Implicit certificate generation method and system based on password service platform

Abstract

The invention discloses an implicit certificate generation method and system based on a password service platform, and the method comprises the steps that terminal equipment applies for an implicit signature certificate through a terminal equipment management platform and the password service platform, and the terminal equipment initiates an encryption certificate application to the terminal management platform; the terminal management platform calls the password service platform to generate a pre-encrypted public key, the password service platform sends the pre-encrypted public key to the PKI / CA system, and the PKI / CA system calculates to obtain an encrypted public key reconstruction value so as to register an implicit encryption certificate and send the implicit encryption certificate to the password service platform; the password service platform generates a terminal equipment encryption private key and sends the terminal equipment encryption private key to the terminal management platform, the terminal management platform backs up the implicit encryption certificate and forwards the implicit encryption certificate to the terminal equipment, and the terminal equipment obtains the terminal equipment encryption private key and the terminal equipment encryption public key. According to the method, the implicit certificate adopting the national secret algorithm is divided into the signature certificate and the encryption certificate, the signature certificate supports the issuing of the encryption certificate key, and a password service platform is added to realize the localization of the multilayer management implicit certificate.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for generating an implicit certificate based on a cryptographic service platform. Background Art

[0002] In the IoT scenario, there are a large number of heterogeneous devices, such as DTU, RTU and industrial gateway, which carry the task of transmitting information data between different platforms and devices. However, in the current increasingly severe network security environment, it is particularly important to ensure the security of the data interaction process between various endpoints. Considering that the computing power and storage capacity of IoT devices are usually limited, the traditional identity authentication model based on digital certificates is difficult to implement effectively in this environment.

[0003] Based on the strategic consideration of national information security, a digital certificate with national security and national secret standards, namely the national secret certificate, was proposed. Compared with the digital certificate with international standards, the national secret certificate adopts the cryptographic algorithm and security standards independently developed by China, such as SM2, SM3 and SM4. Different from the traditional digital certificate, the national secret certificate is divided into signature certificate and encryption certificate according to the functions of identity authentication and secure communication. The two are different in terms of application subject and function, so it is necessary to discuss the implementation of signature certificate and encryption certificate separately.

[0004] In addition, in some application scenarios, the terminal service platform needs to build additional cryptographic devices such as cryptographic machines to support the management of multi-layer certificates. Therefore, it is necessary to consider the construction of a cryptographic service platform. The terminal management platform supported by the cryptographic service platform assumes the access and management functions of the IoT devices. At the same time, it is necessary to consider an authentication method so that the identity authentication of IoT devices is not only based on the digital certificate issued by the traditional CA, but the CA, the terminal management platform and the cryptographic service platform jointly assume the function of device identity authentication. Summary of the invention

[0005] In order to overcome the shortcomings of the above technologies, the present invention provides an implicit certificate generation method and system based on a cryptographic service platform, which uses implicit certificates to improve the speed of signature verification, is small in size, and occupies less bandwidth. Under the premise of realizing multi-layer system authentication, hierarchical management is realized, and by adding the multi-layer management mode of the cryptographic service platform, the construction and transformation costs of the terminal management platform using multi-layer management are reduced, and a more complete management system is established.

