A method, device, computer equipment and readable storage medium for key authorization
The method and device for key authorization enable multiple users within an enterprise to independently control key copies through identity verification and escrow keys, addressing the limitations of existing technologies and enhancing security and flexibility in corporate electronic seal applications.
Patent Information
- Application Number
- CN202210446766.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-04-26
- Publication Date
- 2025-01-03
- Estimated Expiration
- 2042-04-26
AI Technical Summary
Existing key authorization technologies are limited in scope and cannot meet the needs of corporate electronic seals for multiple users in different scenarios.
A method and device for key authorization that allows multiple users within an enterprise to independently control target key copies by establishing an association between a target key and applicant users, using temporary encryption and decryption keys, and managing key authorization policies through identity verification and escrow keys.
Enables multiple users to control a single key copy, expanding the application scope of key authorization and enhancing security and flexibility in key management.
Smart Images
Figure CN114844631B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data processing technology, and in particular to a method, apparatus, computer device and readable storage medium for key authorization. Background Art
[0002] With the development of Internet technology, paperless office is becoming more and more popular. For example, the digital certificate and private key corresponding to the company's electronic seal can be controlled through cryptographic technology, allowing users to electronically stamp with the company's electronic seal.
[0003] Under the existing technology, the application scenarios of key authorization are relatively limited, and usually can only meet the needs of individuals for general key authorization, but cannot meet the needs of corporate electronic seals for use by multiple people in different scenarios. Summary of the invention
[0004] The purpose of the embodiments of the present application is to provide a method, apparatus, computer device and readable storage medium for key authorization, so as to improve the scope of application of key authorization when performing key authorization for electronic seals.
[0005] In one aspect, a method for key authorization is provided, comprising:
[0006] When it is determined that the authorization confirmation request message sent by the target device is received, the target key identifier of the target user and the application key identifier of the application user contained in the authorization confirmation request message are obtained;
[0007] Based on the target key identifier, obtain the private key ciphertext and the public key plaintext of the target key, and the copy key identifier of the target key copy, where the target key copy is a key copy created based on the target key;
[0008] Based on the temporary encryption and decryption key set for the application key identifier, the private key ciphertext is encrypted to obtain the copy escrow key, where the temporary encryption and decryption key is generated based on the authorization application sent by the application device;
[0009] Key authorization is performed based on the application key identifier, target key identifier, copy key identifier, public key plaintext, and copy escrow key.
[0010] In the above implementation process, when performing key authorization, the private key ciphertext is encrypted by using the temporary encryption and decryption key of the applicant user, and the above association relationship is established, so that the applicant user obtains independent control over the target key copy, and multiple target key copies can be used so that multiple users in the same enterprise can independently control the target key copies of the target key, thereby expanding the scope of application and meeting the needs of multiple people using the same target key.
[0011] In one implementation, based on the target key identifier, obtaining the private key ciphertext and the public key plaintext of the target key, and the copy key identifier of the copy of the target key includes:
[0012] Authenticate the target user based on the target key identifier;
[0013] If the identity verification is determined to be successful, the target personal identification code is obtained;
[0014] Get the initial escrow key and public key plaintext of the target key set for the target key ID;
[0015] Based on the target personal identification code and the target key identification, the initial escrow key is decrypted to obtain the private key ciphertext;
[0016] Create a key copy of the target key and obtain the target key copy;
[0017] Generate the copy key identifier of the target key copy.
[0018] In the above implementation process, the initial managed key of the target user is decrypted to obtain the private key ciphertext, so that in the subsequent steps, the key authority can be transferred through the private key ciphertext, and multiple target key copies and copy key identifiers can be generated based on the target key, so that in the subsequent steps, multiple users in the same enterprise can independently control the target key copies of the target key.
[0019] In one implementation, authenticating the target user based on the target key identifier includes:
[0020] Get the contact information set for the target key identity and the target personal identification code summary;
[0021] Sending a first verification code to a target device of a target user through the contact method;
[0022] Receiving a second verification code corresponding to the target user and a target personal identification code;
[0023] If the first verification code and the second verification code meet the verification failure condition, determining that the identity verification has failed, otherwise, determining a digest of the target personal identification code;
[0024] If the target personal identification code digest is the same as the target personal identification code digest, then the identity authentication is determined to be successful, otherwise, the identity authentication is determined to be unsuccessful.
[0025] In the above implementation process, identity authentication is performed on the target user, thereby improving security.
[0026] In one implementation, key authorization is performed based on the application key identifier, the target key identifier, the replica key identifier, the public key plaintext, and the replica escrow key, including:
[0027] Obtain the contact information of the applicant user and the summary of the personal identification code of the applicant set for the application key identifier, as well as the key authorization policy also included in the authorization confirmation request message;
[0028] Establish an association between the applicant's contact information, the applicant's personal identification code summary, the target key identifier, the copy key identifier, the public key plaintext, the copy escrow key, and the key authorization policy.
[0029] In the above implementation process, the above association relationship is established so that the applicant user can call the target key copy for electronic stamping based on the above association relationship.
[0030] In one implementation, before encrypting the private key ciphertext based on the temporary encryption and decryption key set for the application key identifier to obtain the copy escrow key, it also includes:
[0031] When it is determined that the authorization application is received, obtaining the application key identifier contained in the authorization application;
[0032] Based on the application key identifier, the applicant is authenticated;
[0033] If the verification is successful, the applicant's personal identification code is obtained;
[0034] Generate a temporary encryption and decryption key based on the application key identifier and the application personal identification code.
