A trusted network communication method and apparatus

Abstract

The application provides a trusted network communication method and device, which are used for communication between a trusted network communication device and an application terminal. The method comprises the following steps: storing a user PIN code and a user digital certificate; when the trusted network communication device is connected with the application terminal, authenticating a user private key authority by using the user PIN code, and providing a trusted password calculation by using the trusted network communication device after successful authentication; and realizing trusted network communication between the trusted network communication device and the application terminal by using a network protocol stack. The trusted terminal password calculation and network communication device can be moved or carried. The physical trusted calculation device outside a physical calculation environment of an application provides a secure password basic calculation service and a secure network communication service for the application, and is not limited by a fixed application running environment.

Description

Technical Field

[0001] This invention relates to the field of trusted computing, and more specifically to a trusted network communication method and apparatus. Background Technology

[0002] Since 1999, the IT industry has had an organization called TCPA (Trusted Computing Platform Alliance), initiated by Intel, IBM, HP, Microsoft, and Compaq, to ​​promote the construction of a trustworthy computing environment.

[0003] As early as 2000, my country began to pay attention to trusted computing and initiated projects and research. Unlike other countries, my country's approach to trusted computing was a leapfrog development: first introducing technology, then conducting independent research and development; first productization, then standardization. In 2004, Wuhan Ruida produced China's first TPM (Trusted Product Manager), followed by Lenovo, Great Wall, and others producing trusted PCs based on TPMs. In January 2005, the National Information Security Standardization Technical Committee established the Trusted Computing Working Group (WGI), which subsequently developed and formulated several standards and specifications, including Trusted Cryptographic Modules (TCMs), Trusted Motherboards, and Trusted Network Connections. A series of trusted computing products emerged in my country.

[0004] However, a large number of PC devices are currently outdated, and these devices generally lack security chips. In high-security scenarios, the computing environment for applications cannot be guaranteed to be secure and trustworthy, posing a risk. Furthermore, replacing these devices would require significant financial investment, resulting in wasted resources. For example, upgrading to Windows 11 requires the CPU to have a TPM module, making it impossible for many devices to upgrade to this system. On the other hand, in the security field, autonomy and control are essential; the key to security must be in our own hands. Summary of the Invention

[0005] This application aims to provide a trusted network communication method and apparatus, which provides secure cryptographic computing services and secure network communication services to applications through a mobile / portable trusted terminal cryptographic computing and network communication device, outside the physical computing environment in which the application runs, and is not limited by a fixed application running environment.

[0006] According to one aspect of this application, a trusted network communication method is proposed for communication between a trusted network communication device and an application terminal, the method comprising:

[0007] Store user PIN codes and user digital certificates;

[0008] When the trusted network communication device connects to the application terminal, it authenticates the user's private key permissions through the user's PIN code. After successful authentication, it provides trusted password calculation through the trusted network communication device.

[0009] The trusted network communication device and the application terminal are made possible through the network protocol stack.

[0010] According to some embodiments, the method includes:

[0011] The storage of user PIN codes and user digital certificates includes:

[0012] Create and store the user's SM2 key pair, which includes a signing key pair and an encryption key pair. The signing key pair includes a signing private key, and the encryption key pair includes an encryption private key.

[0013] According to some embodiments, the method includes:

[0014] The storage of user PIN codes and user digital certificates also includes:

[0015] Obtain and store the user's self-signed public key certificate or a public key certificate issued by a trusted third-party certificate authority.

[0016] According to some embodiments, the method includes:

[0017] When the trusted network communication device connects to the application terminal, it authenticates the user's private key permissions. After successful authentication, it provides trusted password calculation through the trusted network communication device, including:

[0018] The user is prompted to enter a PIN code.

[0019] After the user enters the correct PIN code, the user's signature private key and the data to be signed are used as input parameters for password calculation.

[0020] According to some embodiments, the method includes:

[0021] When the trusted network communication device connects to the application terminal, it authenticates the user's private key permissions. After successful authentication, it provides trusted password calculation through the trusted network communication device, including:

[0022] The user is prompted to enter a PIN code.

[0023] After the user enters the correct PIN code, the user's encrypted private key and the data to be decrypted are used as input parameters for password calculation.

