Method, system and electronic equipment for time-sharing personalized application of public terminal

Abstract

Some embodiments of the present application provide a method, system and electronic device for time-sharing personalized application of a public terminal, the method being applied to a cryptographic service end, comprising: receiving first data information sent by a user terminal held by a user, the first data information being obtained based on a first key component of the user terminal; receiving second data information sent by a target terminal; obtaining a third key component based on the second key component, the first data information and the second data information, wherein a fourth key component can be calculated from the second data information generated by the public terminal, the third key component matches the fourth key component of the target terminal, and can cooperate to complete digital signatures, data encryption and decryption and other operations on behalf of the user during personal use of the public terminal.

Description

Technical Field

[0001] The present application relates to the field of key security technology, and in particular to a method, system and electronic device for time-sharing personalized application of a public terminal. Background Art

[0002] In order to ensure the security of information transmission, storage and processing, the mainstream technology is to use public key cryptography technology in the terminal based on the Electronic Signature Law. The user generates a key pair (public key and private key) in the terminal and forms a digital certificate request with the user identity and public key, and applies for a digital certificate from an electronic certification agency established in accordance with the law. The private key and certificate in the terminal can provide security functions such as identity authentication, information confidentiality, information integrity, and non-repudiation of operation behavior, thereby providing reliable electronic signature security support for various network applications.

[0003] In some business scenarios (for example, in the medical field, police field, and rental equipment field, etc.), terminal devices are public, that is, the terminal devices can be used by several different users at different time periods to decrypt and use corresponding keys. In order to achieve key security, the cryptographic modules on the terminal devices are generally designed to be used and controlled by users with valid permissions, so as to ensure the exclusive use of keys. However, considering the security of keys and the limited resources of the terminal security storage area, public terminal devices cannot store the keys of a specific user for a long time, nor can they store the keys of many "users who may use the device" for a long time.

[0004] At present, the common method used by researchers is that each time a public terminal device is assigned to a specific person for use, the public terminal device is first cleared and then a temporary key is generated for the specific person. However, the temporary key does not correspond to the identity of the specific person one-to-one, so it faces the disadvantage of being unable to provide network identity authentication during use. To this end, the improved method is that after the public terminal device generates the key, it is also necessary to apply for a certificate from an electronic certification agency established in accordance with the law each time. During the certificate application process, in order to ensure the authenticity of the identity, a series of processes such as identity verification must be carried out before the certificate can be issued. At the same time, it is also necessary to verify that the signer accepts and trusts the certificate, which undoubtedly greatly increases the complexity of the business and reduces business efficiency.

[0005] Therefore, how to provide a technical solution for realizing time-sharing personalized application of a public cryptographic device has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] The purpose of some embodiments of the present application is to provide a method, system and electronic device for time-sharing personalized application of public terminals. The technical solution of the embodiments of the present application can personalize a public terminal (as a specific example of a target terminal) by using the first key component and the second key component as preset conditions and generating a third key component on the cryptographic service end in combination with the data of the public terminal. The third key component and the fourth key component of the public terminal are then used to form a time-sharing personal key. This can realize the authentication of the user's identity without the need to reapply for a certificate from an electronic certification agency each time, thereby improving the efficiency of processing business and reducing the complexity of the business.

[0007] In the first aspect, some embodiments of the present application provide a method for time-sharing personalized application of a public terminal, which is applied to a cryptographic service end, including: receiving first data information sent by a user terminal held by a user, the first data information being obtained based on a first key component of the user terminal; receiving second data information sent by a target terminal; obtaining a third key component based on the second key component, the first data information and the second data information, wherein the third key component matches with the fourth key component of the target terminal to form a time-sharing personal key, the fourth key component is generated by the target terminal based on the second data information, and the first key component matches with the second key component to form the time-sharing personal key.

[0008] The cryptographic service end of some embodiments of the present application obtains the third key component through the first data information of the user terminal, the second data information of the target terminal and the second key component of the cryptographic service end. After that, the third key component and the fourth key component of the public terminal (that is, the target terminal) are combined into a time-sharing personalized key, which can be used for confidentiality and integrity protection. At the same time, the time-sharing personalized key itself corresponds one-to-one with the user certificate key, which can realize user identity authentication, and there is no need to apply for a certificate from the electronic certification agency every time, which improves the efficiency of processing business and reduces the complexity of business. At the same time, the third key component matches the fourth key component, and can cooperate to complete digital signatures, data encryption and decryption and other operations on behalf of the user during the personal use of the public terminal.

[0009] In some embodiments, the method further includes: generating a task sequence number corresponding to the first data information, and sending the task sequence number to the user terminal.

[0010] Some embodiments of the present application can ensure the orderly progress of tasks by generating a task serial number as an identifier to record the task of generating the third key component this time.

[0011] In some embodiments, the method also includes: receiving a transformation function sent by the user terminal, and receiving authentication information sent by the target terminal, wherein the authentication information is generated by the user terminal and sent to the target terminal; obtaining a third key component according to the second key component, the first data information and the second data information, including: inputting the authentication information into the transformation function to obtain transformation data; performing operations on the second key component, the first data information, the transformation data and the second data information to obtain the third key component, wherein the operations include: at least one of modular addition, modular subtraction, modular multiplication, addition, subtraction and multiplication.

[0012] Some embodiments of the present application obtain the third key component by performing random operations on relevant data, so that the third key component has high randomness, cannot be guessed and analyzed by others, and has high security.

[0013] In some embodiments, the second data information is obtained by the target terminal performing calculations on a plurality of generated random numbers.

