A method and system for accessing and storing mobile terminal certificates based on commercial cryptography

Abstract

This invention proposes a method and system for retrieving and storing mobile terminal certificates based on commercial cryptography. It utilizes commercial cryptographic encryption and decryption methods to verify the identity of mobile terminal users via server-side authentication, generating a key pair based on a soft key and a mobile key. This enables a secondary authentication process between the mobile terminal and the server. After verification, it retrieves the user certificate corresponding to the user's request, facilitating the certificate retrieval process for user certificate applications or updates. The invention also stores the user certificate on the mobile terminal. This invention achieves secure and reliable transmission of user certificates through information encryption and decryption based on commercial cryptography.

Description

Technical Field

[0001] This invention relates to the field of information technology, and specifically to a method and system for local encrypted storage of terminal certificates based on commercial cryptography. Background Technology

[0002] The main security risks to mobile terminals lie in identity theft, threats from unauthorized users, and virus damage to application terminals. An effective way to protect application terminals is to implement targeted security measures for different communication methods.

[0003] Commercial cryptography refers to cryptographic technologies and products used for encrypting or authenticating information that does not involve state secrets. Commercial cryptography technology is the core of commercial cryptography and an important tool for social groups, organizations, enterprises, and individuals in the information age to protect their rights. In existing commercial cryptography application environments, especially during the application or renewal of user certificates, there are security risks associated with information acquisition. When users apply for or renew user certificates through mobile terminals, the content is generally obtained through simple encrypted communication, which obviously leads to insecurity in user certificates. Furthermore, the user identity information carried in existing encryption processes also poses significant challenges to the security of information transmission, resulting in substantial security vulnerabilities during the transmission of user certificates. Summary of the Invention

[0004] To address the aforementioned technical issues, this invention proposes a method and system for local encrypted storage of terminal certificates based on commercial cryptography. By employing commercial cryptographic encryption algorithms, the method encrypts user identity information and simultaneously ensures the security of user certificate acquisition through multiple encryption and decryption verification processes.

[0005] According to the purpose of this invention, a method for accessing and storing mobile terminal certificates based on commercial cryptography is proposed, applicable to both mobile terminals and servers. The method includes:

[0006] The mobile terminal receives a certificate access request message input by the user, encrypts it using a commercial cryptographic encryption algorithm, and generates a first encrypted message.

[0007] The server receives the first encrypted message, decrypts the first encrypted message using a commercial cryptographic decryption algorithm to extract the user's identity information, generates a key-based call instruction after successful identity verification, generates a first response message based on the call instruction, and sends the first response message to the mobile terminal.

[0008] The mobile terminal generates a second encrypted message based on the first response message and sends the second encrypted message to the server for verification.

[0009] After the server verifies the second encrypted message, it returns a second response message based on the user certificate to the mobile terminal.

[0010] The mobile terminal parses the second response message, extracts the user certificate, and stores it.

[0011] Preferably, the steps for the server to verify the user's identity include:

[0012] After the server extracts the user's identity information, it matches it with the pre-stored identity information. If the match is successful, the authorization code and the user's mobile phone number are encrypted using a commercial cryptographic algorithm and sent to the SMS gateway.

[0013] After the SMS gateway extracts the user's mobile phone number, it sends the encrypted authorization code to the user's mobile phone.

[0014] The user sends an authorization code to the server via the mobile terminal;

[0015] After receiving the authorization code, the server performs a matching process to complete the user identity verification process.

[0016] Preferably, the steps of generating a key-based invocation instruction, generating a first response message based on the invocation instruction, and sending the first response message to the mobile terminal include:

[0017] After successful authentication, the server generates a key-based invocation instruction and generates a key-based soft key message and a key pair message based on the mobile key according to the invocation instruction.

[0018] The server encrypts the soft key message and the key pair message using a commercial cryptographic algorithm to generate a first response message, and then sends the first response message to the mobile terminal.

[0019] Preferably, the step of the mobile terminal generating a second encrypted message based on the first response message and sending the second encrypted message to the server for verification specifically includes:

[0020] After receiving the first response message, the mobile terminal receives a content message based on the user certificate call type input by the user, encrypts the first response message and the content message using the commercial cryptographic encryption algorithm to generate a second encrypted message, and sends the second encrypted message to the server.