[0024] According to some embodiments, the method includes:

[0025] The method of enabling trusted network communication of the application terminal through a network protocol stack includes:

[0026] The network protocol stack of the trusted network communication device uses the key pair and the public key certificate to establish a Chinese national cryptographic SSL two-way authentication with the application server.

[0027] According to some embodiments, the method includes:

[0028] The method of enabling trusted network communication of the application terminal through a network protocol stack includes:

[0029] The data to be sent is placed into the network protocol stack of the trusted network communication device;

[0030] The data to be sent is transmitted through the input interface of the trusted network communication device to the national cryptographic SSL protocol stack of the trusted network communication device.

[0031] The data to be sent is sent to the application server through the national cryptographic SSL protocol stack.

[0032] According to some embodiments, the method includes:

[0033] The method of enabling trusted network communication of the application terminal through the network protocol stack further includes:

[0034] The data received from the application server is sent from the output interface of the trusted network communication device to the network protocol stack via the national cryptographic SSL protocol stack.

[0035] The received data is returned to the application terminal via the network protocol stack.

[0036] According to some embodiments, the method further includes:

[0037] A two-level PIN code mechanism is used to protect the user key and achieve secure key storage, including: dividing the PIN code into a user PIN code and a device PIN code, wherein the device PIN code corresponds to the serial number of the trusted network communication device and is stored in the secure storage area of ​​the trusted network communication device;

[0038] The device PIN code is used as the SM4 algorithm key to encrypt the user PIN code, and the encrypted user PIN code is stored in the secure storage area of ​​the trusted network communication device.

[0039] The user's PIN code is used as the SM4 algorithm key to encrypt the SM2 private key in the user's SM2 key pair, and then stored in the secure storage area of ​​the trusted network communication device.

[0040] According to some embodiments, the method further includes:

[0041] When a user needs to use the private key, they need to enter the user's PIN code to unlock the user's SM2 private key;

[0042] When a user forgets their PIN code, the user's PIN code is decrypted using the device PIN code, and then the user's SM2 private key is decrypted using the user's PIN code. The SM2 private key is then encrypted using a new user PIN code, and the new user PIN code is encrypted using the device PIN code and stored in the secure storage area of ​​the trusted network communication device.

[0043] According to another aspect of this application, a trusted network communication device is provided for connecting to the application terminal to implement a trusted network communication method, comprising:

[0044] A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method described in any one of the above methods.

[0045] According to another aspect of this application, a computer program product is provided, comprising a computer program or instructions that, when executed by a processor, implement the method described in any one of the above methods.

[0046] According to the example embodiments of this application, the user's identity is authenticated and the required trusted password calculation is provided through a mobile / portable trusted cryptographic service or network communication device. Then, when there is a need for network communication, trusted network communication is achieved through its own network protocol stack.

[0047] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below.

[0049] Figure 1 A flowchart illustrating a trusted network communication method according to an example embodiment of this application is shown.

[0050] Figure 2 A schematic diagram illustrating the trusted network topology according to an example embodiment of this application is shown.

[0051] Figure 3 A flowchart illustrating network communication and trusted communication according to an example embodiment of this application is shown.

[0052] Figure 4A comparison diagram is shown between existing network communication methods and communication methods using this device, based on example embodiments of this application.

[0053] Figure 5 A schematic diagram illustrating user key protection according to an example embodiment of this application is shown.

[0054] Figure 6 A block diagram of a trusted network communication apparatus according to an example embodiment of this application is shown. Detailed Implementation

[0055] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this application will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0056] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0057] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0058] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0059] It should be understood that although the terms first, second, third, etc., may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another. Therefore, the first component discussed below may be referred to as the second component without departing from the teachings of this application. As used herein, the term "and / or" includes all combinations of any one and more of the associated listed items.

[0060] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of exemplary embodiments, and the modules or processes in the drawings are not necessarily essential for implementing this application, and therefore cannot be used to limit the scope of protection of this application.

[0061] No relevant solutions have been found in existing technologies. Currently, the solutions and products on the market are all based on the Trusted Computing Platform (TCP Trusted Computing Platform) using the Trusted Cryptography Module (TCMT). This technology requires tight coupling with the application's runtime environment, meaning the application is anchored to the device. If additional devices are needed in the future, they must be consistent with or compatible with the previously anchored devices, which imposes significant constraints.

