A method for secure transmission of a collaborative encryption key

Abstract

The application discloses a secure transmission method of a cooperative encryption key, which can realize secure transmission of the cooperative encryption key, cannot obtain a private key plaintext by a man-in-the-middle, can solve the problem that the private key of the cooperative encryption key is not landed when the cooperative encryption key is split into two parts, effectively deals with the transmission security of the cooperative encryption key, can well guarantee the security of the cooperative encryption key pair in the distribution transmission process, thereby guaranteeing the security of the key and avoiding a man-in-the-middle attack.

Description

Technical Field

[0001] This invention relates to the field of computer information security technology, and in particular to a method for secure transmission of collaborative encryption keys. Background Technology

[0002] With the widespread adoption of the SM2 commercial cryptographic algorithm in cloud and mobile application environments, some devices cannot provide key operation functions using hardware cryptographic modules. The use of software-based commercial cryptographic algorithms has introduced security issues. Through continuous application and improvement in various scenarios, a collaborative digital signature mechanism based on SM2 has been developed, which, in conjunction with digital certificates, solves problems such as identity authentication. In the process of combining with digital certificates, the key distribution process for collaborative encryption keys differs from that of traditional hardware ukeys. Security issues during transmission need to be considered; therefore, a secure method that prevents keys from being stored locally should be adopted.

[0003] Therefore, through beneficial exploration and research, the applicant has found a solution to the above problems, and the technical solution to be introduced below is the result of this research. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a secure transmission method for collaborative encryption keys that improves transmission security performance, addressing the security issues encountered during the transmission of encryption keys under collaborative signature technology.

[0005] The technical problem to be solved by this invention can be achieved by the following technical solution:

[0006] A secure transmission method for collaborative encryption keys includes the following steps:

[0007] Step S10: The collaborative client combines with the collaborative server to generate a signature certificate collaborative key pair, and sends the generated signature certificate collaborative key pair to the collaborative server;

[0008] Step S20: The collaborative server generates a server-side partial collaborative key based on the signature certificate collaborative key pair, and generates a collaborative server-side protection key pair for the collaborative encryption certificate corresponding to the server-side partial collaborative key. The collaborative server returns a key generation response to the collaborative client, and simultaneously returns the collaborative server-side protection public key to the collaborative client.

[0009] Step S30: The collaborative client generates a certificate request, adds the collaborative server's protection public key to the extension of the certificate request, and sends the certificate request to the public key infrastructure RA / CA system for certificate issuance.

[0010] Step S40: After receiving the certificate request, the public key infrastructure (RA / CA) system parses the certificate request, obtains the signature certificate collaboration public key and collaboration server protection public key from the certificate request, and sends a key distribution request to the key management center (KM) system to obtain the encryption certificate key.

[0011] Step S50: After obtaining the key distribution request, the Key Management Center (KM) system determines the collaborative key type based on the key distribution request, generates a collaborative encryption key pair, and then decomposes the collaborative encryption key pair into a collaborative client encryption key fragment and a collaborative server encryption key fragment.

[0012] In step S60, the Key Management Center (KM) system uses the collaborative signature certificate public key to encrypt and protect the collaborative client encrypted key fragment, and uses the collaborative server protection public key to encrypt and protect the collaborative server encrypted key fragment. The system then returns the collaborative encryption key public key, the encrypted collaborative client encrypted key fragment, and the collaborative server encrypted key fragment to the Public Key Infrastructure (RA / CA) system.

[0013] In step S70, after the public key infrastructure (RA / CA) system generates the signature and encryption certificate, it returns the result and the encrypted data to the collaborating client.

[0014] Step S80: The collaborative client uses the private key of the collaborative signature certificate to decrypt and save the encrypted key fragment of the collaborative client, and sends the encrypted key fragment of the collaborative server to the collaborative server.

[0015] In step S90, the collaborative server uses its private key to decrypt and save the encrypted key fragment, and returns the processing result to the collaborative client, thus completing the key generation and certification process.

[0016] In a preferred embodiment of the present invention, when the collaborative server cooperates with the collaborative client to generate a collaborative key for a signature certificate, the collaborative server simultaneously generates a collaborative server protection public key for the collaborative encryption key, and returns the collaborative server protection public key to the collaborative client along with the collaborative signature key generation information.

