Method and device for encrypting data by using identity card security chip

Abstract

The embodiment of the invention relates to a method and a device for encrypting data by using an identity card security chip. The method comprises the following steps: acquiring a serial number and a random number of an identity card; performing Boolean operation on the identity card serial number and the random number to generate a first digital code; obtaining a first encrypted ciphertext generated by encrypting the first digital code by the main control module through the identity card key; performing digital signature on the first encrypted ciphertext through an SM2 preset signature private key of a data receiver to generate signature data; sending the signature data to a data sending client; the data sending client carries out signature verification through an SM2 preset signature public key of a data receiver, if the signature verification is passed, the first encrypted ciphertext in the signature data is used as a data encryption key, and the data encryption key is used to carry out encryption processing on the to-be-encrypted data to generate a second encrypted ciphertext; and receiving the second encrypted ciphertext, and performing decryption operation on the second encrypted ciphertext by using the first encrypted ciphertext to generate a decrypted plaintext corresponding to the second encrypted ciphertext.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a method and device for encrypting data using an identity card security chip. Background Art

[0002] At present, special security chips are needed for secure data transmission. However, security chips are a scarce resource in our country. Increasing the reuse of security chips and thus saving a large amount of integrated circuit security chip resources has become an urgent problem to be solved. Summary of the invention

[0003] The purpose of the present invention is to address the defects of the prior art and provide a method and device for encrypting data using an identity card security chip. The identity card security chip generates a data encryption key with a digital signature. The data sending client encrypts the data to be transmitted using the data encryption key and transmits it to the data recipient. The identity card security chip is reused during the data encryption process, and data encryption protection is achieved without the need for other additional security chips, thereby saving security chip resources.

[0004] To achieve the above-mentioned purpose, the first aspect of the present invention provides a method for encrypting data using an ID card security chip, comprising:

[0005] Obtain the ID card serial number in the user data storage module of the ID card security chip; the ID card is the data recipient's ID card;

[0006] Get the random number generated by the random number generator of the ID card security chip;

[0007] Perform a Boolean operation on the ID card serial number and the random number to generate a first digital code;

[0008] The main control module of the identity card security chip obtains a first encrypted ciphertext generated by encrypting the first digital code with the identity card key based on a preset encryption algorithm;

[0009] Digitally signing the first encrypted ciphertext using the SM2 preset signature private key of the data recipient to generate signature data;

[0010] Send the signed data to the data sending client; the data sending client performs signature verification through the SM2 preset signature public key of the data recipient. If the signature verification passes, the first encrypted ciphertext in the signed data is used as the data encryption key, and the data to be encrypted is encrypted using the data encryption key based on the national secret symmetric algorithm to generate a second encrypted ciphertext;

[0011] Receive the second encrypted ciphertext sent by the data sending client, and use the first encrypted ciphertext to perform a decryption operation on the second encrypted ciphertext based on the national secret symmetric algorithm to generate a decrypted plaintext corresponding to the second encrypted ciphertext.

[0012] Further, the obtaining of the ID card serial number in the user data storage module of the ID card security chip is specifically:

[0013] Sending a first APDU command to the NFC communication module of the ID card security chip;

[0014] The NFC communication module forwards the first APDU instruction to the main control module of the ID card security chip;

[0015] The main control module identifies the first APDU instruction;

[0016] If it is an ID card serial number acquisition instruction, the ID card serial number is read from the first storage location specified in the user data storage module and sent to the NFC communication module;

[0017] Receive the ID card serial number sent by the NFC communication module.

[0018] Further, the random number generated by the random number generator of the identity card security chip is obtained, specifically:

[0019] Sending a second APDU command to the NFC communication module;

[0020] The NFC communication module forwards the second APDU instruction to the main control module;

[0021] The main control module identifies the second APDU instruction;

[0022] If it is a random number generation instruction, calling the random number generator to generate a random number, obtaining a corresponding random number, and temporarily storing the random number in a second storage location specified in the user data storage module;

[0023] Reading the random number from the second storage location and sending it to the NFC communication module;

[0024] Receive the random number sent by the NFC communication module.

[0025] Furthermore, the main control module for obtaining the ID card security chip encrypts the first digital code with the ID card key based on a preset encryption algorithm to generate a first encrypted ciphertext, which is specifically:

[0026] Sending a third APDU command to the NFC communication module;

[0027] The NFC communication module forwards the third APDU instruction to the main control module;

[0028] The main control module identifies the third APDU instruction;

[0029] If it is an internal verification instruction, extract the first digital code in the parameter carried by the third APDU instruction; extract the ID card key in the key storage module of the ID card security chip; based on a preset encryption algorithm, encrypt the first digital code with the ID card key to generate a first encrypted ciphertext, and send it to the NFC communication module;

[0030] Receive the first encrypted ciphertext sent by the NFC communication module.

