Encryption key import method and system based on national secret USB-key

Abstract

The invention discloses an encryption key import method and system based on a national secret USB-key. The encryption key import method based on the national secret USB-key comprises the steps that a server generates a communication key pair and sends a communication public key to a client; the server side obtains a to-be-imported encryption key pair safely transmitted by the client side based on the communication public key; the server generates a decrypted encryption key pair, then generates a protected encryption key pair and imports the protected encryption key pair into the national secret USB-key; and the server performs data encryption and decryption by using the national secret USB-key based on the data encryption and decryption request of the client. The invention discloses an encryption key importing method based on a national secret USB-key, and aims to solve the problems that a user cannot intuitively import an encryption key pair into the USB-key, the encryption key pair cannot be safely transmitted, and the encryption key cannot be imported and used by using remote procedure calling.

Description

Technical Field

[0001] The present invention relates to the field of national secret USB-key encryption technology, and in particular to a method and system for importing an encryption key based on a national secret USB-key. Background Art

[0002] For the application of USB-key devices that support the national secret algorithm, the state has promulgated an industry standard "Intelligent Password Key Application Interface Specification" (GM / T0016-2012). The USB-key devices with the national secret algorithm sold on the market also (in fact, they must) support this interface specification. Therefore, as long as the application is developed according to this specification, it can be compatible with USB-key products of different manufacturers and brands. Since the function names in this specification all start with SKF, we generally call the device development interface library provided according to this specification SKF library or SKF interface.

[0003] The existing encryption key import method is generally to directly call the SKF interface for encryption key import provided by USB-key. This method requires users to fully understand the encryption key import mechanism. It is very difficult for users who have not been deeply exposed to national encryption standards to understand how to use it. In addition, the method of directly calling through the API has no scalability. The local application can only link the SKF library and call the SKF API to import the encryption key. Summary of the invention

[0004] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, a method and system for importing an encryption key based on a national secret USB-key are provided. The present invention aims to solve the problem that users cannot intuitively import encryption key pairs into a USB-key, the problem of secure transmission of encryption key pairs, and the problem of being unable to use remote procedure calls to import and use encryption keys.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: A method for importing an encryption key based on a national secret USB-key comprises the following steps: S1, the server generates a key pair for communication and sends the communication public key to the client; S2, the server obtains the encryption key pair to be imported that is securely transmitted by the client based on the communication public key; S3, the server generates a decryption encryption key pair and then generates a protected encryption key pair and imports it into the national encryption USB-key; S4, the server uses the national secret USB-key to encrypt and decrypt data based on the client's data encryption and decryption request.

[0006] Optionally, step S1 includes: based on the client's remote request, the server generates a communication key pair consisting of a communication public key and a communication private key using the national secret USB-key and stores it in the national secret USB-key, and returns the communication public key to the client that initiates the remote request.

[0007] Optionally, the generating a communication key pair consisting of a communication public key and a communication private key by using the national secret USB-key refers to generating a communication key pair consisting of a communication public key and a communication private key by using the SM2 national secret algorithm in the national secret USB-key.

[0008] Optionally, the communication key pair in step S1 is an RSA key pair or an ECC key pair.

[0009] Optionally, the encryption key pair to be imported obtained by the server in step S2 based on the secure transmission of the communication public key by the client includes a first public key, an encrypted first private key and its own identity authentication information, wherein the encryption key pair to be imported consists of the first public key and the first private key, and the encrypted first private key is obtained by encrypting the first private key using the communication public key.

[0010] Optionally, step S3 includes: the server authenticates the identity authentication information in the encryption key pair import request, and after the authentication is passed, uses the communication private key to decrypt the encrypted first private key to obtain the original encryption key pair to be imported; uses a preset or temporarily generated session key to encrypt the first private key, and obtains the communication public key stored in the national secret USB-key to encrypt the session key to obtain an encrypted session key, wherein the preset session key is a string from a fixed character array, and the temporarily generated session key is a random number generated by calling the national secret USB-key, or a random number generated by a function or interface; organizes the first public key, the first private key encrypted by the session key, and the encrypted session key into a protected encryption key pair, and calls the API interface of the national secret USB-key to import the encryption key pair to import the protected encryption key pair.

[0011] Optionally, the server's response to the client's data encryption request in step S4 includes: obtaining the client's data encryption request, sending the client's data encryption request to the national secret USB-key, obtaining the national secret USB-key using the imported protected encryption key pair to encrypt the data in the data encryption request to obtain the encrypted data, and returning the encrypted data to the client that initiated the data encryption request; the server's response to the client's data decryption request in step S4 includes: obtaining the client's data decryption request, sending the client's data decryption request to the national secret USB-key, obtaining the national secret USB-key using the imported protected encryption key pair to decrypt the encrypted data in the data decryption request to obtain the original data, and returning the original data to the client that initiated the data decryption request.

