Method for mutual decryption of encrypted data by ukey and mobile shield

Abstract

The present application relates to the field of mutual decryption of encrypted data, in particular to a mutual decryption method of encrypted data of UKEY and mobile phone shield, mainly including three steps of user identity binding, data encryption and data decryption. The mutual decryption of data between UKEY and mobile phone shield first needs to bind different media of the same user, after binding, the encryption party uses platform encryption certificate to encrypt data, the decryption party inputs its encryption certificate platform, the platform encrypts data through the encryption certificate and then issues, and the decryption party decrypts data by itself, wherein identity binding, data encryption and data decryption all need to identify the identity of the operator through digital signature authentication mode to ensure that the identity is reliable. The present application can randomly decrypt encrypted data of any party as long as the UKEY and mobile phone shield end are authenticated in use, without confirming the identity of the decryption party in advance, more free, and in line with the business application process.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of mutual decryption of encrypted data, in particular to a mutual decryption method of encrypted data of UKEY and mobile phone shield. BACKGROUND

[0002] Currently, in the personal password application of information system, the UKEY medium is usually used as a carrier to realize the functions of CA digital certificate storage, identity authentication, electronic signature and data signature, encryption and decryption, etc. With the development of mobile application, more and more business scenarios are transferred to mobile phone for use, and the personal password application of mobile phone generally uses the collaborative signature mode, i.e. the mobile phone shield mode, so that a user can log in the system to perform business data encryption operation in the UKEY mode and the mobile phone shield mode. However, the encryption certificate in the UKEY is different from the encryption certificate in the mobile phone shield, and they cannot be mutually decrypted, which causes problems in business flow. Therefore, there is a demand for the mutual decryption of data of UKEY and mobile phone shield of the same user, i.e. the same principal can use the UKEY or the mobile phone shield to mutually encrypt and decrypt the encrypted data.

[0003] Generally, data encryption uses encryption certificates, and the encryption certificates are issued by the CA institution. If a user uses both the UKEY and the mobile phone shield, he needs to apply to the CA institution twice, so that two encryption certificates will be issued. Generally, business data encryption is performed through the digital envelope mode, i.e. the symmetric key is used to encrypt the business data, and the asymmetric key is used to encrypt the symmetric key. If the mutual decryption of UKEY and mobile phone shield is realized, the data plaintext is obtained, and generally, the UKEY and the mobile phone shield need to participate in the two-time encryption and decryption, i.e. the decryption party is determined in advance. SUMMARY

[0004] In view of the problem that the prior art needs to determine the decryption party in advance when data is encrypted, the present application provides a mutual decryption method of encrypted data of UKEY and mobile phone shield, which can randomly decrypt the encrypted data of any party as long as the UKEY and the mobile phone shield are authenticated in use, and does not need to determine the decryption party in advance.

[0005] The technical solution adopted by the present application to solve the technical problem is as follows:

[0006] The mutual decryption method of encrypted data of UKEY and mobile phone shield comprises the following steps:

[0007] Step 1: User binding

[0008] S11, the user logs in the system and authenticates the user identity through the digital signature authentication mode;

[0009] S12, after successful login, the user selects the medium to be bound;

[0010] S13, according to the selected binding medium, PC end binding mobile shield, PC end pop-up two-dimensional code, mobile shield scan code; mobile end binding UKEY, pop-up UKEY binding address, copy to PC end inserted UKEY;

[0011] S14, mobile shield scan code, PC end inserted UKEY for digital signature, while uploading encryption certificate, signature certificate to the server;

[0012] S15, the server according to the signature certificate to verify the identity of the user, while retaining the encryption certificate;

[0013] S16, complete user binding;

[0014] Second, data encryption:

[0015] S21, generate symmetric key pair business data encryption;

[0016] S22, get the encryption certificate of the system, through the system encryption certificate will be encrypted, get the digital envelope data;

[0017] S23, using user signature certificate to system random number, encryption data signature;

