A method and apparatus for encrypting data using an ID card security chip
By generating a data encryption key with a digital signature using the ID card security chip, the problem of scarce security chip resources is solved, achieving resource conservation in the data encryption process and security in key transmission.
Patent Information
- Application Number
- CN202411242994.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-05
- Publication Date
- 2025-10-31
- Estimated Expiration
- 2044-09-05
Smart Images
Figure CN119172066B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data processing technology, and in particular to a method and apparatus for encrypting data using an ID card security chip. Background Technology
[0002] Currently, dedicated security chips are required for secure data transmission. However, security chips are a scarce resource in our country. Therefore, increasing the reuse of security chips and thus saving a significant amount of integrated circuit security chip resources has become an urgent problem to be solved. Summary of the Invention
[0003] The purpose of this invention is to address the shortcomings of existing technologies by providing a method and apparatus for encrypting data using an ID card security chip. The ID card security chip generates a data encryption key with a digital signature. The data sending client uses this data encryption key to encrypt the data to be transmitted and transmit it to the data receiving party. During the data encryption process, the ID card security chip is reused, achieving data encryption protection without the need for other additional security chips and saving security chip resources.
[0004] To achieve the above objectives, the first aspect of the present invention provides a method for encrypting data using an ID card security chip, comprising:
[0005] The ID card serial number is obtained from the user data storage module of the ID card security chip; the ID card is the data recipient's ID card.
[0006] Obtain the random number generated by the random number generator of the ID card security chip;
[0007] Perform a Boolean operation between the ID card serial number and the random number to generate a first numeric code;
[0008] The main control module that acquires the ID card security chip generates the first encrypted ciphertext by encrypting the first digital code with the ID card key using a preset encryption algorithm.
[0009] The first encrypted ciphertext is digitally signed using the data receiver's SM2 pre-set signature private key to generate signature data.
[0010] The signature data is sent to the data sending client; the data sending client verifies the signature using the SM2 pre-set signature public key of the data receiver. If the signature verification is successful, the first encrypted ciphertext in the signature data is used as the data encryption key, and the data to be encrypted is encrypted using the data encryption key based on the national cryptographic symmetric algorithm to generate the second encrypted ciphertext.
[0011] The system receives the second encrypted ciphertext sent by the data sending client, and uses the first encrypted ciphertext to perform a decryption operation on the second encrypted ciphertext based on the Chinese national cryptographic symmetric algorithm to generate the decrypted plaintext corresponding to the second encrypted ciphertext.
[0012] Furthermore, the method for obtaining the ID card serial number from the user data storage module of the ID card security chip specifically includes:
[0013] Send the first APDU command to the NFC communication module of the ID card security chip;
[0014] The NFC communication module forwards the first APDU instruction to the main control module of the ID card security chip;
[0015] The main control module identifies the first APDU instruction;
[0016] If the instruction is to retrieve the ID card serial number, the ID card serial number is read from the first storage location specified in the user data storage module and sent to the NFC communication module.
[0017] Receive the ID card serial number sent by the NFC communication module.
[0018] Furthermore, the random number generated by the random number generator for obtaining the ID card security chip is specifically as follows:
[0019] Send a second APDU command to the NFC communication module;
[0020] The NFC communication module forwards the second APDU command to the main control module;
[0021] The main control module identifies the second APDU command;
[0022] If the instruction is to generate a random number, the random number generator is invoked to generate a random number once, and a corresponding random number is obtained. The random number is then temporarily stored in the second storage location specified in the user data storage module.
[0023] The random number is read from the second storage location and sent to the NFC communication module;
[0024] Receive the random number sent by the NFC communication module.
[0025] Furthermore, the main control module for acquiring the ID card security chip generates the first encrypted ciphertext by encrypting the first digital code with the ID card key using a preset encryption algorithm, specifically as follows:
[0026] Send a third APDU command to the NFC communication module;
[0027] The NFC communication module forwards the third APDU command to the main control module;
[0028] The main control module identifies the third APDU instruction;
[0029] If it is an internal verification instruction, extract the first digital code from the parameters carried by the third APDU instruction; extract the ID card key from the key storage module of the ID card security chip; based on a preset encryption algorithm, encrypt the first digital code with the ID card key to generate a first encrypted ciphertext, and send it to the NFC communication module;
[0030] Receive the first encrypted ciphertext sent by the NFC communication module.