[0035] In the above implementation process, after the user identity verification is passed, a temporary encryption and decryption key is generated, so that the key authority can be transferred through the temporary encryption and decryption key in the subsequent steps.
[0036] In one implementation, after key authorization is performed based on the application key identifier, the target key identifier, the copy key identifier, the public key plaintext, and the copy escrow key, the following is further included:
[0037] Receiving an authorization change request including a target key identifier and a copy key identifier, the authorization change request is used to request to revoke key authorization or change a key authorization policy of a target key copy;
[0038] Authenticate the target user based on the target key identifier;
[0039] If the verification is successful, the key authorization for the target key copy is revoked or the key authorization policy of the target key copy is changed based on the copy key identifier in the authorization change request.
[0040] In the above implementation process, the revocation of key authorization and the change of key authorization policy can be realized, which improves the flexibility of authorization.
[0041] In one aspect, a key authorization device is provided, comprising:
[0042] A receiving unit, configured to obtain a target key identifier of a target user and an application key identifier of an application user contained in the authorization confirmation request message when determining that the authorization confirmation request message sent by the target device is received;
[0043] An acquisition unit, used for acquiring, based on a target key identifier, a private key ciphertext and a public key plaintext of a target key, and a copy key identifier of a target key copy, where the target key copy is a key copy created based on the target key;
[0044] An encryption unit, used to encrypt the private key ciphertext based on a temporary encryption and decryption key set for the application key identifier to obtain a copy escrow key, where the temporary encryption and decryption key is generated based on the authorization application sent by the application device;
[0045] The authorization unit is used to perform key authorization based on the application key identifier, the target key identifier, the replica key identifier, the public key plaintext, and the replica escrow key.
[0046] In one implementation, the acquisition unit is used to:
[0047] Authenticate the target user based on the target key identifier;
[0048] If the identity verification is determined to be successful, the target personal identification code is obtained;
[0049] Get the initial escrow key and public key plaintext of the target key set for the target key ID;
[0050] Based on the target personal identification code and the target key identification, the initial escrow key is decrypted to obtain the private key ciphertext;
[0051] Create a key copy of the target key and obtain the target key copy;
[0052] Generate the copy key identifier of the target key copy.
[0053] In one implementation, the acquisition unit is used to:
[0054] Get the contact information set for the target key identity and the target personal identification code summary;
[0055] Sending a first verification code to a target device of a target user through the contact method;
[0056] Receiving a second verification code corresponding to the target user and a target personal identification code;
[0057] If the first verification code and the second verification code meet the verification failure condition, determining that the identity verification has failed, otherwise, determining a digest of the target personal identification code;
[0058] If the target personal identification code digest is the same as the target personal identification code digest, then the identity authentication is determined to be successful, otherwise, the identity authentication is determined to be unsuccessful.
[0059] In one implementation, the authorization unit is used to:
[0060] Obtain the contact information of the applicant user and the summary of the personal identification code of the applicant set for the application key identifier, as well as the key authorization policy also included in the authorization confirmation request message;
[0061] Establish an association between the applicant's contact information, the applicant's personal identification code summary, the target key identifier, the copy key identifier, the public key plaintext, the copy escrow key, and the key authorization policy.
[0062] In one implementation, the encryption unit is further used to:
[0063] When it is determined that the authorization application is received, obtaining the application key identifier contained in the authorization application;
[0064] Based on the application key identifier, the applicant is authenticated;
[0065] If the verification is successful, the applicant's personal identification code is obtained;
[0066] Generate a temporary encryption and decryption key based on the application key identifier and the application personal identification code.
[0067] In one implementation, the authorization unit is further configured to:
[0068] Receiving an authorization change request including a target key identifier and a copy key identifier, the authorization change request is used to request to revoke key authorization or change a key authorization policy of a target key copy;
[0069] Authenticate the target user based on the target key identifier;
[0070] If the verification is successful, the key authorization for the target key copy is revoked or the key authorization policy of the target key copy is changed based on the copy key identifier in the authorization change request.
[0071] On the one hand, a computer device is provided, including a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the method provided in any of the various optional implementations of key authorization described above are executed.
[0072] On the one hand, a readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method provided in any of the various optional implementations of key authorization described above are executed.
[0073] In one aspect, a computer program product is provided. When the computer program product is run on a computer, the computer is enabled to execute the steps of the method provided in any of the various optional implementations of key authorization described above.
[0074] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0075] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0076] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;
[0077] Figure 2 A flowchart of a key application method provided in an embodiment of the present application;
[0078] Figure 3 A flowchart of a key authorization method provided in an embodiment of the present application;
[0079] Figure 4 A structural block diagram of a key authorization device provided in an embodiment of the present application;
[0080] Figure 5 It is a schematic diagram of the structure of a computer device in an embodiment of the present application. DETAILED DESCRIPTION
[0081] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.
[0082] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.
[0083] First, some terms involved in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.
[0084] Terminal device: can be a mobile terminal, a fixed terminal or a portable terminal, such as a mobile phone, a station, a unit, a device, a multimedia computer, a multimedia tablet, an Internet node, a communicator, a desktop computer, a laptop computer, a notebook computer, a netbook computer, a tablet computer, a personal communication system device, a personal navigation device, a personal digital assistant, an audio / video player, a digital camera / camcorder, a positioning device, a television receiver, a radio broadcast receiver, an electronic book device, a gaming device or any combination thereof, including accessories and peripherals of these devices or any combination thereof. It is also foreseeable that the terminal device can support any type of interface for the user (such as a wearable device), etc.