[0062] The network communication of applications also mainly relies on the network protocol stack in the original computing environment, which is also exposed to an untrusted threat environment, posing security risks.

[0063] This invention primarily addresses the challenge of integrating applications with trusted computing environments. In real-world scenarios, a large number of outdated terminal devices lack trusted computing modules such as TCM (Trusted Computing Modules). Complete replacement would require substantial funds, resulting in unnecessary resource waste. Newly purchased, compliant devices may encounter TCM compatibility issues during subsequent expansion, and applications may need to be adapted for them.

[0064] When it comes to network communication, the application layer runtime environment needs to check the network trust environment or require developers to have a high level of industry knowledge in security. However, it is difficult to meet these requirements in reality, which expands the attack surface and creates security risks.

[0065] This invention authenticates the user's identity and provides the necessary trusted cryptographic calculations through a mobile / portable trusted cryptographic service or network communication device. Then, when network communication is required, it achieves trusted network communication through its own network protocol stack. Combined with national cryptographic digital certificate authentication technology, it can avoid device theft in high-security scenarios, thus meeting the application's requirements for trusted cryptographic calculations and trusted network communication.

[0066] This invention decouples cryptographic computing services from network communication and application running devices through a mobile / portable approach, thereby enhancing the ease of use and versatility of combining trusted computing environments with applications.

[0067] The terminology used in this invention is as follows.

[0068] SSL (Secure Socket Layer): SSL sits between the TCP / IP protocol and various application layer protocols, providing security support for data communication. The SSL protocol can be divided into two layers: SSL Record Protocol: Built on top of a reliable transport protocol (such as TCP), it provides support for basic functions such as data encapsulation, compression, and encryption for higher-level protocols. SSL Handshake Protocol: Built on top of the SSL Record Protocol, it is used for authentication, encryption algorithm negotiation, and key exchange between communicating parties before actual data transmission begins.

[0069] TCM (Trusted Cryptography Module): This is a hardware module of the trusted computing platform that provides cryptographic operation functions for the trusted computing platform.

[0070] TCP (Trusted Computing Platform): This approach ensures the security of the platform and the distributed applications running on it through a certain level of hardware security. There are two main implementation methods: a security coprocessor (which is independent of the main processor and responsible for secure computation); and a trusted platform module.

[0071] PIN (Personal Identification Number): Originating from telecommunications terminology, it originally referred to a personal SIM card identification password, but now it generally refers to a password that a device needs to use to identify an individual.

[0072] SM2 (SM2 Cryptographic Algorithm): The SM2 cryptographic algorithm is an elliptic curve cryptography algorithm defined in GB / T 32918. Its key length is 256 bits and it is published by the State Cryptography Administration.

[0073] SM4 (SM4 Algorithm): The SM4 cryptographic algorithm is a block cipher algorithm with a block length of 128 bits and a key length of 128 bits. It is a block cipher algorithm defined in GB / T32907 and issued by the State Cryptography Administration.

[0074] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application.

[0075] Figure 1 A flowchart illustrating a trusted network communication method according to an example embodiment of this application is shown.

[0076] See Figure 1 In S101, the user's PIN code and user digital certificate are stored.

[0077] This application provides a portable and easily movable external device, which can be called a trusted network communication device. It converts a communication protocol stack (such as USB) into a device protocol and ensures the security and trustworthiness of cryptographic computation, key storage, and network communication according to the application's business requirements.

[0078] During initialization, this device requires the user to fill in information to generate a certificate request. It then issues a personal certificate with the help of a third-party certificate authority. Through digital certificate technology, the user can be identified, giving the device an identity verification function. Applications can use this function to implement related auditing functions.

[0079] According to some embodiments, the primary purpose of initializing the trusted network communication device itself is to create a personal signature key pair (e.g., SM2) and an encryption key pair (e.g., SM2), set a PIN code for using the internal private key, and obtain a self-signed or third-party trusted certificate authority-issued public key certificate. In other words, the mobile device is bound to the user and can be carried by the user, solving the problem of current devices being tightly coupled to hardware, requiring the entire initialization and key pair creation process to be repeated when replacing the device.

[0080] The initialization process of a trusted network communication device mainly includes: setting a user PIN code and applying for and importing a personal certificate. The specific process may include the following steps.

