Media certificate issuance management method and management system

Abstract

The present application is about a method and a management system for issuing media certificates, and relates to the field of digital certificate issuance technology. The system includes a media registration module, a certificate issuance module, and a certificate registration module. The type of media is controlled during media registration management, and keys of non-safe and reliable types cannot be registered to ensure the reliability and controllability of the media certificate after issuance. After the certificate medium receives the public and private keys of the certificate issued by the certificate center, the basic key stored in the medium is used to decrypt and verify the signature to ensure the authenticity, confidentiality, integrity, and non-repudiation of the received certificate private key.

Description

Technical Field

[0001] The present application relates to the technical field of digital certificate issuance, and in particular to a medium certificate issuance management method and management system. Background Art

[0002] A media certificate refers to a physical product that stores digital certificates on a physical device, which can store the user's key and digital certificate.

[0003] In the related art, when issuing a digital certificate, a finished medium device is usually selected. After purchasing the medium device, the digital certificate is directly configured into the medium device to form a finished medium certificate.

[0004] However, in combination with related technologies, the media certificate issuance process does not include registration management for the media, and the security and reliability of the media cannot be guaranteed when the certificate is issued. Summary of the invention

[0005] This application is about a media certificate issuance management method and management system, which ensures the security and reliability of the media certificate during use. The technical solution is as follows:

[0006] On the one hand, a method for managing the issuance of a media certificate is provided, which is applied to a media certificate issuance management system, the media certificate issuance management system comprising a media registration module, a certificate issuance module and a certificate registration module;

[0007] The medium registration module is communicatively connected to the certificate issuance module, and the certificate registration module is communicatively connected to the certificate issuance module;

[0008] The method comprises:

[0009] The media registration module obtains media information, the media information is associated with the media device; encrypts the media information in combination with the first key to obtain media registration information; and sends the media registration information to the certificate issuance module;

[0010] The certificate registration module receives the medium registration information; verifies the medium registration information; and generates first verification information in response to the verification being successful;

[0011] The certificate registration module reads the medium information, encrypts the medium information in combination with the second key, and obtains the certificate registration information; and sends the certificate registration information to the certificate issuing module;

[0012] The certificate issuance module receives the certificate registration information; verifies the certificate registration information; generates second verification information in response to the verification being successful; compares the first verification information with the second verification information to obtain a comparison result; generates digital certificate issuance information in response to the comparison result indicating that the comparison is successful;

[0013] The first key and the second key are keys generated based on a common public key, the first key is used for verification of a medium registration module, and the second key is used for verification of a certificate registration module.

[0014] In an optional embodiment, the system further includes a media database;

[0015] The media database is connected to the media registration module;

[0016] The medium registration module obtains medium information, including:

[0017] The medium registration module obtains the medium information through a connection interface with the medium database.

[0018] In an optional embodiment, the media database stores at least one of media number data, manufacturer data, manufacturer data and version data corresponding to the media device.

[0019] In an optional embodiment, the first key and the second key are keys generated based on a common public key;

[0020] The method further comprises:

[0021] The certificate issuing module sends a first key to the medium registration module, and sends a second key to the certificate registration module.

[0022] In an optional embodiment, the method further includes:

[0023] In response to verification failure, the certificate issuing module discards the medium registration information.

[0024] In an optional embodiment, the verifying the certificate registration information includes:

[0025] The certificate registration module verifies the certificate registration information by using a symmetric key corresponding to the first key.

[0026] In an optional embodiment, the method further comprises:

[0027] In response to the verification failure, the certificate registration module generates issuance failure information; and synchronizes the issuance failure information to the medium registration module and the certificate registration module.

[0028] In an optional embodiment, the first key and the second key are private keys generated based on the SM4 encryption algorithm.

[0029] On the other hand, a media certificate issuance management system is provided, the system comprising a media registration module, a certificate issuance module and a certificate registration module;

[0030] The medium registration module is communicatively connected to the certificate issuance module, and the certificate registration module is communicatively connected to the certificate issuance module;

[0031] The media certificate issuance management system is used to execute any of the media certificate issuance management methods described above.

[0032] The technical effects of each embodiment of the present application include at least:

[0033] In the process of issuing the media certificate,

[0034] (1) Control the type of media during media registration management. Keys that are not secure and reliable cannot be registered to ensure the reliability and controllability of the keys for the certificates to be issued.

[0035] (2) After the certificate medium receives the public and private keys of the certificate issued by the CA center, it uses the basic key stored in the medium to decrypt and verify the signature to ensure the authenticity, confidentiality, integrity and non-repudiation of the received certificate private key. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 A schematic structural diagram of a media certificate issuance and management system provided by an exemplary embodiment of the present application is shown.

[0038] Figure 2 A schematic diagram of the structure of another media certificate issuance and management system provided by an exemplary embodiment of the present application is shown.