[0085] Server: It can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, and big data and artificial intelligence platforms.
[0086] In order to expand the application scope of key authorization when performing key authorization for electronic seals, the embodiments of the present application provide a method, apparatus, computer device and readable storage medium for key authorization.
[0087] The application scenario of the embodiment of the present application is: the target user holds the control of the target key, and through the key application and key authorization process in the embodiment of the present application, the control of the target key is granted to the applicant user, that is, an association is established between the target key copy and the applicant user, so that the applicant user has control over the target key.
[0088] In the embodiments of the present application, only the execution subject is taken as an example of a server. In actual applications, the execution subject can also be a computer device such as a terminal device, which is not limited here.
[0089] In the embodiment of the present application, the applicant user applies to the server for authorization of the target key, and the target user authorizes the use of the key.
[0090] See also Figure 1 As shown, it is a flowchart of a key application method provided in an embodiment of the present application, and the specific implementation process of the method is as follows:
[0091] Step 100: When it is determined that an authorization application is received, obtain the application key identifier contained in the authorization application.
[0092] Specifically, the application device obtains the application key identifier of the application user and the target key identifier of the target key to be authorized, and sends an authorization application to the server. When the server determines that the authorization application is received, it obtains the application key identifier included in the authorization application.
[0093] Furthermore, the target key identifier included in the authorization application may also be obtained.
[0094] It should be noted that both the applicant and the target user have at least one independent key, and the application device can be a terminal device or a server, and can be one or more, without limitation here.
[0095] In one implementation, the target user has an independent key (i.e., the target key) in the managed key signing service, and the target key is identified as keyId_A. The applicant user has an independent key (i.e., the application key) in the managed key signing service, and the application key is identified as keyId_B. The applicant user applies to the managed key signing service to execute the requestKeyPairCounterpart process (authorization application), and the input parameters in the authorization application include: the target key identification keyId_A of the target key to be applied for, and the application key identification keyId_B of the application key held by the applicant user.
[0096] Step 101: Based on the application key identifier, the applicant user is authenticated.
[0097] Specifically, when executing step 101, the following steps may be adopted:
[0098] S1011: Obtain the contact information set for the application key identification and the summary of the application personal identification code.
[0099] In one implementation, metadata of the application key is obtained from a key library based on the application key identifier.
[0100] The metadata of the application key at least includes the contact information of the applicant and the summary of the personal identification code of the application. The summary of the personal identification code of the application is a summary value obtained by performing a hash operation on the personal identification number (PIN) of the application.
[0101] Optionally, the contact information can be the applicant's mobile phone number or other methods, which are not limited here.
[0102] S1012: Send a first verification code to the applicant through the above contact method.
[0103] Specifically, the first verification code may be a one-time password (OTP), an activation link for access, or other "challenge-response" methods, which are not limited here.
[0104] S1013: Receive a second verification code and an application personal identification code returned by the applicant based on the first verification code.
[0105] It should be noted that, to ensure security, OTP needs to be sent through an out-of-band channel. That is, the user receives the first verification code through one device and returns the second verification code through another device, or receives the activation link through SMS or email and verifies by clicking on the activation link.
[0106] For example, the server sends a randomly generated first verification code to the mobile phone of user Bob (the applicant) (a communication device other than the application device) through the mobile phone number of user Bob (the applicant). After receiving the first verification code sent by the server through the mobile phone, user Bob sends the second verification code and the application personal identification code to the server through the notebook (i.e. the application device).
[0107] S1014: If the first verification code and the second verification code meet the verification failure condition, it is determined that the identity authentication fails, otherwise, a summary of the application for the personal identification code is determined.
[0108] For example, the verification failure condition may be that the first verification code and the second verification code are different, that is, if the first verification code and the second verification code are the same, a hash calculation is performed on the applicant personal identity code returned by the applicant device to obtain the summary hashPin_B of the applicant personal identity code; otherwise, it indicates that the identity authentication has failed and an error message may be returned to the applicant device.
[0109] In actual applications, the verification failure condition can be set according to the actual application scenario and is not limited here.
[0110] S1015: If the summary of the applied personal identification code is the same as the summary of the applied personal identification code, it is determined that the identity authentication is successful; otherwise, it is determined that the identity authentication fails.
[0111] Specifically, if the summary of the personal identification code applied for is the same as the summary of the personal identification code applied for, it is determined that the identity authentication is successful, and the program running result of the completed identity authentication can be returned. If the summary of the personal identification code applied for is different from the summary of the personal identification code applied for, it is determined that the identity authentication fails. An error message can also be returned to the applying device.
[0112] In this way, the identity of the applicant device can be verified, which improves security.
[0113] Step 102: If the verification is successful, obtain the applicant's personal identification code.
[0114] Step 103: Generate a temporary encryption and decryption key based on the application key identifier and the application personal identification code.
[0115] In one implementation, the temporary encryption and decryption key can be obtained using the following formula:
[0116] key0=KDF(SAM_SymKey, keyId||pin);
[0117] Key_B=Truncate(key0, 16Bytes).
[0118] Among them, key0 is the temporary initial encryption and decryption key, KDF is the key derivation function, SAM_SymKey is the key securely stored inside the hardware cryptographic module, keyId is the key identifier, pin is the personal identity code, Truncate is the truncation function, and Key_B is the temporary encryption and decryption key.