[0081] Step A: The user initializes the device through the terminal management program and enters the user PIN code as prompted. This PIN code serves as the authentication code for the signature private key and the encryption private key. At the same time, the user sets the PIN code retrieval security question and answer.

[0082] Step B: The user creates an SM2 key pair through the device's terminal management program and chooses whether the device generates a self-signed certificate (skip to step C) or the certificate is issued by a third-party trusted certificate authority (skip to step D).

[0083] Step C: The user selects a self-signed certificate, which is then issued by the device itself as a public key certificate. The certificate can be downloaded through the device's terminal management program as needed, and the process ends.

[0084] Step D: The user selects a third-party trusted certificate authority to issue the certificate. The device generates a certificate request and downloads it as a file. The user submits this file to the third-party trusted certificate authority to issue a public key certificate.

[0085] Step E: The user imports the public key certificate issued by the third-party trusted certificate authority into the device for storage through the device's terminal management program. The certificate can be downloaded as needed later, and the process ends.

[0086] By leveraging the device's portability and the user's PIN code mechanism and digital certificate system, a one-to-one binding between the device and the user's identity can be achieved, further enhancing the credibility of the auditing function.

[0087] In S103, when the trusted network communication device is connected to the application terminal, the user's private key permissions are authenticated through the user PIN code, and after successful authentication, trusted password calculation is provided through the trusted network communication device.

[0088] The PIN code, as an SM4 key, is used to authenticate the user's private key and protect it; the user needs to enter the PIN code when calculating the private key password.

[0089] According to some embodiments, the application can establish a connection with the trusted network communication device by installing the trusted network communication terminal SDK; and then call the required cryptographic operation API through the device terminal SDK.

[0090] Password calculation and result retrieval are only performed after the user enters the correct PIN code. Trusted password calculation includes signature calculation and decryption calculation. For example, the terminal SDK pops up a PIN code interface, prompting the user to enter the PIN code. After successful PIN code authentication, during signature calculation, the trusted network communication device uses the user's signing private key and the data to be signed as input parameters to perform password calculation and outputs the signed data. During decryption calculation, the device uses the user's encryption private key and the data to be decrypted as input parameters to perform password calculation and outputs the decrypted original data.

[0091] Trusted network communication devices perform cryptographic computations in a trusted computing environment outside of the application's running and computing environment. This prevents potential threat programs in the untrusted computing environment from tracking the cryptographic algorithm and obtaining the algorithm key, thus reducing the attack surface and improving endpoint security.

[0092] In S105, trusted network communication between the trusted network communication device and the application terminal is achieved through the network protocol stack.

[0093] According to some embodiments, a trusted network communication device uses an SM2 key pair and a public key certificate to establish a Chinese national cryptographic SSL two-way authentication with the application server via its network protocol stack. This authentication is based on the Chinese national cryptographic SSL two-way protocol for user identity verification. It may include the following process.

[0094] The application client and the application server confirm the symmetric encryption algorithm;

[0095] The application server sends its public key certificate to the application client, and the client verifies the validity of the certificate.

[0096] The application client generates a symmetric key and signs it with the client's private key (which is the signing private key in the device, so the user will be prompted to enter a PIN code here) and encrypts it with the server's public key. Then, it sends the client's public key certificate (which is the signing public key certificate in the device) to the application server.

[0097] The application server verifies the public key certificate (which is to authenticate the user's identity) and decrypts and verifies the signature using the symmetric key. After successful authentication, the communication data is encrypted using the symmetric key and the corresponding symmetric cryptographic algorithm to establish trusted network communication.

[0098] According to some embodiments, the application client enables network communication function through the device terminal SDK; the terminal SDK pops up a PIN code interface, prompting the user to enter the PIN code; after the user enters the correct PIN code, the network communication module uses its own network protocol stack to establish a communication channel with the application server using the user's SM2 private key and public key certificate, that is, using a communication channel with SSL two-way authentication recognized by the State Cryptography Administration.

[0099] According to some embodiments, after a trusted communication channel is established, the application client can call the network protocol stack provided by the device terminal-side SDK to put the network data to be sent into the stack; the device terminal-side SDK sends the data to be sent to the national cryptographic SSL protocol stack in the device through the device's input interface; the national cryptographic SSL protocol stack sends the received return data to the network protocol stack in the device terminal-side SDK through the device's output interface; the network protocol stack in the device terminal-side SDK returns the received data to the application client.

