unit.

[0054] Figure 2 is a flow chart of an optional key application method according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0055] Step S202, receiving a first application request initiated by a user terminal, generating an identity protection key based on the first application request, and encrypting the identity protection key using a key generation public key, wherein the first application request at least includes: user identification information and a user protection key encrypted using an identity registration public key;

[0056] Step S204: Generate a second application request based on the user identification information and the encrypted identification protection key, calculate and generate a first data signature according to the second application request, and send the second application request including the first data signature to the key generation unit;

[0057] Step S206, receiving the first response data returned by the key generation unit, and verifying the second data signature in the first response data, wherein the first response data at least includes: the encrypted intermediate key and the second data signature, and the intermediate key is generated based on the user identification information;

[0058] Step S208, after the second data signature is verified, a user key is generated according to the intermediate key, and the user key is encrypted using the user protection key;

[0059] Step S210: Return the encrypted user key and the third data signature to the user terminal.

[0060] Through the above steps, a first application request initiated by a user terminal can be received, and an identification protection key can be generated based on the first application request, and the identification protection key can be encrypted using a key generation public key, wherein the first application request at least includes: user identification information and a user protection key encrypted using an identification registration public key, a second application request is generated based on the user identification information and the encrypted identification protection key, and a first data signature is calculated and generated according to the second application request, the second application request containing the first data signature is sent to a key generation unit, the first response data returned by the key generation unit is received, and the second data signature in the first response data is verified, wherein the first response data at least includes: an encrypted intermediate key and a second data signature, the intermediate key is generated based on the user identification information, after the second data signature is verified, a user key is generated based on the intermediate key, and the user key is encrypted using the user protection key; the encrypted user key and the third data signature are returned to the user terminal. In this embodiment, an intermediate key can be obtained based on the user identification information, and a user key can be directly generated through the intermediate key. There is no need to use a personal certificate, and there is no need to authenticate the personal certificate subsequently. Only basic user personal information needs to be submitted to safely apply for the corresponding identification key information. In the subsequent authentication process, the recipient only needs to calculate the sender's public key data based on the sender's identification and public key base, and verify the signature data to complete the identity authentication. The identity authentication is significantly simplified, thereby solving the technical problem in the related technology that when using certificates for authentication, the two parties to be authenticated need to apply for personal certificates and keys respectively before authentication, and authenticate the validity of the other party's certificate, and the authentication process is relatively complicated.

[0061] The embodiments of the present invention are described below in combination with the above-mentioned implementation steps.

[0062] First, the initialization process of the identification registration unit RMC is schematically illustrated. Through the above system, a complete set of safe and complete system initialization methods is provided, which can ensure that the basic configuration of the system is completed through the initialization steps before the system is run, and the key base and system key are respectively saved in the secure storage area on the specified cryptographic device for storage.

[0063] Optionally, before receiving the first application request initiated by the user terminal, it also includes: receiving a public key acquisition request initiated by the user terminal; generating second response data based on the public key acquisition request, wherein the second response data includes: a unit identifier and a public key base identifying the registration unit; and returning the second response data to the user terminal.

[0064] In this embodiment, when the user terminal establishes a communication connection with the identification registration unit and the user terminal is in an online state, the user terminal can call the network interface to initiate a public key acquisition request to the RMC. After receiving the public key acquisition request, the RMC can return the RMC response data consisting of the RMC identification (i.e., the unit identification of the identification registration unit), the public key base and the data signature to the user terminal. The data signature is a signature for the RMC response data. Afterwards, the RMC response data containing the data signature is returned to the user terminal.

[0065] As an optional implementation of the embodiment of the present invention, before receiving the public key acquisition request initiated by the user terminal, it also includes: entering the unit identification of the identification registration unit into the key generation unit to complete the information registration process.

[0066] In this embodiment, RMC information registration means that before initialization, RMC needs to complete system information registration in KMC and enter unit identification (or system identification), IP and other information into KMC. No service is provided for requests sent by unregistered RMC.

[0067] Another optional method, before receiving the public key acquisition request initiated by the user terminal, also includes: sending a system key request to the key generation unit, wherein the system key request includes at least: a unit identifier that identifies the registration unit, and the key generation unit generates a first system key based on the unit identifier and the key base; receiving the first system key returned by the key generation unit; based on the system configuration parameters, importing the first system key to a specified location of a preset password device; and generating a system protection key at a specified location of the preset password device according to the system configuration parameters.

[0068] In this embodiment, RMC applies for a system key, which means that the identification registration unit RMC sends a system key request to apply for an RMC system key, and the key generation unit KMC calculates and generates the RMC system key (i.e., the first system key mentioned above) based on the RMC's identification and key base, and returns it to RMC.

[0069] In this embodiment, importing the RMC system key means: importing the RMC system key obtained in the previous step and saving it in a designated location of a preset password device according to system configuration parameters.

[0070] In this embodiment, generating the RMC protection key means: generating a system protection key at a specified location of a preset password device according to system configuration parameters, and the system protection key is used for encrypting sensitive data during the use of the system.

[0071] Optionally, after generating a system protection key at a specified location of a preset password device according to system configuration parameters, the method further includes: copying the first system key and the system protection key; and storing the copied first system key and system protection key in a first secure backup medium.

[0072] In this embodiment, RMC key backup means: by using the first secure backup medium (such as a security password key), in this embodiment, the backup of the RMC system key and the system protection key can be completed in a three-five threshold manner (that is, the copied first system key and the system protection key are stored in the first secure backup medium). Optionally, after receiving the RMC response data consisting of the RMC identifier (that is, the unit identifier of the identifier registration unit), the public key base, and the data signature, the user terminal can calculate and generate the user protection key through the obtained RMC identifier and public key base, and encrypt the user protection key using the RMC public key (that is, the identifier registration public key), and send the encrypted user protection key, user identification information, and scope ID together to form a first application request to the identifier registration unit RMC.

[0073] Step S202: receiving a first application request initiated by a user terminal, and generating an identification protection key based on the first application request, wherein the first application request at least includes: user identification information and a user protection key encrypted using an identification registration public key.

[0074] In this embodiment, the user identification information includes but is not limited to: user ID, user identity information, etc.

[0075] Optionally, after generating the identification protection key based on the first application request, it also includes: obtaining a key generation public key; and encrypting the identification protection key using the key generation public key.

[0076] After receiving the first application request, the identification registration unit can generate an identification protection key, namely, the RMC protection key, based on the response data, and encrypt the identification protection key using the KMC public key (namely, the above-mentioned key generation public key). The user identification information, the encrypted RMC protection key and the data signature constitute a second application request and send it to the key application unit KMC.