[0014] In some embodiments of the present application, the target terminal can obtain the second data information through multiple random numbers, so that the security of the third key component finally obtained is higher.

[0015] In some embodiments, after obtaining the third key component based on the second key component, the first data information and the second data information, the method further includes: when the target terminal is abnormal, authenticating the identity of the user; and when confirming that the identity authentication is passed, clearing the third key component.

[0016] Some embodiments of the present application can authenticate the user's identity by clearing the third key component when the user's identity authentication is passed when the target terminal is abnormal, and make it impossible for people other than the user to access the target terminal through the time-sharing personal key, thereby ensuring the security of the target terminal.

[0017] In the second aspect, some embodiments of the present application provide a method for time-sharing personalized application of a public terminal, which is applied to a user terminal, including: receiving an initial message sent by a target terminal; generating authentication information, wherein the authentication information is used to represent the user's authorization credentials to use the target terminal; obtaining first data information based on a first key component, the initial message and the authentication information, and sending at least the first data information to a cryptographic server, wherein the first key component is generated and stored by the user terminal, and the first data information is used to be processed by the cryptographic server to generate a third key component.

[0018] In some embodiments of the present application, the user terminal can provide necessary data support for the cryptographic server by sending the first data information obtained from the first key component, the initial message and the authentication information to the cryptographic server. The data sent is not the plain text of the first key component directly, but the changed form of the first key component, which is more secure.

[0019] In some embodiments, the method further includes: receiving a task number corresponding to the first data information and sent by the cryptographic service end; and sending the task number and the authentication information to the target terminal.

[0020] Some embodiments of the present application can ensure the orderly progress of tasks by receiving a task sequence number as an identifier for recording the task of generating the third key component this time.

[0021] In some embodiments, obtaining the first data information based on the first key component, the initial message and the authentication information includes: inputting the authentication information into a transformation function to obtain transformation information; performing operations on the first key component, the initial message and the transformation information to obtain the first data information, wherein the operations include: at least one of modular addition, modular subtraction, modular multiplication, addition, subtraction and multiplication.

[0022] In some embodiments, sending at least the first data information to a cryptographic server includes: sending the first data information and the transformation function to the cryptographic server.

[0023] Some embodiments of the present application provide the cryptographic server with necessary data for generating a third cryptographic component by sending the first data information and the transformation function to the cryptographic server.

[0024] In the third aspect, some embodiments of the present application provide a method for time-sharing personalized application of a public terminal, which is applied to a target terminal, including: generating a random number and a fourth key component, and generating an initial message and a second data information based on the random number; sending the initial message to a user terminal; receiving authentication information sent by the user terminal; sending the second data information and the authentication information to a cryptographic server, so that the cryptographic server generates a third key component, wherein the third key component and the fourth key component constitute a time-sharing personal key.

[0025] In some embodiments of the present application, the target terminal sends the second data information and authentication information generated by random numbers to the cryptographic server, which can provide necessary data support for the cryptographic server.

[0026] In some embodiments, the method further includes: receiving a task serial number sent by the user terminal; and sending the task serial number to the cryptographic server, so that the cryptographic server records the third key component generation task corresponding to the task serial number.

[0027] Some embodiments of the present application can ensure the orderly progress of tasks by receiving the corresponding task serial number as an identifier to record the task of generating the third key component this time.

[0028] In some embodiments, the number of the random numbers is three, wherein generating the initial message and the second data information based on the random numbers includes: extracting two random numbers from the three random numbers and performing random operations to obtain the initial message and the second data information, wherein the two random numbers constitute the fourth key component.

[0029] Some embodiments of the present application obtain the initial message, the second data information and the fourth key component by generating random numbers, thereby avoiding the plaintext transmission of the key components and effectively ensuring the security of the generated key.

[0030] In some embodiments, after sending the second data information and the authentication information to the cryptographic service end, the method further includes: receiving an operation instruction from a user of the user terminal to clear the fourth key component.

[0031] In some embodiments of the present application, when a target terminal is deactivated by a user, corresponding data can be cleared through the user's operating instructions, thereby avoiding providing data information of the target terminal to other persons, and effectively ensuring the security of the target terminal.

[0032] In a fourth aspect, some embodiments of the present application provide a cryptographic service end, comprising: a first receiving module, configured to receive first data information sent by a user terminal held by a user, the first data information being obtained based on a first key component of the user terminal; a second receiving module, configured to receive second data information sent by a target terminal; a key generation module, configured to obtain a third key component based on the second key component, the first data information and the second data information, wherein the third key component matches the fourth key component of the target terminal to form a time-sharing personal key, the fourth key component is generated by the target terminal based on the second data information, and the first key component matches the second key component to form the time-sharing personal key.

[0033] In the fifth aspect, some embodiments of the present application provide a user terminal, comprising: a receiving module, configured to receive an initial message sent by a target terminal; an information generating module, configured to generate authentication information, wherein the authentication information is used to characterize the user's authorization credentials to use the target terminal; an information sending module, configured to obtain first data information based on a first key component, the initial message and the authentication information, and send at least the first data information to a cryptographic server, wherein the first key component is generated and stored by the user terminal, and the first data information is used to be processed by the cryptographic server to generate a third key component.

[0034] In the sixth aspect, some embodiments of the present application provide a target terminal, comprising: a generation module, configured to generate a random number and a fourth key component, and generate an initial message and a second data information based on the random number; a first sending module, configured to send the initial message to a user terminal; a receiving module, configured to receive authentication information sent by the user terminal; a second sending module, configured to send the second data information and the authentication information to a cryptographic server, so that the cryptographic server generates a third key component, wherein the third key component and the fourth key component constitute a time-sharing personal key.