[0006] The technical solution adopted by the present invention to overcome its technical problems is: the first aspect of the present invention proposes a method for generating an implicit certificate based on a cryptographic service platform, including a terminal device applying for a signature certificate from a PKI / CA system through a terminal device management platform and a cryptographic service platform and obtaining an implicit signature certificate; the terminal device sends device information and the implicit signature certificate to the terminal management platform to initiate an encryption certificate application; the terminal management platform verifies the signature certificate, thereby registering an encryption certificate application message to the cryptographic service platform, and calling the cryptographic service platform to generate a pre-encrypted private key and a pre-encrypted public key; the cryptographic service platform at least encapsulates the pre-encrypted public key and the device information, and calls the PKI / CA system to apply for an encryption certificate based on the encapsulated message; the PKI / CA system generates a CA temporary encryption private key based on the encryption certificate application message sent by the cryptographic service platform to obtain a CA temporary encryption public key, and calculates the encrypted private key based on the CA temporary encryption public key and the pre-encrypted public key. Encrypt the public key reconstruction value to register the implicit encryption certificate, and generate the CA encryption private key reconstruction value based on the implicit encryption certificate; the PKI / CA system sends the implicit encryption certificate and the CA encryption private key reconstruction value to the cryptographic service platform; the cryptographic service platform generates the terminal device encryption private key based on the implicit encryption certificate, the pre-encrypted private key and the CA encryption private key reconstruction value, and encrypts the terminal device encryption private key based on the terminal device signature public key to obtain the terminal device encryption private key ciphertext; the cryptographic service platform at least sends the implicit encryption certificate and the terminal device encryption private key ciphertext to the terminal management platform; the terminal management platform backs up the implicit encryption certificate, and sends the encapsulated information including at least the implicit encryption certificate and the terminal device encryption private key ciphertext to the terminal device; the terminal device decrypts the terminal device encryption private key ciphertext based on the terminal device signature private key to obtain the terminal device encryption private key, and generates the terminal device encryption public key based on the encrypted public key reconstruction value in the implicit encryption certificate and the CA encryption public key.

[0007] By setting up a cryptographic service platform, it supports key distribution and management, data encryption and decryption, signature verification, digital envelopes and other functions, and can provide cryptographic services and key service interfaces for the underlying system.

[0008] Furthermore, the terminal management platform verifies the signature certificate, thereby registering an encrypted certificate application message with the cryptographic service platform, and calling the cryptographic service platform to generate a pre-encrypted private key and a pre-encrypted public key, specifically including: the terminal management platform calculates the terminal device signature public key; compares and verifies the implicit signature certificate backed up on the terminal management platform with the received implicit signature certificate; if the verification passes, the terminal management platform registers an encrypted certificate application message with the cryptographic service platform, and calls the cryptographic service platform to randomly generate a random number as a pre-encrypted private key; the cryptographic service platform calculates the pre-encrypted public key based on the pre-encrypted private key.

[0009] Furthermore, the PKI / CA system generates a CA temporary encryption private key based on the encrypted certificate application message sent by the cryptographic service platform to obtain the CA temporary encryption public key, calculates the encrypted public key reconstruction value based on the CA temporary encryption public key and the pre-encrypted public key to register the implicit encryption certificate, and generates the CA encryption private key reconstruction value based on the implicit encryption certificate, specifically including: the PKI / CA system obtains the pre-encrypted public key based on the terminal device encryption certificate application message; the PKI / CA system generates a random number as the CA temporary encryption private key to calculate the CA temporary encryption public key; calculates the encrypted public key reconstruction value based on the pre-encrypted public key and the CA temporary encryption public key; registers the implicit encryption certificate based on the encrypted public key reconstruction value; calculates the implicit encryption certificate hash value based on the implicit encryption certificate, and calculates the CA encryption private key reconstruction value based on the implicit encryption certificate hash value, the CA temporary encryption private key and the CA root encryption certificate private key.

[0010] Furthermore, the cryptographic service platform performs integrity verification and signature verification on the implicit encryption certificate, generates a terminal device encryption private key based on the implicit encryption certificate, the pre-encrypted private key and the CA encryption private key reconstruction value, and encrypts the terminal device encryption private key based on the terminal device signature public key to obtain the terminal device encryption private key ciphertext, specifically including: the cryptographic service platform performs integrity verification on the implicit encryption certificate, and verifies the signature of the received implicit encryption certificate issued by the PKI / CA system; generates a terminal device encryption private key based on the implicit encryption certificate, the pre-encrypted private key and the CA encryption private key reconstruction value; encrypts the terminal device encryption private key based on the terminal device signature public key to obtain the terminal device encryption private key ciphertext.