[0119] In an embodiment of the present application, the application key identifier and the application personal identity identification code are taken as input, and the temporary encryption and decryption initial key key0 is obtained through the key derivation function KDF calculation, and key0 is transformed into a 128-bit temporary encryption and decryption key Key_B through the truncation function Truncate.
[0120] Among them, the key derivation function KDF can apply multiple algorithms. In the process of deriving the key, the key SAM_SymKey securely stored inside the hardware cryptographic module is used, ensuring that the key derivation process depends on the hardware cryptographic module device, making it impossible for attackers to calculate temporary encryption and decryption keys offline without the hardware cryptographic module device.
[0121] Furthermore, the temporary encryption and decryption key may be stored, for example, the temporary encryption and decryption key may be stored in a cache system.
[0122] In an embodiment of the present application, after the applicant user issues an authorization application for the target key, the server generates a temporary encryption and decryption key based on the applicant user's application key identifier and application personal identity identification code, so that in the subsequent authorization confirmation process, the target key can be authorized to the applicant user through the temporary encryption and decryption key.
[0123] See also Figure 2 As shown, it is a flowchart of a key authorization method provided in an embodiment of the present application. The specific implementation process of the method is as follows:
[0124] Step 200: When it is determined that an authorization confirmation request message sent by a target device is received, a target key identifier of a target user and an application key identifier of an application user included in the authorization confirmation request message are obtained.
[0125] Specifically, the authorization confirmation request message may also include a key authorization policy. The key authorization policy is used to indicate the authorized use mode of the target key, such as the authorized use period and the number of allowed calls.
[0126] In actual applications, the key authorization policy can be set according to the actual application scenario and is not restricted here.
[0127] Step 201: Based on the target key identifier, obtain the private key ciphertext and public key plaintext of the target key, and the copy key identifier of the target key copy.
[0128] Specifically, when executing step 201, the following steps may be adopted:
[0129] S2011: Authenticate the target user based on the target key identifier.
[0130] Specifically, when executing S2011, the following steps may be adopted:
[0131] Step 1: Get the contact information set for the target key identity and the target personal identification code summary.
[0132] In one implementation, metadata of the target key is obtained from a key library based on the application key identifier.
[0133] The metadata of the target key at least includes the contact information of the target user and the target personal identification code summary. The target personal identification code summary is a summary value obtained by performing a hash operation on the target personal identification code.
[0134] Step 2: Send a first verification code to the target device of the target user through the contact method.
[0135] Step 3: Receive the second verification code corresponding to the target user and the target personal identification code.
[0136] Step 4: If the first verification code and the second verification code meet the verification failure condition, it is determined that the identity authentication has failed, otherwise, the digest of the target personal identification code is determined.
[0137] Step 5: If the target personal identification code digest hashPIN_A is the same as the digest of the target personal identification code PIN_A, it is determined that the identity authentication is successful, otherwise, it is determined that the identity authentication fails.
[0138] It should be noted that, in the embodiment of the present application, a principle similar to the principle of authenticating the applicant user in the above step 101 is adopted to authenticate the identity of the target user, which will not be elaborated here.
[0139] S2012: If the identity authentication is determined to be successful, the target personal identification code is obtained.
[0140] S2013: Obtain the initial escrow key and public key plaintext of the target key set for the target key identifier.
[0141] Specifically, the initial escrow key encUsrPri_A and the public key plaintext usrPub are obtained from the metadata corresponding to the target key identifier.
[0142] It should be noted that the initial escrow key encUsrPri_A is obtained by encrypting the private key ciphertext, and the private key ciphertext is obtained by encrypting the private key. In other words, the private key ciphertext is the ciphertext encrypted once with the private key, and the initial escrow key encUsrPri_A is the ciphertext encrypted twice with the private key.
[0143] S2014: Based on the target personal identification code and the target key identifier, the initial escrow key is decrypted to obtain the private key ciphertext.
[0144] Specifically, based on the target personal identification code PIN_A of the target user and the target key identifier keyId_A, an encryption and decryption key key_A is generated, and based on the encryption and decryption key key_A, a decryption operation is performed on the initial escrow key encUsrPri_A to obtain the private key ciphertext usrPri.
[0145] Among them, the encryption and decryption key key_A is obtained by calculating the key derivation function KDF.
[0146] Optionally, the encryption and decryption algorithm for decryption may adopt the Advanced Encryption Standard (AES) algorithm, or may adopt the national secret SM4 block encryption.
[0147] In practical applications, the encryption and decryption algorithms can be set according to the actual application scenarios and are not limited here.
[0148] S2015: Create a key copy of the target key and obtain the target key copy.
[0149] It should be noted that the private key and public key plaintext contained in the target key copy are the same as the private key and public key plaintext contained in the target key.
[0150] S2016: Generate a copy key identifier of the target key copy.
[0151] Specifically, a unique copy key identifier keyId_F is generated for the target key copy.
[0152] In this way, the private key ciphertext and public key plaintext of the target key, as well as the copy key identifier of the target key copy, can be obtained, so that multiple target key copies can be generated for different users, so that different users can independently control a target key copy.
[0153] Further, the target key identifier keyId_A is set as the original key identifier masterKeyId of the target key copy.
