A backup method of an anonymous certificate on a new terminal device

Abstract

This invention discloses a method for backing up anonymous certificates on a new terminal device. The method comprises: a) the owner of the anonymous certificate to be backed up applies for and stores their identity certificate on the new terminal device; b) the owner generates a public / private key pair corresponding to the anonymous certificate to be backed up, backup anonymous certificate application information, identity verification information, and authorization information on the new terminal device and sends them to an anonymous certificate authority (CCA); c) the CCA verifies whether the identity of the backup operation applicant matches the identity of the owner of the anonymous certificate to be backed up through the identity verification information, and verifies whether the backup operation is authorized by the network application corresponding to the anonymous certificate to be backed up through the authorization information; if both verifications pass, a backup anonymous certificate is issued; d) the CCA synchronizes the issued backup anonymous certificate to the new terminal device and the network application corresponding to the anonymous certificate to be backed up. This invention ensures the availability and security of anonymous certificate-related services.

Description

Technical Field

[0001] This invention relates to the field of information transmission technology, and more specifically to a method for backing up anonymous certificates on new terminal devices. Background Technology

[0002] In sensitive transactions such as online banking and electronic payments, service providers typically issue digital certificates and USB keys (e.g., bank USB tokens) to users to ensure the security of user logins and critical sensitive operations (e.g., large-amount transfers). However, with the widespread adoption of mobile internet, more and more users are handling sensitive transactions, such as mobile banking and mobile payments, via mobile devices. Consequently, many manufacturers have launched software cryptographic module products (i.e., software keys) that can be deployed on mobile devices, using the mobile device as the digital certificate carrier to solve the problem of traditional USB keys being difficult to deploy on mobile devices. However, compared to USB keys, mobile devices inevitably undergo frequent upgrades, and it's common for individuals to use multiple devices. Ensuring the continuity and convenience of certificate-related services under conditions of device replacement and multiple devices is a pressing issue, and this invention is developed based on this problem. Summary of the Invention

[0003] This invention addresses the aforementioned technical problems by providing a method for backing up anonymous certificates on new terminal devices, enabling secure backup of digital certificates issued by service providers across multiple terminals.

[0004] To solve the above-mentioned technical problems, the technical solutions adopted in the embodiments of the present invention are as follows:

[0005] A method for backing up an anonymous certificate on a new terminal device, characterized in that the anonymous certificate is a digital certificate representing a user's specific anonymous identity in a specific network application, containing no real identity information, and its corresponding private key; the new terminal device refers to a terminal device that has not yet stored an anonymous certificate corresponding to the anonymous identity represented by the anonymous certificate to be backed up; the backup operation refers to the process of generating and storing a backup anonymous certificate corresponding to the anonymous identity represented by the anonymous certificate to be backed up on the new terminal device, wherein the backup anonymous certificate and the anonymous certificate to be backed up represent the same anonymous identity but have different public-private key pairs; the backup method involves the network application certificate corresponding to the anonymous certificate to be backed up, the owner of the anonymous certificate to be backed up, the new terminal device, the anonymous certificate authority, and the identity certificate, and includes the following steps:

[0006] a) The owner of the anonymous certificate to be backed up applies for and stores the identity certificate on the new terminal device;

[0007] b) The owner of the anonymous certificate to be backed up initiates an anonymous certificate backup application on the new terminal device. The application includes generating a public-private key pair corresponding to the backup anonymous certificate, a backup anonymous certificate application message signed by the private key of the backup anonymous certificate, an identity verification message signed by the private key of the identity certificate applied in step a), and an authorization message signed by the private key of the network application certificate corresponding to the anonymous certificate to be backed up.

[0008] c) The owner of the anonymous certificate to be backed up sends the backup anonymous certificate application message, identity verification message, and authorization message to the anonymous certificate authority;

[0009] d) The anonymous certificate authority verifies that the identity of the applicant for the backup operation is consistent with the identity of the owner of the anonymous certificate to be backed up through the identity verification message, and verifies that the backup operation is authorized by the network application corresponding to the anonymous certificate to be backed up through the authorization message; if both verifications pass, a backup anonymous certificate is issued.

[0010] e) The anonymous certificate authority will synchronize the issued backup anonymous certificate to the new terminal device and the network application corresponding to the anonymous certificate to be backed up.

[0011] The identity certificate in step a) is a digital certificate containing the user's identity ID and its private key; the identity certificate on the terminal device where the anonymous certificate to be backed up is located contains the same identity ID as the identity certificate generated on the new terminal device, but they have different public and private key pairs.

[0012] Optionally, the identity certificate may be a real-name digital certificate containing a natural person's real-name identity ID and its private key, or an anonymous identity digital certificate containing a natural person's online identity ID and its private key.