[0021] Preferably, the step of the server returning a second response message based on the user certificate to the mobile terminal after successfully verifying the second encrypted message specifically includes:

[0022] The server decrypts the second encrypted message and verifies the soft key and the key pair. After successful verification, it extracts the content message of the user certificate call type, calls the user certificate based on the content message, and encrypts the user certificate using a commercial cryptographic algorithm to generate the second response message.

[0023] Preferably, the user certificate invocation type includes user certificates based on applications and user certificates based on updates.

[0024] Preferably, the method further includes: the mobile terminal periodically preprocessing the stored user certificate content to determine whether the user certificate content has expired; if it has expired, the mobile terminal sends a user certificate update request to the server; and after the update is completed, the expired user certificate is revoked in real time.

[0025] According to the purpose of this invention, this invention also proposes a mobile terminal certificate retrieval and storage system based on commercial cryptography. The system includes a certificate management app deployed on the mobile terminal, and an over-the-air certificate issuing server, a CA system, and an SDK server deployed on the server side; wherein,

[0026] The certificate management APP receives a certificate access request message input by the user, encrypts it using a commercial cryptographic encryption algorithm, and generates a first encrypted message.

[0027] The over-the-air certificate server receives the first encrypted message, decrypts the first encrypted message using a commercial cryptographic decryption algorithm, extracts the user's identity information, and generates a key-based invocation instruction after successful identity verification.

[0028] The CA system is used to generate soft key messages for key-based invocation instructions, and the SDK server is used to generate key pair messages for key-based invocation instructions.

[0029] After receiving the soft key message and the key pair message, the certificate management APP sends a verification request to the over-the-air certificate server. After the over-the-air certificate server verifies the request, it calls the user certificate content of the CA system, retrieves the user certificate, and stores it in the certificate management APP.

[0030] Preferably, the storage system further includes an SMS gateway, wherein when the over-the-air certificate issuing server verifies user identity information, it compares the received identity information with pre-stored identity information. If the comparison is successful, it sends an authorization code and the user's mobile phone number to the SMS gateway. The SMS gateway then sends the authorization code to the user's mobile phone number. The user then sends the authorization code to the over-the-air certificate issuing server for comparison through the certificate management APP to complete the user identity information authentication.

[0031] This invention proposes a method and system for retrieving and storing mobile terminal certificates based on commercial cryptography. It utilizes commercial cryptographic encryption and decryption methods to verify the identity of mobile terminal users via server-side authentication, generating a key pair based on a soft key and a mobile key. This enables a secondary authentication process between the mobile terminal and the server. After verification, it retrieves the user certificate corresponding to the user's request, facilitating the certificate retrieval process for user certificate applications or updates. The invention also stores the user certificate on the mobile terminal. This invention achieves secure and reliable transmission of user certificates through information encryption and decryption based on commercial cryptography. Attached Figure Description

[0032] Figure 1 This is a flowchart of the mobile terminal certificate retrieval and storage method based on commercial cryptography proposed in this invention. Detailed Implementation

[0033] For ease of understanding, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] like Figure 1 As shown, this invention proposes a mobile terminal certificate retrieval and storage method based on commercial cryptography, applicable to both mobile terminals and servers. The method includes:

[0035] P001. The mobile terminal receives a certificate access request message input by the user, encrypts it using a commercial cryptographic encryption algorithm, and generates a first encrypted message;

[0036] P002. The server receives the first encrypted message, decrypts the first encrypted message using a commercial cryptographic decryption algorithm to extract the user's identity information, generates a key-based call instruction after successful identity verification, generates a first response message based on the call instruction, and sends the first response message to the mobile terminal.

[0037] P003. The mobile terminal generates a second encrypted message based on the first response message and sends the second encrypted message to the server for verification;

[0038] P004. After the server verifies the second encrypted message, it returns a second response message based on the user certificate to the mobile terminal.

[0039] P005. The mobile terminal parses the second response message, extracts the user certificate, and stores it.

[0040] In this embodiment, the steps for the server to verify the user's identity include:

[0041] After the server extracts the user's identity information, it matches it with the pre-stored identity information. If the match is successful, the authorization code and the user's mobile phone number are encrypted using a commercial cryptographic algorithm and sent to the SMS gateway.