[0039] Figure 3 A flow chart of a media certificate issuance management method provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0040] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0041] First, the media certificate involved in this application is explained:

[0042] A media certificate usually refers to a digital certificate stored in a physical device (such as a USB Key, smart card, etc.), as opposed to a soft certificate stored in a computer file system. Because media certificates are stored in hardware devices, they are generally considered more secure because they are more difficult to copy or tamper with by unauthorized third parties. The private key of a hard certificate is encrypted and can only be used on the corresponding hardware device, which provides an additional layer of physical security for the certificate. The functions of using media certificates include but are not limited to: ensuring the security of transactions and communications, verifying identity and data integrity through digital signatures; used in various scenarios such as e-government, e-commerce, and enterprise security login; used for code signing to ensure the source and integrity of software code.

[0043] In the process of issuing a media certificate, usually when the medium is connected to a computer device, the certificate is written to form a media certificate. In the relevant process, the writing process of the media certificate lacks the linkage verification between the medium and the computer device.

[0044] Figure 1 A schematic diagram of a media certificate issuance management system provided by an exemplary embodiment of the present application is shown. Figure 1 The system includes a medium registration module 110, a certificate issuance module 120 and a certificate registration module 130. The medium registration module is communicatively connected to the certificate issuance module, and the certificate registration module is communicatively connected to the certificate issuance module.

[0045] It should be noted that in the embodiment of the present application, the media registration module, the certificate issuance module and the media registration module can all be implemented as independent servers, or as three sub-servers with a linked relationship in a server cluster. The embodiment of the present application does not limit the physical implementation form of the above modules.

[0046] In the embodiment of the present application, the medium registration module is used to obtain the information of the medium and generate the medium registration information. Optionally, after the medium device is manufactured, the medium registration module will register the information corresponding to the medium device.

[0047] In the embodiment of the present application, the certificate registration module is used to implement the certificate information system corresponding to the medium certificate. Optionally, the certificate registration module is built with a certificate center database, and the certificate center database includes the certificates to be registered. The certificate is implemented in the form of a digital certificate.

[0048] In an embodiment of the present application, the certificate issuance module is implemented as a server for issuing media certificates. The certificate issuance module is used to verify and send the media certificate after the data verification is completed. Optionally, after the media certificate is issued, the media device can be connected to the computer device to perform the function of the digital certificate external device.

[0049] In this case, please refer to Figure 2 The device further includes a media database 140, which is connected to the media registration module 110 and is used to store media data. In one example, the media database is a database corresponding to the manufacturer of the media device. After the media device is produced, the media number data, manufacturer data, manufacturer data and version data corresponding to the media device will be registered.

[0050] Figure 3 A flow chart of a method for managing the issuance of a media certificate provided by an exemplary embodiment of the present application is shown, and the method is applied to Figure 1 or Figure 2 Taking the media certificate issuance management system shown in the figure as an example, the process includes:

[0051] Step 301: The medium registration module obtains medium information.

[0052] In the embodiment of the present application, the medium information is associated with the medium device.

[0053] Optionally, the media information is stored in a media database, and the media registration module obtains the media information through a data interface with the media database. In the case where a media database exists corresponding to the media certificate issuance system, the media database stores at least one of the media number data, manufacturer data, manufacturer data, and version data corresponding to the media device. In this case, the media registration module obtains the media information through a connection interface with the media database.

[0054] Step 302: The medium registration module encrypts the medium information in combination with the first key to obtain medium registration information.

[0055] In the embodiment of the present application, the first key is a key generated based on the national secret SM4 algorithm, and the first key is a private key, which corresponds to a public key.

[0056] In the embodiment of the present application, the medium registration information is the encrypted medium information.

[0057] Step 303: The media registration module sends the media registration information to the certificate issuing module.

[0058] Step 304: The certificate issuing module receives the medium registration information.

[0059] Step 305: The certificate issuing module verifies the medium registration information.

[0060] In some embodiments of the present application, a public-private key pair is stored in the certificate issuance module, and the first key and the second key are keys generated based on a common public key. The certificate issuance module sends the first key to the media registration module, and sends the second key to the certificate registration module. That is, the certificate issuance module stores a public key, and after generating the first key and the second key based on the public key and in combination with a symmetric algorithm, the certificate issuance module synchronizes the keys with the media registration module and the certificate registration system.

[0061] Step 306: In response to the verification being successful, the certificate issuing module generates first verification information.

[0062] Optionally, after the medium registration information passes the verification of the first key, indicating that the verification between the medium registration system and the certificate issuing system passes, the first verification information is generated. Optionally, the first verification information is implemented as an information field.

[0063] Optionally, if the verification fails, the medium registration information is discarded.

[0064] Step 307: The certificate registration module reads the medium information.

[0065] In the embodiment of the present application, steps 301 to 306 indicate the verification process of the medium information, and steps 307 to 312 indicate the verification process of the certificate information.

[0066] Optionally, the certificate registration module obtains and matches the media certificate from the media registration module. In some embodiments, the media database synchronizes the media information to the certificate registration module.