[0031] Further, the digitally signing the first encrypted ciphertext by using the SM2 preset private key of the data receiving client to generate signature data specifically includes:

[0032] The first encrypted ciphertext is encrypted using the SM2 preset private key of the data recipient to generate signature data.

[0033] Further, the data sending client performs signature verification through the SM2 preset public key of the data recipient. If the signature verification passes, the first encrypted ciphertext in the signature data is used as the data encryption key, specifically:

[0034] The data sending client decrypts the signature data through the SM2 preset public key of the data recipient; if the decryption is successful, the first encrypted ciphertext is used as the data encryption key, wherein the first encrypted ciphertext is consistent with the plaintext of the signature data after decryption.

[0035] Furthermore, the Boolean operation is an exclusive-OR operation.

[0036] A second aspect of the present invention provides a device for encrypting data using an ID card security chip, the device comprising:

[0037] The first data acquisition module is used to acquire the ID card serial number in the user data storage module of the ID card security chip; the ID card is the data recipient's ID card;

[0038] A second data acquisition module is used to obtain a random number generated by a random number generator of the identity card security chip;

[0039] A first data processing module, used for performing a Boolean operation on the ID card serial number and the random number to generate a first digital code;

[0040] A third data acquisition module, used for acquiring a first encrypted ciphertext generated by encrypting the first digital code with the ID card key based on a preset encryption algorithm by the main control module of the ID card security chip;

[0041] A second data processing module, used to digitally sign the first encrypted ciphertext using the SM2 preset private key of the data recipient to generate signature data;

[0042] A data sending module is used to send the signed data to a data sending client; the data sending client performs signature verification through the SM2 preset public key of the data recipient. If the signature verification passes, the first encrypted ciphertext in the signed data is used as the data encryption key, and the data to be encrypted is encrypted using the data encryption key based on the national secret symmetric algorithm to generate a second encrypted ciphertext;

[0043] The third data processing module is used to receive the second encrypted ciphertext sent by the data sending client, and use the first encrypted ciphertext to perform a decryption operation on the second encrypted ciphertext based on the national secret symmetric algorithm to generate a decrypted plaintext corresponding to the second encrypted ciphertext.

[0044] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0045] A fourth aspect of the present invention provides a controller, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of any one of the methods described in the first aspect.

[0046] The embodiment of the present invention provides a method and device for encrypting data using an ID card security chip, and related products. The ID card security chip generates a data encryption key with a digital signature. The data sending client encrypts the data to be transmitted using the data encryption key and transmits it to the data recipient. The ID card security chip is reused during the data encryption process, and data encryption protection is achieved without the need for other additional security chips, thereby saving security chip resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A flowchart of a method for encrypting data using an ID card security chip provided in Embodiment 1 of the present invention;

[0048] Figure 2 A schematic diagram of the structure of a device for encrypting data using an ID card security chip provided in Embodiment 2 of the present invention;

[0049] Figure 3 This is a schematic diagram of the controller structure provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] The embodiment of the present invention provides a method and device for encrypting data using an ID card security chip. The ID card security chip generates a data encryption key with a digital signature. The data sending client encrypts the data to be transmitted using the data encryption key and transmits it to the data recipient. The ID card security chip is reused during the data encryption process, and data encryption protection is achieved without the need for other additional security chips, thereby saving security chip resources.

[0052] Embodiment 1

[0053] The ID card of the present application is an ID card with a security chip, and the security chip has an encryption function. At present, the ID card has been updated to the second-generation ID card, and the following embodiments are described by taking the second-generation ID card as an example. The second-generation ID card is an important tool for Chinese citizens to identify their identities. Its built-in security chip is an integrated circuit chip, including a main control module, a near field communication (Near Field Communication, NFC) module, a storage module, a random number generator and a user data storage module. Wherein, the main control module is used to parse and execute a series of smart card application protocol data units (Application Protocol Data Unit, APDU) instructions, the NFC communication module is used to process NFC signal transceiver, and the storage module uses EEPROM or FLASH media as storage media on the second-generation ID card. Based on the stored content, it can be divided into a system data storage module, a user data storage module and a key storage module.

