A data carrying method by means of a temporary digital certificate

Abstract

Data carrying method by means of temporary digital certificate: the cryptographic data contains data obtained by cryptographic operation using a key of a digital certificate and has a prescribed or agreed data format, and a field capable of storing other digital certificates in addition to the digital certificate corresponding to the key used for the cryptographic operation; when additional data in addition to the prescribed or agreed data content needs to be added to the cryptographic data, a program for generating the cryptographic data using the digital certificate and the key generates a temporary digital certificate containing the additional data to be added, and adds the temporary digital certificate to the field storing the digital certificate of the cryptographic data; the temporary digital certificate is a digital certificate generated when the cryptographic data is generated, and is not a digital certificate required to be used when subsequent processing of the cryptographic data is performed; a program for processing the cryptographic data acquires the temporary digital certificate from the field storing the digital certificate of the cryptographic data, and acquires the aforementioned additional data from the temporary digital certificate.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of cryptography, in particular, a data carrying method by means of temporary digital certificate. BACKGROUND

[0002] X509 digital certificate is an electronic identity certificate based on public key cryptography, by which identity authentication, digital signature, data encryption, secure communication and other security functions can be realized in various applications. Each digital certificate corresponds to a pair of user keys, public key and private key, wherein the user public key is contained in the digital certificate and is securely issued through the digital certificate (hence the digital certificate is also called public key digital certificate), and the user private key is securely kept by the user (in the cryptographic module or device or system).

[0003] The data formed after the cryptographic operation of the user keys corresponding to the digital certificate, including the public key and the private key, is called cryptographic data, such as the data formed after the encryption of the public key and the data formed after the signature of the private key. The cryptographic data is usually in a predetermined or specified format, including self-defined format and standard format. The most commonly used standard of cryptographic data format is Cryptographic Message Syntax (CMS) (RFC5652). Based on the standard of CMS cryptographic data format, application-specific cryptographic data format standards can also be defined for specific applications such as secure electronic mail. The data content contained in these predetermined or specified format cryptographic data is pre-agreed or specified, and cannot be enhanced with other data content at will. The format is fixed and cannot be changed at will. Adding data content outside the pre-specified data content or changing the format of the cryptographic data will cause the specific application program / application system using the cryptographic data to be unable to recognize or process the cryptographic data, or even produce errors. However, in actual applications, people may expect to transmit or carry additional data (usually small data) in the predetermined or specified format cryptographic data. As mentioned above, it is not possible to add additional data content to the cryptographic data or change the format of the cryptographic data. This poses a technical problem that needs to be solved: how to add additional data that is not originally defined outside the predetermined or specified data content of the cryptographic data without changing the format of the cryptographic data or the data content originally allowed to be contained in the cryptographic data. SUMMARY

[0004] The purpose of the present application is to provide a solution to add additional data that is not originally defined outside the predetermined or specified data content of the cryptographic data without changing the format of the cryptographic data or the data content originally allowed to be contained in the cryptographic data.

[0005] To achieve the purpose of the present application, the technical solution proposed by the present application is a data carrying method by means of temporary digital certificate, which is as follows.

[0006] When additional data needs to be added to the cryptographic data, the program that generates the cryptographic data using the digital certificate and the key generates a temporary digital certificate containing the additional data to be added, and adds the temporary digital certificate to the field of the cryptographic data for storing or allowing to store digital certificates other than the digital certificate corresponding to the key used in the cryptographic operation (such as the field of the CMS for storing digital certificates; if other digital certificates need to be stored in the cryptographic data, the temporary digital certificate is stored in the field of the cryptographic data for storing digital certificates together with the other digital certificates);

[0007] The cryptographic data contains data obtained after the cryptographic operation using the key of the digital certificate and has a prescribed or agreed data format;

[0008] The additional data is data other than the data content prescribed or agreed by the cryptographic data;

[0009] The temporary digital certificate is a digital certificate generated when the cryptographic data is generated; the temporary digital certificate is not a digital certificate that needs to be used in the subsequent processing of the cryptographic data identified by the cryptographic data (such as the digital certificate identified by issuerAndSerialNumber and subjectKeyIdentifier of the CMS), nor is it a digital certificate that needs to be used when verifying the validity of the digital certificate to be used in the subsequent processing of the cryptographic data (such as the digital certificate for signature verification, the digital certificate corresponding to the private key required for data decryption); the digital certificate used to verify the validity of a digital certificate is usually a CA digital certificate, i.e., based on the existing or existing cryptographic data definition, this temporary digital certificate is not a digital certificate that needs to be used in the subsequent processing, but the inclusion of this temporary digital certificate in the field of the cryptographic data for storing digital certificates does not cause problems, i.e., when the cryptographic data does not need to carry additional data, i.e., in the usual use of the cryptographic data, the temporary digital certificate is not a required digital certificate; the digital signature of the temporary digital certificate, i.e., the certificate signature value, is a valid signature value or an invalid signature value.