[0077] In addition to the user identification information, the first application request also includes: a user protection key, through which the subsequently generated identification protection key can be encrypted and information can be transmitted in an encrypted manner.

[0078] Step S204: Generate a second application request based on the user identification information and the encrypted identification protection key, calculate and generate a first data signature according to the second application request, and send the second application request including the first data signature to the key generation unit.

[0079] In this embodiment, the data signature is used to sign each application request, and the receiving party verifies the identity of the requesting party to prevent the request data from being tampered with during transmission. Here, after the second application request is determined by the user identification information and the identification protection key, the second application request can be digitally signed to prevent the application request from being tampered with during transmission.

[0080] After the key generation unit KMC receives the second application request, it can call the cryptographic device to generate an intermediate key based on the user identification information, and encrypt the intermediate key using the identification protection key (i.e., the RMC protection key). The key generation unit can then combine the encrypted intermediate key and the second data signature to form the first response data.

[0081] Here, the second data signature may be a data signature calculated and generated for the first response data including the intermediate key, and then the intermediate key and the second data signature are combined into the first response data, and the key generation unit KMC transmits the first response data to the identification registration unit.

[0082] Step S206, receiving the first response data returned by the key generation unit, and verifying the second data signature in the first response data, wherein the first response data at least includes: an encrypted intermediate key and the second data signature, and the intermediate key is generated based on the user identification information.

[0083] Step S208, after the second data signature is verified, a user key is generated according to the intermediate key, and the user key is encrypted with the user protection key.

[0084] Optionally, the step of generating a user key according to the intermediate key includes: obtaining a pre-configured scope identifier, wherein the scope identifier is used to link to target scope data; and generating the user key based on the scope identifier and the intermediate key.

[0085] The identification registration unit verifies the second data signature in the first response data. After the verification is passed, based on the intermediate key and the scope ID (in this embodiment, the scope parameter file can be indexed by the scope ID, and the scope ID is optional. If there is no scope ID, the intermediate key is the user key), the cryptographic device is called to calculate and generate the user key, and the user protection key is used to encrypt the user key.

[0086] Another optional method is that after generating a user key based on the intermediate key and encrypting the user key with the user protection key, it also includes: obtaining the user protection key in the first application request; and encrypting the intermediate key with the user protection key.

[0087] Step S210: Return the encrypted user key and the third data signature to the user terminal.

[0088] In this embodiment, after the encrypted user key and the third data signature are returned to the user terminal, the user terminal verifies the third data signature. After the verification is passed, the user key can be obtained by decrypting it using the user protection key, thereby completing the user key application.

[0089] Here, the third data signature refers to a data signature calculated based on the response data generated by the encrypted user key, and then the encrypted user key and the third data signature form a data packet and return it to the user terminal.

[0090] In this embodiment, the signature types and methods of the first data signature, the second data signature, and the third data signature mentioned can be adjusted at will, and this embodiment does not make any specific limitations.

[0091] In this embodiment, a key application method is provided, and the user terminal only needs to submit basic personal information (user identification information) to safely apply for corresponding identification key information.

[0092] In this embodiment, a method for signature authentication between users is provided. After the sender signs with the personal user's private key, the receiver only needs to calculate the sender's public key data based on the sender's identification and public key base, perform signature verification on the signature data, and complete identity authentication.

[0093] The following is a schematic illustration of an offline registration process based on user identification information provided in this embodiment. The offline registration means that the user terminal is in an offline device and has not directly established a communication connection with the identification registration unit, and is in an offline state. At this time, the user terminal can communicate with the system operation terminal of the management system to complete the identification key application.

[0094] The embodiment of the present invention provides a key application method, which is applied to an identification registration unit, and the identification registration unit is connected to a key generation unit.

[0095] Figure 3 Another optional key application method according to an embodiment of the present invention is as follows: Figure 1 ,like Figure 3 As shown, the key application method includes:

[0096] Step S302, receiving a protection key file sent by a system operation terminal, generating an identity protection key based on the protection key file, and encrypting the identity protection key using a key generation public key, wherein the system operation terminal is a terminal used by a management user of the identity management system, the system operation terminal is connected to at least one user terminal, and the protection key file includes at least: user identification information and a user protection key encrypted using an identity registration public key;

[0097] Step S304, generating a target application request based on the user identification information and the encrypted identification protection key, calculating a first data signature according to the target application request, and sending the target application request including the first data signature to the key generation unit;

[0098] Step S306, receiving the first response data returned by the key generation unit, and verifying the second data signature in the first response data, wherein the first response data at least includes: the encrypted intermediate key and the second data signature, and the intermediate key is generated based on the user identification information;

[0099] Step S308, after the second data signature is verified, a user key is generated according to the intermediate key, and the user key is encrypted using the user protection key;

[0100] Step S310: Return the encrypted user key and the third data signature to the system operation terminal.

[0101] The above-mentioned key application method receives the protection key file sent by the system operation terminal, generates an identification protection key based on the protection key file, generates a target application request based on the user identification information and the encrypted identification protection key, and calculates the first data signature according to the target application request, sends the target application request containing the first data signature to the key generation unit, receives the first response data returned by the key generation unit, and verifies the second data signature in the first response data, wherein the first response data at least includes: an encrypted intermediate key and a second data signature, the intermediate key is generated based on the user identification information, after the second data signature is verified, a user key is generated based on the intermediate key, and the user key is encrypted using the user protection key, and the encrypted user key and the third data signature are returned to the system operation terminal. In this embodiment, for the offline key application process, an intermediate key can be obtained based on the user identification information, and the user key can be directly generated through the intermediate key. There is no need to use a personal certificate, and there is no need to authenticate the personal certificate subsequently. It is only necessary to submit basic user personal information and safely apply for the corresponding identification key information. In the subsequent authentication process, the recipient only needs to calculate the sender's public key data based on the sender's identification and public key base, and verify the signature data to complete the identity authentication. The identity authentication is significantly simplified, thereby solving the technical problem that when using certificates for authentication in related technologies, the two parties to be authenticated need to apply for personal certificates and keys respectively before authentication, and authenticate the validity of the other party's certificate, and the authentication process is relatively complicated.

[0102] This embodiment is described in detail below in combination with the above embodiments.

[0103] Optionally, before receiving the protection key file sent by the system operation terminal, it also includes: sending a public key base file to the user terminal, wherein the public key base file includes: a unit identifier and a public key base of the identification registration unit; generating an identification public key by the user terminal according to the unit identifier and the public key base of the identification registration unit; generating a user protection key by the user terminal; encrypting the user protection key based on the identification public key by the user terminal; generating a protection key file by the user terminal based on the encrypted user protection key and user identification information.