[0054] Figure 1 This is a flowchart of a method for encrypting data using an ID card security chip provided in the first embodiment of the present invention. Figure 1 , the technical solution of the present invention is described with specific embodiments.

[0055] Step 110, obtaining the ID card serial number in the user data storage module of the ID card security chip; the ID card is the data recipient's ID card.

[0056] Specifically, the data receiving client sends a first APDU instruction to the NFC communication module of the ID card security chip; the NFC communication module forwards the first APDU instruction to the main control module of the ID card security chip; the main control module identifies the first APDU instruction. If it is an ID card serial number acquisition instruction, the ID card serial number is read from the first storage location specified in the user data storage module and sent to the NFC communication module; the data receiving client receives the ID card serial number sent by the NFC communication module.

[0057] Step 120, obtaining a random number generated by a random number generator of the identity card security chip.

[0058] Specifically, the data receiving client sends a second APDU instruction to the NFC communication module; the NFC communication module forwards the second APDU instruction to the main control module; the main control module identifies the second APDU instruction; if it is an instruction to generate a random number, call the random number generator to generate a random number, obtain a corresponding random number, and temporarily save the random number in a second storage location specified in the user data storage module; read the random number from the second storage location and send it to the NFC communication module; the data receiving client receives the random number sent by the NFC communication module.

[0059] Step 130, perform a Boolean operation on the ID card serial number and the random number to generate a first digital code. Optionally, the Boolean operation is an exclusive OR operation.

[0060] Step 140 , obtaining a first encrypted ciphertext generated by encrypting the first digital code using the ID card key based on a preset encryption algorithm by the main control module of the ID card security chip.

[0061] Specifically, the data receiving client sends a third APDU instruction to the NFC communication module; the NFC communication module forwards the third APDU instruction to the main control module; the main control module identifies the third APDU instruction; if it is an internal verification instruction, extract the first digital code in the parameter carried by the third APDU instruction; extract the ID card key in the key storage module of the ID card security chip; based on a preset encryption algorithm, encrypt the first digital code with the ID card key to generate a first encrypted ciphertext, and send it to the NFC communication module; the data receiving client receives the first encrypted ciphertext sent by the NFC communication module.

[0062] Step 150: Digitally sign the first encrypted ciphertext using the SM2 preset signature private key of the data recipient client to generate signature data.

[0063] Specifically, the data receiving client generates an SM2 signature public-private key pair in advance. The signature private key is retained by the data receiving client, and the signature public key is sent to the data sending client. Data encrypted with the signature public key can only be decrypted by the corresponding signature private key. Conversely, data encrypted with the signature private key can only be decrypted by the corresponding signature public key.

[0064] Step 160, sending the signed data to the data sending client; the data sending client performs signature verification through the SM2 preset signature public key of the data recipient. If the signature verification passes, the first encrypted ciphertext in the signed data is used as the data encryption key, and the data to be encrypted is encrypted using the data encryption key based on the national secret symmetric algorithm to generate a second encrypted ciphertext. The data to be encrypted includes text, images, or graphics, etc. Optionally, the national secret symmetric algorithm is the SM4 national secret symmetric algorithm.

[0065] In combination with step 150 and step 160, when the first encrypted ciphertext is transmitted to the data sender client, since the first encrypted ciphertext is used as the data encryption key for the data to be transmitted, the security and confidentiality of the first encrypted ciphertext must be guaranteed. When signing the data, data cannot be transmitted in plain text.

[0066] In a possible implementation, the method of generating and verifying signature data is as follows: the data sender client generates an encrypted public-private key pair in advance, the encrypted private key is retained by the data sender client, and the encrypted public key is sent to the data receiver client. The first encrypted ciphertext is encrypted with the encrypted public key to generate ciphertext A, the first encrypted ciphertext is hashed to generate hash value A, the hash value A is encrypted with the SM2 preset signature private key of the data receiver to generate signature A, signature A and ciphertext A are sent to the data sender client, the data sender client decrypts ciphertext A with the encrypted private key, and hashes the decrypted plaintext to generate hash value B, the data sender client decrypts signature A with the SM2 preset signature public key of the data receiver to obtain hash value A, and compares hash value A and hash value B. If they are the same, the plaintext of ciphertext A is available, and the plaintext is consistent with the content of the first encrypted ciphertext.