[0031] Furthermore, the step of digitally signing the first encrypted ciphertext using the SM2 pre-set private key of the data receiving client to generate signature data specifically includes:
[0032] The first encrypted ciphertext is encrypted using the data receiver's pre-set SM2 private key to generate signature data.
[0033] Furthermore, the data sending client performs signature verification using the data receiver's pre-set SM2 public key. If the signature verification passes, the first encrypted ciphertext in the signature data is used as the data encryption key, specifically:
[0034] The data sending client decrypts the signature data using the data receiver's SM2 pre-set public key; if decryption is successful, the first encrypted ciphertext is used as the data encryption key, wherein the first encrypted ciphertext is consistent with the plaintext after the signature data is decrypted.
[0035] Furthermore, the Boolean operation is an XOR operation.
[0036] A second aspect of the present invention provides a data encryption device using an ID card security chip, the device comprising:
[0037] The first data acquisition module is used to acquire the ID card serial number from the user data storage module of the ID card security chip; the ID card is the data recipient's ID card.
[0038] The second data acquisition module is used to acquire random numbers generated by the random number generator of the ID card security chip;
[0039] The first data processing module is used to perform a Boolean operation on the ID card serial number and the random number to generate a first digital code;
[0040] The third data acquisition module is used to acquire the first encrypted ciphertext generated by the main control module of the ID card security chip based on a preset encryption algorithm and the ID card key encrypting the first digital code.
[0041] The second data processing module is used to digitally sign the first encrypted ciphertext using the SM2 preset private key of the data receiver to generate signature data;
[0042] The data sending module is used to send the signature data to the data sending client. The data sending client performs signature verification using the SM2 pre-set public key of the data receiver. If the signature verification is successful, the first encrypted ciphertext in the signature data is used as the data encryption key. Based on the national cryptographic symmetric algorithm, the data to be encrypted is encrypted using the data encryption key to generate the second encrypted ciphertext.
[0043] The third data processing module is used to receive the second encrypted ciphertext sent by the data sending client, and to perform decryption operation on the second encrypted ciphertext using the first encrypted ciphertext based on the national cryptographic symmetric algorithm to generate the decrypted plaintext corresponding to the second encrypted ciphertext.
[0044] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any of the first aspects.
[0045] A fourth aspect of the present invention provides a controller including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method of any of the first aspects.
[0046] This invention provides a method, device, and related products for encrypting data using an ID card security chip. The ID card security chip generates a data encryption key with a digital signature. The data sending client uses this data encryption key to encrypt the data to be transmitted and transmit it to the data receiver. During the data encryption process, the ID card security chip is reused, achieving data encryption protection without the need for other additional security chips, thus saving security chip resources. Attached Figure Description
[0047] Figure 1 This is a flowchart of a data encryption method using an ID card security chip provided in Embodiment 1 of the present invention;
[0048] Figure 2 This is a schematic diagram of the data encryption device using an ID card security chip provided in Embodiment 2 of the present invention;
[0049] Figure 3 This is a schematic diagram of the controller structure provided in Embodiment 4 of the present invention. Detailed Implementation
[0050] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.
[0051] This invention provides a method and apparatus for encrypting data using an ID card security chip. The ID card security chip generates a data encryption key with a digital signature. The data sending client uses this data encryption key to encrypt the data to be transmitted and transmit it to the data receiving party. During the data encryption process, the ID card security chip is reused, achieving data encryption protection without the need for other additional security chips, thus saving security chip resources.
[0052] Example 1
[0053] The ID card in this application is an ID card with a security chip and encryption function. Currently, ID cards have been updated to the second generation. The following embodiments use the second-generation ID card as an example. The second-generation ID card is an important tool for identifying Chinese citizens. Its built-in security chip is an integrated circuit chip, including a main control module, a Near Field Communication (NFC) module, a storage module, a random number generator, and a user data storage module. The main control module is used to parse and execute a series of Application Protocol Data Unit (APDU) instructions. The NFC communication module is used to process NFC signal transmission and reception. The storage module in the second-generation ID card typically uses EEPROM or FLASH media as the storage medium, and based on the stored content, it can be divided into a system data storage module, a user data storage module, and a key storage module.
[0054] Figure 1 This is one of the flowcharts for a data encryption method using an ID card security chip provided in Embodiment 1 of the present invention. The following is in conjunction with... Figure 1 The technical solution of the present invention will be described with reference to specific embodiments.
[0055] Step 110: Obtain the ID card serial number from the user data storage module of the ID card security chip; the ID card is the data recipient's ID card.