[0011] Furthermore, the terminal device decrypts the terminal device encrypted private key ciphertext based on the terminal device signature private key to obtain the terminal device encrypted private key, and generates an encrypted public key based on the encrypted public key reconstruction value in the implicit encryption certificate and the CA encrypted public key, specifically including: the terminal device verifies the integrity of the received implicit encryption certificate and verifies the signature; if the integrity verification and the signature verification are both passed, the terminal device encrypted private key is decrypted based on the terminal device signature private key to obtain the terminal device encrypted private key; the terminal device encrypted public key is calculated based on the encrypted public key reconstruction value in the implicit encryption certificate and the CA root encryption certificate public key; the terminal device encrypted public key and the terminal device encrypted private key are verified to obtain the terminal device encryption key.

[0012] Furthermore, the terminal device applies for a signature certificate from the PKI / CA system through the terminal device management platform and the cryptographic service platform and obtains an implicit signature certificate, which specifically includes: the terminal device generates a pre-signed private key, and calculates a pre-signed public key based on the pre-signed private key; the terminal device at least encapsulates the device information of the terminal device and the information of the pre-signed public key, and then initiates a signature certificate application request to the terminal management platform; the terminal management platform registers the signature certificate application message with the cryptographic service platform, and calls the cryptographic service platform to generate a platform temporary signature private key, and the cryptographic service platform calculates the platform temporary signature public key based on the platform temporary signature private key. key; the cryptographic service platform at least encapsulates the pre-signed public key, the platform temporary signature public key and the device information, and then calls the PKI / CA system to apply for the terminal device signature certificate; the PKI / CA system generates a CA temporary signature private key based on the signature certificate application message, and calculates the CA temporary signature public key based on the CA temporary signature private key, and calculates the signature public key reconstruction value based on the CA temporary signature public key, the platform temporary signature public key and the pre-signed public key to register the implicit signature certificate, and generates the CA signature private key reconstruction value based on the implicit signature certificate, the CA temporary signature private key and the CA root signature certificate private key, and calculates the signature public key reconstruction value based on the pre-signed public key The CA signature private key reconstruction value is encrypted to obtain the CA signature private key reconstruction value ciphertext; the PKI / CA system sends the implicit signature certificate and the CA signature private key reconstruction value ciphertext to the cryptographic service platform; the cryptographic service platform verifies the integrity and signature of the implicit encryption certificate, thereby generating the platform signature private key reconstruction value based on the implicit signature certificate and the platform temporary signature private key, and encrypts the platform signature private key reconstruction value based on the pre-signed public key to obtain the platform signature private key reconstruction value ciphertext; the cryptographic service platform at least sends the implicit signature certificate, CA signature private key reconstruction value ciphertext and platform signature private key reconstruction value ciphertext to the terminal management platform. The terminal management platform backs up the implicit signature certificate, and sends the packaged information including at least the implicit signature certificate, the CA signature private key reconstruction value ciphertext and the platform signature private key reconstruction value ciphertext to the terminal device; the terminal device decrypts the received packaged message based on the pre-signed private key to obtain the platform signature private key reconstruction value and the CA signature private key reconstruction value, and generates the terminal device signature private key and the terminal device signature public key respectively based on the implicit signature certificate, the CA signature private key reconstruction value, the platform signature private key reconstruction value and the pre-signed private key; the terminal device verifies the terminal device signature public key and the terminal device signature private key to obtain the terminal device signature key.

[0013] The issuance of encryption certificate keys is supported by signature certificates. The public key reconstruction value and the corresponding private key reconstruction value used for the signature certificate are composed of the terminal device, the terminal management platform and the PKI / CA system.

[0014] Furthermore, the PKI / CA system generates a CA temporary signature private key based on the signature certificate application message, and calculates the CA temporary signature public key based on the CA temporary signature private key, and calculates the signature public key reconstruction value based on the CA temporary signature public key, the platform temporary signature public key and the pre-signature public key to register the implicit signature certificate, and generates the CA signature private key reconstruction value based on the implicit signature certificate, the CA temporary signature private key and the CA root signature certificate private key, and encrypts the CA signature private key reconstruction value based on the pre-signature public key to obtain the CA signature private key reconstruction value ciphertext specifically includes: the PKI / CA system obtains the pre-signature public key based on the signature certificate application message key and platform temporary signature public key; the PKI / CA system generates a random number as the CA temporary signature private key, and calculates the CA temporary signature public key based on the CA temporary signature private key; the signature public key reconstruction value is calculated based on the pre-signed public key, the platform temporary signature public key and the CA temporary signature public key; the implicit signature certificate is calculated based on the signature public key reconstruction value and registered; the implicit signature certificate hash value is calculated based on the implicit signature certificate, and the CA signature private key reconstruction value is calculated based on the implicit signature certificate hash value, the CA temporary signature private key and the CA root signature certificate private key; the CA signature private key reconstruction value is encrypting based on the pre-signed public key to obtain the CA signature private key reconstruction value ciphertext.