[0067] In another possible implementation, the method of generating and verifying the signature data is as follows: the data sender client generates an encryption public-private key pair in advance, the encryption private key is retained by the data sender client, and the encryption public key is sent to the data receiver client. The first encrypted ciphertext is encrypted with the encryption public key to generate ciphertext B, ciphertext B is hashed to generate a hash value C of ciphertext B, hash value C is encrypted with the SM2 preset signature private key of the data receiver to generate signature B, signature B and ciphertext B are sent to the data sender client, the data sender client performs a hash operation on ciphertext B to generate a hash value D, the data sender client decrypts signature B with the SM2 preset signature public key of the data receiver to obtain hash value C, compares hash value C and hash value D, if they are the same, the plaintext of ciphertext B is available, ciphertext B is decrypted with the encryption private key to obtain the plaintext of ciphertext B, and the plaintext is consistent with the content of the first encrypted ciphertext.

[0068] In the above implementation, when verifying the signature, the hash value calculated after the first encrypted ciphertext is encrypted is compared. This ensures the security of the first encrypted ciphertext during transmission, and it is no longer necessary to decrypt the encrypted first encrypted ciphertext and calculate the hash value when verifying the signature, thereby improving the signature verification rate.

[0069] In another possible implementation, the signature data is generated and verified as follows: the first encrypted ciphertext is encrypting the data with the SM2 preset signature private key of the data recipient to generate signature data; the data sending client decrypts the signature data with the SM2 preset signature public key of the data recipient; if the decryption is successful, the first encrypted ciphertext is used as the data encryption key, wherein the first encrypted ciphertext is consistent with the plaintext of the signature data after decryption.

[0070] In the above implementation, since the first encrypted ciphertext is generated by the first digital code, which is generated by Boolean operation of the ID card serial number and a random number, and the first encrypted ciphertext occupies a small number of characters, when performing digital signature, the first encrypted ciphertext is not hashed, and the first encrypted ciphertext is directly encrypted to generate signature data. The ciphertext of the signature data contains the content of the first encrypted ciphertext, and does not need to be transmitted separately to the data sender client. When verifying the signature, as long as the signature data is successfully decrypted by the SM2 preset public key of the data receiver, it can be regarded as a successful signature verification, and there is no need to compare the hash value. The digital signature and signature verification method is simple, safe, and efficient.

[0071] In another possible implementation, the signature data is generated and verified in the following manner: the first encrypted ciphertext is padded with a complement code, and the first encrypted ciphertext padded with a complement code is encrypted with the SM2 preset signature private key of the data receiver to generate signature data; the data sending client decrypts the signature data with the SM2 preset signature public key of the data receiver; if the decryption is successful, the complement code rule is verified, and if the verification is passed, the decrypted plaintext without the complement code rule is available, and its content is consistent with the first encrypted ciphertext. The security of the transmitted data is further enhanced by padded with a complement code on the first encrypted ciphertext.

[0072] Step 170, receiving the second encrypted ciphertext sent by the data sending client, and using the first encrypted ciphertext to perform a decryption operation on the second encrypted ciphertext based on the national secret symmetric algorithm to generate a decrypted plaintext corresponding to the second encrypted ciphertext.

[0073] An embodiment of the present invention provides a method for encrypting data using an ID card security chip. The ID card security chip generates a data encryption key with a digital signature. The data sending client encrypts the data to be transmitted using the data encryption key and transmits it to the data receiving party. The ID card security chip is reused during the data encryption process, and data encryption protection is achieved without the need for other additional security chips, thereby saving security chip resources. A digital signature is added when the data encryption key is transmitted, thereby ensuring the correctness of the transmission identity of the data encryption key.

[0074] Embodiment 2

[0075] Embodiment 2 of the present invention provides a device for encrypting data using an ID card security chip. Figure 2 The schematic diagram of the structure of the data encryption device using the ID card security chip provided in the second embodiment of the present invention is as follows: Figure 2 As shown, the data encryption device 200 using the ID card security chip includes a first data acquisition module 201, a second data acquisition module 202, a first data processing module 203, a third data acquisition module 204, a second data processing module 205, a data sending module 206, and a third data processing module 207.

[0076] The first data acquisition module 201 is used to acquire the ID card serial number in the user data storage module of the ID card security chip; the ID card is the data recipient's ID card.

[0077] The ID card serial number in the user data storage module of the ID card security chip is obtained as follows:

[0078] Send a first APDU instruction to the NFC communication module of the ID card security chip; the NFC communication module forwards the first APDU instruction to the main control module of the ID card security chip; the main control module identifies the first APDU instruction; if it is an ID card serial number acquisition instruction, read the ID card serial number from the first storage location specified in the user data storage module and send it to the NFC communication module; receive the ID card serial number sent by the NFC communication module.