[0013] The backup anonymous certificate application message in step b) includes the anonymous identity ID represented by the anonymous certificate, the backup anonymous certificate public key, the network application identifier corresponding to the anonymous certificate to be backed up, and the signature of the backup anonymous certificate private key on the aforementioned content; the identity verification message includes the backup anonymous certificate public key, the identity certificate identifier generated in step a), the anonymous certificate identifier to be backed up, and the signature of the identity certificate private key generated in step a) on the aforementioned content; the authorization message includes the backup anonymous certificate public key, the identity certificate identifier generated in step a), and the signature of the network application certificate private key corresponding to the anonymous certificate to be backed up on the aforementioned content.

[0014] Optionally, the backup anonymous certificate application message, authentication message, and authorization message in step b) can be merged into a single message.

[0015] Optionally, the backup anonymous certificate application message in step b) may include device information of the new terminal device, including but not limited to device name, device identifier, etc.

[0016] In step c), the anonymous certificate authority maintains the correspondence between anonymous certificates and identity certificates.

[0017] The authentication process in step d) is as follows: Obtain the corresponding identity certificate (i.e., the identity certificate corresponding to the anonymous certificate to be backed up) based on the anonymous certificate identifier in the authentication message. The identity certificate has the same identity ID as the identity certificate generated by the new terminal device in the authentication message. Both identity certificates are valid and the signature of the authentication message is valid.

[0018] The authorization message verification in step d) includes verifying that the network application certificate is valid and that the signature of the authorization message is valid.

[0019] The network application identifier corresponding to the anonymous certificate to be backed up can be a string that uniquely identifies the network application, a network application certificate serial number, or a network application certificate; the identity certificate identifier and the anonymous certificate identifier to be backed up can be a certificate serial number that uniquely identifies the certificate or the identity certificate itself.

[0020] The beneficial effects of adopting the above technical solution of the present invention are as follows:

[0021] This invention allows the same user to securely deploy anonymous certificates for the same network application across different terminal devices when accessing network applications using anonymous certificates. This ensures that users can seamlessly roam across different terminal devices and access corresponding network applications using anonymous certificates. Furthermore, this invention guarantees the availability and security of anonymous certificate-related services even when users are using new terminals, discarding old terminals, or losing their terminals. Attached Figure Description

[0022] Figure 1 This is an embodiment of the method for backing up anonymous certificates on new terminal devices according to the present invention.

[0023] Figure 2 This is the system architecture of the present invention. Detailed Implementation

[0024] To enable those skilled in the art to understand and implement the present invention, the embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0025] Figure 1 The image shows an embodiment of a method for backing up anonymous certificates on a new terminal device. Figure 2 For system architecture. For example... Figure 2The system shown includes an anonymous certificate terminal cryptographic suite, an anonymous certificate management server, and a digital certificate issuance system. The anonymous certificate terminal cryptographic suite, installed on the mobile terminal, provides management of anonymous certificates and their private keys, and offers cryptographic operation support for the terminal device. The anonymous certificate management server, deployed on a remote server, maintains the association between anonymous certificates and terminal devices, identity certificates, network applications, etc., and provides users with anonymous certificate storage and retrieval services. The digital certificate issuance system provides issuance and management functions for anonymous certificates, identity certificates, and certificate revocation lists. The anonymous certificate terminal cryptographic suite and the anonymous certificate management server are connected via a secure network channel, and the anonymous certificate management server and the digital certificate issuance system are connected via a secure network channel. In this system, the anonymous certificate terminal cryptographic suite can be implemented as an APP or SDK on a user's mobile terminal; the anonymous certificate management server can be implemented as an application or website on a server or PC; and the digital certificate issuance system is a standard digital certificate issuance system.

[0026] Figure 1 The anonymous certificate backup process is as follows:

[0027] a) The owner of the anonymous certificate to be backed up applies for and stores the identity certificate on the new terminal device through the anonymous certificate terminal cryptographic suite.

[0028] b) The owner of the anonymous certificate to be backed up initiates an anonymous certificate backup request on the new terminal device using the anonymous certificate terminal cryptographic suite. Details are as follows:

[0029] ● Use the anonymous certificate terminal cipher suite to obtain the list of anonymous certificates currently applied for by the user, and select an anonymous certificate to perform a backup operation;

[0030] • Use the anonymous certificate terminal cipher suite to generate a backup of the public / private key pair corresponding to the anonymous certificate;

[0031] ● Generate a backup anonymous certificate application message, which includes the anonymous identity ID extracted from the selected anonymous certificate to be backed up, as well as the network application identifier, device name, public key of the backup anonymous certificate generated in the previous step, and a signature of the aforementioned content using the private key of the backup anonymous certificate generated in the previous step.