[0010] The case where the signature value of the temporary digital certificate is invalid includes: the signature value is not data generated by the signature operation using the private key, or the authenticity of the signature value cannot be verified or confirmed (such as that generated by the temporary private key signature).

[0011] If the digital signature of the temporary digital certificate, i.e., the certificate signature value, is a valid signature value, the issuer of the temporary digital certificate includes the executor or user or running entity (organization) of the program that generates the cryptographic data.

[0012] If the digital signature of the temporary digital certificate, i.e. the certificate signature value, is not a valid signature value, the issuer of the temporary digital certificate does not necessarily have a valid digital certificate corresponding to the temporary digital certificate.

[0013] The way the temporary digital certificate contains the additional data includes: including the additional data in a self-defined or extended defined extension field of the temporary digital certificate, or including the additional data as pseudo data in a pre-defined field of the temporary digital certificate; the pseudo data has the format and encoding of the data stored in the pre-defined field of the digital certificate, but does not have the corresponding real meaning (such as pseudo subject name, pseudo subject alias, etc.).

[0014] If there are multiple items of additional data, the multiple items are contained in one temporary digital certificate or in multiple different temporary digital certificates; the multiple items refer to two or more items; the multiple refers to two or more.

[0015] If the additional data is generated by performing a cryptographic operation on the key of another digital certificate (such as a post-quantum cryptography, PQC, key) other than the digital certificate identified in the cryptographic data, the program that generates the cryptographic data adds the digital certificate corresponding to the key used to generate the additional data (such as a PQC digital certificate) to the field storing the digital certificate of the cryptographic data, or does not add it to the field storing the digital certificate of the cryptographic data (it can be obtained by other means).

[0016] The program that generates the cryptographic data includes an application program that uses the digital certificate and the key, calls a cryptographic component (software, hardware, or a combination of software and hardware component, including a cryptographic module, a cryptographic system), generates the cryptographic data, a security protocol program, a digital certificate application programming interface, and a special cryptographic component or program therein that generates the cryptographic data using the digital certificate and the key.

[0017] The program that subsequently processes the aforementioned cryptographic data obtains the temporary digital certificate from the field storing the digital certificate of the cryptographic data, and obtains the additional data from the temporary digital certificate.

[0018] The program that subsequently processes the aforementioned cryptographic data includes an application program that uses the digital certificate and the key, calls a cryptographic component (software, hardware, or a combination of software and hardware component, including a cryptographic module, a cryptographic system), processes the cryptographic data, a security protocol program, a digital certificate application programming interface, and a special cryptographic component or program therein that processes the cryptographic data using the digital certificate and the key.

[0019] The technical solution of the present application can carry additional data in the pre-defined format of the password data by means of the temporary digital certificate; when the password data is processed subsequently, the program that cannot recognize and process the additional data can process the password data in the normal way, while the program that can recognize and process the additional data can process the password data and the additional data included in the temporary digital certificate in the agreed manner.

[0020] One use of the present application is for the transition of the public key cryptography algorithm: the data stored in the pre-defined field of the password data is the data generated by the password operation using the currently used (old) public key cryptography algorithm, while the data generated by the password operation using the transitioned target (new) public key cryptography algorithm is stored in the field of the password data as the additional data in the form of the temporary digital certificate; the program that can use the transitioned target (new) public key cryptography algorithm subsequently processes the password data and the additional data included therein using the target (new) public key cryptography algorithm, while the program that cannot use the transitioned target (new) public key cryptography algorithm processes the password data using the used (old) public key cryptography algorithm without processing the additional data. DETAILED DESCRIPTION

[0021] The specific embodiments of the present application are described below. The following is only an explanation of the possible embodiments of the present application, and does not represent all possible embodiments, nor limit the protection scope of the present application.