[0056] Specifically, the data receiving client sends a first APDU instruction to the NFC communication module of the ID card security chip; the NFC communication module forwards the first APDU instruction to the main control module of the ID card security chip; the main control module identifies the first APDU instruction. If it is an ID card serial number retrieval instruction, the ID card serial number is read from the first storage location specified in the user data storage module and sent to the NFC communication module; the data receiving client receives the ID card serial number sent by the NFC communication module.
[0057] Step 120: Obtain the random number generated by the random number generator of the ID card security chip.
[0058] Specifically, the data receiving client sends a second APDU command to the NFC communication module; the NFC communication module forwards the second APDU command to the main control module; the main control module identifies the second APDU command; if it is a random number generation command, it calls the random number generator to generate a random number, obtains a corresponding random number, and temporarily stores the random number in the second storage location specified in the user data storage module; the random number is read from the second storage location and sent to the NFC communication module; the data receiving client receives the random number sent by the NFC communication module.
[0059] Step 130: Perform a Boolean operation on the ID card number and the random number to generate the first numeric code. Optionally, the Boolean operation can be an XOR operation.
[0060] Step 140: The main control module of the ID card security chip obtains the first encrypted ciphertext generated by encrypting the first digital code with the ID card key based on the preset encryption algorithm.
[0061] Specifically, the data receiving client sends a third APDU command to the NFC communication module; the NFC communication module forwards the third APDU command to the main control module; the main control module identifies the third APDU command; if it is an internal verification command, it extracts the first digital code from the parameters carried by the third APDU command; it extracts the ID card key from the key storage module of the ID card security chip; based on a preset encryption algorithm, it encrypts the first digital code with the ID card key to generate a first encrypted ciphertext, and sends it to the NFC communication module; the data receiving client receives the first encrypted ciphertext sent by the NFC communication module.
[0062] Step 150: Digitally sign the first encrypted ciphertext using the SM2 pre-set signature private key of the data receiving client to generate signature data.
[0063] Specifically, the data receiving client pre-generates an SM2 signature public-private key pair. The signature private key is stored by the data receiving client, while the signature public key is sent to the data sending client. Data encrypted with the signature public key can only be decrypted with the corresponding signature private key, and vice versa.
[0064] Step 160: Send the signature data to the data sending client. The data sending client verifies the signature using the data receiver's pre-set SM2 signature public key. If the signature verification is successful, the first encrypted ciphertext in the signature data is used as the data encryption key. Based on the national cryptographic symmetric algorithm, the data to be encrypted is encrypted using the data encryption key to generate the second encrypted ciphertext. The data to be encrypted includes text, images, or a combination of text and images. Optionally, the national cryptographic symmetric algorithm is the SM4 national cryptographic symmetric algorithm.
[0065] Combining steps 150 and 160, when transmitting the first encrypted ciphertext to the data sender's client, since the first encrypted ciphertext is to be used as the data encryption key for the data to be transmitted, it is necessary to ensure the security and confidentiality of the first encrypted ciphertext. Therefore, data cannot be transmitted in plaintext when performing data signing.
[0066] In one possible implementation, the generation and verification of signature data are as follows: The data sending client pre-generates an encryption public-private key pair. The encryption private key is stored by the data sending client, and the encryption public key is sent to the data receiving client. The first encrypted ciphertext is encrypted using the encryption public key to generate ciphertext A. A hash operation is performed on the first encrypted ciphertext to generate hash value A. The hash value A is encrypted using the data receiving client's pre-set SM2 signature private key to generate signature A. Signature A and ciphertext A are sent to the data sending client. The data sending client decrypts ciphertext A using the encryption private key and performs a hash operation on the decrypted plaintext to generate hash value B. The data sending client decrypts signature A using the data receiving client's pre-set SM2 signature public key to obtain hash value A. Hash value A and hash value B are compared. If they are the same, the plaintext of ciphertext A is usable, and the plaintext is consistent with the content of the first encrypted ciphertext.
[0067] In another possible implementation, the generation and verification of signature data are as follows: The data sending client pre-generates an encryption public-private key pair. The encryption private key is stored by the data sending client, and the encryption public key is sent to the data receiving client. The first encrypted ciphertext is encrypted using the encryption public key to generate ciphertext B. A hash operation is performed on ciphertext B to generate a hash value C. The hash value C is encrypted using the data receiving client's SM2 pre-set signature private key to generate signature B. Signature B and ciphertext B are sent to the data sending client. The data sending client performs a hash operation on ciphertext B to generate a hash value D. The data sending client decrypts signature B using the data receiving client's SM2 pre-set signature public key to obtain hash value C. Hash value C and hash value D are compared. If they are the same, the plaintext of ciphertext B is usable. Ciphertext B is decrypted using the encryption private key to obtain the plaintext of ciphertext B, which is consistent with the content of the first encrypted ciphertext.