[0012] In addition, the present invention also provides an encryption key import system based on the national secret USB-key, including a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the encryption key import method based on the national secret USB-key.

[0013] In addition, the present invention also provides a computer-readable storage medium, which stores a computer program or instruction, and the computer program or instruction is programmed or configured to execute the encryption key import method based on the national secret USB-key through a processor.

[0014] In addition, the present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the encryption key import method based on the national secret USB-key through a processor.

[0015] Compared with the prior art, the present invention mainly has the following advantages: 1. The method of the present invention is used to complete the import of encryption keys in the national secret USB-key. Users only need to know the encryption key pair they want to import, and do not need to understand the implementation mechanism of the national secret USB-key encryption key import, and do not need to perform complicated operations such as generating symmetric keys, symmetric key encryption, and private key encryption.

[0016] 2. The method of the present invention can import and use encryption keys securely through remote procedure calls, which greatly increases the scalability and ease of use of the national encryption USB-key.

[0017] 3. The method of the present invention uses the key pair generated inside the national secret USB-key for transmission encryption and decryption, and uses the symmetric key and the signature public key in the USB-key for encryption. The sensitive data (SSP) between the client and the server, and between the server and the national secret USB-key are encrypted and transmitted using the national secret algorithm, which ensures the security of the import of the encryption key pair to a certain extent.

[0018] 4. Since the part of the method of the present invention involving key transmission uses the national encryption algorithm that complies with the national encryption standard, if the USB-key supports the national encryption standard, the system using the present invention also supports the national encryption standard in terms of encryption key import and use. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 The following is a basic flow chart of the method according to the embodiment of the present invention.

[0020] Figure 2 It is the position of the encryption key import and encryption / decryption system in the application hierarchy in the embodiment of the present invention.

[0021] Figure 3 This is a flow chart after the server receives a key pair request for establishing communication in an embodiment of the present invention.

[0022] Figure 4 The flowchart of importing an encryption key pair in an embodiment of the present invention.

[0023] Figure 5 This is a flow chart of data encryption and decryption using the national secret USB-key after importing the encryption key pair in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] When a user uses a USB-key, it is necessary to import an encryption key into the USB-key before using its encryption and decryption functions. However, the method of importing an encryption key is often complicated. Only by understanding the specific logic of importing an encryption key into the USB-key can it be used normally. This is inconsistent with the user's normal need to import a key pair, and does not conform to conventional usage logic. The present invention aims to solve the problem that the user cannot intuitively import an encryption key pair into the USB-key, the problem of secure transmission of the encryption key pair, and the problem that the encryption key cannot be imported and used using a remote procedure call. It aims to shield the user's need to import a key and the difference in the use of the USB-key, improve the ease of use, and improve the scalability and security of key importing by means of remote procedure calls and encryption and decryption using the internal session key of the USB-key. The specific implementation of the present invention is described below.

[0025] like Figure 1 As shown, the encryption key import method based on the national secret USB-key in this embodiment includes the following steps: S1, the server generates a key pair for communication and sends the communication public key to the client; S2, the server obtains the encryption key pair to be imported that is securely transmitted by the client based on the communication public key; S3, the server generates a decryption encryption key pair and then generates a protected encryption key pair and imports it into the national encryption USB-key; S4, the server uses the national secret USB-key to encrypt and decrypt data based on the client's data encryption and decryption request.

[0026] like Figure 2 As shown, the client in this embodiment refers to the client that initiates the remote procedure call, and the server refers to the system for importing and encrypting and decrypting encryption keys. The client cannot directly access the national secret USB-key. Only the server can access the national secret USB-key (smart password key) through the smart password key application interface.

[0027] The communication key pair can be generated by software or hardware as needed. For example, as an optional implementation, step S1 in this embodiment includes: the server generates a communication key pair consisting of a communication public key and a communication private key using the national secret USB-key based on the client's remote request and stores it in the national secret USB-key, and returns the communication public key to the client that initiated the remote request. As an optional implementation, in this embodiment, using the national secret USB-key to generate a communication key pair consisting of a communication public key and a communication private key refers to using the SM2 national secret algorithm in the national secret USB-key to generate a communication key pair consisting of a communication public key and a communication private key, wherein the communication key pair can be an RSA key pair or an ECC key pair, etc. Figure 3 As shown, the communication process between the client and the server in this embodiment includes: S1.1, the client initiating the remote procedure call requests the creation of a communication key pair (SM2 key pair) for communication; S1.2, after receiving the request, the server initiates a request to create a communication key pair (SM2 key pair) to the National Cryptography USB-key; S1.3, the national secret USB-key generates a communication key pair (SM2 key pair) and returns it to the server; S1.4, the server stores the communication public key and communication private key of the communication key pair (SM2 key pair) in the national secret USB-key respectively, and returns the communication public key to the client that initiated the remote request.