[0104] In this embodiment, the identification registration unit can provide a public key base file for the user terminal, and the public key base file can include the RMC identification (i.e., the unit identification of the identification registration unit) and the public key base. The user terminal can generate a user protection key based on the public key base file, calculate and generate the RMC public key (i.e., the identification public key) according to the RMC identification and the public key base in the public key base file, encrypt the user protection key using the RMC public key, and form a protection key file with the user identification, scope ID, and the encrypted user protection key, and provide it to the system operation terminal.

[0105] After the system operation terminal receives the protection key file, you can log in to the RMC management page, upload the protection key file of the user terminal, and perform identification registration and key download.

[0106] Step S302, receiving the protection key file sent by the system operation terminal, and generating an identification protection key based on the protection key file, wherein the system operation terminal is a terminal used by the management user of the identification management system, and the system operation terminal is connected to at least one user terminal, and the protection key file includes at least: user identification information and a user protection key encrypted using the identification registration public key.

[0107] After receiving the protection key file, the back-end server of the identification registration unit can generate an RMC protection key (i.e. the identification protection key mentioned above), and can use the KMC public key (i.e. the identification registration public key) to encrypt the RMC protection key (i.e. the user protection key is encrypted using the identification registration public key).

[0108] Step S304: Generate a target application request based on the user identification information and the encrypted identification protection key, calculate a first data signature according to the target application request, and send the target application request including the first data signature to the key generation unit.

[0109] In this embodiment, the identification registration unit may compose an RMC request (ie, the target application request mentioned above) based on the encrypted identification protection key, user identification information, and data signature, and send the RMC request to the key generation unit KMC.

[0110] After the key generation unit KMC receives the second application request, it can call the cryptographic device to generate an intermediate key based on the user identification information, and encrypt the intermediate key using the identification protection key. The key generation unit can then combine the encrypted intermediate key and the second data signature to form the first response data and return it to the identification registration unit.

[0111] Step S306, receiving the first response data returned by the key generation unit, and verifying the second data signature in the first response data, wherein the first response data at least includes: an encrypted intermediate key and the second data signature, and the intermediate key is generated based on the user identification information.

[0112] The identification registration unit verifies the signature of the second data in the first response data. After the verification is passed, based on the intermediate key and the scope ID (in this embodiment, the scope parameter file can be indexed by the scope ID, and the scope ID is optional), the cryptographic device is called to calculate and generate the user key, and the user protection key is used to encrypt the user key.

[0113] Step S308, after the second data signature is verified, a user key is generated according to the intermediate key, and the user key is encrypted with the user protection key.

[0114] The identification registration unit composes the encrypted user key and data signature into a user key file, and completes the download through the system operation terminal.

[0115] Step S310: Return the encrypted user key and the third data signature to the system operation terminal.

[0116] After the system operation terminal completes the download, it will provide the user key file to the user terminal. The user terminal will verify the third data signature in the key file. After the verification is passed, the user key can be obtained by decrypting it using the user protection key, thus completing the user key application.

[0117] In this embodiment, a key application method is provided, and the user terminal only needs to submit basic personal information (user identification information) to safely apply for the corresponding identification key information.

[0118] In the following implementations, the key generation unit is used as the implementation subject to schematically illustrate the key application process. The embodiment of the present invention also provides a key application method, which is applied to the key generation unit, and the key generation unit is connected to at least one identification registration unit.

[0119] Figure 4 Another optional key application method according to an embodiment of the present invention is as follows: Figure 2 ,like Figure 4 As shown, the key application method includes:

[0120] Step S402: receiving an application request initiated by an identification registration unit, wherein the application request includes at least: user identification information, an identification protection key, and a first data signature.

[0121] Step S404: after the first data signature is verified, an intermediate key is generated based on the user identification information.

[0122] The key generation unit calls the cryptographic device to generate an intermediate key according to the user identification information, and encrypts the intermediate key using the RMC protection key (ie, the identification protection key).

[0123] Step S406: Use the identification protection key to encrypt the intermediate key.

[0124] Step S408: Generate first response data based on the encrypted intermediate key, and calculate a second data signature according to the first response data.

[0125] The key generation unit returns the KMC response (ie, first response data) composed of the encrypted intermediate key and the data signature to the identification registration unit RMC.

[0126] Step S410, returns the first response data including the second data signature to the identification registration unit, wherein the identification registration unit, after verifying the second data signature, generates a user key based on the intermediate key, encrypts the user key with the user protection key, and returns the encrypted user key and the third data signature to the user terminal.

[0127] The above steps can receive an application request initiated by the identification registration unit, wherein the application request includes at least: user identification information, an identification protection key and a first data signature. After the first data signature is verified, an intermediate key is generated based on the user identification information, the intermediate key is encrypted using the identification protection key, the first response data is generated based on the encrypted intermediate key, and the second data signature is calculated based on the first response data, and the first response data containing the second data signature is returned to the identification registration unit, wherein the identification registration unit, after verifying the second data signature, generates a user key based on the intermediate key, encrypts the user key using the user protection key, and returns the encrypted user key and the third data signature to the user terminal. In this embodiment, the key generation unit can generate an intermediate key based on the user identification information, so that the identification registration unit can directly generate the user key through the intermediate key, without using a personal certificate, and there is no need to authenticate the personal certificate later. It only needs to submit basic user personal information and safely apply for the corresponding identification key information. In the subsequent authentication process, the recipient only needs to calculate the sender's public key data based on the sender's identification and public key base, and verify the signature data to complete the identity authentication. The identity authentication is significantly simplified, thereby solving the technical problem that when using certificates for authentication in related technologies, the two parties to authentication need to apply for personal certificates and keys respectively before authentication, and authenticate the validity of the other party's certificate, and the authentication process is relatively complicated.

[0128] The following is a schematic illustration of the initialization process of the key generation unit.

[0129] Optionally, before receiving the application request initiated by the identification registration unit, it also includes: generating a key base at a specified location of a preset password device according to system configuration parameters; generating a second system key according to the key base and the unit identifier of the identification registration unit; and importing the second system key to the specified location of the preset password device according to the system configuration parameters.

[0130] In this embodiment, generating the key base means that the key generation unit KMC generates the key base at a specified location of the cryptographic device according to the system configuration parameters.

[0131] In this embodiment, generating the KMC system key means: calculating and generating the KMC system key (ie, the second system key mentioned above) according to the key base generated in the previous step, and importing and saving it in a designated location of the cryptographic device according to the system configuration parameters.

[0132] Optionally, after generating the second system key according to the key base and the unit identifier of the identifier registration unit, the method further includes: copying the key base and the second system key; and storing the copied key base and the second system key in a second secure backup medium.