[0017] In a preferred embodiment of the present invention, in step S10, the collaborative key algorithm used by the collaborative client is the Chinese national cryptographic asymmetric SM2 algorithm.

[0018] In a preferred embodiment of the present invention, the collaborative server protection key pair algorithm used in steps S10 and S60 is the SM2 algorithm.

[0019] In a preferred embodiment of the present invention, in step S30, the certificate request format is PKCS#10 or GM / T0092.

[0020] In a preferred embodiment of the present invention, in steps S40, S50 and S60, obtaining the collaborative server protection key pair is not limited to the public key infrastructure RA / CA system or the key management center KM, but can be processed in various systems according to the actual situation.

[0021] Due to the adoption of the above technical solution, the beneficial effects of the present invention are as follows: the present invention securely distributes and transmits collaborative encryption keys, preventing the private key plaintext from being obtained by a man in the middle. It can solve the problem that when the collaborative signature key is split into two parts of private keys, the key of each part of the private key is not stored on the ground. It effectively addresses the transmission security of collaborative encryption keys and can well guarantee the security of collaborative encryption key pairs during the distribution and transmission process, thereby ensuring the security of the key and avoiding man-in-the-middle attacks. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a logical structure diagram of the secure transmission method for the collaborative encryption key of the present invention;

[0024] Figure 2 This is a flowchart of the secure transmission method for the collaborative encryption key of the present invention. Detailed Implementation

[0025] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below with reference to specific illustrations.

[0026] See Figure 1 The secure transmission method of the collaborative encryption key of the present invention is based on Figure 1 The given logical structure implements the following functional modules:

[0027] The collaborative client is primarily responsible for jointly generating collaborative keys with the collaborative server, including installing collaborative encryption keys, and also for issuing and installing client certificates.

[0028] The collaborative server is responsible for providing the collaborative key to the collaborative client and for implementing functions such as collaborative signing and collaborative decryption.

[0029] The Public Key Infrastructure (RA / CA) system and the Key Management Center (KM) are systems within the Public Key Infrastructure (PRI) framework and are standard and standardized systems. Their detailed functions will not be elaborated upon here.

[0030] See Figure 2 and combined Figure 1 The secure transmission method for collaborative encryption keys of the present invention includes the following steps:

[0031] Step S10: The collaborative client combines with the collaborative server to generate a signature certificate collaborative key pair, and sends the generated signature certificate collaborative key pair to the collaborative server;

[0032] Step S20: The collaborative server generates a server-side partial collaborative key based on the signature certificate collaborative key pair, and generates a collaborative server-side protection key pair for the collaborative encryption certificate corresponding to the server-side partial collaborative key. The collaborative server returns a key generation response to the collaborative client, and simultaneously returns the collaborative server-side protection public key to the collaborative client.

[0033] Step S30: The collaborative client generates a certificate request, adds the collaborative server's protection public key to the extension of the certificate request, and sends the certificate request to the public key infrastructure RA / CA system for certificate issuance.

[0034] Step S40: After receiving the certificate request, the public key infrastructure (RA / CA) system parses the certificate request, obtains the signature certificate collaboration public key and collaboration server protection public key from the certificate request, and sends a key distribution request to the key management center (KM) system to obtain the encryption certificate key.

[0035] Step S50: After obtaining the key distribution request, the Key Management Center (KM) system determines the collaborative key type based on the key distribution request, generates a collaborative encryption key pair, and then decomposes the collaborative encryption key pair into a collaborative client encryption key fragment and a collaborative server encryption key fragment.

[0036] In step S60, the Key Management Center (KM) system uses the collaborative signature certificate public key to encrypt and protect the collaborative client encrypted key fragment, and uses the collaborative server protection public key to encrypt and protect the collaborative server encrypted key fragment. The system then returns the collaborative encryption key public key, the encrypted collaborative client encrypted key fragment, and the collaborative server encrypted key fragment to the Public Key Infrastructure (RA / CA) system.

[0037] In step S70, after the public key infrastructure (RA / CA) system generates the signature and encryption certificate, it returns the result and the encrypted data to the collaborating client.

[0038] Step S80: The collaborative client uses the private key of the collaborative signature certificate to decrypt and save the encrypted key fragment of the collaborative client, and sends the encrypted key fragment of the collaborative server to the collaborative server.