[0154] In this way, the target key copy can be associated with the original target key, so that when the key authorization is subsequently revoked, the association between the target key copy and the original target key can be used to verify whether the user applying for revocation has the authority.
[0155] Step 202: Based on the temporary encryption and decryption key set for the application key identifier, encrypt the private key ciphertext to obtain the copy escrow key.
[0156] Specifically, based on the application key identifier, the stored temporary encryption and decryption key of the applicant user is obtained, and the private key ciphertext is encrypted again using the temporary encryption and decryption key to obtain the copy custody key.
[0157] Optionally, the encryption and decryption algorithm may be the AES algorithm, the national SM4 block encryption, or other encryption and decryption algorithms, without limitation here.
[0158] In one implementation, a temporary encryption and decryption key Key_B is used to perform symmetrical encryption (i.e., second-layer encryption) on the private key ciphertext usrPri and the application key identifier keyId_F to obtain the copy escrow key encUsrPri_F=Sym_Encrypt(keyId_F, usrPri||keyId_F).
[0159] Optionally, the encryption and decryption algorithm can use AES block encryption, or national encryption SM4 block encryption, or can be set according to the actual application scenario, without limitation here.
[0160] Furthermore, after the copy escrow key is generated, the temporary encryption and decryption key corresponding to the applicant user is deleted from the storage system to improve the security of encryption and decryption.
[0161] Step 203: Perform key authorization based on the application key identifier, target key identifier, copy key identifier, public key plaintext, and copy escrow key.
[0162] Specifically, when executing step 203, the following steps are adopted:
[0163] S2031: Obtain the contact information of the applicant user and the summary of the applicant personal identification code set for the application key identifier.
[0164] Specifically, the application personal identification code digest hashPIN_B and contact information of the applicant user are obtained from the metadata corresponding to the application key identifier.
[0165] S2032: Establish an association relationship between the applicant's contact information, the applicant's personal identity code summary, the target key identifier, the copy key identifier, the public key plaintext, and the copy escrow key, so that the applicant can perform encryption and decryption based on the association relationship.
[0166] Specifically, the target key identifier keyId_A is set as the original key identifier masterKeyId of the target key copy, and an association is established between the applicant's contact information telNum_B, the applicant's personal identity code digest hashPIN_B, the original key identifier masterKeyId of the target key copy, the copy key identifier keyId_F, the public key plaintext usrPub, and the copy escrow key encUsrPri_F.
[0167] Furthermore, an association relationship can be established between the applicant's contact information telNum_B, the applicant's personal identity code summary hashPIN_B, the original key identifier masterKeyId of the target key copy, the copy key identifier keyId_F, the public key plaintext usrPub, the copy escrow key encUsrPri_F and the key authorization policy authorized and confirmed by the target user.
[0168] It should be noted that the execution order of the steps in the embodiments of the present application can be executed sequentially or in other orders, which is not limited here.
[0169] In an embodiment of the present application, after establishing an association between the applicant's contact information, the applicant's personal identity code summary, the target key identifier, the copy key identifier, the public key plaintext, and the copy escrow key, the applicant user has independent control over the target key copy.
[0170] In the embodiment of the present application, only the authorization of the target key to one applicant user is taken as an example for explanation. In actual application, based on the principle similar to the authorization of the target key to one applicant user, the target key can be authorized to multiple different applicant users.
[0171] Furthermore, if the applicant needs to use the target key copy, after the applicant's identity verification is passed, the target key copy can be used to generate electronic signature data based on the above association relationship to realize the management and use of the company's electronic official seal.
[0172] Furthermore, after the target user passes the identity authentication, he or she can also revoke the key authorization of the applicant user or change the key authorization policy through the original key identifier masterKeyId.
[0173] In one embodiment, an authorization change request including a target key identifier and a copy key identifier is received, and the authorization change request is used to request the revocation of key authorization or the change of key authorization policy. Based on the target key identifier, the target user is authenticated; if the verification is successful, the key authorization for the target key copy is revoked or the key authorization policy of the target key copy is changed based on the copy key identifier in the authorization change request.
[0174] Furthermore, a correspondence can be established between the original key identifier masterKeyId of the target key copy, the application key identifier keyId_B, and the key authorization policy. Based on the correspondence, the applicant user can further authorize the authorized target key copy to another user (i.e., the third user) based on a principle similar to authorizing the target key to an applicant user, thereby forming a chained key authorization relationship.
[0175] It should be noted that one or more target key copies can be created based on one target key.
[0176] After building a chain of key authorization relationships, it can be stipulated that any predecessor node of a target key copy (e.g., the target user) has the authority to revoke the key authorization of any one or more key copies that follow it in the chain (e.g., the key authorization of the target key copy of the applicant user), thereby achieving more flexible key authorization management.
[0177] In the embodiment of the present application, the user's temporary encryption and decryption keys can be stored through the cache system. These are security-sensitive parameters related to the user's keys, have high security requirements, and need to be protected to prevent data leakage.
[0178] Furthermore, the data may be encrypted before being stored in a cache system, and it is necessary to ensure key sharing between different nodes of a server (eg, a cluster system hosting a key signing service) so that the ciphertext data stored in the cache system can be correctly decrypted.
[0179] It should be noted that the embodiments of the present application need to be executed in a secure and controllable environment, and the cache system needs to be run in a secure and controllable environment.
[0180] Optionally, a secure and controllable environment can be built based on a trusted execution environment (TEE), such as by using an extension (Software Guard Extension, SGX) technology of the Intel instruction set architecture.