[0133] In this embodiment, KMC key backup means: using a secure backup medium (such as a secure password key) and adopting a three-five threshold method to complete the backup of the key base and the KMC system key (i.e., storing the copied key base and the second system key in a second secure backup medium).

[0134] In this embodiment, the signature types and methods of the first data signature, the second data signature, and the third data signature mentioned can be adjusted at will, and this embodiment does not make any specific limitations.

[0135] In this embodiment, a key application method is provided, and the user terminal only needs to submit basic personal information (user identification information) to safely apply for the corresponding identification key information.

[0136] In this embodiment, a method for signature authentication between users is provided. After the sender signs with the personal user's private key, the receiver only needs to calculate the sender's public key data based on the sender's identification and public key base, perform signature verification on the signature data, and complete identity authentication.

[0137] The present invention is schematically described below in conjunction with another key application method. The key application method is applied to an identification management system, which includes: a user terminal, an identification registration unit and a key generation unit.

[0138] Figure 5 Another optional key application method according to an embodiment of the present invention is as follows: Figure 3 ,like Figure 5 As shown, the key application method includes:

[0139] Step S501: The user terminal initiates a first application request to an identification registration unit, wherein the first application request at least includes: user identification information and a user protection key encrypted using an identification registration public key;

[0140] Step S502: the identification registration unit generates an identification protection key based on the first application request, and encrypts the identification protection key using a key generation public key;

[0141] Step S503: the identification registration unit generates a second application request based on the user identification information and the encrypted identification protection key, calculates the first data signature according to the second application request, and sends the second application request including the first data signature to the key generation unit;

[0142] Step S504: the key generation unit generates an intermediate key based on the user identification information, encrypts the intermediate key using the identification protection key, generates first response data based on the encrypted intermediate key, and calculates a second data signature based on the first response data;

[0143] Step S505, the key generation unit sends the first response data including the second data signature to the identification registration unit;

[0144] Step S506, the identification registration unit receives the first response data returned by the key generation unit, and verifies the second data signature in the first response data;

[0145] Step S507, after the second data signature is verified, the identification registration unit generates a user key according to the intermediate key, and encrypts the user key with the user protection key;

[0146] Step S508, the identification registration unit returns the encrypted user key and the third data signature to the user terminal;

[0147] Step S509: After the user terminal passes the verification of the third data signature, it uses the user protection key to decrypt the user key to obtain the user key.

[0148] In the above steps, the user terminal can initiate a first application request to the identification registration unit, wherein the first application request at least includes: user identification information and a user protection key encrypted with the identification registration public key; the identification registration unit generates an identification protection key based on the first application request, and encrypts the identification protection key with the key generation public key; the identification registration unit generates a second application request based on the user identification information and the encrypted identification protection key, calculates the first data signature according to the second application request, and sends the second application request containing the first data signature to the key generation unit; the key generation unit generates an intermediate key based on the user identification information, and encrypts the intermediate key with the identification protection key; based on the encryption The key generation unit generates the first response data with the encrypted intermediate key, and calculates the second data signature according to the first response data. The key generation unit sends the first response data including the second data signature to the identification registration unit. The identification registration unit receives the first response data returned by the key generation unit, and verifies the second data signature in the first response data. After the verification of the second data signature is passed, the identification registration unit generates a user key according to the intermediate key, and encrypts the user key with the user protection key. The identification registration unit returns the encrypted user key and the third data signature to the user terminal. After the verification of the third data signature is passed, the user terminal decrypts the user key with the user protection key to obtain the user key. In this embodiment, the key generation unit can generate an intermediate key based on the user identification information, so that the identification registration unit can directly generate the user key through the intermediate key, without using a personal certificate, and there is no need to authenticate the personal certificate later. It only needs to submit basic user personal information and safely apply for the corresponding identification key information. In the subsequent authentication process, the recipient only needs to calculate the sender's public key data based on the sender's identification and public key base, and verify the signature data to complete the identity authentication. The identity authentication is significantly simplified, thereby solving the technical problem that when using certificates for authentication in related technologies, the two parties to authentication need to apply for personal certificates and keys respectively before authentication, and authenticate the validity of the other party's certificate, and the authentication process is relatively complicated.

[0149] Optionally, before the user terminal initiates a first application request to the identification registration unit, it also includes: the user terminal initiates a public key acquisition request to the identification registration unit; the identification registration unit generates second response data based on the public key acquisition request, wherein the second response data includes: the unit identification of the identification registration unit, the public key base and the second data signature; the identification registration unit returns the second response data to the user terminal.

[0150] Through the above-mentioned identification key management system, identification key application for multiple users in a specified environment can be realized. Users can use personal identification keys and public key bases to complete identity authentication, key negotiation, data encryption transmission and other usage scenarios with other users.

[0151] Combine the following Figure 1 , the process of using the identification key management system in the embodiment of the present invention is specifically described.

[0152] 1. Initialization process

[0153] Figure 6 is a flowchart of initializing various devices of an optional system according to an embodiment of the present invention, such as Figure 6 As shown, the system includes: an identification registration center RMC, a key generation center KMC and a cryptographic device. A RMC security backup medium is provided corresponding to the identification registration center RMC, and a KMC security backup medium is provided corresponding to the key generation center KMC.

[0154] The specific initialization process includes two parts, namely the KMC initialization process and the RMC initialization process. Figure 6 As shown, the KMC initialization process and the RMC initialization process are described below respectively.

[0155] The KMC initialization process includes:

[0156] 1.1. Generate key base: KMC generates the key base at the specified location of the cryptographic device according to the system configuration parameters.

[0157] 1.2. Generate KMC system key: Based on the key base generated in the previous step, calculate and generate the KMC system key, and import and save it in the specified location of the password device according to the system configuration parameters.

[0158] 1.3.KMC key backup: By using secure backup media (such as secure password keys), the key base and KMC system key are backed up using a three-five threshold method.

[0159] The RMC initialization process includes:

[0160] 2.1.RMC information registration: Before initialization, RMC needs to complete system information registration in KMC and enter system identification, IP and other information into KMC. No service will be provided for requests sent by unregistered RMC.

[0161] 2.2.RMC applies for system key: RMC sends a system key request to apply for RMC system key. KMC calculates and generates RMC system key based on RMC's identification and key base, and returns it to RMC.

[0162] 2.3.RMC system key import: Import the RMC system key obtained in the previous step and save it in the specified location of the password device according to the system configuration parameters.

[0163] 2.4. Generate RMC protection key: Generate system protection key at the specified location of the password device according to system configuration parameters, which is used to encrypt sensitive data during system use.

[0164] 2.5.RMC key backup: By using secure backup media (such as security password keys), the RMC system key and system protection key are backed up using a three-five threshold method.