[0018] S24, the system according to the user identity authentication signature value;

[0019] S25, after verification, save the encrypted data;

[0020] S26, complete data encryption;

[0021] Third, data decryption:

[0022] S31, first get the system random number when decryption;

[0023] S32, through the decryption of the signature key to the system random number digital signature;

[0024] S33, upload signature value;

[0025] S34, the system according to the decryption of the user's signature certificate to verify whether the binding user;

[0026] S35, after the identity verification, the encrypted data, user encryption key into the password device decryption, password device through the system encryption key decryption encryption data to get the key plaintext, and through the user encryption key again to return the key plaintext encryption;

[0027] S36, the system issues the encrypted data;

[0028] S37, business end through its own encryption key decryption data to get the key plaintext, and then use the key plaintext decryption to get the data plaintext;

[0029] S38, completing decryption.

[0030] The application has the advantages that the application can randomly decrypt encrypted data of any party as long as the UKEY and the mobile shield are authenticated in use by the unified key management module, without confirming the identity of the decryption party in advance, and is more free and conforms to the business application process.

[0031] Specifically,

[0032] 1. The same user can decrypt data by using other bound media at any time after authentication of different media binding;

[0033] 2. Not limited to the UKEY and the mobile shield, but can be extended to different UKEYs and different mobile shields, and can be selected independently according to the business needs, and is more flexible and easier to use;

[0034] 3. All operations are based on identity authentication of digital signature, and the identity is trusted as a prerequisite;

[0035] 4. The encrypted data only appears in plaintext when the password device is converted and encrypted in the whole process, and the security can be guaranteed since it appears in the internal security of the password device, and the plaintext does not appear during transmission and storage, ensuring the security of the data. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 is a user binding flowchart;

[0037] Figure 2 is a data encryption flowchart;

[0038] Figure 3 is a data decryption flowchart. DETAILED DESCRIPTION

[0039] In order to better understand the application, the embodiments of the application will be explained in detail below with reference to the accompanying drawings. Figures 1-3 The embodiments of the application will be explained in detail below with reference to the accompanying drawings.

[0040] The application establishes a key management module, and protects the symmetric key of the encrypted data by EKE (key encryption key) in the key management module. The core function of the key management module is to enable the encrypted data of the UKEY and the mobile shield of the same user to be mutually authenticated and decrypted, and the symmetric key needs to be uniformly managed. Therefore, the security of the transmission, storage and application process of the key needs to be ensured, and the identity of the user needs to be identified. Since the UKEY and the mobile shield have a signature key for identifying the unique identity, the identity can be ensured to be trusted by the digital signature technology. The specific scheme is described as follows:

[0041] The data mutual solution between the UKEY and the mobile shield first needs to bind different media of the same user. After the binding, the encryption party uses the platform encryption certificate to encrypt the data, the decryption party inputs its encryption certificate, the platform encrypts the data through the encryption certificate and then issues the encrypted data, and the decryption party decrypts the data by itself. In the identity binding, data encryption and data decryption, the identity of the operator needs to be identified through the digital signature authentication mode to ensure the identity is reliable, and the reliable identity is the key of the data mutual solution.

[0042] The specific method flow is as follows:

[0043] The data mutual solution between different media mainly has three flows, user identity binding, data encryption and data decryption.

[0044] The first step is the user binding flow as shown in Figure 1

[0045] S11, the user logs in the system and identifies the user identity through the digital signature authentication mode.

[0046] S12, after the login succeeds, the user selects the media to be bound.

[0047] S13, according to the selected bound media, the PC end pops up a two-dimensional code when the PC end binds the mobile shield, and the mobile shield scans the code; when the mobile end binds the UKEY, the UKEY binding address is popped up and copied to the PC end and inserted into the UKEY.

[0048] S14, the mobile shield scans the code and the PC end inserts the UKEY to perform the digital signature, and uploads the encryption certificate and the signature certificate to the server.