[0035] In a seventh aspect, some embodiments of the present application provide a system for time-sharing personalized application of a public terminal, comprising: a target terminal, for generating a random number and a fourth key component, and generating an initial message and a second data information according to the random number; sending the initial message to a user terminal; receiving authentication information sent by the user terminal; sending the second data information and the authentication information to a password service end; the user terminal, for receiving the initial message; generating authentication information, the authentication information being used to characterize the authorization credentials of the user to use the target terminal; obtaining first data information according to a first key component, the initial message and the authentication information, and sending at least the first data information to a password service end; a password service end, for receiving the first data information sent by the user terminal held by the user, the first data information being obtained based on the first key component of the user terminal; receiving the second data information sent by the target terminal; obtaining a third key component according to the second key component, the first data information and the second data information, wherein the third key component matches the fourth key component of the target terminal to form a time-sharing personal key, the fourth key component is generated by the target terminal according to the second data information, and the first key component matches the second key component to form the time-sharing personal key.

[0036] In an eighth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect, the second aspect, or the third aspect.

[0037] In the ninth aspect, some embodiments of the present application provide an electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the method described in any embodiment of the first aspect, the second aspect, or the third aspect can be implemented.

[0038] In the tenth aspect, some embodiments of the present application provide a computer program product, wherein the computer program product includes a computer program, wherein when the computer program is executed by a processor, it can implement the method described in any embodiment of the first aspect, the second aspect or the third aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A system diagram of a public terminal time-sharing personalized application provided for some embodiments of the present application;

[0041] Figure 2 One of the method flow charts of time-sharing personalized application of public terminals provided in some embodiments of the present application;

[0042] Figure 3 A second flow chart of a method for time-sharing personalized application of a public terminal provided in some embodiments of the present application;

[0043] Figure 4 A third flow chart of a method for time-sharing personalized application of a public terminal provided in some embodiments of the present application;

[0044] Figure 5 An interactive flow chart of a public terminal time-sharing personalized application provided in some embodiments of the present application;

[0045] Figure 6 A block diagram of a cryptographic server provided for some embodiments of the present application;

[0046] Figure 7 A block diagram of a user terminal provided for some embodiments of the present application;

[0047] Figure 8 A block diagram of a target terminal provided for some embodiments of the present application;

[0048] Fig. 9 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0049] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0050] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0051] In the related art, in various business scenarios, terminal devices are public, that is, they are used by multiple different users at different time periods according to the business situation. For example, police terminal devices, medical terminal devices, rental terminal devices and counter terminal devices, etc. In police business, police terminal devices are generally allocated to police officers according to the management strategy of the equipment. Medical terminal devices may be allocated when medical staff are at work. Rental terminal devices may be handed over to lessees in certain rental business. Counter terminal devices can record the business intentions of people who go to the business hall to handle business as compliance evidence of the business. The above-mentioned terminal devices usually include password modules, which perform the function of generating a certain password in the corresponding business. The password function has its own particularity. The password function depends on the key, and the key is the basis of its security. In order to achieve key security, the password modules on the terminal devices are basically designed to be used and controlled by users with valid permissions to ensure the exclusive use of the key. However, public terminal devices cannot store the key of a specific user for a long time, nor can they store the keys of many "users who may use the terminal device" for a long time.

[0052] In some businesses, in order to solve the problem of not being able to store data for a long time, a public terminal device temporarily generates a key exclusive to a specific person each time it is assigned to a specific person. However, although the public terminal device is used by an individual, it does not represent any user identity, but only represents the "device identity". The system needs to use other methods to identify the user identity based on the "device identity".

[0053] In the prior art, when temporarily generating a key exclusive to a specific person, it is necessary to confirm that it is compliant. That is to say, after the public terminal device generates the key, it needs to apply for a certificate from an electronic certification authority (CA) established in accordance with the law. In order to ensure the authenticity of the identity, the certificate application process must go through a series of processes such as identity verification before the certificate can be issued. At the same time, it is also necessary to verify that the signer accepts and trusts the certificate, which undoubtedly increases the complexity of the business and reduces business efficiency. Moreover, for encryption applications, if a user uses a public terminal device to decrypt content that the user has previously encrypted on other devices, it is obviously impossible to successfully complete the decryption by temporarily generating a new key at this time.

[0054] Therefore, it can be seen from the above-mentioned related technologies that in the prior art, when users use public terminal equipment, they cannot authenticate their identities. The use of additional identity authentication methods increases business complexity and business processing efficiency, while also reducing the role and value of public terminal equipment.

[0055] In view of this, some embodiments of the present application provide a method for time-sharing personalized application of public terminals, which can generate a third key component through the cooperation of partial information of the user terminal, the target terminal and the information of the cryptographic service end. Afterwards, the third key component and the fourth key component of the target terminal can constitute a time-sharing personal key. Among them, the cryptographic service end can provide key management services and collaborative cryptographic calculation functions to the outside, and cooperate with user terminals and public terminals (that is, target terminals, which can also be called public terminal devices) to complete various required cryptographic functions. The cryptographic service end supports identity authentication and establishment of secure channels for user terminals and public terminals, and can support users to temporarily authorize the public terminals they use and revoke authorization on demand, thereby improving the efficiency of processing business and reducing the complexity of business.

[0056] It should be noted that collaborative cryptographic computing is a method in which the communicating parties jointly generate signatures. Specifically, part of the private key can be stored separately on both communicating parties, and the two parties can jointly sign or decrypt the message. Neither communicating party can obtain any information about the other party's private key. Therefore, if an attacker invades either party, he cannot forge a signature or decrypt the ciphertext, thereby improving the security of the private key in the cloud computing environment. Moreover, during the signing and decryption processes, the communicating parties only need to interact very little, thereby meeting the low-latency and low-interaction application requirements in the cloud computing environment.