[0028] like Figure 3 As shown, in step S2 of this embodiment, the encryption key pair to be imported by the client based on the secure transmission of the communication public key obtained by the server includes the first public key, the encrypted first private key and the identity authentication information of the client, wherein the encryption key pair to be imported consists of the first public key and the first private key, and the encrypted first private key is obtained by encrypting the first private key using the communication public key. Figure 3 As shown in the figure, the secure transmission process of the encryption key pair to be imported includes: S2.1, the client initiating the remote procedure call requests to generate an encryption key pair to be imported, and uses the communication public key to encrypt the first private key to obtain the encrypted first private key; S2.2, the client generates an encryption key pair import request based on the first public key, the encrypted first private key and its own identity authentication information and sends it to the server, so that the server obtains the encryption key pair to be imported by the client based on the secure transmission of the communication public key.

[0029] like Figure 4 As shown, step S3 includes: S3.1, the server authenticates the identity authentication information in the encryption key pair import request, and after the authentication is passed, uses the communication private key to decrypt the encrypted first private key to obtain the original encryption key pair to be imported (first public key and first private key); S3.2, the server calls the random number generated by the national secret USB-key to create a temporarily generated session key; the encryption key pair imported in this embodiment is the encryption key pair of the SM4 national secret algorithm, so the session key also becomes the SM3 session key; S3.3, encrypting the first private key using the session key; S3.4, obtain the communication public key stored in the national secret USB-key and encrypt the session key to obtain the encrypted session key; S3.5, organizing the first public key, the first private key encrypted by the session key, and the encrypted session key into a protected encryption key pair; S3.6, call the API interface (SKF interface) of the national encryption USB-key to import the encryption key pair to import the protected encryption key pair.

[0030] It should be noted that the session key can not only be a random number generated by calling the National Cryptography USB-key, but also a preset session key or a random number generated by other means, such as a string from a fixed character array, a random number generated by a function or interface software, and a random number generated by other hardware other than the National Cryptography USB-key.

[0031] like Figure 5 As shown, the server's response to the client's data encryption request in step S4 of this embodiment includes: obtaining the client's data encryption request, sending the client's data encryption request to the national secret USB-key, obtaining the encrypted data obtained by encrypting the data in the data encryption request using the imported protected encryption key pair of the national secret USB-key, and returning the encrypted data to the client that initiated the data encryption request.

[0032] like Figure 5 As shown, the response of the server to the data decryption request of the client in step S4 of this embodiment includes: obtaining the data decryption request of the client, sending the data decryption request of the client to the national secret USB-key, obtaining the original data obtained after the national secret USB-key uses the imported protected encryption key to decrypt the encrypted data in the data decryption request, and returning the original data to the client that initiated the data decryption request.

[0033] In summary, the encryption key import system (server end) of the encryption key import method based on the national secret USB-key in this embodiment uses USB-key to generate a pair of SM2 key pairs, which can be RSA key pairs or ECC key pairs, for data transmission encryption and decryption of remote procedure calls. The public and private keys are saved in the USB-key file respectively, and the public key is output to the caller (client, which should have completed identity authentication through the authentication method supporting the national secret algorithm). The client generates its own encryption key pair as the encryption key pair to be imported into the USB-key. The private key in the encryption key pair is encrypted using the public key generated in the previous step, and the encrypted private key, the public key to be imported, and other authentication information are sent to the service party. After the server authenticates the identity of the client, the private key stored in the USB-key file is used to decrypt the private key in the encryption key pair transmitted by the caller. Then a string of random numbers is generated in the USB-key as a temporary session key, the private key is encrypted by the session key, and then the session key is encrypted. In this way, the public key in the encryption key pair, the encryption key private key after the session key is encrypted, and the encrypted session key is organized into a protected encryption key pair. Finally, the above encryption key structure is imported into the container through the SKF interface for importing encryption keys through the USB-key, and the client can subsequently use the encryption and decryption interface of the server to perform encryption and decryption operations on the data. The encryption key import based on the national secret USB-key in this embodiment can solve the problem that users cannot intuitively import encryption key pairs into USB-key, the problem of secure transmission of encryption key pairs, and the problem of being unable to use remote procedure calls to import and use encryption keys. The encryption key import and use support the national secret specifications. The method of this embodiment generates a key pair in the USB-key and performs encryption and decryption of remote procedure calls, which has high communication security. By organizing session keys, signature keys, and protected encryption keys on the server side, the problem that users import encryption key pairs is complicated and counterintuitive is solved. By fully using the SM2 and SM4 national secret algorithms in the national secret USB-key, the method of this embodiment also supports the national secret specifications in terms of encryption keys. The encryption key import method based on the national secret USB-key in this embodiment shields the user's need to import keys and the difference in USB-key usage, thereby improving ease of use. The key import scalability and security are improved by using the remote procedure call method and the method of using the USB-key internal session key for encryption and decryption.