[0022] The password data targeted by the present application is the formatted password data (such as CMS), and the pre-defined format of the password data has a (optional or mandatory) field for storing the digital certificate, and the digital certificate stored in the field does not have to be the certificate required subsequently for the password data, for example, the certificates field of the SignedData of the CMS, the certs field of the originatorInfo of the EnvelopedData, which are such fields.

[0023] The temporary digital certificate is only needed when there is additional data, and usually it is not needed, so the identification of the temporary digital certificate needs to be noted: the temporary digital certificate is not the digital certificate that needs to be used in the subsequent processing of the cryptographic data identified by the cryptographic data (such as the issuerAndSerialNumber and subjectKeyIdentifier of CMS), nor is it the digital certificate that needs to be used in the validity verification of the digital certificate used in the subsequent processing of the cryptographic data identified by the cryptographic data (such as the signature verification user digital certificate, the digital certificate corresponding to the decryption private key) (such as the issuer, serialNumber, and subjectKeyIdentifier of the temporary digital certificate, which need to be set to avoid such conflicts).

[0024] The additional data that needs to be added to the cryptographic data can be any data, as long as it can be stored in the temporary digital certificate after encoding. The digital certificate field that stores the additional data can be a self-defined or extended defined extension field, or the additional data is encoded and stored in the form of pseudo data (false data) in any predefined field of the digital certificate, such as being saved in the subject name and subject alias in the form of pseudo data after encoding (such as being encoded into a certain type of subject alias, such as an email address or a DNS domain name).

[0025] If the validity of the additional data itself does not need to be verified (i.e., it does not need to be verified whether the additional data itself is counterfeit or tampered), the digital signature of the temporary digital certificate, i.e., the certificate signature value, can be a valid digital signature, or a non-valid signature value, where the non-valid digital signature includes: the signature value is not data generated by signing operation using a private key, or the authenticity of the signature value cannot be verified or confirmed, such as a signature value generated by signing the temporary digital certificate with a randomly generated private key (although it is generated by signing operation using a private key, the authenticity of the signature value cannot be verified or confirmed, and cannot be guaranteed).

[0026] If the validity of the additional data itself needs to be verified before using the additional data (whether the additional data is counterfeit or tampered), the digital signature of the temporary digital certificate, i.e., the certificate signature value (the data in the signature value field), is a valid digital signature (signature value), and the implementation of the valid digital signature includes: signing the temporary digital certificate with the private key of any valid digital certificate, the simplest way is to use the private key of the digital certificate of the program executioner or owner or running entity that generates the cryptographic data to sign the temporary digital certificate.

[0027] One application of the present application is for the transition of public key cryptography algorithms, and one application example is as follows:

[0028] One message is signed by the private key of the old public key cryptography algorithm of the signer and the private key of the new public key cryptography algorithm of the signer, wherein the signature value generated by the private key of the old public key cryptography algorithm is stored in the field for storing signature value of the signed data (such as CMS SignedData) in the usual way, and the signature value generated by the private key of the new public key cryptography algorithm is stored in the field for storing digital certificate of the signed data (such as the certificates field of CMS SignedData) as additional data in the form of temporary digital certificate. At this time, the signature value of the temporary digital certificate can be either a valid signature value or an invalid signature value, and signature verification on the signature value of the temporary digital certificate is not necessary.

[0029] Another variation of the above digital signature application case is as follows:

[0030] The signature value generated by the private key of the old public key cryptography algorithm of the signer is stored in the field for storing signature value of the signed data (such as CMS SignedData) in the usual way, and the hash value of the message to be signed is included in the temporary digital certificate signed by the private key of the new public key cryptography algorithm of the signer as additional data, and then the temporary digital certificate is stored in the field for storing digital certificate of the signed data (such as the certificates field of CMS SignedData). At this time, the signature value (certificate signature) of the temporary digital certificate is a valid signature value, and signature verification on the signature value of the temporary digital certificate is necessary.

[0031] For the above digital signature application case, the private key of the old public key cryptography algorithm of the signer and the private key of the new public key cryptography algorithm of the signer correspond to the same multi-public key digital certificate (an extended X509 digital certificate containing multiple public keys), or to different digital certificates; if they correspond to different digital certificates, the digital certificate corresponding to the private key of the new public key cryptography algorithm is also stored in the field for storing digital certificate of the signed data (such as the certificates field of CMS SignedData).