[0057] The following is an exemplary introduction to the system composition structure of the public terminal time-sharing personalized application provided by some embodiments of the present application.

[0058] like Figure 1As shown, some embodiments of the present application provide a system for time-sharing personalized application of a public terminal, the system comprising: a user terminal 110, a password server 120 and a public terminal 130. The user terminal 110 and the password server 120 can realize two-way communication, the user terminal 110 and the public terminal 130 can also realize two-way communication, and the public terminal 130 can realize one-way communication with the password server 120. The user terminal 110 can at least send the first data information to the password server 120, and the password server 120 can send the task sequence number to the user terminal 110. The user terminal 110 can send authentication information and the task sequence number to the public terminal 130. The public terminal 130 can send an initial message to the user terminal 110, and can also send at least the second data information and authentication information to the password server 120. Finally, the password server 120 generates a third key component according to the received information, wherein the third key component and the fourth key component of the public terminal 130 are used to form a time-sharing personal key.

[0059] It should be noted that in some embodiments of the present application, the user terminal 110, the password service end 120 and the public terminal 130 can communicate with each other by using a QR code, NFC (Near Field Communication), screen display or keyboard input, or by outputting the screen of a PC connected to the public terminal 130 or forwarding through a network service after encryption, etc. Among them, the user terminal 110 can be a private terminal that the user has always held, and the public terminal 130 can be a terminal device that the user is preparing to use.

[0060] The following is an example of Figure 1 The relevant functions of each unit.

[0061] In some embodiments of the present application, the user terminal 110 is at least used to: receive the initial message; generate authentication information, the authentication information being used to characterize the user's authorization credentials to use the target terminal; obtain first data information based on the first key component, the initial message and the authentication information, and at least send the first data information to the cryptographic server.

[0062] For example, in some embodiments of the present application, a user holds a personal user terminal device (that is, user terminal 110) that is always controlled by the user. The user terminal device includes a cryptographic module, which collaborates with an external cryptographic server 120 to provide the required cryptographic functions (such as digital signatures, data encryption and decryption) to support business applications and provide data integrity and confidentiality protection for related business applications. The cryptographic module can securely generate and store the user's first key component Ka1. The cryptographic server 120 can securely generate and store the second key component Ka2. The user's actual key K = λ (Ka1, Ka2), but K does not actually appear, where λ is a constant.

[0063] In some embodiments of the present application, the cryptographic service end 120 is at least used for: receiving first data information sent by a user terminal held by a user, the first data information being obtained based on a first key component of the user terminal; receiving second data information sent by a target terminal; obtaining a third key component based on the second key component, the first data information, and the second data information, wherein the third key component and the fourth key component of the target terminal are used to constitute a time-sharing personal key, and the first key component and the second key component constitute the time-sharing personal key.

[0064] For example, in some embodiments of the present application, the cryptographic service end 120 provides key management services and collaborative cryptographic computing functions to the outside, and cooperates with the user terminal 110 and the public terminal 130 to complete various required cryptographic functions. The cryptographic service end 120 supports identity authentication and establishment of a secure channel for two different terminals, and can support users to temporarily authorize the public equipment they use and revoke authorization as needed. For example, under the user's authorized operation, the cryptographic service end 120 can generate a third key component Kb2, and use it with the fourth key component Kb1 of the public terminal 130 to obtain a time-sharing personalized key K, where K = λ(Kb1, Kb2), and K also does not appear in the process. That is to say, K will not be transmitted in plain text during the communication process of the three terminals, thereby ensuring the security of the time-sharing personal key. It is not difficult to understand that K = λ(Ka1, Ka2) = λ(Kb1, Kb2).

[0065] In some embodiments of the present application, the public terminal 130 is at least used to: generate a random number and a fourth key component, and generate an initial message and a second data information based on the random number; send the initial message to the user terminal; receive authentication information sent by the user terminal; and send the second data information and the authentication information to the cryptographic server.

[0066] For example, in some embodiments of the present application, a public terminal device (that is, a public terminal 130) may be "claimed" by a specific user at a certain moment. A cryptographic module is also deployed on the public terminal device. The cryptographic module on the public terminal device supports the cryptographic module of the cryptographic service end 120 to collaborate to complete digital signatures and data encryption and decryption operations related to K, and supports reset by the user or the manager responsible for allocating the public terminal device. After reset, the cryptographic module on the public terminal device returns to the factory state. In this state, the cryptographic module on the public terminal device has nothing to do with any user and only contains the key K of the public terminal device.

[0067] The following is combined with Figure 2 The implementation process of the method for time-sharing personalized application of a public terminal executed by the cryptographic service end 120 in some embodiments of the present application is described.

[0068] Please see attached Figure 2 , Figure 2 A method flow chart of time-sharing personalized application of public terminals provided for some embodiments of the present application, the method may include: S210, receiving first data information sent by a user terminal held by a user, the first data information being obtained based on a first key component of the user terminal.

[0069] S220, receiving second data information sent by the target terminal. S230, obtaining a third key component according to the second key component, the first data information and the second data information, wherein the third key component matches with a fourth key component of the target terminal to form a time-sharing personal key, the fourth key component is generated by the target terminal according to the second data information, and the first key component matches with the second key component to form the time-sharing personal key.

[0070] The above process is explained below as an example.