[0165] This system provides a complete set of safe and complete system initialization methods, which can ensure that the basic system configuration is completed through the initialization steps before the system is running, and the key base and system key are saved in the secure storage area of ​​the specified cryptographic device for storage.

[0166] After initialization, online and offline registration based on user identification information can be realized. Figure 1 The online registration process and the offline registration process are respectively described schematically. The online registration process and the offline registration process are applied to the identification key management system, which includes: a user terminal (in Figure 7 The user is used as an example to illustrate the identification of the registration center and the key generation center.

[0167] Figure 7 is a schematic diagram of an optional online registration process of an identifier according to an embodiment of the present invention. Figure 7 As shown, the online registration process includes:

[0168] 1. The user initiates a request to obtain the RMC public key through a network interface call.

[0169] 2. RMC returns the RMC response data consisting of the RMC identifier, public key base and data signature to the user.

[0170] 3. The user obtains the RMC ID and public key base, calculates and generates the user protection key, encrypts it with the RMC public key, and sends it to RMC together with the user ID and scope ID to form an application request.

[0171] 4. After receiving the request, RMC generates an RMC protection key and encrypts it using the KMC public key. It then sends the RMC request consisting of the user ID, the encrypted RMC protection key and the data signature to KMC.

[0172] 5. After receiving the request, KMC calls the cryptographic device to generate an intermediate key based on the user identification information, and encrypts the intermediate key using the RMC protection key.

[0173] 6. KMC returns the encrypted intermediate key and data signature to RMC in the form of a KMC response.

[0174] 7.RMC verifies the data signature in the KMC response. After the verification is passed, it calls the cryptographic device to calculate and generate the user key based on the intermediate key and scope ID, and encrypts the user key using the user protection key.

[0175] 8. RMC returns the encrypted user key and data signature to the user. The user verifies the data signature. After the verification is passed, the user key can be obtained by decrypting it with the user protection key, completing the user key application.

[0176] The following is a schematic diagram of the offline registration process. For offline registration of identification, the user terminal applies for key information through the system operation terminal ( Figure 8 The operator is used to illustrate the above) to register the user ID and apply for the user key.

[0177] Figure 8 is a schematic diagram of an optional offline registration process of an identifier according to an embodiment of the present invention, such as Figure 8 As shown, the offline registration process includes:

[0178] 1.RMC provides the user with a public key base file, which includes the RMC logo and public key base.

[0179] 2. The user generates a user protection key, calculates and generates the RMC public key based on the RMC identifier and public key base in the public key base file, uses the RMC public key to encrypt the user protection key, and forms a protection key file with the user identifier, scope ID and encrypted user protection key, and provides it to the system operator.

[0180] 3. The system operator logs in to the RMC management page and uploads the user's protection key file for identification registration and key download.

[0181] 4. After receiving the file, the RMC backend service generates an RMC protection key and encrypts it using the KMC public key. It then sends the RMC request consisting of the user ID, the encrypted RMC protection key, and the data signature to the KMC.

[0182] 5. After receiving the request, KMC calls the cryptographic device to generate an intermediate key based on the user identification information, and encrypts the intermediate key using the RMC protection key.

[0183] 6. KMC returns the encrypted intermediate key and data signature to RMC in the form of a KMC response.

[0184] 7.RMC verifies the signature of the data shared by KMC. After the verification is passed, it calls the cryptographic device to calculate and generate the user key based on the intermediate key and scope ID, and encrypts the user key with the user protection key.

[0185] 8.RMC will encrypt the user and data signatures to form a user key file, which will be downloaded by the system operator on the management page.

[0186] 9. After the operator completes the download, the user key file will be provided to the user. The user will verify the data signature in the key file. After the signature verification is passed, the user key can be obtained by decrypting it using the user protection key, thus completing the user key application.

[0187] In this embodiment, a key application method based on user identification is provided, and the user terminal can safely apply for corresponding identification key information through the key management system by only submitting basic personal information.

[0188] In this embodiment, a method for signature authentication between users is provided. After the sender signs with the personal user's private key, the receiver only needs to calculate the sender's public key data based on the sender's identification and public key base, perform signature verification on the signature data, and complete identity authentication.

[0189] The embodiments of the present invention are described below in conjunction with various implementation devices.

[0190] Fig. 9 is a schematic diagram of an optional key application device according to an embodiment of the present invention, which is applied to an identification registration unit, and the identification registration unit is connected to a key generation unit, such as Fig. 9 As shown, the key application device may include: a first receiving unit 91, a first generating unit 93, a second receiving unit 95, a second generating unit 97, and a first sending unit 99, wherein:

[0191] The first receiving unit 91 is used to receive a first application request initiated by a user terminal, generate an identity protection key based on the first application request, and encrypt the identity protection key using a key generation public key, wherein the first application request at least includes: user identification information and a user protection key encrypted using an identity registration public key;

[0192] The first generating unit 93 is used to generate a second application request based on the user identification information and the encrypted identification protection key, calculate and generate a first data signature according to the second application request, and send the second application request including the first data signature to the key generating unit;

[0193] The second receiving unit 95 is used to receive the first response data returned by the key generating unit, and verify the second data signature in the first response data, wherein the first response data at least includes: the encrypted intermediate key and the second data signature, and the intermediate key is generated based on the user identification information;

[0194] The second generating unit 97 is used to generate a user key according to the intermediate key after the second data signature is verified, and encrypt the user key with the user protection key;

[0195] The first sending unit 99 is used to return the encrypted user key and the third data signature to the user terminal.

[0196] The above-mentioned key application device can receive a first application request initiated by a user terminal through a first receiving unit 91, and generate an identification protection key based on the first application request, wherein the first application request at least includes: user identification information and a user protection key encrypted using an identification registration public key, generate a second application request based on the user identification information and the encrypted identification protection key through a first generating unit 93, calculate and generate a first data signature based on the second application request, send the second application request containing the first data signature to the key generating unit, receive the first response data returned by the key generating unit through a second receiving unit 95, and verify the second data signature in the first response data, wherein the first response data at least includes: an encrypted intermediate key and a second data signature, the intermediate key is generated based on the user identification information, generate a user key based on the intermediate key after the second data signature is verified through a second generating unit 97, and encrypt the user key using the user protection key; return the encrypted user key and the third data signature to the user terminal through a first sending unit 99. In this embodiment, an intermediate key can be obtained based on the user identification information, and a user key can be directly generated through the intermediate key. There is no need to use a personal certificate, and there is no need to authenticate the personal certificate subsequently. Only basic user personal information needs to be submitted to safely apply for the corresponding identification key information. In the subsequent authentication process, the recipient only needs to calculate the sender's public key data based on the sender's identification and public key base, and verify the signature data to complete the identity authentication. The identity authentication is significantly simplified, thereby solving the technical problem in the related technology that when using certificates for authentication, the two parties to be authenticated need to apply for personal certificates and keys respectively before authentication, and authenticate the validity of the other party's certificate, and the authentication process is relatively complicated.