[0015] Furthermore, the cryptographic service platform performs integrity verification and signature validation on the implicit encryption certificate, thereby generating a platform signature private key reconstruction value based on the implicit signature certificate and the platform temporary signature private key, and encrypts the platform signature private key reconstruction value based on the pre-signed public key to obtain the platform signature private key reconstruction value ciphertext, specifically including: the cryptographic service platform performs integrity verification on the implicit signature certificate, and signature validation on the received implicit signature certificate issued by the PKI / CA system; generates a platform signature private key reconstruction value based on the implicit signature certificate, the platform temporary signature private key and the terminal management platform signature private key; encrypts the platform signature private key reconstruction value based on the pre-signed public key to obtain the platform signature private key reconstruction value ciphertext.

[0016] Furthermore, the terminal device decrypts the received encapsulated message based on the pre-signed private key to obtain the platform signature private key reconstruction value and the CA signature private key reconstruction value, and generates the terminal device signature private key and the terminal device signature public key respectively based on the implicit signature certificate, the CA signature private key reconstruction value, the platform signature private key reconstruction value and the pre-signed private key, specifically including: the terminal device decrypts based on the pre-signed private key to obtain the platform signature private key reconstruction value and the CA signature private key reconstruction value; the terminal device signature private key is calculated based on the implicit signature certificate hash value, the platform signature private key reconstruction value, the pre-signed private key and the CA signature private key reconstruction value; the terminal device signature public key is calculated based on the implicit signature certificate hash value, the signature public key reconstruction value in the implicit signature certificate, the CA root signature certificate public key and the terminal management platform signature public key.

[0017] The second aspect of the present invention proposes an implicit certificate generation system based on a cryptographic service platform, which is used to run the above-mentioned implicit certificate generation method based on a cryptographic service platform, and at least includes a plurality of terminal devices, a plurality of terminal management platforms for managing the IoT terminal devices respectively, a PKI / CA system and a cryptographic service platform arranged between the PKI / CA system and the terminal management platform.

[0018] Terminal device: used to generate a pre-signed key, and send a signature certificate application to the terminal management platform based on the device information and the pre-signed public key, and obtain the terminal device signature key and implicit signature certificate based on the returned implicit signature certificate, platform signature private key reconstruction value ciphertext and CA signature private key reconstruction value ciphertext.

[0019] And, based on the signature certificate and device information, initiate an encryption certificate application to the terminal management platform, and obtain the terminal device encryption key based on the returned implicit encryption certificate and the terminal device encryption private key ciphertext;

[0020] Terminal management platform: used to call the cryptographic service platform to generate a temporary platform signature key based on the signature certificate application message sent by the terminal device, thereby sending a signature certificate application to the cryptographic service platform.

[0021] Alternatively, it is used to call the cryptographic service platform to generate a pre-encryption key according to the encrypted certificate application message sent by the terminal device, thereby sending the encrypted certificate application message to the cryptographic service platform,

[0022] And, back up the implicit signature certificate and implicit encryption certificate returned by the password service platform, and send the implicit signature certificate and the corresponding platform signature private key reconstruction value ciphertext and CA signature private key reconstruction value ciphertext, implicit encryption certificate and the corresponding terminal device encryption private key ciphertext to the terminal device;

[0023] Cryptographic service platform: used to verify the integrity and signature of implicit signature certificates and implicit encryption certificates returned by the PKI / CA system.