[0071] In order to ensure the orderly execution of the task of generating a time-sharing personal key, in some embodiments of the present application, the method for time-sharing personalized application of a public terminal further includes: generating a task sequence number corresponding to the first data information, and sending the task sequence number to the user terminal.

[0072] For example, in some embodiments of the present application, there may be multiple tasks of generating time-sharing personal keys simultaneously in an actual application scenario, and in this case, a corresponding ID (Identity document, as a specific example of a task sequence number) needs to be generated for each task. The task sequence number may be generated based on the first data information or based on the user terminal 110.

[0073] In order to improve the security of the method, in some embodiments of the present application, the method for time-sharing personalized application of a public terminal further includes: receiving a transformation function sent by the user terminal, and receiving authentication information sent by the target terminal, wherein the authentication information is generated by the user terminal and sent to the target terminal. Among them, S230 may include: inputting the authentication information into the transformation function to obtain transformation data; performing an operation on the second key component, the first data information, the transformation data and the second data information to obtain the third key component, wherein the operation includes: at least one of modular addition, modular subtraction, modular multiplication, addition, subtraction and multiplication.

[0074] For example, in some embodiments of the present application, the authentication information can be used as a temporary authorization credential between the user terminal 110 and the public terminal 130, which is usually a string of length L. The transformation function can be a hash function or other function with a string transformation function. The transformed data can be obtained by inputting the authentication information into the transformation function. Then, a random operation is performed on the second key component, the first data information, the transformed data, and the second data information to obtain the final third key component. At least one of the above-mentioned operation methods can be used when performing random operations, and the present application does not make specific limitations here. Among them, the random operation method may include at least one of modular addition, modular subtraction, modular multiplication, addition, subtraction, and multiplication, etc. It should be understood that for the sake of simplicity of description, the present application only lists several common random operation methods, but the present application is not limited to this.

[0075] In order to improve the confidentiality and security of the key, in some embodiments of the present application, the second data information is obtained by the target terminal performing calculations on multiple random numbers generated.

[0076] In some embodiments of the present application, after executing S230, the method for time-sharing personalized application of public terminals also includes (not shown in the figure): when the target terminal is abnormal, authenticating the identity of the user; when it is confirmed that the identity authentication is passed, clearing the third key component.

[0077] For example, in some embodiments of the present application, the abnormal situation of the target terminal may be that the target terminal is damaged or lost, etc. When the public terminal 130 is damaged or lost, the user can send a message to the administrator or make a phone call to inform him. After the administrator verifies the user's identity, the third key component generated by the password service end 120 can be destroyed or cleared. Without the cooperation of the third key component, the public terminal 130 cannot perform any operation on behalf of any user, thereby effectively ensuring the security of the public terminal 130.

[0078] The following is combined with Figure 3The implementation process of the method for time-sharing personalized application of a public terminal executed by the user terminal 110 in some embodiments of the present application is described.

[0079] Please see attached Figure 3 , Figure 3 A method flow chart of a time-sharing personalized application of a public terminal provided for some embodiments of the present application, the method may include: S310, receiving an initial message sent by a target terminal. S320, generating authentication information, the authentication information being used to characterize the authorization credentials of a user to use the target terminal. S330, acquiring first data information according to a first key component, the initial message and the authentication information, and sending at least the first data information to a cryptographic service end, wherein the first key component is generated and stored by the user terminal, and the first data information is used to be processed by the cryptographic service end to generate a third key component.

[0080] For example, in some embodiments of the present application, the first data information is obtained by performing random operations on the initial message of the public terminal 130, the first key component, and the authentication information generated by itself. The first key component has been generated and stored by the password module of the user terminal 110 before executing S310. Finally, the first data information is sent to the password server 120 so that the password server 120 generates a third key component.

[0081] In order to ensure the orderly execution of the task of generating time-sharing personal keys, in some embodiments of the present application, the method of time-sharing personalized application of public terminals also includes: receiving the task number corresponding to the first data information sent by the cryptographic service end; and sending the task number and the authentication information to the target terminal.

[0082] In some embodiments of the present application, S330 may include: inputting the authentication information into a transformation function to obtain transformation information; performing operations on the first key component, the initial message and the transformation information to obtain the first data information, wherein the operations include: at least one of modular addition, modular subtraction, modular multiplication, addition, subtraction and multiplication.

[0083] For example, in some embodiments of the present application, the transformation function is Figure 2 By transforming the authentication information, the first data information with higher complexity can be obtained, thereby increasing the randomness of the generated time-sharing personal key, which has higher security and is not easy to be analyzed and obtained by irrelevant personnel.

[0084] In some embodiments of the present application, the first data information and the transformation function are sent to the cryptographic service end.

[0085] For example, in some embodiments of the present application, the transformation function can also be sent to the cryptographic server 120, so as to increase the complexity of the cryptographic calculation, ensure the complexity of the generated time-sharing personal key, and ensure high security, which is not easy to be analyzed and obtained by irrelevant personnel.

[0086] The following is combined with Figure 4 The implementation process of the method for time-sharing personalized application of a public terminal executed by the public terminal 130 in some embodiments of the present application is described.

[0087] Please see attached Figure 4 , Figure 4 A method flow chart of a time-sharing personalized application of a public terminal provided for some embodiments of the present application, the method may include: S410, generating a random number and a fourth key component, and generating an initial message and a second data information according to the random number. S420, sending the initial message to a user terminal. S430, receiving authentication information sent by the user terminal. S440, sending the second data information and the authentication information to a cryptographic service end, so that the cryptographic service end generates a third key component, wherein the third key component and the fourth key component constitute a time-sharing personal key.