[0042] After the SMS gateway extracts the user's mobile phone number, it sends the encrypted authorization code to the user's mobile phone.

[0043] The user sends an authorization code to the server via the mobile terminal;

[0044] After receiving the authorization code, the server performs a matching process to complete the user identity verification process.

[0045] In this embodiment, the steps of generating a key-based invocation instruction, generating a first response message based on the invocation instruction, and sending the first response message to the mobile terminal include:

[0046] After successful authentication, the server generates a key-based invocation instruction and generates a key-based soft key message and a key pair message based on the mobile key according to the invocation instruction.

[0047] The server encrypts the soft key message and the key pair message using a commercial cryptographic algorithm to generate a first response message, and then sends the first response message to the mobile terminal.

[0048] In this embodiment, the step of the mobile terminal generating a second encrypted message based on the first response message and sending the second encrypted message to the server for verification specifically includes:

[0049] After receiving the first response message, the mobile terminal receives a content message based on the user certificate call type input by the user, encrypts the first response message and the content message using the commercial cryptographic encryption algorithm to generate a second encrypted message, and sends the second encrypted message to the server.

[0050] In this embodiment, the step of the server returning a second response message based on the user certificate to the mobile terminal after successfully verifying the second encrypted message specifically includes:

[0051] The server decrypts the second encrypted message and verifies the soft key and the key pair. After successful verification, it extracts the content message of the user certificate call type, calls the user certificate based on the content message, and encrypts the user certificate using a commercial cryptographic algorithm to generate the second response message.

[0052] In this embodiment, the user certificate invocation type includes user certificates based on applications and user certificates based on updates.

[0053] In this embodiment, the method further includes: the mobile terminal periodically preprocessing the stored user certificate content to determine whether the user certificate content has expired; if it has expired, the mobile terminal sends a user certificate update request to the server; and after the update is completed, the expired user certificate is revoked in real time.

[0054] According to the purpose of this invention, this invention also proposes a mobile terminal certificate retrieval and storage system based on commercial cryptography. The system includes a certificate management app deployed on the mobile terminal, and an over-the-air certificate issuing server, a CA system, and an SDK server deployed on the server side; wherein,

[0055] The certificate management APP receives a certificate access request message input by the user, encrypts it using a commercial cryptographic encryption algorithm, and generates a first encrypted message.

[0056] The over-the-air certificate server receives the first encrypted message, decrypts the first encrypted message using a commercial cryptographic decryption algorithm, extracts the user's identity information, and generates a key-based invocation instruction after successful identity verification.

[0057] The CA system is used to generate soft key messages for key-based invocation instructions, and the SDK server is used to generate key pair messages for key-based invocation instructions.

[0058] After receiving the soft key message and the key pair message, the certificate management APP sends a verification request to the over-the-air certificate server. After the over-the-air certificate server verifies the request, it calls the user certificate content of the CA system, retrieves the user certificate, and stores it in the certificate management APP.

[0059] The storage system also includes an SMS gateway. When the over-the-air certificate issuing server verifies user identity information, it compares the received identity information with pre-stored identity information. If the comparison is successful, it sends an authorization code and the user's mobile phone number to the SMS gateway. The SMS gateway then sends the authorization code to the user's mobile phone number. The user then sends the authorization code to the over-the-air certificate issuing server through the certificate management APP for comparison, thereby completing the user identity information authentication.

[0060] It will be apparent to those skilled in the art that the embodiments of the present invention are not limited to the details of the exemplary embodiments described above, and that the embodiments of the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the embodiments of the present invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the embodiments of the present invention is defined by the appended claims rather than the foregoing description. Therefore, all variations falling within the meaning and scope of equivalents of the claims are intended to be encompassed within the embodiments of the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims. Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units, modules, or devices recited in the system, apparatus, or terminal claims may also be implemented by the same unit, module, or device through software or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any particular order.