[0181] See also Figure 3 The figure shows a schematic diagram of the architecture of a key authorization system. Figure 3 In the process, the server obtains the applicant's personal identification code pin_B based on the applicant's authorization application, uses the applicant's personal identification code pin_B as the input of the key derivation function KDF, obtains the calculated temporary encryption and decryption key Key_B, and stores the temporary encryption and decryption key Key_B to the cache system.
[0182] Furthermore, based on the authorization confirmation request message of the target user, the server performs a hash calculation on the target personal identity code PIN_A of the target user to obtain a summary of the target personal identity code. If the summary of the target personal identity code is the same as the target personal identity code summary hashPIN_A set for the target key identifier keyId_A, it is determined that the identity authentication of the target user is passed, and a key derivation function KDF is used to generate an encryption and decryption key key_A based on the target personal identity code PIN_A of the target user and the target key identifier keyId_A, and a decryption operation is performed on the initial escrow key encUsrPri_A based on the encryption and decryption key key_A to obtain the private key ciphertext usrPri.
[0183] Next, the server encrypts the private key ciphertext usrPri based on the temporary encryption and decryption key Key_B, obtains the copy escrow key encUsrPri_F and establishes an association between the applicant's contact information telNum_B, the applicant's personal identity code summary hashPIN_B, the original key identifier masterKeyId of the target key copy, the copy key identifier keyId_F, the public key plaintext usrPub, the copy escrow key encUsrPri_F and the key authorization policy requested by the applicant.
[0184] In the embodiment of the present application, based on the authorization application of the applicant user, a temporary encryption and decryption key Key_B is generated, and after receiving the authorization confirmation request message of the target user, the initial escrow key encUsrPri_A obtained after the secondary encryption is outer-decrypted through the target personal identity code PIN_A of the target user to obtain the private key ciphertext, and a target key copy is created, and the private key ciphertext is secondary-encrypted through the applicant personal identity code pin_B of the applicant user to obtain the copy escrow key encUsrPri_F that the applicant user can independently control, and then establish the applicant user's contact information telNum_B, the applicant personal identity code summary hashPIN_B, the original key identifier masterKeyId of the target key copy, the copy key identifier keyId_F, the public key plaintext usrPub, the copy escrow key encUsrPri_F and the key authorization policy requested by the applicant user. The transfer of control of the target key copy is realized, so that multiple users can independently control the target key copy, and the target user (such as an administrator) can also revoke the key authorization at any time through the original key identifier, thereby realizing the life cycle management of the key authorization and the flexible change of the key authorization policy.
[0185] Based on the same inventive concept, a key authorization device is also provided in the embodiment of the present application. Since the principle of solving the problem by the above-mentioned device and equipment is similar to a key authorization method, the implementation of the above-mentioned device can refer to the implementation of the method, and the repeated parts will not be repeated.
[0186] like Figure 4 As shown, it is a structural diagram of a key authorization device provided in an embodiment of the present application, including:
[0187] The receiving unit 401 is used to obtain the target key identifier of the target user and the application key identifier of the application user contained in the authorization confirmation request message when determining that the authorization confirmation request message sent by the target device is received;
[0188] The acquisition unit 402 is used to acquire the private key ciphertext and the public key plaintext of the target key and the copy key identifier of the target key copy based on the target key identifier, where the target key copy is a key copy created based on the target key;
[0189] The encryption unit 403 is used to encrypt the private key ciphertext based on the temporary encryption and decryption key set for the application key identifier to obtain the copy escrow key, where the temporary encryption and decryption key is generated based on the authorization application sent by the application device;
[0190] The authorization unit 404 is used to perform key authorization based on the application key identifier, the target key identifier, the copy key identifier, the public key plaintext and the copy escrow key.
[0191] In one implementation, the acquisition unit 402 is used to:
[0192] Authenticate the target user based on the target key identifier;
[0193] If the identity verification is determined to be successful, the target personal identification code is obtained;
[0194] Get the initial escrow key and public key plaintext of the target key set for the target key ID;
[0195] Based on the target personal identification code and the target key identification, the initial escrow key is decrypted to obtain the private key ciphertext;
[0196] Create a key copy of the target key and obtain the target key copy;
[0197] Generate the copy key identifier of the target key copy.
[0198] In one implementation, the acquisition unit 402 is used to:
[0199] Get the contact information set for the target key identity and the target personal identification code summary;
[0200] Sending a first verification code to a target device of a target user through the contact method;
[0201] Receiving a second verification code corresponding to the target user and a target personal identification code;
[0202] If the first verification code and the second verification code meet the verification failure condition, determining that the identity verification has failed, otherwise, determining a digest of the target personal identification code;
[0203] If the target personal identification code digest is the same as the target personal identification code digest, then the identity authentication is determined to be successful, otherwise, the identity authentication is determined to be unsuccessful.
[0204] In one implementation, the authorization unit 404 is used to:
[0205] Obtain the contact information of the applicant user and the summary of the personal identification code of the applicant set for the application key identifier, as well as the key authorization policy also included in the authorization confirmation request message;
[0206] Establish an association between the applicant's contact information, the applicant's personal identification code summary, the target key identifier, the copy key identifier, the public key plaintext, the copy escrow key, and the key authorization policy.