[0197] Optionally, the key application device also includes: a second acquisition module, used to acquire a key generation public key after generating the identity protection key based on the first application request; and a first encryption module, used to encrypt the identity protection key using the key generation public key.

[0198] Optionally, the second generating unit includes: a first acquiring module, used to acquire a pre-configured scope identifier, wherein the scope identifier is used to link the target scope data; and a first generating module, used to generate a user key based on the scope identifier and the intermediate key.

[0199] Optionally, the key application device also includes: a first receiving module, used to receive a public key acquisition request initiated by a user terminal before receiving a first application request initiated by the user terminal; a first generating module, used to generate second response data based on the public key acquisition request, wherein the second response data includes: a unit identifier and a public key base identifying the registration unit; and a first sending module, used to return the second response data to the user terminal.

[0200] Optionally, the key application device further includes: an input unit, used to input the unit identifier of the identification registration unit into the key generation unit before receiving the public key acquisition request initiated by the user terminal, so as to complete the information registration process.

[0201] Optionally, the key application device also includes: a second sending module, used to send a system key request to the key generation unit before receiving a public key acquisition request initiated by a user terminal, wherein the system key request includes at least: a unit identifier that identifies the registration unit, and the key generation unit generates a first system key based on the unit identifier and the key base; a first receiving module, used to receive the first system key returned by the key generation unit; a first import module, used to import the first system key into a specified location of a preset password device based on system configuration parameters; and a second generation module, used to generate a system protection key at a specified location of a preset password device according to the system configuration parameters.

[0202] Optionally, the key application device also includes: a first copying module, used to copy the first system key and the system protection key after generating the system protection key at a designated location of a preset password device according to system configuration parameters; a first saving module, used to save the copied first system key and system protection key in a first secure backup medium.

[0203] Fig.10 Schematic diagram of another optional key application device according to an embodiment of the present invention Figure 1 , applied to the identification registration unit, the identification registration unit is connected to the key generation unit, such as Fig.10 As shown, the device may include:

[0204] The third receiving unit 1001 is used to receive the protection key file sent by the system operation terminal, and generate an identification protection key based on the protection key file, and encrypt the identification protection key with the key generation public key, wherein the system operation terminal is a terminal used by the management user of the identification management system, and the system operation terminal is connected to at least one user terminal, and the protection key file includes at least: user identification information and a user protection key encrypted with the identification registration public key; the third generating unit 1003 is used to generate a target application request based on the user identification information and the encrypted identification protection key, and calculate the first data signature according to the target application request, and convert the first data signature included in the first data signature into the first data signature. The target application request for the data signature is sent to the key generation unit; the fourth receiving unit 1005 is used to receive the first response data returned by the key generation unit, and verify the second data signature in the first response data, wherein the first response data at least includes: an encrypted intermediate key and a second data signature, and the intermediate key is generated based on the user identification information; the fourth generating unit 1005 is used to generate a user key based on the intermediate key after the verification of the second data signature is passed, and encrypt the user key with the user protection key; the second sending unit 1007 is used to return the encrypted user key and the third data signature to the system operation terminal.

[0205] The key application device can receive the protection key file sent by the system operation terminal through the third receiving unit 1001, generate an identity protection key based on the protection key file, and encrypt the identity protection key using the key generation public key, wherein the system operation terminal is a terminal used by the management user of the identity management system, and the system operation terminal is connected to at least one user terminal, and the protection key file at least includes: user identification information and a user protection key encrypted using the identity registration public key, and generate a target application request based on the user identification information and the encrypted identity protection key through the third generation unit 1003, and calculate the first data signature according to the target application request, The target application request including the first data signature is sent to the key generation unit, the first response data returned by the key generation unit is received through the fourth receiving unit 1005, and the second data signature in the first response data is verified, wherein the first response data at least includes: an encrypted intermediate key and a second data signature, the intermediate key is generated based on user identification information, after the second data signature is verified by the fourth generating unit 1005, a user key is generated based on the intermediate key, and the user key is encrypted with the user protection key, and the encrypted user key and the third data signature are returned to the system operation terminal through the second sending unit 1007. In this embodiment, for the offline key application process, an intermediate key can be obtained based on the user identification information, and the user key can be directly generated through the intermediate key. There is no need to use a personal certificate, and there is no need to authenticate the personal certificate subsequently. It is only necessary to submit basic user personal information and safely apply for the corresponding identification key information. In the subsequent authentication process, the recipient only needs to calculate the sender's public key data based on the sender's identification and public key base, and verify the signature data to complete the identity authentication. The identity authentication is significantly simplified, thereby solving the technical problem that when using certificates for authentication in related technologies, the two parties to be authenticated need to apply for personal certificates and keys respectively before authentication, and authenticate the validity of the other party's certificate, and the authentication process is relatively complicated.

[0206] Optionally, the key application device also includes: a second sending module, used to send a public key base file to the user terminal before receiving the protection key file sent by the system operation terminal, wherein the public key base file includes: a unit identifier and a public key base of the identification registration unit; a third generation module, used to generate an identification public key through the user terminal according to the unit identifier and the public key base of the identification registration unit; a fourth generation module, used to generate a user protection key through the user terminal; a second encryption module, used to encrypt the user protection key based on the identification public key through the user terminal; and a fifth generation module, used to generate a protection key file through the user terminal based on the encrypted user protection key and user identification information.

[0207] Fig.11 is a schematic diagram of another optional key application device according to an embodiment of the present invention Figure 2 , applied to a key generation unit, the key generation unit is connected to at least one identification registration unit, such as Fig.11 As shown, the device may include:

[0208] The fifth receiving unit 1101 is used to receive an application request initiated by the identification registration unit, wherein the application request includes at least: user identification information, an identification protection key and a first data signature; the fifth generating unit 1103 is used to generate an intermediate key based on the user identification information after the first data signature is verified; the first encryption unit 1105 is used to encrypt the intermediate key using the identification protection key; the sixth generating unit 1107 is used to generate first response data based on the encrypted intermediate key, and calculate the second data signature based on the first response data; the third sending unit 1109 is used to return the first response data containing the second data signature to the identification registration unit, wherein the identification registration unit, after verifying the second data signature, generates a user key based on the intermediate key, encrypts the user key using the user protection key, and returns the encrypted user key and the third data signature to the user terminal.