[0049] S15, the server verifies the user identity according to the signature certificate, and stores the encryption certificate.

[0050] S16, the user binding is completed.

[0051] The second step is the data encryption flow as shown in Figure 1

[0052] S21, a symmetric key is generated to encrypt the business data.

[0053] S22, the system encryption certificate is obtained, the symmetric key is encrypted through the system encryption certificate, and the digital envelope data is obtained.

[0054] S23, the user signature certificate is used to sign the system random number, the encrypted data and the like.

[0055] S24, the system verifies the signature value according to the user identity.

[0056] S25, after the verification succeeds, the encrypted data is saved. ​​

[0057] S26, complete data encryption.

[0058] Third step, data decryption:

[0059] S31, acquire system random number when decrypting.

[0060] S32, digitally sign the system random number by the decrypter signature key.

[0061] S33, upload the signature value.

[0062] S34, the system verifies whether it is a bound user according to the signature certificate when the decrypter is bound.

[0063] S35, after the identity verification, the encrypted data and user encryption key are transmitted into the password device for decryption, the password device internally decrypts the encrypted data by the system encryption key to obtain the key plaintext, and then encrypts the key plaintext by the user encryption key and returns.

[0064] S36, the system issues the encrypted data.

[0065] S37, the service end decrypts the data by the encryption key to obtain the key plaintext, and then decrypts the data plaintext by the key plaintext.

[0066] S38, complete decryption.

[0067] After the user identity verification, a step of conversion encryption is performed, that is, the data originally encrypted by the system key is converted to be encrypted by the user key, and the whole operation is completed in the password device, so that the decrypted plaintext does not exist outside, and the security is ensured.

[0068] The key point of the application lies in the binding way between different media, and the conversion encryption by the user encryption key of the decrypter after the system encryption, and the whole process is completed in the password module to ensure the security of the key and data. The data between different media of the same user are mutually decrypted, and are not limited to UKEY and mobile shield, but can be UKEY and UKEY, or mobile shield and mobile shield, or other password modules.

Claims

1. A method for mutually decrypting encrypted data between a UKEY and a mobile security token, characterized in that, It includes the following steps: Step 1, User Binding: S11. The user login system authenticates the user's identity through digital signature authentication. S12. After successful login, select the medium to be bound; S13. Depending on the selected binding medium, when binding a mobile security token to a PC, a QR code will pop up on the PC, which the mobile security token will scan; when binding a UKEY to a mobile device, the UEKY binding address will pop up, which will be copied to the PC and inserted into the UKEY. S14. The mobile phone security token scans the code and performs digital signature. The PC client inserts the UKEY to perform digital signature and uploads the encryption certificate and signing certificate to the server. S15. The server verifies the user's identity based on the signature certificate and retains the encrypted certificate. S16. Complete user binding; The second step is data encryption: S21. Generate a symmetric key to encrypt business data; S22. Obtain the system's encryption certificate, encrypt the symmetric key using the system's encryption certificate, and obtain the digital envelope data; S23. Sign the system random numbers and encrypted data using the user signature certificate; S24. The system uses the user's authentication signature value; S25. After successful verification, save the encrypted data; S26. Complete data encryption; Step 3, Data Decryption: S31. Obtain a system random number before decryption; S32. Digitally sign the system random number using the decryptor's signing key; S33. Upload signature value; S34. The system verifies whether the user is a bound user based on the signature certificate used by the decryptor during the binding process. S35. After successful authentication, the encrypted data and user encryption certificate are sent to the cryptographic device for decryption. The cryptographic device decrypts the encrypted data using the system encryption key to obtain the plaintext of the symmetric key, and then encrypts the plaintext of the symmetric key again using the user encryption certificate before returning it. S36. The system sends out encrypted data; S37. The business end decrypts the data using its own encryption key to obtain the original key text, and then uses the original key text to decrypt the data to obtain the original business data text. S38. Decryption complete.

Images