[0039] In step S90, the collaborative server uses its private key to decrypt and save the encrypted key fragment, and returns the processing result to the collaborative client, thus completing the key generation and certification process.

[0040] When the collaborative server works with the collaborative client to generate a collaborative key for the signature certificate, the collaborative server also generates a collaborative server-protected public key for the collaborative encryption key, and returns the collaborative server-protected public key to the collaborative client along with the collaborative signature key generation information.

[0041] In step S10, the collaborative key algorithm used by the collaborative client is the Chinese national cryptographic asymmetric SM2 algorithm.

[0042] In steps S10 and S60, the collaborative server protection key pair algorithm used is the SM2 algorithm.

[0043] In step S30, the certificate request format is PKCS#10 or GM / T 0092.

[0044] In steps S40, S50 and S60, obtaining the collaborative server protection key pair is not limited to the public key infrastructure (RA / CA) system or the key management center (KM), but can be processed in various systems according to the actual situation.

[0045] This invention effectively safeguards the security of collaborative encryption key pairs during distribution and transmission, thereby ensuring key security and preventing man-in-the-middle attacks.

[0046] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for secure transmission of a cooperative encryption key, characterized in that, Includes the following steps: Step S10: The collaborative client combines with the collaborative server to generate a signature certificate collaborative key pair, and sends the generated signature certificate collaborative key pair to the collaborative server; Step S20: The collaborative server generates a server-side partial collaborative key based on the signature certificate collaborative key pair, and generates a collaborative server-side protection key pair for the collaborative encryption certificate corresponding to the server-side partial collaborative key. The collaborative server returns a key generation response to the collaborative client, and simultaneously returns the collaborative server-side protection public key to the collaborative client. Step S30: The collaborative client generates a certificate request, adds the collaborative server's protection public key to the extension of the certificate request, and sends the certificate request to the public key infrastructure RA / CA system for certificate issuance. Step S40: After receiving the certificate request, the public key infrastructure (RA / CA) system parses the certificate request, obtains the signature certificate collaboration public key and collaboration server protection public key from the certificate request, and sends a key distribution request to the key management center (KM) system to obtain the encryption certificate key. Step S50: After obtaining the key distribution request, the Key Management Center (KM) system determines the collaborative key type based on the key distribution request, generates a collaborative encryption key pair, and then decomposes the collaborative encryption key pair into a collaborative client encryption key fragment and a collaborative server encryption key fragment. In step S60, the Key Management Center (KM) system uses the collaborative signature certificate public key to encrypt and protect the collaborative client encrypted key fragment, and uses the collaborative server protection public key to encrypt and protect the collaborative server encrypted key fragment. The system then returns the collaborative encryption key public key, the encrypted collaborative client encrypted key fragment, and the collaborative server encrypted key fragment to the Public Key Infrastructure (RA / CA) system. In step S70, after the public key infrastructure (RA / CA) system generates the signature and encryption certificate, it returns the result and the encrypted data to the collaborating client. Step S80: The collaborative client uses the private key of the collaborative signature certificate to decrypt and save the encrypted key fragment of the collaborative client, and sends the encrypted key fragment of the collaborative server to the collaborative server. In step S90, the collaborative server uses its private key to decrypt and save the encrypted key fragment, and returns the processing result to the collaborative client, thus completing the key generation and certification process.

2. The secure transfer of a symmetric encryption key method of claim 1 wherein, When the collaborative server works with the collaborative client to generate a collaborative key for the signature certificate, the collaborative server also generates a collaborative server-protected public key for the collaborative encryption key, and returns the collaborative server-protected public key to the collaborative client along with the collaborative signature key generation information.

3. The secure transfer of a symmetric encryption key method of claim 1 wherein, In step S10, the collaborative key algorithm used by the collaborative client is the Chinese national cryptographic asymmetric SM2 algorithm.

4. The secure transfer of a symmetric encryption key method of claim 1 wherein, In steps S20 and S60, the collaborative server protection key pair algorithm used is the SM2 algorithm.

5. The secure transfer of a symmetric encryption key method of claim 1 wherein, In step S30, the certificate request format is PKCS#10 or GM / T 0092.

6. The secure transfer of a symmetric encryption key method of claim 1 wherein, In steps S40, S50 and S60, the acquisition of the collaborative server protection key pair can be processed in the public key infrastructure RA / CA system or the key management center KM according to the actual situation.

Images