[0079] The second data acquisition module 202 is used to acquire the random number generated by the random number generator of the identity card security chip.

[0080] Among them, obtaining the random number generated by the random number generator of the identity card security chip is specifically as follows: sending a second APDU instruction to the NFC communication module; the NFC communication module forwards the second APDU instruction to the main control module; the main control module identifies the second APDU instruction; if it is an instruction to generate a random number, calling the random number generator to generate a random number, obtaining a corresponding random number, and temporarily saving the random number in a second storage location specified in the user data storage module; reading the random number from the second storage location and sending it to the NFC communication module; receiving the random number sent by the NFC communication module.

[0081] The first data processing module 203 is used to perform a Boolean operation on the ID card serial number and the random number to generate a first digital code.

[0082] The third data acquisition module 204 is used to obtain the first encrypted ciphertext generated by the main control module of the identity card security chip encrypting the first digital code with the identity card key based on a preset encryption algorithm.

[0083] Among them, the main control module of the identity card security chip encrypts the first digital code with the identity card key based on a preset encryption algorithm to generate a first encrypted ciphertext, specifically: sending a third APDU instruction to the NFC communication module; the NFC communication module forwards the third APDU instruction to the main control module; the main control module identifies the third APDU instruction; if it is an internal verification instruction, extract the first digital code in the parameters carried by the third APDU instruction; extract the identity card key in the key storage module of the identity card security chip; based on the preset encryption algorithm, encrypt the first digital code with the identity card key to generate a first encrypted ciphertext, and send it to the NFC communication module; receive the first encrypted ciphertext sent by the NFC communication module.

[0084] The second data processing module 205 is used to digitally sign the first encrypted ciphertext using the SM2 preset private key of the data recipient to generate signature data.

[0085] Among them, digitally signing the first encrypted ciphertext by using the SM2 preset private key of the data recipient's client to generate signature data specifically includes: encrypting the first encrypted ciphertext by using the SM2 preset private key of the data recipient to generate signature data.

[0086] The data sending module 206 is used to send the signed data to the data sending client; the data sending client performs signature verification through the SM2 preset public key of the data recipient. If the signature verification passes, the first encrypted ciphertext in the signed data is used as the data encryption key, and the data to be encrypted is encrypted using the data encryption key based on the national secret symmetric algorithm to generate a second encrypted ciphertext.

[0087] Among them, the data sending client performs signature verification through the SM2 preset public key of the data recipient. If the signature verification passes, the first encrypted ciphertext in the signature data is used as the data encryption key. Specifically: the data sending client decrypts the signature data through the SM2 preset public key of the data recipient; if the decryption is successful, the first encrypted ciphertext is used as the data encryption key, wherein the first encrypted ciphertext is consistent with the plaintext after the signature data is decrypted.

[0088] The third data processing module 207 is used to receive the second encrypted ciphertext sent by the data sending client, and use the first encrypted ciphertext to perform a decryption operation on the second encrypted ciphertext based on the national secret symmetric algorithm to generate a decrypted plaintext corresponding to the second encrypted ciphertext.

[0089] Embodiment 3

[0090] Embodiment 3 provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, any one of the methods for encrypting data using an ID card security chip provided in Embodiment 1 is implemented.

[0091] Embodiment 4

[0092] Embodiment 5 of the present invention provides a controller, Figure 3 This is a schematic diagram of the controller structure provided by the fourth embodiment of the present invention. Figure 3 As shown, it includes a memory 300, a processor 400 and a computer program stored in the memory, and the processor executes the computer program to implement any one of the data encryption methods using an ID card security chip provided in the above embodiment 1.

[0093] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0094] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0095] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for encrypting data using an ID card security chip, characterized in that: The method comprises: Obtain the ID card serial number in the user data storage module of the ID card security chip; the ID card is the data recipient's ID card; Get the random number generated by the random number generator of the ID card security chip; Perform a Boolean operation on the ID card serial number and the random number to generate a first digital code; The main control module of the identity card security chip obtains a first encrypted ciphertext generated by encrypting the first digital code with the identity card key based on a preset encryption algorithm; Digitally signing the first encrypted ciphertext using the SM2 preset signature private key of the data recipient to generate signature data; Send the signed data to the data sending client; the data sending client performs signature verification through the SM2 preset signature public key of the data recipient. If the signature verification passes, the first encrypted ciphertext in the signed data is used as the data encryption key, and the data to be encrypted is encrypted using the data encryption key based on the national secret symmetric algorithm to generate a second encrypted ciphertext; Receive the second encrypted ciphertext sent by the data sending client, and use the first encrypted ciphertext to perform a decryption operation on the second encrypted ciphertext based on the national secret symmetric algorithm to generate a decrypted plaintext corresponding to the second encrypted ciphertext.