[0024] It is also used to generate a temporary platform signature key based on the call of the terminal management platform, and send the pre-signed public key and the temporary platform public key to the PKI / CA system, thereby calling the PKI / CA system to apply for a signature certificate, and based on the implicit signature certificate returned by the PKI / CA system and the temporary platform signature private key, the terminal management platform signature private key and the pre-signed public key, generate the platform signature private key reconstruction value ciphertext, and send the implicit signature certificate, CA signature private key reconstruction value ciphertext and platform signature private key reconstruction value ciphertext to the terminal management platform.

[0025] Alternatively, it is used to generate a pre-encrypted key based on the call of the terminal management platform, and send the pre-encrypted public key to the PKI / CA system, thereby calling the PKI / CA system to apply for an encryption certificate, and generating a terminal device encryption private key ciphertext based on the implicit encryption certificate and CA encryption private key reconstruction value, the pre-encrypted private key and the terminal device signature public key returned by the PKI / CA system, and sending the implicit encryption certificate and the terminal device encryption private key ciphertext to the terminal management platform;

[0026] PKI / CA system: used to generate CA temporary signature private key based on the signature certificate application of the cryptographic service platform, and obtain CA temporary signature public key based on CA temporary signature private key, and calculate the signature public key reconstruction value based on CA temporary signature public key, platform temporary signature public key and pre-signature public key, so as to register implicit signature certificate and calculate CA signature private key reconstruction value, and send the implicit signature certificate and CA signature private key reconstruction value ciphertext to the cryptographic service platform,

[0027] Also, it is used to generate a CA temporary encryption private key based on the encryption certificate application of the cryptographic service platform, thereby obtaining the CA temporary encryption public key, and calculate the encryption public key reconstruction value based on the CA temporary encryption public key and the pre-encrypted public key to register the implicit encryption certificate and calculate the CA encryption private key reconstruction value, and send the implicit encryption certificate and the CA encryption private key reconstruction value to the cryptographic service platform.

[0028] The beneficial effects of the present invention are:

[0029] 1. The present invention realizes the combination of implicit certificates with national secret algorithms, and the domestic application transformation of multi-layer management implicit certificates. The implicit certificate scheme uses implicit certificates as the signature certificate and encryption certificate of the IoT device, completes the calculation of public and private keys and identity authentication through public and private key reconstruction, and completes certificate verification through public and private key matching;

[0030] 2. By providing a cryptographic service platform with multiple service interfaces, unified management of cryptographic services is achieved, thereby realizing efficient, secure and accurate application of cryptographic resources;

[0031] 3. The public key reconstruction value and the corresponding private key reconstruction value used for the signature certificate are composed of the terminal device, the terminal management platform and the PKI / CA system. The public key reconstruction value and the corresponding private key reconstruction value used for the encryption certificate are composed of the terminal management platform and the PKI / CA system. The signature certificate supports the issuance of the encryption certificate key. The functions of the two complement each other and effectively realize the localization of multi-layer management of implicit certificates;

[0032] 4. The implicit certificate has small storage space, high signature verification speed and is compatible with standard certificate formats;

[0033] 5. The upper-level system authenticates the device through the public and private key reconstruction value, and does not need to be directly responsible for the system or device information other than the directly subordinate lower-level system, which optimizes the identity authentication system architecture. This multi-layer management model greatly reduces the security burden of CA and device management platform. Compared with the single authentication architecture, it improves security and establishes a more complete management system;

[0034] 6. The terminal service platform does not need to build additional cryptographic devices such as cryptographic machines to support the management of multi-layer certificates. By using the cryptographic service platform to provide a cryptographic service interface for the terminal service platform, the construction and transformation costs of the terminal service platform using multi-layer certificates are greatly reduced;

[0035] 7. The cryptographic service platform and the PKI / CA system are deployed in a security domain. Therefore, the cryptographic service platform and CA transmit information in a secure channel and can use non-ciphertext transmission, reducing the authentication and communication costs of multi-layer management. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of a flow chart of a method for generating an implicit certificate based on a cryptographic service platform according to an embodiment of the present invention;

[0037] Figure 2 The present invention is an embodiment of the implicit certificate generation system architecture diagram based on the cryptographic service platform. DETAILED DESCRIPTION

[0038] In order to facilitate those skilled in the art to better understand the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The following is only exemplary and does not limit the protection scope of the present invention.