[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention and are not intended to limit them. Although the embodiments of the present invention have been described in detail with reference to the above preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions to the technical solutions of the embodiments of the present invention should not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for accessing and storing mobile terminal certificates based on commercial cryptography, applied to both mobile terminals and servers, characterized in that, The method is as follows: the mobile terminal receives a certificate access request message input by the user, encrypts it using a commercial cryptographic encryption algorithm, and generates a first encrypted message; The server receives the first encrypted message, decrypts the first encrypted message using a commercial cryptographic decryption algorithm to extract the user's identity information, and generates a key-based call instruction after the identity verification is successful. Based on the call instruction, it generates a key-based soft key message and a key pair message based on a mobile key. The server encrypts the soft key message and the key pair message using a commercial cryptographic algorithm to generate a first response message, and then sends the first response message to the mobile terminal. The mobile terminal generates a second encrypted message based on the first response message and sends the second encrypted message to the server for verification. After the server verifies the second encrypted message, it returns a second response message based on the user certificate to the mobile terminal. The mobile terminal parses the second response message, extracts the user certificate, and stores it. The mobile terminal periodically preprocesses the stored user certificate content to determine whether the user certificate content has expired. If it has expired, the mobile terminal sends a user certificate update request to the server and cancels the expired user certificate in real time after the update is completed.

2. The method for accessing and storing mobile terminal certificates based on commercial cryptography according to claim 1, characterized in that, The steps for the server to verify the user's identity include: after the server extracts the user's identity information, it matches it with the pre-stored identity information. If the match is successful, the server encrypts the authorization code and the user's mobile phone number using a commercial cryptographic algorithm and sends them to the SMS gateway. After the SMS gateway extracts the user's mobile phone number, it sends the encrypted authorization code to the user's mobile phone. The user sends an authorization code to the server via the mobile terminal; After receiving the authorization code, the server performs a matching process to complete the user identity verification process.

3. The method for accessing and storing mobile terminal certificates based on commercial cryptography according to claim 1, characterized in that, The step of the mobile terminal generating a second encrypted message based on the first response message and sending the second encrypted message to the server for verification specifically includes: after receiving the first response message, the mobile terminal receives a content message input by the user based on the user certificate call type, encrypts the first response message and the content message using the commercial cryptographic encryption algorithm to generate a second encrypted message, and sends the second encrypted message to the server.

4. The method for accessing and storing mobile terminal certificates based on commercial cryptography according to claim 3, characterized in that, The step of the server returning a second response message based on the user certificate to the mobile terminal after verifying the second encrypted message specifically includes: the server decrypts the second encrypted message and verifies the soft key and the key pair. After successful verification, the server extracts the content message of the user certificate call type, calls the user certificate based on the content message, and encrypts the user certificate using a commercial cryptographic algorithm to generate the second response message.

5. The method for accessing and storing mobile terminal certificates based on commercial cryptography according to claim 4, characterized in that, The user certificate call types include user certificates based on applications and user certificates based on updates.

6. A mobile terminal certificate retrieval and storage system based on commercial cryptography, characterized in that, The system includes a certificate management APP deployed on a mobile terminal, and an over-the-air certificate issuing server, a CA system, and an SDK server deployed on the server side. The certificate management APP receives a certificate access request message input by the user, encrypts it using a commercial cryptographic encryption algorithm, and generates a first encrypted message. The over-the-air certificate server receives the first encrypted message and decrypts it using a commercial cryptographic decryption algorithm to extract the user's identity information. After successful identity verification, it generates a key-based invocation instruction and generates a key-based soft key message and a key pair message based on the mobile key according to the invocation instruction. The server encrypts the soft key message and the key pair message using a commercial cryptographic algorithm to generate a first response message, and then sends the first response message to the mobile terminal. The CA system is used to generate soft key messages for key-based invocation instructions, and the SDK server is used to generate key pair messages for key-based invocation instructions. After receiving the soft key message and the key pair message, the certificate management APP sends a verification request to the over-the-air certificate server. After the over-the-air certificate server verifies the request, it calls the user certificate content of the CA system, retrieves the user certificate, and stores it in the certificate management APP.

7. The mobile terminal certificate retrieval and storage system based on commercial cryptography according to claim 6, characterized in that, The storage system also includes an SMS gateway. When the over-the-air certificate issuing server verifies user identity information, it compares the received identity information with pre-stored identity information. If the comparison is successful, it sends an authorization code and the user's mobile phone number to the SMS gateway. The SMS gateway then sends the authorization code to the user's mobile phone number. The user then sends the authorization code to the over-the-air certificate issuing server through the certificate management APP for comparison, thereby completing the user identity information authentication.

Images