[0068] In the above embodiments, when verifying signatures, the hash value calculated after encrypting the first encrypted ciphertext is compared. This ensures the security of the first encrypted ciphertext during transmission, and eliminates the need to decrypt the first encrypted ciphertext and calculate the hash value during signature verification, thereby improving the signature verification speed.
[0069] In another possible implementation, the generation and verification of signature data are specifically as follows: the first encrypted ciphertext is encrypted using the data receiver's SM2 pre-set signature private key to generate signature data; the data sending client decrypts the signature data using the data receiver's SM2 pre-set signature public key; if decryption is successful, the first encrypted ciphertext is used as the data encryption key, wherein the first encrypted ciphertext is consistent with the plaintext after the signature data is decrypted.
[0070] In the above implementation, since the first encrypted ciphertext is generated from a first digital code, which is generated by performing a Boolean operation on the ID card serial number and a random number, the first encrypted ciphertext occupies a small number of characters. Therefore, when performing digital signature, no hash calculation is performed on the first encrypted ciphertext; instead, the first encrypted ciphertext is directly encrypted to generate signature data. The ciphertext of the signature data contains the content of the first encrypted ciphertext and does not need to be transmitted separately to the data sender's client. During signature verification, as long as the signature data is successfully decrypted using the data receiver's SM2 pre-set public key, it is considered a successful signature verification, without the need to compare hash values. This digital signature and verification method is simple, secure, and highly efficient.
[0071] In another possible implementation, the generation and verification of signature data are specifically as follows: The first encrypted ciphertext is padded with two's complement; the padded first encrypted ciphertext is then encrypted using the data receiver's pre-set SM2 signature private key to generate signature data; the data sending client decrypts the signature data using the data receiver's pre-set SM2 signature public key; if decryption is successful, the two's complement rule is verified; if the verification passes, the decrypted plaintext without the two's complement rule is usable, and its content is consistent with the first encrypted ciphertext. Padding the first encrypted ciphertext with two's complement further enhances the security of the transmitted data.
[0072] Step 170: Receive the second encrypted ciphertext sent by the data sending client, and use the first encrypted ciphertext to perform decryption operation on the second encrypted ciphertext based on the national cryptographic symmetric algorithm to generate the decrypted plaintext corresponding to the second encrypted ciphertext.
[0073] This invention provides a method for encrypting data using an ID card security chip. The ID card security chip generates a data encryption key with a digital signature. The data sending client uses this key to encrypt the data to be transmitted and transmit it to the data receiver. During the data encryption process, the ID card security chip is reused, achieving data encryption protection without the need for additional security chips, thus saving security chip resources. Furthermore, the addition of a digital signature during the transmission of the data encryption key ensures the authenticity of the transmitted key.
[0074] Example 2
[0075] Embodiment 2 of the present invention provides a device for encrypting data using an ID card security chip. Figure 2 This is a schematic diagram of the data encryption device using an ID card security chip provided in Embodiment 2 of the present invention, as shown below. Figure 2 As shown, the data encryption device 200 using the ID card security chip includes a first data acquisition module 201, a second data acquisition module 202, a first data processing module 203, a third data acquisition module 204, a second data processing module 205, a data sending module 206, and a third data processing module 207.
[0076] The first data acquisition module 201 is used to acquire the ID card serial number in the user data storage module of the ID card security chip; the ID card is the ID card of the data recipient.
[0077] Specifically, the ID card serial number obtained from the user data storage module of the ID card security chip is as follows:
[0078] The first APDU instruction is sent to the NFC communication module of the ID card security chip; the NFC communication module forwards the first APDU instruction to the main control module of the ID card security chip; the main control module identifies the first APDU instruction; if it is an ID card serial number retrieval instruction, the ID card serial number is read from the first storage location specified in the user data storage module and sent to the NFC communication module; the ID card serial number sent by the NFC communication module is received.
[0079] The second data acquisition module 202 is used to acquire random numbers generated by the random number generator of the ID card security chip.