[0039] like Figure 1 As shown, a flow chart of an implicit certificate generation method based on a cryptographic service platform described in this embodiment, the encryption certificate is an important basis for key negotiation and data encryption, and plays an indispensable role in the national secret certificate system. The public key reconstruction value and the corresponding private key reconstruction value used for the encryption certificate are composed of a terminal management platform, a cryptographic service platform and a PKI / CA system. The terminal management platform supported by the cryptographic service platform undertakes the access and management functions of the Internet of Things devices. Therefore, the terminal device applies to the PKI / CA system through the terminal device management platform and the cryptographic service platform and obtains the implicit signature certificate and the implicit encryption certificate, which specifically includes the following steps.

[0040] S100, the terminal device applies to the PKI / CA system through the terminal device management platform and the cryptographic service platform and obtains an implicit signature certificate.

[0041] In the national secret certificate scheme, traditional digital certificates are divided into signature certificates and encryption certificates. Therefore, in order to be compatible with national secret certificates, the implicit certificates in this application are also divided into implicit signature certificates and implicit encryption certificates. As the foundation of the national secret certificate system, the signature certificate is the basis for supporting device security.

[0042] The national secret certificate can be SM2, SM3 and SM4. In one embodiment of the present invention, the public key cryptographic algorithm of the terminal device, the cryptographic service platform and the PKI / CA system adopts the SM2 elliptic curve algorithm, and the selection of the elliptic curve parameters adopts the SM2 specification. The terminal device, the cryptographic service platform and the PKI / CA system pre-agree on a unified elliptic curve parameter G = (p, a, b, g x ,g y ,z).

[0043] S101, the terminal device generates a pre-signed private key, and calculates a pre-signed public key based on the pre-signed private key.

[0044] The terminal device generates a random number k u ∈[1,2,…,n-1] as the pre-signed private key, and pass the pre-signed private key k u Calculate the pre-signed public key P u =k u G, thereby obtaining the pre-signing key (k u ,P u ).

[0045] S102, the terminal device encapsulates at least the device information of the terminal device and the information of the pre-signed public key and then initiates a signature certificate application request to the terminal management platform.

[0046] The device information of the terminal device includes basic device information, device serial number, etc.

[0047] S103, the terminal management platform registers the signature certificate application message to the cryptographic service platform, and calls the cryptographic service platform to generate a platform temporary signature private key. The cryptographic service platform calculates the platform temporary signature public key based on the platform temporary signature private key.

[0048] S1031, the terminal management platform calls the cryptographic service platform to generate a random number k m ∈[1,2,…,n-1] is used as the platform temporary signature private key.

[0049] S1032, the cryptographic service platform uses the platform's temporary signature private key k m Computing platform temporary signature public key P m =k m G, get the platform temporary signature key (k m ,P m ).

[0050] S104, the cryptographic service platform at least sends the pre-signed public key P u 、Platform temporary signature public key P m After encapsulating the device information, call the PKI / CA system to apply for the terminal device signature certificate.

[0051] S105, the PKI / CA system generates a CA temporary signature private key based on the signature certificate application message, and calculates the CA temporary signature public key based on the CA temporary signature private key, and calculates the signature public key reconstruction value based on the CA temporary signature public key, the platform temporary signature public key and the pre-signature public key to register the implicit signature certificate, and generates the CA signature private key reconstruction value based on the implicit signature certificate, the CA temporary signature private key and the CA root signature certificate private key, and encrypts the CA signature private key reconstruction value based on the pre-signature public key to obtain the CA signature private key reconstruction value ciphertext. The following steps are included.

[0052] S1051, the PKI / CA system receives the signature certificate application message and obtains the pre-signed public key P u and the platform temporary public key P m ;

[0053] S1052, the PKI / CA system randomly generates a random number k CA ∈[1,2,…,n-1] as the CA temporary signature private key, based on the CA temporary signature private key k CA Calculate the CA temporary signature public key P CA =k CA G, thereby obtaining the CA temporary signature key pair (k CA ,P CA );

[0054] S1053, based on the pre-signed public key P u 、Platform temporary signature public key P m and CA temporary signature public key P CA Generate signature public key reconstruction value R u , R u =P u +P m +P CA .