2. The method for encrypting data using an ID card security chip according to claim 1, characterized in that: The step of obtaining the ID card serial number in the user data storage module of the ID card security chip is as follows: Sending a first APDU command to the NFC communication module of the ID card security chip; The NFC communication module forwards the first APDU instruction to the main control module of the ID card security chip; The main control module identifies the first APDU instruction; If it is an ID card serial number acquisition instruction, the ID card serial number is read from the first storage location specified in the user data storage module and sent to the NFC communication module; Receive the ID card serial number sent by the NFC communication module.

3. The method for encrypting data using an ID card security chip according to claim 1, characterized in that: The random number generated by the random number generator of the ID card security chip is obtained as follows: Sending a second APDU command to the NFC communication module; The NFC communication module forwards the second APDU instruction to the main control module; The main control module identifies the second APDU instruction; If it is a random number generation instruction, calling the random number generator to generate a random number, obtaining a corresponding random number, and temporarily storing the random number in a second storage location specified in the user data storage module; Reading the random number from the second storage location and sending it to the NFC communication module; Receive the random number sent by the NFC communication module.

4. The method for encrypting data using an ID card security chip according to claim 1, characterized in that: The main control module for obtaining the ID card security chip encrypts the first digital code with the ID card key based on a preset encryption algorithm to generate a first encrypted ciphertext, which is specifically: Sending a third APDU command to the NFC communication module; The NFC communication module forwards the third APDU instruction to the main control module; The main control module identifies the third APDU instruction; If it is an internal verification instruction, extract the first digital code in the parameter carried by the third APDU instruction; Extracting the ID card key from the key storage module of the ID card security chip; encrypting the first digital code with the ID card key based on a preset encryption algorithm to generate a first encrypted ciphertext, and sending it to the NFC communication module; Receive the first encrypted ciphertext sent by the NFC communication module.

5. The method for encrypting data using an ID card security chip according to claim 1, characterized in that: The step of digitally signing the first encrypted ciphertext by using the SM2 preset private key of the data receiving client to generate signature data specifically includes: The first encrypted ciphertext is encrypted using the SM2 preset private key of the data recipient to generate signature data.

6. The method for encrypting data using an ID card security chip according to claim 5, characterized in that: The data sending client performs signature verification through the SM2 preset public key of the data receiving party. If the signature verification passes, the first encrypted ciphertext in the signature data is used as the data encryption key, specifically: The data sending client decrypts the signature data through the SM2 preset public key of the data recipient; if the decryption is successful, the first encrypted ciphertext is used as the data encryption key, wherein the first encrypted ciphertext is consistent with the plaintext of the signature data after decryption.

7. The method for encrypting data using an ID card security chip according to claim 1, characterized in that: The Boolean operation is an exclusive OR operation.

8. A data encryption device using an ID card security chip, characterized in that: The device comprises: The first data acquisition module is used to acquire the ID card serial number in the user data storage module of the ID card security chip; the ID card is the data recipient's ID card; A second data acquisition module is used to obtain a random number generated by a random number generator of the identity card security chip; A first data processing module, used for performing a Boolean operation on the ID card serial number and the random number to generate a first digital code; A third data acquisition module, used for acquiring a first encrypted ciphertext generated by encrypting the first digital code with the ID card key based on a preset encryption algorithm by the main control module of the ID card security chip; A second data processing module, used to digitally sign the first encrypted ciphertext using the SM2 preset private key of the data recipient to generate signature data; A data sending module is used to send the signed data to a data sending client; the data sending client performs signature verification through the SM2 preset public key of the data recipient. If the signature verification passes, the first encrypted ciphertext in the signed data is used as the data encryption key, and the data to be encrypted is encrypted using the data encryption key based on the national secret symmetric algorithm to generate a second encrypted ciphertext; The third data processing module is used to receive the second encrypted ciphertext sent by the data sending client, and use the first encrypted ciphertext to perform a decryption operation on the second encrypted ciphertext based on the national secret symmetric algorithm to generate a decrypted plaintext corresponding to the second encrypted ciphertext.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to claims 1 to 8 are implemented.

10. A controller comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method of claims 1-8.

Images