[0080] Specifically, obtaining the random number generated by the random number generator of the ID card security chip involves: sending a second APDU command to the NFC communication module; the NFC communication module forwarding the second APDU command to the main control module; the main control module recognizing the second APDU command; if it is a random number generation command, calling the random number generator to generate a random number, obtaining a corresponding random number, and temporarily storing the random number in the second storage location specified in the user data storage module; reading the random number from the second storage location and sending it to the NFC communication module; and receiving the random number sent by the NFC communication module.
[0081] The first data processing module 203 is used to perform Boolean operations on the ID card serial number and a random number to generate a first digital code.
[0082] The third data acquisition module 204 is used to acquire the first encrypted ciphertext generated by the main control module of the ID card security chip based on the preset encryption algorithm and the ID card key to encrypt the first digital code.
[0083] Specifically, the main control module for acquiring the ID card security chip encrypts the first digital code using the ID card key based on a preset encryption algorithm to generate the first encrypted ciphertext. This process involves: sending a third APDU command to the NFC communication module; the NFC communication module forwarding the third APDU command to the main control module; the main control module recognizing the third APDU command; if it is an internal verification command, extracting the first digital code from the parameters carried by the third APDU command; extracting the ID card key from the key storage module of the ID card security chip; encrypting the first digital code using the ID card key based on the preset encryption algorithm to generate the first encrypted ciphertext, and sending it to the NFC communication module; and receiving the first encrypted ciphertext sent by the NFC communication module.
[0084] The second data processing module 205 is used to digitally sign the first encrypted ciphertext using the SM2 preset private key of the data receiver to generate signature data.
[0085] Specifically, the process of digitally signing the first encrypted ciphertext using the SM2 pre-set private key of the data receiver client to generate signature data includes: encrypting the first encrypted ciphertext using the SM2 pre-set private key of the data receiver to generate signature data.
[0086] The data sending module 206 is used to send signature data to the data sending client. The data sending client verifies the signature using the SM2 pre-set public key of the data receiver. If the signature verification is successful, the first encrypted ciphertext in the signature data is used as the data encryption key. Based on the national cryptographic symmetric algorithm, the data to be encrypted is encrypted using the data encryption key to generate the second encrypted ciphertext.
[0087] Specifically, the data sending client verifies the signature using the data receiver's SM2 pre-set public key. If the signature verification is successful, the first encrypted ciphertext in the signature data is used as the data encryption key. Specifically, the data sending client decrypts the signature data using the data receiver's SM2 pre-set public key. If the decryption is successful, the first encrypted ciphertext is used as the data encryption key, where the first encrypted ciphertext is consistent with the plaintext after the signature data is decrypted.
[0088] The third data processing module 207 is used to receive the second encrypted ciphertext sent by the data sending client, and to perform decryption operation on the second encrypted ciphertext using the first encrypted ciphertext based on the national cryptographic symmetric algorithm to generate the decrypted plaintext corresponding to the second encrypted ciphertext.
[0089] Example 3
[0090] Embodiment 3 provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the data encryption methods using an ID card security chip provided in Embodiment 1.
[0091] Example 4
[0092] Embodiment 5 of the present invention provides a controller, Figure 3 This is a schematic diagram of the controller structure provided in Embodiment 4 of the present invention. Figure 3 As shown, it includes a memory 300, a processor 400, and a computer program stored in the memory. The processor executes the computer program to implement any of the data encryption methods using an ID card security chip provided in Embodiment 1 above.
[0093] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.
[0094] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented in hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.
[0095] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for encrypting data using an ID card security chip, characterized in that, The method includes: The ID card serial number is obtained from the user data storage module of the ID card security chip; the ID card is the data recipient's ID card. Obtain the random number generated by the random number generator of the ID card security chip; Perform a Boolean operation between the ID card serial number and the random number to generate a first numeric code; The main control module that acquires the ID card security chip generates the first encrypted ciphertext by encrypting the first digital code with the ID card key using a preset encryption algorithm. The first encrypted ciphertext is digitally signed using the data receiver's SM2 pre-set signature private key to generate signature data. The signature data is sent to the data sending client; the data sending client verifies the signature using the SM2 pre-set signature public key of the data receiver. If the signature verification is successful, the first encrypted ciphertext in the signature data is used as the data encryption key, and the data to be encrypted is encrypted using the data encryption key based on the national cryptographic symmetric algorithm to generate the second encrypted ciphertext. The system receives the second encrypted ciphertext sent by the data sending client, and uses the first encrypted ciphertext to perform a decryption operation on the second encrypted ciphertext based on the national cryptographic symmetric algorithm to generate the decrypted plaintext corresponding to the second encrypted ciphertext.