[0100] The above process enables encryption protection of the entire data channel, and the built-in network communication protocol stack of the trusted network communication device avoids threat attacks in untrusted computing environments.

[0101] Figure 2 A schematic diagram illustrating the trusted network topology according to an example embodiment of this application is shown.

[0102] See Figure 2 The authentication module's role is to provide authentication services when a user uses the internal key of a trusted network communication device (i.e., the mobile / portable trusted cryptographic service & network service device in the diagram), specifically through PIN code authentication. After successful authentication, cryptographic operations can be performed using the device's internal key (e.g., the SM2 private key).

[0103] Applications can be C / S or B / S architectures. In the case of a C / S architecture application, the application on the left can be understood as the client and the application on the right as the server. In the case of a B / S architecture application, the application on the left can be understood as a web application in a browser and the application on the right as a web server.

[0104] The application establishes a connection with the trusted network communication device through the device terminal SDK and calls the necessary cryptographic operation APIs through the device terminal SDK. If the cryptographic calculation involves the device's internal key, the terminal SDK will display a PIN code interface, prompting the user to enter a PIN code. Only after the user enters the correct PIN code can the cryptographic calculation be performed and the result obtained; otherwise, an error message will be displayed and the process will end.

[0105] After successful PIN code authentication, the network communication module of the trusted network communication device uses the user's SM2 private key and public key certificate to establish a two-way SSL authentication with the application server through its own network protocol stack.

[0106] Figure 3 A flowchart illustrating network communication and trusted communication according to an example embodiment of this application is shown.

[0107] See Figure 3 The trusted channel establishment process and trusted communication process between trusted network communication devices and application terminals are as follows.

[0108] The application enables network communication functions through the device terminal SDK.

[0109] The terminal SDK displays a PIN code interface, prompting the user to enter a PIN code. PIN codes can be cached to avoid requiring users to enter them every time. After the user enters a correct PIN code, it is cached for a certain period, during which time the user does not need to enter the PIN code again.

[0110] After the user enters the correct PIN code, the network communication module uses the user's private key and public key certificate to establish a two-way SSL authentication channel with the application server through its own network protocol stack.

[0111] The application calls the network protocol stack provided by the device terminal SDK and puts the network data to be sent into the stack.

[0112] The device terminal SDK sends the data to be sent to the national cryptographic SSL protocol stack in the device through the device's input interface, and then sends it to the application server.

[0113] The Chinese national cryptographic SSL protocol stack sends the returned data received from the application server to the network protocol stack in the device terminal SDK through the device's output interface.

[0114] The network protocol stack in the device terminal SDK returns the received data to the application terminal.

[0115] The communication method after using this device is compared with the existing network communication method, for example... Figure 4 As shown.

[0116] This device uses a built-in network communication protocol stack to package network data from applications and relies on built-in algorithm services to complete the handshake and communication of the national cryptographic SSL protocol. It establishes a secure and reliable encrypted communication tunnel with the application server, preventing potential threats in untrusted computing environments from tracking the national cryptographic SSL protocol and sniffing communication data.

[0117] Figure 5 A schematic diagram illustrating user key protection according to an example embodiment of this application is shown.

[0118] See Figure 5 The PIN code can be divided into a user PIN code and a device PIN code. The device PIN code corresponds one-to-one with the device serial number and is stored in a secure storage area within the device, backed up and stored by the device manufacturer at the factory. The device PIN code is used as the SM4 algorithm key to encrypt the user PIN code, and the encrypted user PIN code is stored in the device's secure storage area.

[0119] The user PIN code can be used as the SM4 algorithm key to encrypt and store the SM2 private key generated during user registration. When the user needs to use the private key, they need to enter the PIN code to decrypt their personal SM2 private key.

[0120] When a user forgets their PIN code, they can reset it using the device PIN code. This involves decrypting the user's PIN code using the device PIN code, then decrypting the user's SM2 private key using the user's PIN code, encrypting the SM2 private key with the new user PIN code, and finally encrypting the new user PIN code with the device PIN code.