[0207] In one implementation, the encryption unit 403 is further configured to:
[0208] When it is determined that the authorization application is received, obtaining the application key identifier contained in the authorization application;
[0209] Based on the application key identifier, the applicant is authenticated;
[0210] If the verification is successful, the applicant's personal identification code is obtained;
[0211] Generate a temporary encryption and decryption key based on the application key identifier and the application personal identification code.
[0212] In one implementation, the authorization unit 404 is further configured to:
[0213] Receiving an authorization change request including a target key identifier and a copy key identifier, the authorization change request is used to request to revoke key authorization or change a key authorization policy of a target key copy;
[0214] Authenticate the target user based on the target key identifier;
[0215] If the verification is successful, the key authorization for the target key copy is revoked or the key authorization policy of the target key copy is changed based on the copy key identifier in the authorization change request.
[0216] Figure 5 FIG. 5 shows a schematic diagram of the structure of a computer device 5000. Figure 5 As shown, the computer device 5000 includes: a processor 5010 and a memory 5020 , and optionally, may also include a power supply 5030 , a display unit 5040 , and an input unit 5050 .
[0217] The processor 5010 is the control center of the computer device 5000. It uses various interfaces and lines to connect various components, and performs various functions of the computer device 5000 by running or executing software programs and / or data stored in the memory 5020, thereby monitoring the computer device 5000 as a whole.
[0218] In the embodiment of the present application, the processor 5010 executes the various steps in the above embodiment when calling the computer program stored in the memory 5020.
[0219] Optionally, the processor 5010 may include one or more processing units; preferably, the processor 5010 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and applications, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 5010. In some embodiments, the processor and the memory may be implemented on a single chip, and in some embodiments, they may also be implemented separately on separate chips.
[0220] The memory 5020 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, various applications, etc.; the data storage area may store data created according to the use of the computer device 5000, etc. In addition, the memory 5020 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices, etc.
[0221] The computer device 5000 also includes a power source 5030 (such as a battery) for supplying power to various components. The power source can be logically connected to the processor 5010 through a power management system, thereby managing functions such as charging, discharging, and power consumption through the power management system.
[0222] The display unit 5040 may be used to display information input by the user or information provided to the user and various menus of the computer device 5000, and in the embodiment of the present invention, is mainly used to display the display interface of each application in the computer device 5000 and objects such as text and pictures displayed in the display interface. The display unit 5040 may include a display panel 5041. The display panel 5041 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc.
[0223] The input unit 5050 may be used to receive information such as numbers or characters input by the user. The input unit 5050 may include a touch panel 5051 and other input devices 5052. The touch panel 5051, also known as a touch screen, may collect touch operations of the user on or near it (such as operations of the user using a finger, a stylus, or any other suitable object or accessory on or near the touch panel 5051).
[0224] Specifically, the touch panel 5051 can detect the user's touch operation, detect the signal brought by the touch operation, convert these signals into touch point coordinates, send them to the processor 5010, and receive and execute the command sent by the processor 5010. In addition, the touch panel 5051 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. Other input devices 5052 can include but are not limited to one or more of a physical keyboard, function keys (such as volume control keys, power on / off keys, etc.), a trackball, a mouse, a joystick, etc.
[0225] Of course, the touch panel 5051 can cover the display panel 5041. When the touch panel 5051 detects a touch operation on or near it, it is transmitted to the processor 5010 to determine the type of touch event. Then the processor 5010 provides corresponding visual output on the display panel 5041 according to the type of touch event. Figure 5 In the embodiment, the touch panel 5051 and the display panel 5041 are used as two independent components to implement the input and output functions of the computer device 5000, but in some embodiments, the touch panel 5051 and the display panel 5041 can be integrated to implement the input and output functions of the computer device 5000.
[0226] The computer device 5000 may also include one or more sensors, such as a pressure sensor, a gravity acceleration sensor, a proximity light sensor, etc. Of course, according to the needs of specific applications, the computer device 5000 may also include other components such as a camera. Since these components are not the key components used in the embodiments of the present application, Figure 5It is not shown and will not be described in detail.
[0227] Those skilled in the art will understand that Figure 5 This is merely an example of a computer device and does not constitute a limitation on the computer device. The computer device may include more or fewer components than shown in the figure, or a combination of certain components, or different components.
[0228] In an embodiment of the present application, a readable storage medium stores a computer program, and when the computer program is executed by a processor, a communication device can perform each step in the above embodiment.
[0229] For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, when implementing this application, the functions of each module (or unit) can be implemented in the same or multiple software or hardware.
[0230] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0231] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0232] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0233] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0234] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.
[0235] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A method for key authorization, characterized in that: include: When it is determined that the authorization confirmation request message sent by the target device is received, obtaining the target key identifier of the target user and the application key identifier of the application user contained in the authorization confirmation request message; Based on the target key identifier, obtaining a private key ciphertext and a public key plaintext of the target key, and a copy key identifier of a target key copy, where the target key copy is a key copy created based on the target key; Based on the temporary encryption and decryption key set for the application key identifier, the private key ciphertext is encrypted to obtain the copy escrow key, wherein the temporary encryption and decryption key is generated based on the authorization application sent by the application device; Key authorization is performed based on the application key identifier, the target key identifier, the copy key identifier, the public key plaintext, and the copy escrow key.