[0209] The above-mentioned key application device can receive an application request initiated by the identification registration unit through the fifth receiving unit 1101, wherein the application request at least includes: user identification information, identification protection key and first data signature, and after the first data signature is verified, the fifth generating unit 1103 generates an intermediate key based on the user identification information, and the intermediate key is encrypted by the first encryption unit 1105 using the identification protection key, and the first response data is generated based on the encrypted intermediate key by the sixth generating unit 1107, and the second data signature is calculated according to the first response data, and the first response data containing the second data signature is returned to the identification registration unit through the third sending unit 1109, wherein the identification registration unit, after verifying the second data signature, generates a user key based on the intermediate key, encrypts the user key with the user protection key, and returns the encrypted user key and the third data signature to the user terminal. In this embodiment, the key generation unit can generate an intermediate key based on the user identification information, so that the identification registration unit can directly generate the user key through the intermediate key, without using a personal certificate, and there is no need to authenticate the personal certificate later. It only needs to submit basic user personal information and safely apply for the corresponding identification key information. In the subsequent authentication process, the recipient only needs to calculate the sender's public key data based on the sender's identification and public key base, and verify the signature data to complete the identity authentication. The identity authentication is significantly simplified, thereby solving the technical problem that when using certificates for authentication in related technologies, the two parties to authentication need to apply for personal certificates and keys respectively before authentication, and authenticate the validity of the other party's certificate, and the authentication process is relatively complicated.

[0210] Optionally, the key application device further includes: a sixth generation module, used to generate a key base at a specified location of a preset password device according to system configuration parameters before receiving an application request initiated by the identification registration unit; a seventh generation module, used to generate a second system key according to the key base and the unit identification of the identification registration unit; a second import module, used to import the second system key to the specified location of the preset password device according to the system configuration parameters. Optionally, the key application device further includes: a second copy module, used to copy the key base and the second system key after generating the second system key according to the key base and the unit identification of the identification registration unit; a second storage module, used to store the copied key base and the second system key in a second secure backup medium.

[0211] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned key application methods by executing the executable instructions. According to another aspect of an embodiment of the present invention, there is also provided a computer-readable storage medium, the computer-readable storage medium comprising a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned key application methods.

[0212] The technical solution of the present invention, in essence, or the part that contributes to the prior art, or the whole or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc., various media that can store program codes.

Claims

1. A key application method, characterized in that: Applied to an identification registration unit, the identification registration unit is connected to a key generation unit, and includes: Receive a first application request initiated by a user terminal, generate an identification protection key based on the first application request, and encrypt the identification protection key using a key generation public key, wherein the first application request at least includes: user identification information and a user protection key encrypted using an identification registration public key, and the user protection key is generated by the user terminal after receiving response data consisting of a unit identification of an identification registration unit, a public key base, and a data signature, by calculating the unit identification and public key base of the identification registration unit; Generate a second application request based on the user identification information and the encrypted identification protection key, calculate a first data signature according to the second application request, and send the second application request including the first data signature to the key generation unit; Receive the first response data returned by the key generation unit, and verify the second data signature in the first response data, wherein the first response data at least includes: the encrypted intermediate key and the second data signature, and the intermediate key is a pair of SM2 keys generated by the key generation center KMC calling the cryptographic device based on the user identification information; After the second data signature is verified, a user key is generated according to the intermediate key, and the user key is encrypted using the user protection key; The encrypted user key and the third data signature are returned to the user terminal.

2. The key application method according to claim 1, characterized in that: The step of generating a user key according to the intermediate key comprises: Obtaining a pre-configured scope identifier, wherein the scope identifier is used to link to target scope data; The user key is generated based on the scope identifier and the intermediate key.

3. The key application method according to claim 1, characterized in that: Before receiving the first application request initiated by the user terminal, the method further includes: Receiving a public key acquisition request initiated by the user terminal; Based on the public key acquisition request, generate second response data, wherein the second response data includes: a unit identifier and a public key base of the identifier registration unit; The second response data is returned to the user terminal.

4. The key application method according to claim 3, characterized in that: Before receiving the public key acquisition request initiated by the user terminal, the method further includes: The unit identification of the identification registration unit is entered into the key generation unit to complete the information registration process.

5. The key application method according to claim 4, characterized in that: Before receiving the public key acquisition request initiated by the user terminal, the method further includes: Sending a system key request to the key generation unit, wherein the system key request at least includes: a unit identifier of the identifier registration unit, and the key generation unit generates a first system key based on the unit identifier and a key base; receiving the first system key returned by the key generation unit; Based on the system configuration parameters, importing the first system key into a specified location of a preset password device; A system protection key is generated at a designated location of the preset password device according to the system configuration parameters.

6. The key application method according to claim 5, characterized in that: After generating a system protection key at a designated location of the preset password device according to the system configuration parameters, the method further includes: Copying the first system key and the system protection key; The copied first system key and the system protection key are stored in a first secure backup medium.

7. A key application method, characterized in that: Applied to an identification registration unit, the identification registration unit is connected to a key generation unit, and includes: Receive a protection key file sent by a system operation terminal, generate an identification protection key based on the protection key file, and encrypt the identification protection key using a key generation public key, wherein the system operation terminal is a terminal used by a management user of the identification management system, and the system operation terminal is connected to at least one user terminal, and the protection key file includes at least: user identification information and a user protection key encrypted using an identification registration public key, and the user protection key is generated by the user terminal after receiving response data consisting of a unit identification of an identification registration unit, a public key base, and a data signature, by calculating the unit identification and public key base of the identification registration unit; Generate a target application request based on the user identification information and the encrypted identification protection key, calculate a first data signature according to the target application request, and send the target application request including the first data signature to the key generation unit; Receive the first response data returned by the key generation unit, and verify the second data signature in the first response data, wherein the first response data at least includes: the encrypted intermediate key and the second data signature, and the intermediate key is a pair of SM2 keys generated by the key generation center KMC calling the cryptographic device based on the user identification information; After the second data signature is verified, a user key is generated according to the intermediate key, and the user key is encrypted using the user protection key; The encrypted user key and the third data signature are returned to the system operation terminal.

8. The key application method according to claim 7, characterized in that: Before receiving the protection key file sent by the system operation terminal, it also includes: Sending a public key base file to a user terminal, wherein the public key base file includes: a unit identifier and a public key base of the identifier registration unit; Generate an identification public key by the user terminal according to the unit identification and the public key base of the identification registration unit; generating a user protection key through the user terminal; Encrypting the user protection key based on the identification public key by the user terminal; The protection key file is generated by the user terminal based on the encrypted user protection key and the user identification information.