[0088] For example, in some embodiments of the present application, when the user obtains the public terminal 130, the public terminal 130 can randomly generate a random key Kb1 as the fourth key component, and also generate a random number of a specified length, thereby obtaining the initial message and the second data information. Finally, the received authentication information and the second data information are sent to the cryptographic server 120, so that the cryptographic server 120 generates the third key component.

[0089] In order to ensure the orderly progress of tasks, in some embodiments of the present application, a task serial number sent by the user terminal is received; the task serial number is sent to the cryptographic server so that the cryptographic server records the third key component generation task corresponding to the task serial number.

[0090] In some embodiments of the present application, the number of the random numbers is three, wherein S410 may include: extracting two random numbers from the three random numbers for random operation to obtain the initial message and the second data information, wherein the two random numbers constitute the fourth key component.

[0091] For example, in some embodiments of the present application, the random numbers are α, β and δ, α and δ are extracted for the first time, and the initial message T1 = α + δ is obtained, and β and δ are extracted for the first time, and the second data information T2 = β - δ is obtained, wherein the fourth key component Kb1 = T1 + T2.

[0092] It should be noted that, during the collaborative cryptographic calculation process of the cryptographic server 120, the time-sharing personal key composed of the third key component and the fourth key component does not contain any random number. The random number plays a role in assisting the calculation during the collaborative cryptographic calculation process. This can increase the complexity of the collaborative cryptographic calculation, making Kb2 difficult to be used and analyzed by others, and having a higher security.

[0093] In some embodiments of the present application, after executing S440, the method for time-sharing personalized application of a public terminal further includes (not shown in the figure): receiving an operation instruction from a user of the user terminal, and clearing the fourth key component.

[0094] For example, in some embodiments of the present application, when the user no longer uses the public terminal 130, the user can implement two-factor authentication by proving that he holds K and obtaining a sequence code sent by the administrator. After the user passes the authentication, he can release the control of the public terminal 130 by clicking the "clear" operation. At this time, the password module on the public terminal 130 is reset to zero, and Kb1 and related data (such as access data) are cleared.

[0095] The following is combined with Figure 5 The interactive process of generating a time-sharing personal key by a public terminal, a user terminal and a cryptographic service end provided in some embodiments of the present application is exemplified.

[0096] Please see attached Figure 5 , Figure 5 The interactive flow chart for generating a time-sharing personal key provided for some embodiments of the present application. The specific implementation process of generating a time-sharing personal key is described below as an example. It should be noted that before executing the following method, the user terminal 110 has stored an asymmetric private key Ka1, the cryptographic service end has stored an asymmetric private key Ka2, and the user's actual private key K = Ka1 + Ka2, then the method for implementing the authorization of the public terminal 130 is as follows:

[0097] S1. The public terminal 130 generates a random number and a fourth key component, and generates an initial message and second data information according to the random number.

[0098] For example, as a specific example of the present application, the public terminal 130 can randomly generate the fourth key component Kb1, and then generate three random numbers α, β and γ. Finally, the initial message T1 = α + γ and the second data information T2 = β - γ are obtained according to the three random numbers. Among them, Kb1 = T1 + T2 = α + β.

[0099] S2. The public terminal 130 sends an initial message to the user terminal 110.

[0100] For example, as a specific example of the present application, the public terminal 130 sends T1 to the password module on the user terminal 110 by scanning a QR code or the user inputting a serial number in the public terminal 130 .

[0101] S3. After receiving the initial message, the user terminal 110 generates authentication information.

[0102] For example, as a specific example of the present application, the user terminal 110 obtains authentication information M by generating a random number or manually inputting it, where M can be a character string with a length of L.

[0103] S4. The user terminal 110 obtains first data information according to the first key component, the initial message and the authentication information.

[0104] For example, as a specific example of the present application, M is deformed and input into the transformation function f() to obtain f(M) = R. Then, the first data information T3 = Ka1 - T1 + R is calculated.

[0105] S5. The user terminal 110 sends the first data information and the transformation function to the cryptographic service end 120.

[0106] For example, as a specific example of the present application, T3 and f() are transmitted to the cryptographic service end 120 .

[0107] S6. After receiving the first data information and the transformation function, the cryptographic server 120 generates a task sequence number and sends it to the user terminal 110.

[0108] For example, as a specific example of the present application, after the cryptographic server 120 authenticates the user identity (for example, the cryptographic server 120 confirms that the user terminal 110 holds a first key component that matches the second key component), it generates an ID for the task of generating the third key component as the authorized task number and sends it to the user terminal 110.

[0109] S7. After receiving the task sequence number, the user terminal 110 sends the task sequence number and authentication information to the public terminal 130.

[0110] For example, as a specific example of the present application, M and ID are sent to the public terminal 130 .

[0111] S8. The public terminal 130 sends the second data information, authentication information and task sequence number to the cryptographic service terminal 120.

[0112] For example, as a specific example of the present application, the public terminal 130 sends T2, M and ID to the password service end 120.

[0113] S9. The cryptographic server 120 generates a third key component after receiving the second data information, the authentication information and the task sequence number.

[0114] For example, as a specific example of the present application, the cryptographic server 120 may calculate the received first data information, second data information, authentication information, transformation function, and second key component to obtain a third key component:

[0115] T4=Kb2=Ka2+T3-T2-f(M)=Ka2+Ka1-(α+γ)-(β-γ)=(Ka2+Ka1)-Kb1, let T4=Kb2, at this time, Kb1+Kb2=Ka1+Ka2=K is satisfied. T4 is stored in the cryptographic service end 120 as a key component of the time-sharing personal key. Among them, the third key component and the fourth key component of the public terminal 130 together constitute the collaborative key (that is, the time-sharing personal key). At this time, the public terminal 130 can be temporarily used by the user according to the above internal strategy. The public terminal 130 holds a certain share Kb1 of K, and can complete the cryptographic operation together with Kb2 of the cryptographic service end.