[0032] The program implementing the method of the present application can be an application program (system), a security protocol program, a digital certificate application programming interface, or a special program for generating cryptographic data using digital certificates and keys, which can implement cryptographic operations or call cryptographic modules or components or cryptographic systems (software, hardware or hardware-software combined components, modules or systems) for cryptographic operations.

[0033] Other specific technical implementations not described are prior art, known knowledge to those skilled in the relevant art.

Claims

1. A method for carrying data using a temporary digital certificate, characterized by: When additional data needs to be added to the password data, the program that generates password data using digital certificates and keys generates a temporary digital certificate containing the additional data to be added, and adds the temporary digital certificate to the field where the digital certificate is stored in the password data. The field where the digital certificate is stored is used to store or allows the storage of other digital certificates besides the digital certificate corresponding to the key used for cryptographic operations. The cryptographic data packet contains data obtained by performing cryptographic operations using the key of the digital certificate and has a specified or agreed-upon data format; The additional data refers to data beyond the content specified or agreed upon in the cryptographic data rules; The temporary digital certificate is a digital certificate generated when the cryptographic data is generated; the temporary digital certificate is not the digital certificate that needs to be used for subsequent processing of the cryptographic data as identified by the cryptographic data, nor is it the digital certificate that needs to be used to verify the validity of the digital certificate that needs to be used for subsequent processing of the cryptographic data as identified by the cryptographic data; the digital signature, i.e., the certificate signature value, of the temporary digital certificate is either a valid signature value or an invalid signature value.

2. The data carrying method using a temporary digital certificate according to claim 1, characterized in that: The following situations constitute invalid signatures for temporary digital certificates: the signature value is not data generated by signing using the private key, or the authenticity of the signature value cannot be verified or confirmed.

3. The data carrying method using a temporary digital certificate according to claim 1, characterized in that: If the digital signature of the temporary digital certificate, i.e. the certificate signature value, is a valid signature value, then the issuer of the temporary digital certificate includes the executor, user, or operating entity of the program that generated the cryptographic data.

4. The data carrying method using a temporary digital certificate according to claim 1, characterized in that: If the digital signature, i.e., the certificate signature value, of the temporary digital certificate is an invalid signature value, then the issuer of the temporary digital certificate does not need to have a corresponding valid digital certificate that signs the temporary digital certificate.

5. The data carrying method using a temporary digital certificate according to claim 1, characterized in that: Temporary digital certificates may include additional data in the following ways: either by including the additional data in a custom or extended field of the temporary digital certificate, or by including the additional data as pseudo data in a predefined field of the temporary digital certificate; the pseudo data has the format and encoding of the data stored in the predefined field of the digital certificate, but does not have a corresponding real meaning.

6. The data carrying method using a temporary digital certificate according to claim 1, characterized in that: If there are multiple additional data items, the multiple additional data items are contained in one temporary digital certificate or in multiple different temporary digital certificates; "multiple" refers to two or more; "multiple" refers to two or more.

7. The data carrying method using a temporary digital certificate according to claim 1, characterized in that: If the additional data is generated by performing cryptographic operations using a key of a digital certificate other than the digital certificate identified in the cryptographic data, the program that generated the cryptographic data will either add the digital certificate corresponding to the key used to generate the additional data to the field where the digital certificate is stored in the cryptographic data, or not add it to the field where the digital certificate is stored in the cryptographic data.

8. The data carrying method using a temporary digital certificate according to any one of claims 1-7, characterized in that: The program for generating cryptographic data includes an application program that uses digital certificates and keys to call cryptographic components to generate cryptographic data, a security protocol program and / or a digital certificate application programming interface, and a dedicated cryptographic component or program therein that uses digital certificates and keys to generate cryptographic data.

9. The data carrying method using a temporary digital certificate according to any one of claims 1-7, characterized in that: The subsequent process for processing the aforementioned password data retrieves a temporary digital certificate from the field where the digital certificate stores the password data, and then retrieves additional data from the temporary digital certificate.

10. The data carrying method using a temporary digital certificate according to claim 9, characterized in that: The subsequent processing procedures for the aforementioned cryptographic data include applications that use digital certificates and keys to call cryptographic components to process the cryptographic data, security protocol programs and / or digital certificate application programming interfaces, as well as dedicated cryptographic components or programs therein that use digital certificates and keys to process the cryptographic data.