[0067] Step 308: The certificate registration module encrypts the medium information in combination with the second key to obtain certificate registration information.

[0068] Optionally, the certificate registration module encrypts the same medium information in a symmetrical form to generate certificate registration information, which is used for verification.

[0069] In other embodiments of the present application, the certificate registration information also includes identity authentication information related to the certificate center.

[0070] In the embodiment of the present application, the first key and the second key are keys generated based on a common public key.

[0071] Step 309: The certificate registration module sends the certificate registration information to the certificate issuing module.

[0072] Step 310: The certificate issuing module receives certificate registration information.

[0073] Step 311: The certificate issuing module verifies the certificate registration information.

[0074] This process is the process of verifying the certificate registration information through a symmetric key.

[0075] Step 312: In response to the verification being successful, the certificate issuing module generates second verification information.

[0076] Step 313: The certificate issuing module compares the first verification information with the second verification information to obtain a comparison result.

[0077] Step 314: In response to the comparison result indicating that the comparison is successful, the certificate issuance module generates digital certificate issuance information.

[0078] In the embodiment of the present application, in response to the verification failure, the certificate registration module generates registration verification failure information, which includes the medium registration verification failure status and the detailed reason for the medium registration verification failure, and synchronizes the registration verification failure information to the medium registration module. The medium registration module updates the medium status to registration verification failure, and the registration status and registration verification failure reason of the medium can be queried in the medium registration module, and the specific abnormal problem of the medium device has been determined.

[0079] To summarize, the method and system provided in the embodiments of the present application, during the process of issuing a media certificate, register and register the media-related information through the media registration system, so that during the process of issuing the media certificate, even the media used to bind the certificate can be traced and the authenticity can be confirmed, so as to ensure the reliability and controllability of the media for issuing the certificate.

[0080] The method and system provided in the embodiments of the present application control the type of media during media registration management. Media devices that are not secure and reliable cannot be registered, thereby ensuring the reliability and controllability of the media devices to which certificates are to be issued. After the certificate medium receives the public and private keys of the certificate issued by the certificate center, the basic key stored in the medium is used to decrypt and verify the signature to ensure the authenticity, confidentiality, integrity and non-repudiation of the received certificate private key.

[0081] The above are only optional embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for issuing and managing a media certificate, characterized in that: The method is applied to a media certificate issuance management system, which includes a media registration module, a certificate issuance module and a certificate registration module; The medium registration module is communicatively connected to the certificate issuance module, and the certificate registration module is communicatively connected to the certificate issuance module; The method comprises: The media registration module obtains media information, the media information is associated with the media device; encrypts the media information in combination with the first key to obtain media registration information; and sends the media registration information to the certificate issuance module; The certificate issuing module receives the medium registration information; verifies the medium registration information; and generates first verification information in response to the verification being successful; The certificate registration module reads the medium information, encrypts the medium information in combination with the second key, and obtains the certificate registration information; and sends the certificate registration information to the certificate issuing module; The certificate issuance module receives the certificate registration information; verifies the certificate registration information; generates second verification information in response to the verification being successful; compares the first verification information with the second verification information to obtain a comparison result; generates digital certificate issuance information in response to the comparison result indicating that the comparison is successful; The first key and the second key are keys generated based on a common public key, the first key is used for verification of a medium registration module, and the second key is used for verification of a certificate registration module.

2. The method for issuing and managing media certificates according to claim 1, characterized in that: The system also includes a media database; The media database is connected to the media registration module; The medium registration module obtains medium information, including: The medium registration module obtains the medium information through a connection interface with the medium database.

3. The method for issuing and managing media certificates according to claim 2, characterized in that: The media database stores at least one of media number data, manufacturer data, manufacturer data, and version data corresponding to the media device.

4. The method for issuing and managing media certificates according to claim 1, characterized in that: The method further comprises: The certificate issuing module sends a first key to the medium registration module, and sends a second key to the certificate registration module.

5. The method for issuing and managing media certificates according to claim 4, characterized in that: The method further comprises: In response to verification failure, the certificate issuing module discards the medium registration information.

6. The method for issuing and managing media certificates according to claim 3, characterized in that: The verifying the certificate registration information includes: The certificate issuing module verifies the certificate registration information using a symmetric key corresponding to the first key.

7. The method according to claim 6, characterized in that The method further comprises: In response to verification failure, the certificate issuing module generates issuance failure information; and synchronizes the issuance failure information to the medium registration module and the certificate registration module.

8. The method according to claim 3, characterized in that The first key and the second key are private keys generated based on the SM4 encryption algorithm.

9. A media certificate issuance and management system, characterized in that: The media certificate issuance management system includes a media registration module, a certificate issuance module and a certificate registration module; The medium registration module is communicatively connected to the certificate issuance module, and the certificate registration module is communicatively connected to the certificate issuance module; The media certificate issuance management system is used to execute the media certificate issuance management method as described in any one of claims 1 to 8.

Images