[0034] In addition, this embodiment also provides an encryption key import system based on the national secret USB-key, including a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the encryption key import method based on the national secret USB-key.

[0035] In addition, this embodiment also provides a computer-readable storage medium, which stores a computer program or instruction, and the computer program or instruction is programmed or configured to execute the encryption key import method based on the national secret USB-key through a processor.

[0036] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the encryption key import method based on the national secret USB-key through a processor.

[0037] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0038] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A method for importing encryption keys based on a national secret USB-key, characterized in that: The steps include: S1, the server generates a key pair for communication and sends the communication public key to the client; S2, the server obtains the encryption key pair to be imported that is securely transmitted by the client based on the communication public key; S3, the server generates a decryption encryption key pair and then generates a protected encryption key pair and imports it into the national encryption USB-key; S4, the server uses the national secret USB-key to encrypt and decrypt data based on the client's data encryption and decryption request.

2. The method for importing encryption keys based on the national secret USB-key according to claim 1 is characterized in that: Step S1 includes: based on the remote request of the client, the server generates a communication key pair consisting of a communication public key and a communication private key using the national secret USB-key and stores it in the national secret USB-key, and returns the communication public key to the client that initiates the remote request.

3. The method for importing encryption keys based on the national secret USB-key according to claim 2 is characterized in that: The use of the national secret USB-key to generate a communication key pair consisting of a communication public key and a communication private key refers to using the SM2 national secret algorithm in the national secret USB-key to generate a communication key pair consisting of a communication public key and a communication private key.

4. The method for importing encryption keys based on the national secret USB-key according to claim 1, characterized in that: The communication key pair in step S1 is an RSA key pair or an ECC key pair.

5. The method for importing encryption keys based on the national secret USB-key according to claim 1, characterized in that: In step S2, the encryption key pair to be imported obtained by the server based on the secure transmission of the communication public key by the client includes the first public key, the encrypted first private key and the client's own identity authentication information, wherein the encryption key pair to be imported consists of the first public key and the first private key, and the encrypted first private key is obtained by encrypting the first private key using the communication public key.

6. The method for importing encryption keys based on the national secret USB-key according to claim 1, characterized in that: Step S3 includes: the server authenticates the identity authentication information in the encryption key pair import request, and after the authentication is passed, uses the communication private key to decrypt the encrypted first private key to obtain the original encryption key pair to be imported; uses the preset or temporarily generated session key to encrypt the first private key, and obtains the communication public key stored in the national secret USB-key to encrypt the session key to obtain the encrypted session key, wherein the preset session key is a string from a fixed character array, and the temporarily generated session key is a random number generated by calling the national secret USB-key, or a random number generated by a function or interface; organizes the first public key, the first private key encrypted by the session key, and the encrypted session key into a protected encryption key pair, and calls the API interface of the national secret USB-key to import the encryption key pair to import the protected encryption key pair.

7. The method for importing encryption keys based on the national secret USB-key according to claim 1, characterized in that: In step S4, the server's response to the client's data encryption request includes: obtaining the client's data encryption request, sending the client's data encryption request to the national secret USB-key, obtaining the national secret USB-key using the imported protected encryption key pair to encrypt the data in the data encryption request to obtain the encrypted data, and returning the encrypted data to the client that initiated the data encryption request; in step S4, the server's response to the client's data decryption request includes: obtaining the client's data decryption request, sending the client's data decryption request to the national secret USB-key, obtaining the national secret USB-key using the imported protected encryption key pair to decrypt the encrypted data in the data decryption request to obtain the original data, and returning the original data to the client that initiated the data decryption request.

8. An encryption key import system based on a national secret USB-key, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the encryption key import method based on the national secret USB-key as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the encryption key import method based on the national secret USB-key described in any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the encryption key import method based on the national secret USB-key described in any one of claims 1 to 7 through a processor.

Images