[0121] This device ensures that the key is not leaked by securely storing it in a trusted computing environment outside the application's running and computing environment, and effectively prevents the device from being stolen by using the device's PIN code for access control.

[0122] A two-level PIN code mechanism is used to protect the user's SM2 key, which realizes the secure storage of the key. At the same time, it can support the modification and retrieval of the PIN. The use of the national cryptographic dual digital certificate system can maximize the protection of the retrieval of application encrypted business data.

[0123] This invention allows cryptographic operations to always be performed in a trusted computing environment, reducing the terminal's reliance on the built-in TCM hardware module and consequently lowering terminal procurement costs. Through the network communication protocol stack implemented within the device, it effectively reduces the threat software sniffing in untrusted computing environments, narrowing the attack surface and improving network communication security. Furthermore, leveraging the device's portability and the user's PIN code mechanism and digital certificate system, a one-to-one binding between the device and the user's identity can be achieved, further enhancing the reliability of the auditing function. In summary, this device can effectively improve the cryptographic security of application systems on the terminal side at a relatively low cost.

[0124] It should be clearly understood that this application describes how specific examples are formed and used, but this application is not limited to any details of these examples. Rather, based on the teachings of the disclosure of this application, these principles can be applied to many other embodiments.

[0125] Those skilled in the art will understand that all or part of the steps of the above embodiments are implemented as a computer program executed by a CPU. When the computer program is executed by the CPU, the program that performs the functions defined by the methods provided in this application can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk.

[0126] Furthermore, it should be noted that the above figures are merely illustrative representations of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0127] From the description of the example embodiments, those skilled in the art will readily understand that the trusted network communication method according to the embodiments of this application has at least one or more of the following advantages.

[0128] According to the example embodiment, by providing a trusted computing environment for cryptographic operations through an external mobile / portable trusted computing environment device on the terminal side computing environment, the reliance on the built-in TCM hardware module on the terminal side is reduced.

[0129] According to the example embodiment, through the network protocol stack built into the external mobile / portable trusted computing environment device, the handshake and communication steps of the national cryptographic SSL protocol are all carried out in the trusted computing environment, which reduces the possibility of malicious program sniffing and protects communication security.

[0130] According to the example implementation, a two-level PIN code mechanism is used to protect the user's SM2 key, which realizes the secure storage of the key. At the same time, it can support the modification and retrieval of the PIN. The use of the national cryptographic dual digital certificate system can maximize the protection of the retrieval of application encrypted business data.

[0131] Figure 6 A block diagram of a trusted network communication apparatus according to an example embodiment of this application is shown.

[0132] The device performs functions similar to those described above; other functions are described in the preceding descriptions and will not be repeated here.

[0133] The following reference Figure 6 To describe an electronic device 200 according to this embodiment of the present application. Figure 6 The electronic device 200 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0134] like Figure 6 As shown, the electronic device 200 is presented in the form of a general-purpose computing device. The components of the electronic device 200 may include, but are not limited to: at least one processing unit 210, at least one storage unit 220, a bus 230 connecting different system components (including storage unit 220 and processing unit 210), a display unit 240, etc.

[0135] The storage unit stores program code, which can be executed by the processing unit 210, causing the processing unit 210 to perform the methods described in this specification according to various exemplary embodiments of this application.

[0136] Storage unit 220 may include readable media in the form of volatile storage units, such as random access memory (RAM) 2201 and / or cache memory 2202, and may further include read-only memory (ROM) 2203.

[0137] Storage unit 220 may also include a program / utility 2204 having a set (at least one) program module 2205, such program module 2205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0138] Bus 230 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0139] Electronic device 200 can also communicate with one or more external devices 300 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 200, and / or with any device that enables electronic device 200 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 250. Furthermore, electronic device 200 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 260. Network adapter 260 can communicate with other modules of electronic device 200 via bus 230. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 200, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0140] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. The technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the methods described above according to the embodiments of this application.

[0141] Software products may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example,, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0142] Computer-readable storage media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable storage medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0143] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0144] Those skilled in the art will understand that the above modules can be distributed in the device as described in the embodiments, or they can be modified accordingly and placed in one or more devices that are unique to this embodiment. The modules in the above embodiments can be combined into one module, or they can be further divided into multiple sub-modules.