2. The method for encrypting data using an ID card security chip according to claim 1, characterized in that, The specific details of obtaining the ID card serial number from the user data storage module of the ID card security chip are as follows: Send the first APDU command to the NFC communication module of the ID card security chip; The NFC communication module forwards the first APDU instruction to the main control module of the ID card security chip; The main control module identifies the first APDU instruction; If the instruction is to retrieve the ID card serial number, the ID card serial number is read from the first storage location specified in the user data storage module and sent to the NFC communication module. Receive the ID card serial number sent by the NFC communication module.
3. The method for encrypting data using an ID card security chip according to claim 1, characterized in that, The random number generated by the random number generator for obtaining the ID card security chip is specifically as follows: Send a second APDU command to the NFC communication module; The NFC communication module forwards the second APDU command to the main control module; The main control module identifies the second APDU command; If the instruction is to generate a random number, the random number generator is invoked to generate a random number once, and a corresponding random number is obtained. The random number is then temporarily stored in the second storage location specified in the user data storage module. The random number is read from the second storage location and sent to the NFC communication module; Receive the random number sent by the NFC communication module.
4. The method for encrypting data using an ID card security chip according to claim 1, characterized in that, The main control module for acquiring the ID card security chip generates the first encrypted ciphertext by encrypting the first digital code with the ID card key using a preset encryption algorithm. Specifically: Send the third APDU command to the NFC communication module; The NFC communication module forwards the third APDU command to the main control module; The main control module identifies the third APDU instruction; If it is an internal verification instruction, extract the first numeric code from the parameters carried by the third APDU instruction; Extract the ID card key from the key storage module of the ID card security chip; based on a preset encryption algorithm, encrypt the first digital code with the ID card key to generate the first encrypted ciphertext, and send it to the NFC communication module; Receive the first encrypted ciphertext sent by the NFC communication module.
5. The method for encrypting data using an ID card security chip according to claim 1, characterized in that, The step of digitally signing the first encrypted ciphertext using the SM2 pre-set private key of the data receiving client to generate signature data specifically includes: The first encrypted ciphertext is encrypted using the data receiver's pre-set SM2 private key to generate signature data.
6. The method for encrypting data using an ID card security chip according to claim 5, characterized in that, The data sending client performs signature verification using the data receiver's pre-set SM2 public key. If the signature verification passes, the first encrypted ciphertext in the signature data is used as the data encryption key, specifically: The data sending client decrypts the signature data using the data receiver's SM2 pre-set public key; if decryption is successful, the first encrypted ciphertext is used as the data encryption key, wherein the first encrypted ciphertext is consistent with the plaintext after the signature data is decrypted.
7. The method for encrypting data using an ID card security chip according to claim 1, characterized in that, The Boolean operation is the XOR operation.
8. A data encryption device using an ID card security chip, characterized in that, The device includes: The first data acquisition module is used to acquire the ID card serial number from the user data storage module of the ID card security chip; the ID card is the data recipient's ID card. The second data acquisition module is used to acquire random numbers generated by the random number generator of the ID card security chip; The first data processing module is used to perform a Boolean operation on the ID card serial number and the random number to generate a first digital code; The third data acquisition module is used to acquire the first encrypted ciphertext generated by the main control module of the ID card security chip based on a preset encryption algorithm and the ID card key encrypting the first digital code. The second data processing module is used to digitally sign the first encrypted ciphertext using the SM2 preset private key of the data receiver to generate signature data; The data sending module is used to send the signature data to the data sending client. The data sending client performs signature verification using the SM2 pre-set public key of the data receiver. If the signature verification is successful, the first encrypted ciphertext in the signature data is used as the data encryption key. Based on the national cryptographic symmetric algorithm, the data to be encrypted is encrypted using the data encryption key to generate the second encrypted ciphertext. The third data processing module is used to receive the second encrypted ciphertext sent by the data sending client, and to perform decryption operation on the second encrypted ciphertext using the first encrypted ciphertext based on the national cryptographic symmetric algorithm to generate the decrypted plaintext corresponding to the second encrypted ciphertext.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in claims 1-8.
10. A controller, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to claims 1-8.
Citation Information
Patent Citations
Digital envelope encryption method and device
CN116389100A
User identity identification card
WO2015158172A1