[0116] It should be noted that the above-mentioned methods of sending data can all be QR code, NFC, screen display or keyboard input, and can also be output through the screen of a PC connected to the public terminal 130 or forwarded through a network service after encryption.

[0117] In addition, it should be noted that in the above steps, "+" is used to simply illustrate the process of authorizing the public terminal 130 to be used in a time-sharing manner to the user, but in fact, not only addition can be used, but also modular addition, subtraction, modular subtraction, multiplication, modular multiplication and other similar methods of finite fields can be used, that is, λ(Ka1, Ka2) = λ(Kb1, Kb2), and the specific methods used are consistent with the collaborative mechanism in the user's actual private key.

[0118] In summary, in some embodiments of the present application, the cryptographic service end 120 can provide services related to "personalization of public terminal 130" and collaborative cryptographic computing services in addition to ensuring general identity verification, identity authentication, secure communication, and log auditing. The cryptographic module on the personal dedicated device (that is, the user terminal) needs to support the above-mentioned method to implement the operation process in addition to ensuring the security of sensitive data storage, operator identity authentication, and secure communication, and supports collaborative cryptographic computing with the key service end 120. The cryptographic module on the public terminal 130 needs to support initialization and reset (that is, clear key operations) in addition to ensuring the security of sensitive data storage, operator identity authentication, and secure communication, and supports cryptographic module initialization according to the above-mentioned process, supports collaborative cryptographic computing with the key service end 120, supports clearing according to policies and user wishes, and clears all personalized data and key information of historical users.

[0119] It is not difficult to understand that some embodiments provided by the present application can allow users to authorize the password service end 120 to complete the password operations they need only when they obtain the operation control right of the public terminal 130. The user can terminate the authorization manually or automatically. After the authorization is terminated, the public terminal 130 cannot perform password operations for the user. The password operations performed by the user at the public terminal 130 are consistent with the operation effects of using a personal dedicated device. For example, the electronic signature performed using the public terminal 130 is consistent with the signature performed by a personal dedicated device that is completely controlled by the individual, and both can be verified using a digital certificate obtained by the user from a third party. The key and password mechanism performed by the password module in the public terminal 130 cannot guess and analyze the key held by the user, and the security is relatively high.

[0120] Please refer to Figure 6 , Figure 6 The following is a block diagram showing the composition of the password server provided by some embodiments of the present application. It should be understood that the password server is similar to the above-mentioned Figure 2 Corresponding to the method embodiment, it is able to execute each step involved in the above method embodiment. The specific functions of the password server can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0121] Figure 6The cryptographic server includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the cryptographic server, and the cryptographic server includes: a first receiving module 610, configured to receive first data information sent by a user terminal held by a user, wherein the first data information is obtained based on a first key component of the user terminal; a second receiving module 620, configured to receive second data information sent by a target terminal; a key generation module 630, configured to obtain a third key component based on the second key component, the first data information and the second data information, wherein the third key component matches with the fourth key component of the target terminal to form a time-sharing personal key, the fourth key component is generated by the target terminal according to the second data information, and the first key component matches with the second key component to form the time-sharing personal key.

[0122] Please refer to Figure 7 , Figure 7 FIG. 1 shows a block diagram of a user terminal provided by some embodiments of the present application. It should be understood that the user terminal is similar to the above-mentioned Figure 3 Corresponding to the method embodiment, the user terminal can execute each step involved in the above method embodiment. The specific functions of the user terminal can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0123] Figure 7 The user terminal includes at least one software function module that can be stored in a memory or fixed in the user terminal in the form of software or firmware, and the user terminal includes: a receiving module, configured to receive an initial message sent by a target terminal; an information generating module, configured to generate authentication information, the authentication information is used to represent the authorization credentials of the user to use the target terminal; an information sending module, configured to obtain first data information according to a first key component, the initial message and the authentication information, and at least send the first data information to a cryptographic server, wherein the first key component is generated and stored by the user terminal, and the first data information is used to be processed by the cryptographic server to generate a third key component.

[0124] Please refer to Figure 8 , Figure 8 FIG. 1 shows a block diagram of a target terminal provided by some embodiments of the present application. It should be understood that the target terminal is similar to the above Figure 4 Corresponding to the method embodiment, each step involved in the above method embodiment can be executed. The specific functions of the target terminal can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0125] Figure 8The target terminal includes at least one software function module that can be stored in the memory or fixed in the target terminal in the form of software or firmware, and the target terminal includes: a generation module 810, configured to generate a random number and a fourth key component, and generate an initial message and a second data information according to the random number; a first sending module 820, configured to send the initial message to the user terminal; a receiving module, configured to receive the authentication information sent by the user terminal; a second sending module 830, configured to send the second data information and the authentication information to the cryptographic server, so that the cryptographic server generates a third key component, wherein the third key component and the fourth key component constitute a time-sharing personal key.

[0126] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the cryptographic server, user terminal and target terminal described above can refer to the corresponding processes in the aforementioned method and will not be elaborated here.

[0127] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0128] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0129] like Fig. 9 As shown, some embodiments of the present application provide an electronic device 900, which includes: a memory 910, a processor 920, and a computer program stored in the memory 910 and executable on the processor 920, wherein the processor 920 can implement a method as described in any of the above embodiments when reading the program from the memory 910 through a bus 930 and executing the program.