2. The method according to claim 1, characterized in that The step of obtaining the private key ciphertext and the public key plaintext of the target key and the copy key identifier of the copy of the target key based on the target key identifier includes: authenticating the target user based on the target key identifier; If the identity verification is determined to be successful, the target personal identification code is obtained; Obtaining an initial escrow key and a plaintext public key of the target key set for the target key identifier; Decrypting the initial escrow key based on the target personal identification code and the target key identifier to obtain the private key ciphertext; Creating a key copy of the target key, and obtaining the target key copy; Generate a copy key identifier of the target key copy.
3. The method according to claim 2, characterized in that The authenticating the target user based on the target key identifier includes: Obtaining contact information set for the target key identifier and a target personal identification code summary; Sending a first verification code to a target device of the target user through the contact method; Receiving a second verification code corresponding to the target user and a target personal identification code; If the first verification code and the second verification code meet the verification failure condition, determining that the identity authentication has failed, otherwise, determining the digest of the target personal identification code; If the target personal identification code digest is the same as the target personal identification code digest, it is determined that the identity authentication is successful, otherwise, it is determined that the identity authentication fails.
4. The method according to any one of claims 1 to 3, characterized in that: The performing key authorization based on the application key identifier, the target key identifier, the copy key identifier, the public key plaintext and the copy escrow key includes: Obtaining the contact information of the applicant user and the summary of the application personal identification code set for the application key identifier, as well as the key authorization policy also included in the authorization confirmation request message; Establish an association relationship between the contact information of the applicant user, the summary of the applicant personal identity code, the target key identifier, the copy key identifier, the public key plaintext, the copy escrow key and the key authorization policy.
5. The method according to any one of claims 1 to 3, characterized in that: Before encrypting the private key ciphertext based on the temporary encryption and decryption key set for the application key identifier to obtain the copy escrow key, the method further includes: When determining that an authorization application has been received, obtaining the application key identifier contained in the authorization application; Based on the application key identifier, identity verification is performed on the applicant user; If the verification is successful, the applicant's personal identification code is obtained; The temporary encryption and decryption key is generated based on the application key identifier and the application personal identity identification code.
6. The method according to any one of claims 1 to 3, characterized in that: After the key authorization is performed based on the application key identifier, the target key identifier, the copy key identifier, the public key plaintext and the copy escrow key, the method further includes: Receiving an authorization change request including a target key identifier and a copy key identifier, the authorization change request being used to request revocation of key authorization or change of a key authorization policy of the target key copy; authenticating the target user based on the target key identifier; If the verification is successful, the key authorization for the target key copy is revoked or the key authorization policy of the target key copy is changed based on the copy key identifier in the authorization change request.
7. A key authorization device, characterized in that: include: A receiving unit, configured to obtain a target key identifier of a target user and an application key identifier of an application user contained in the authorization confirmation request message when determining that the authorization confirmation request message sent by the target device is received; an acquisition unit, configured to acquire, based on the target key identifier, a private key ciphertext and a public key plaintext of the target key, and a copy key identifier of a target key copy, wherein the target key copy is a key copy created based on the target key; an encryption unit, configured to encrypt the private key ciphertext based on a temporary encryption / decryption key set for the application key identifier to obtain a copy escrow key, wherein the temporary encryption / decryption key is generated based on the authorization application sent by the application device; The authorization unit is used to perform key authorization based on the application key identifier, the target key identifier, the copy key identifier, the public key plaintext and the copy escrow key.
8. The device according to claim 7, characterized in that The acquisition unit is used for: authenticating the target user based on the target key identifier; If the identity verification is determined to be successful, the target personal identification code is obtained; Obtaining an initial escrow key and a plaintext public key of the target key set for the target key identifier; Decrypting the initial escrow key based on the target personal identification code and the target key identifier to obtain the private key ciphertext; Creating a key copy of the target key, and obtaining the target key copy; Generate a copy key identifier of the target key copy.
9. The device according to claim 8, characterized in that The acquisition unit is used for: Obtaining contact information set for the target key identifier and a target personal identification code summary; Sending a first verification code to a target device of the target user through the contact method; Receiving a second verification code corresponding to the target user and a target personal identification code; If the first verification code and the second verification code meet the verification failure condition, determining that the identity authentication has failed, otherwise, determining the digest of the target personal identification code; If the target personal identification code digest is the same as the target personal identification code digest, it is determined that the identity authentication is successful, otherwise, it is determined that the identity authentication fails.
10. The device according to any one of claims 7 to 9, characterized in that: The authorization unit is used to: Obtaining the contact information of the applicant user and the summary of the application personal identification code set for the application key identifier, as well as the key authorization policy also included in the authorization confirmation request message; Establish an association relationship between the contact information of the applicant user, the summary of the applicant personal identity code, the target key identifier, the copy key identifier, the public key plaintext and the copy escrow key.
11. The device according to any one of claims 7 to 9, characterized in that: The encryption unit is also used for: When determining that an authorization application has been received, obtaining the application key identifier contained in the authorization application; Based on the application key identifier, identity verification is performed on the applicant user; If the verification is successful, the applicant's personal identification code is obtained; The temporary encryption and decryption key is generated based on the application key identifier and the application personal identity identification code.
12. The device according to any one of claims 7 to 9, characterized in that: The authorization unit is also used for: Receiving an authorization change request including a target key identifier and a copy key identifier, the authorization change request being used to request revocation of key authorization or change of a key authorization policy of the target key copy; authenticating the target user based on the target key identifier; If the verification is successful, the key authorization for the target key copy is revoked or the key authorization policy of the target key copy is changed based on the copy key identifier in the authorization change request.
13. A computer device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 6 is executed.
14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is executed.