[0032] • Generate an authentication message, which includes the public key of the backup anonymous certificate, the identity certificate identifier generated in step a), the identity certificate identifier to be backed up, and the signature of the aforementioned content by the private key of the identity certificate generated in step a);

[0033] • Generate an authorization message, which includes the public key of the backup anonymous certificate, the identity certificate identifier generated in step a), and the signature of the aforementioned content by the private key of the network application certificate corresponding to the anonymous certificate to be backed up;

[0034] c) The owner of the anonymous certificate to be backed up sends the backup anonymous certificate application message, identity verification message, and authorization message to the anonymous certificate management server;

[0035] d) The anonymous certificate management server verifies that the identity of the backup operation applicant is consistent with the identity of the owner of the anonymous certificate to be backed up through the identity verification message, and verifies that the backup operation is authorized by the network application corresponding to the anonymous certificate to be backed up through the authorization message; if both verifications are successful, an anonymous certificate application request is sent to the digital certificate issuance system.

[0036] e) The digital certificate issuance system issues a backup anonymous certificate and returns the issued backup anonymous certificate to the anonymous certificate management system; the anonymous certificate management system records the correspondence between the new certificate and the identity certificate, terminal device, and network application, and synchronizes the backup anonymous certificate to the new terminal device and the network application corresponding to the anonymous certificate to be backed up.

[0037] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A method for backing up an anonymous certificate on a new terminal device, comprising the following steps: a) The owner of the anonymous certificate to be backed up applies for and stores the owner's identity certificate on the selected new terminal device; The identity certificate includes a digital certificate with the user's identity ID, an identity certificate private key, and an identity certificate identifier; b) The owner of the anonymous certificate to be backed up generates, on the new terminal device, the public-private key pair corresponding to the backup anonymous certificate, the backup anonymous certificate application information signed by the private key of the backup anonymous certificate, the identity verification information signed by the private key of the identity certificate applied for in step a), and the authorization information signed by the private key of the network application certificate corresponding to the anonymous certificate to be backed up; c) The owner of the anonymous certificate to be backed up sends the application information, identity verification information, and authorization information of the backup anonymous certificate to the anonymous certificate authority; d) The anonymous certificate authority verifies whether the identity of the backup operation applicant matches the identity of the owner of the anonymous certificate to be backed up through the identity verification information, and verifies whether the backup operation is authorized by the network application corresponding to the anonymous certificate to be backed up through the authorization information; if both verifications pass, a backup anonymous certificate is issued. e) The anonymous certificate authority will synchronize the issued backup anonymous certificate to the new terminal device and the network application corresponding to the anonymous certificate to be backed up.

2. The method of claim 1, wherein, The owner of the anonymous certificate to be backed up applies for and stores the owner's identity certificate on the new terminal device through a terminal cryptographic suite; the identity certificate on the terminal device where the anonymous certificate to be backed up is located contains the same identity ID as the identity certificate generated and stored on the new terminal device, but has different public and private key pairs.

3. The method of claim 2, wherein, The user identity ID is either the user's real-name identity ID or the user's network identity ID.

4. The method according to claim 1 or 2 or 3, characterized in that, The backup anonymous certificate application information includes the anonymous identity ID represented by the backup anonymous certificate, the public key of the backup anonymous certificate, the network application identifier corresponding to the anonymous certificate to be backed up, and the signature of the above content using the private key of the backup anonymous certificate; the identity verification information includes the public key of the backup anonymous certificate, the identity certificate identifier generated in step a), the identifier of the anonymous certificate to be backed up, and the signature of the above content using the private key of the identity certificate generated in step a). The authorization information includes the public key of the backup anonymous certificate, the identity certificate identifier generated in step a), and the signature of the above content using the private key of the network application certificate corresponding to the anonymous certificate to be backed up.

5. The method according to claim 1, 2, or 3, characterized in that, Step d) The process of verifying whether the identity of the backup operation applicant is consistent with the identity of the owner of the anonymous certificate to be backed up through the identity verification information is as follows: Obtain the corresponding identity certificate according to the anonymous certificate identifier to be backed up in the identity verification information. If it has the same identity ID as the identity certificate corresponding to the new terminal device in the identity verification information, both identity certificates are valid, and the signature of the identity verification information is valid, then the verification is successful.

6. The method according to claim 1, 2, or 3, characterized in that, The network application identifier corresponding to the anonymous certificate to be backed up is a unique string that identifies the network application, or the network application certificate serial number, or the network application certificate itself; the identifier of the identity certificate is the identity certificate serial number or the identity certificate itself; the identifier of the anonymous certificate to be backed up is the serial number of the anonymous certificate to be backed up or the anonymous certificate to be backed up itself.

7. The method according to claim 1, characterized in that, The backup anonymous certificate application information includes the device information of the new terminal device, which includes, but is not limited to, the device name and device identifier.

8. The method according to claim 1, characterized in that, The anonymous certificate authority maintains the correspondence between anonymous certificates and identity certificates.

9. The method according to claim 1, characterized in that, Step d) Verify whether the backup operation is authorized by the network application corresponding to the anonymous certificate to be backed up through the authorization information, including verifying whether the network application certificate is valid and whether the signature of the authorization information is valid.

Images