[0130] Processor 920 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 920 can be a microprocessor.

[0131] The memory 910 may be used to store instructions executed by the processor 920 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 920 of the disclosed embodiment may be used to execute instructions in the memory 910 to implement the method shown above. The memory 910 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0132] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0133] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0134] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for time-sharing personalized application of a target terminal, characterized in that: Applied to password servers, including: Receiving first data information sent by a user terminal held by a user, where the first data information is obtained based on a first key component of the user terminal; receiving second data information sent by the target terminal; A third key component is obtained according to the second key component, the first data information and the second data information, wherein the third key component is matched with the fourth key component of the target terminal to obtain a time-sharing personal key, the fourth key component is generated by the target terminal according to the second data information, and the first key component is matched with the second key component to obtain the time-sharing personal key.

2. The method according to claim 1, characterized in that The method further comprises: Generate a task sequence number corresponding to the first data information, and send the task sequence number to the user terminal.

3. The method according to claim 1 or 2, characterized in that The method further comprises: receiving a transformation function sent by the user terminal, and receiving authentication information sent by the target terminal, wherein the authentication information is generated by the user terminal and sent to the target terminal; Obtaining a third key component according to the second key component, the first data information, and the second data information, including: Inputting the authentication information into the transformation function to obtain transformation data; An operation is performed on the second key component, the first data information, the transformed data and the second data information to obtain the third key component, wherein the operation includes at least one of modular addition, modular subtraction, modular multiplication, addition, subtraction and multiplication.

4. The method according to claim 1 or 2, characterized in that: The second data information is obtained by the target terminal performing calculations on a plurality of generated random numbers.

5. The method according to claim 1 or 2, characterized in that: After obtaining the third key component according to the second key component, the first data information and the second data information, the method further includes: When the target terminal is abnormal, identifying the identity of the user; When it is confirmed that the identity authentication is passed, the third key component is cleared.

6. A method for time-sharing personalized application of a target terminal, characterized in that: Applied to user terminals, including: Receive an initial message sent by a target terminal; Generate authentication information, the authentication information is used to represent the user's authorization credentials to use the target terminal; According to the first key component, the initial message and the authentication information, first data information is obtained, and at least the first data information is sent to the cryptographic server, wherein the first key component is generated and stored by the user terminal, and the first data information is used to be processed by the cryptographic server in combination with the second key component of the cryptographic server and the second data information of the target terminal to generate a third key component; wherein the third key component is matched with the fourth key component of the target terminal to calculate a time-sharing personal key, the fourth key component is generated by the target terminal according to the second data information, and the first key component is matched with the second key component to calculate the time-sharing personal key.

7. The method according to claim 6, characterized in that The method further comprises: Receiving a task sequence number corresponding to the first data information sent by the cryptographic service end; The task sequence number and the authentication information are sent to the target terminal.

8. The method according to claim 6 or 7, characterized in that The acquiring the first data information according to the first key component, the initial message and the authentication information includes: Inputting the authentication information into a transformation function to obtain transformation information; An operation is performed on the first key component, the initial message and the transformed information to obtain the first data information, wherein the operation includes at least one of modular addition, modular subtraction, modular multiplication, addition, subtraction and multiplication.

9. The method according to claim 8, characterized in that The at least sending the first data information to the password service end includes: The first data information and the transformation function are sent to the cryptographic service end.

10. A method for time-sharing personalized application of a target terminal, characterized in that: Applied to target terminals, including: Generate a random number and a fourth key component, and generate an initial message and a second data information according to the random number; Sending the initial message to a user terminal so that the user terminal generates authentication information, and acquiring first data information according to the first key component, the initial message and the authentication information; Receiving authentication information sent by the user terminal; The second data information and the authentication information are sent to a cryptographic server, so that the cryptographic server generates a third key component according to the second key component of the cryptographic server, the first data information and the second data information, wherein the third key component is matched with the fourth key component to calculate a time-sharing personal key.

11. The method according to claim 10, characterized in that The method further comprises: Receiving a task sequence number sent by the user terminal; The task serial number is sent to the cryptographic server so that the cryptographic server records the third key component generation task corresponding to the task serial number.

12. The method according to claim 10 or 11, characterized in that The number of the random numbers is three, wherein generating the initial message and the second data information according to the random numbers includes: Two random numbers are extracted from the three random numbers for random operation to obtain the initial message and the second data information, wherein the two random numbers constitute the fourth key component.

13. The method according to claim 10 or 11, characterized in that: After sending the second data information and the authentication information to the password service end, the method further includes: An operation instruction from a user of the user terminal is received to clear the fourth key component.

14. A system for time-sharing personalized applications of target terminals, characterized in that: include: A target terminal, configured to generate a random number and a fourth key component, and to generate an initial message and a second data information according to the random number; Sending the initial message to a user terminal; Receiving authentication information sent by the user terminal; Sending the second data information and the authentication information to a password service end; The user terminal is used to receive the initial message; Generate authentication information, the authentication information is used to represent the user's authorization credentials to use the target terminal; Acquire first data information according to the first key component, the initial message and the authentication information, and send at least the first data information to the cryptographic service end; A cryptographic service end, configured to receive the first data information sent by the user terminal held by the user, wherein the first data information is obtained based on the first key component of the user terminal; and receive the second data information sent by the target terminal; A third key component is obtained according to the second key component, the first data information and the second data information, wherein the third key component is matched with the fourth key component of the target terminal to obtain a time-sharing personal key, the fourth key component is generated by the target terminal according to the second data information, and the first key component is matched with the second key component to obtain the time-sharing personal key.

15. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 13 when being run by the processor.

Images