[0055] S1054, reconstruct value R based on signature public key u Calculate and register implicit encryption certificate Cert1 u ;

[0056] S1055, calculating the implicit encryption certificate hash value h1 based on the implicit encryption certificate u =hash(Cert1 u ), and based on the implicitly encrypted certificate hash value h1 u, CA temporary signature private key and CA root signature certificate private key are used to calculate the CA signature private key reconstruction value r1 CA =h1 u ×k CA +q CA ,.

[0057] S1056, based on the pre-signed public key P u Encrypt the CA signature private key reconstruction value to obtain the CA signature private key reconstruction value ciphertext P u (r1 CA ).

[0058] In one embodiment of the present invention, the hash function uses the SM3 hash algorithm. In addition, the CA root signature certificate private key of the PKI / CA system is q CA and CA root signing certificate public key Q CA , together constitute the CA root signature certificate key pair (q ca , Q CA ).

[0059] It should be noted that the CA signature private key reconstruction value ciphertext P issued by the PKI / CA system u (r1 CA ) is transmitted to the terminal device through the cryptographic service platform and the terminal management platform for application in the decryption stage.

[0060] S106, the PKI / CA system will implicitly sign the certificate Cert1 u and CA signature private key to reconstruct the ciphertext P u (r1 CA ) is sent to the password service platform.

[0061] S107, the cryptographic service platform verifies the integrity and signature of the implicit encryption certificate, thereby generating a platform signature private key reconstruction value r based on the implicit signature certificate and the platform temporary signature private key. m , and based on the pre-signed public key P u Encrypt the platform signature private key reconstruction value to obtain the platform signature private key reconstruction value ciphertext P u (r m ), including:

[0062] S1071, the cryptographic service platform verifies the integrity of the implicit signature certificate and verifies the implicit signature certificate received in response from the PKI / CA system.

[0063] In one embodiment of the present invention, by h1 u =hash(Cert1 u ) Verify the integrity of the implicit signature certificate and verify the signature of the implicit signature certificate.

[0064] S1072, based on implicit signature certificate Cert1 u 、Platform temporary private key k m And the terminal management platform signature private key q m Generate platform signature private key reconstruction value r m .

[0065] Generate platform signature private key reconstruction value r m =h u ×k m +q m .

[0066] S1073, based on the pre-signed public key P u Reconstruct the value r of the platform signature private key m Encrypt to obtain the platform signature private key reconstruction value ciphertext.

[0067] S108, the cryptographic service platform sends at least the implicit signature certificate Cert1 to the terminal management platform u 、CA signature private key reconstruction value ciphertext P u (r1 CA ) and the platform signature private key reconstruction value ciphertext P u (r m ).

[0068] S109, the terminal management platform backs up the implicit signature certificate, and will at least include the implicit signature certificate Cert1 u 、Platform signature private key reconstruction value ciphertext P u (r m ) and CA signature private key reconstruction value ciphertext P u (r1 CA ) is sent to the terminal device.

[0069] S110, the terminal device uses the pre-signed private key k u Decrypt the received encapsulated message to obtain the platform signature private key reconstruction value r m And CA signature private key reconstruction value r1 CA , and based on the received implicit signature certificate Cert1 u , CA signature private key reconstruction value r1 CA , platform signature private key reconstruction value r m The terminal device signature private key and the terminal device signature public key are generated by the pre-signed private key respectively.

[0070] S1101, the terminal device verifies the integrity of the received implicit signature certificate, and if the verification is successful, verifies the signature of the received implicit signature certificate.

[0071] In one embodiment of the present invention, h1 is used u =hash(Cert1u ) to verify the integrity of the implicit encryption certificate.

[0072] S1102, if the verification is successful, then based on the pre-signed private key k u Decrypt to get the platform signature private key reconstruction value r m And CA signature private key reconstruction value r1 CA .