9. A key application method, characterized in that: Applied to a key generation unit, the key generation unit is connected to at least one identification registration unit, comprising: Receiving an application request initiated by the identification registration unit, wherein the application request at least includes: user identification information, an identification protection key, and a first data signature; After the first data signature is verified, calling a cryptographic device to generate an intermediate key based on the user identification information; Using the identification protection key to encrypt the intermediate key; Generate first response data based on the encrypted intermediate key, and calculate a second data signature according to the first response data; The first response data including the second data signature is returned to the identification registration unit, wherein the identification registration unit, after verifying the second data signature, generates a user key based on the intermediate key, encrypts the user key with the user protection key, and returns the encrypted user key and the third data signature to the user terminal, wherein the user protection key is generated by the unit identification and public key base of the identification registration unit obtained by the user terminal after receiving the response data consisting of the unit identification, public key base and data signature of the identification registration unit.

10. The key application method according to claim 9, characterized in that: Before receiving the application request initiated by the identification registration unit, the method further includes: Generate a key base at a specified location of a preset password device according to system configuration parameters; generating a second system key according to the key base and the unit identifier of the identifier registration unit; According to the system configuration parameters, the second system key is imported into the specified location of the preset password device.

11. The key application method according to claim 10, characterized in that: After generating a second system key according to the key base and the unit identification of the identification registration unit, the method further includes: Copying the key base and the second system key; The copied key base and the second system key are stored in a second secure backup medium.

12. A key application method, characterized in that: Applied to an identification management system, the identification management system includes: a user terminal, an identification registration unit and a key generation unit, including: The user terminal initiates a first application request to the identification registration unit, wherein the first application request at least includes: user identification information and a user protection key encrypted by using the identification registration public key, and the user protection key is generated by the user terminal after receiving response data consisting of the unit identification, public key base and data signature of the identification registration unit, by calculating the unit identification and public key base of the identification registration unit; The identification registration unit generates an identification protection key based on the first application request, and encrypts the identification protection key using a key generation public key; The identification registration unit generates a second application request based on the user identification information and the encrypted identification protection key, calculates a first data signature according to the second application request, and sends the second application request including the first data signature to the key generation unit; The key generation unit generates an intermediate key based on the user identification information, and uses the identification protection key to encrypt the intermediate key, generates first response data based on the encrypted intermediate key, and calculates a second data signature based on the first response data, wherein the intermediate key is a pair of SM2 keys generated by the key generation center KMC calling the cryptographic device based on the user identification information; The key generation unit sends the first response data including the second data signature to the identification registration unit; The identification registration unit receives the first response data returned by the key generation unit, and verifies the second data signature in the first response data; After the second data signature is verified, the identification registration unit generates a user key according to the intermediate key, and encrypts the user key with the user protection key; The identification registration unit returns the encrypted user key and the third data signature to the user terminal; After the user terminal passes the verification of the third data signature, the user terminal uses the user protection key to decrypt the user key to obtain the user key.

13. The key application method according to claim 12, characterized in that: Before the user terminal initiates a first application request to the identification registration unit, the method further includes: The user terminal initiates a public key acquisition request to the identification registration unit; The identification registration unit generates second response data based on the public key acquisition request, wherein the second response data includes: a unit identification of the identification registration unit, a public key base, and a second data signature; The identification registration unit returns the second response data to the user terminal.

14. A key application device, characterized in that: Applied to an identification registration unit, the identification registration unit is connected to a key generation unit, and includes: A first receiving unit is used to receive a first application request initiated by a user terminal, and generate an identification protection key based on the first application request, and encrypt the identification protection key by using a key generation public key, wherein the first application request at least includes: user identification information and a user protection key encrypted by using an identification registration public key, and the user protection key is generated by the user terminal after receiving response data consisting of a unit identification of an identification registration unit, a public key base, and a data signature, by calculating the unit identification and public key base of the identification registration unit; A first generating unit, configured to generate a second application request based on the user identification information and the encrypted identification protection key, calculate a first data signature according to the second application request, and send the second application request including the first data signature to the key generating unit; A second receiving unit is configured to receive first response data returned by the key generation unit, and verify the second data signature in the first response data, wherein the first response data at least includes: an encrypted intermediate key and the second data signature, and the intermediate key is a pair of SM2 keys generated by a key generation center KMC calling a cryptographic device based on the user identification information; A second generating unit, configured to generate a user key according to the intermediate key after the second data signature is verified, and encrypt the user key with the user protection key; The first sending unit is used to return the encrypted user key and the third data signature to the user terminal.

15. A key application device, characterized in that: Applied to an identification registration unit, the identification registration unit is connected to a key generation unit, and includes: a third receiving unit, configured to receive a protection key file sent by a system operation terminal, generate an identification protection key based on the protection key file, and encrypt the identification protection key using a key generation public key, wherein the system operation terminal is a terminal used by a management user of the identification management system, and the system operation terminal is connected to at least one user terminal, and the protection key file includes at least: user identification information and a user protection key encrypted using an identification registration public key, and the user protection key is generated by the user terminal after receiving response data consisting of a unit identification of an identification registration unit, a public key base, and a data signature, by calculating the unit identification and public key base of the identification registration unit; A third generating unit is used to generate a target application request based on the user identification information and the encrypted identification protection key, calculate a first data signature according to the target application request, and send the target application request including the first data signature to the key generating unit; a fourth receiving unit, configured to receive first response data returned by the key generation unit, and verify the second data signature in the first response data, wherein the first response data at least includes: an encrypted intermediate key and the second data signature, and the intermediate key is a pair of SM2 keys generated by a key generation center KMC calling a cryptographic device based on the user identification information; a fourth generating unit, configured to generate a user key according to the intermediate key after the second data signature is verified, and encrypt the user key with the user protection key; The second sending unit is used to return the encrypted user key and the third data signature to the system operation terminal.

16. A key application device, characterized in that: Applied to a key generation unit, the key generation unit is connected to at least one identification registration unit, comprising: A fifth receiving unit, configured to receive an application request initiated by the identification registration unit, wherein the application request at least includes: user identification information, an identification protection key, and a first data signature; a fifth generating unit, configured to call a cryptographic device to generate an intermediate key based on the user identification information after the first data signature is verified; A first encryption unit, used to encrypt the intermediate key using the identification protection key; a sixth generating unit, configured to generate first response data based on the encrypted intermediate key, and calculate a second data signature according to the first response data; The third sending unit is used to return the first response data including the second data signature to the identification registration unit, wherein the identification registration unit, after verifying the second data signature, generates a user key based on the intermediate key, encrypts the user key with the user protection key, and returns the encrypted user key and the third data signature to the user terminal, and the user protection key is generated by the user terminal through the unit identification and public key base of the identification registration unit after receiving the response data consisting of the unit identification, public key base and data signature of the identification registration unit.

17. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the key application method described in any one of claims 1 to 11 by executing the executable instructions.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the key application method according to any one of claims 1 to 11.

Images