[0145] Exemplary embodiments of this application have been specifically shown and described above. It should be understood that this application is not limited to the detailed structures, arrangements, or implementation methods described herein; rather, this application is intended to cover various modifications and equivalent arrangements contained within the spirit and scope of the appended claims.

Claims

1. A trusted network communication method for communication between a trusted network communication device and an application terminal, characterized in that, The method includes: Store user PIN codes and user digital certificates; When the trusted network communication device is connected to the application terminal, it authenticates the user's SM2 key pair authorization through the user PIN code. After successful authentication, it provides trusted password calculation through the trusted network communication device. The trusted network communication device and the application terminal are made possible through the network protocol stack. The storage of user PIN codes and user digital certificates includes: Obtain and store the user's self-signed public key certificate or a public key certificate issued by a trusted third-party certificate authority; The process of achieving trusted network communication between the trusted network communication device and the application terminal through a network protocol stack includes: The network protocol stack of the trusted network communication device uses the SM2 key pair and the public key certificate to establish a national cryptographic SSL two-way authentication with the application server; The data to be sent is placed into the network protocol stack of the trusted network communication device; The data to be sent is transmitted through the input interface of the trusted network communication device to the national cryptographic SSL protocol stack of the trusted network communication device. The data to be sent is sent to the application server through the national cryptographic SSL protocol stack.

2. The method according to claim 1, characterized in that, The storage of user PIN codes and user digital certificates includes: Create and store the SM2 key pair, which includes a signature key pair and an encryption key pair. The signature key pair includes a signature private key, and the encryption key pair includes an encryption private key.

3. The method according to claim 2, characterized in that, When the trusted network communication device connects to the application terminal, it authenticates the user's SM2 key pair permissions using the user PIN code. Upon successful authentication, it provides trusted password calculation via the trusted network communication device, including: The user is prompted to enter a PIN code. After the user enters the correct PIN code, the user's signature private key and the data to be signed are used as input parameters for password calculation.

4. The method according to claim 3, characterized in that, When the trusted network communication device connects to the application terminal, it authenticates the user's SM2 key pair permissions using the user PIN code. Upon successful authentication, it provides trusted password calculation via the trusted network communication device, including: The user is prompted to enter a PIN code. After the user enters the correct PIN code, the user's encrypted private key and the data to be decrypted are used as input parameters for password calculation.

5. The method according to claim 1, characterized in that, The step of enabling trusted network communication between the trusted network communication device and the application terminal through a network protocol stack further includes: The data received from the application server is sent from the output interface of the trusted network communication device to the network protocol stack via the national cryptographic SSL protocol stack. The received data is returned to the application terminal via the network protocol stack.

6. The method according to claim 2, characterized in that, The storage of user PIN codes and user digital certificates also includes: A two-level PIN code mechanism is adopted to protect the user key and achieve secure key storage, including: dividing the PIN code into a user PIN code and a device PIN code, wherein the device PIN code corresponds to the serial number of the trusted network communication device and is stored in the secure storage area of ​​the trusted network communication device; The device PIN code is used as the SM4 algorithm key to encrypt the user PIN code, and the encrypted user PIN code is stored in the secure storage area of ​​the trusted network communication device. The user's PIN code is used as the SM4 algorithm key to encrypt the signature private key and the encryption private key in the user's SM2 key pair, and then stored in the secure storage area of ​​the trusted network communication device.

7. The method according to claim 6, characterized in that, The storage of user PIN codes and user digital certificates also includes: When a user needs to use the signing private key and the encryption private key, they need to enter the user PIN code to decrypt the user's signing private key and the encryption private key; When a user forgets their PIN code, the PIN code is decrypted using the device PIN code. Then, the user's signature private key and encryption private key are decrypted using the PIN code. The signature private key and encryption private key are then encrypted using a new PIN code. Finally, the new PIN code is encrypted using the device PIN code and stored in the secure storage area of ​​the trusted network communication device.

8. A trusted network communication device for connecting to the application terminal to implement a trusted network communication method, characterized in that, include: A memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the computer program to implement the method of any one of claims 1-7.

9. A non-transitory computer-readable storage medium having stored computer-readable instructions thereon, which, when executed by a processor, cause the processor to perform the method as described in any one of claims 1-7.

Images