[0073] S1103, based on the implicit signature certificate hash value h1 u , platform signature private key reconstruction value r m , CA signature private key reconstruction value r1 CA and the pre-signed private key k u Calculate the terminal device signature private key.

[0074] Terminal device signature private key q u =h1 u ×k u +r m +r1 CA .

[0075] S1104, based on the implicit signature certificate hash value h1 u and the signature public key reconstruction value R u Calculate and obtain the terminal device signature public key.

[0076] Terminal device signature public key Q u =h1 u ×R u +Q CA +Q m Among them, Q CA Q is the public key of the CA root signing certificate. m Sign the public key for the terminal management platform.

[0077] S111, the terminal device verifies the terminal device signature public key and obtains the terminal device signature key.

[0078] Verify that Q is satisfied u =q u G, if satisfied, the terminal device signature key (q u, ,Q u ). And save the obtained terminal device signature key.

[0079] like Figure 1 As shown, the terminal device applies for and obtains an encryption certificate from the PKI / CA system through at least the terminal management platform and the cryptographic service platform, including the following steps.

[0080] S200, the terminal device sends the device information and implicit signature certificate to the terminal management platform to initiate an encryption certificate application.

[0081] The terminal device sends an encrypted certificate request, encapsulates the device information and the corresponding digital signature, and the implicit signature certificate and sends it to the terminal management platform.

[0082] It should be noted that the reconstruction value of the terminal device signature public key is included in the implicit signature certificate. When applying for an implicit encryption certificate, the implicit signature certificate is first submitted as the basis for device authentication. The terminal management platform calculates the terminal device signature public key through the reconstruction value of the terminal device signature public key and then verifies the signature to determine the device identity.

[0083] S300, the terminal management platform verifies the signature certificate, thereby registering an encrypted certificate application message to the cryptographic service platform, and calling the cryptographic service platform to generate a pre-encrypted private key and a pre-encrypted public key, including the following steps.

[0084] S3001, the terminal management platform calculates the terminal device signature public key.

[0085] Terminal device signature public key Q u =R u +Q m +Q CA , where R u Reconstruct the value of the signature public key in the implicit signature certificate, Q CA Q is the public key of the CA root signing certificate. m Sign the public key for the terminal management platform.

[0086] S3002: perform a comparison and verification based on the implicit signature certificate backed up on the terminal management platform and the received implicit signature certificate.

[0087] S3003, if the verification is successful, the terminal management platform registers the encryption certificate application message to the cryptographic service platform, and calls the cryptographic service platform to generate a pre-encrypted private key and a pre-encrypted public key.

[0088] If the verification is successful, the terminal management platform calls the password service platform to randomly generate a random number t m ∈[1,2,…,n-1] as the pre-encryption private key.

[0089] S3004, the cryptographic service platform calculates the pre-encrypted public key T based on the pre-encrypted private key m =t m G, get the pre-encryption key (t m ,T m ).

[0090] S400, the cryptographic service platform encapsulates at least the pre-encrypted public key and the device information, and calls the PKI / CA system to apply for an encryption certificate based on the encapsulated message.

[0091] S500, the PKI / CA system generates a CA temporary encryption private key based on the encrypted certificate application message sent by the cryptographic service platform to obtain a CA temporary encryption public key, calculates an encrypted public key reconstruction value based on the CA temporary encryption public key and the pre-encrypted public key to register an implicit encryption certificate, and generates a CA encryption private key reconstruction value based on the implicit encryption certificate.

[0092] S5001, the PKI / CA system obtains the pre-encrypted public key T according to the encrypted certificate application message m

[0093] S5002, after receiving the encrypted certificate application message sent by the cryptographic service platform, the PKI / CA system generates a random number t CA ∈[1,2,…,n-1] as the CA temporary encryption private key, thereby calculating the CA temporary encryption public key T CA =t CA G, get CA temporary key (t CA ,T CA ).

[0094] S5003, calculate the encrypted public key reconstruction value D based on the pre-encrypted public key and the CA temporary encrypted public key u =T m +T CA .

[0095] S5004, reconstructing the value D based on the encrypted public key u Register implicit encryption certificate Cert2 u .

[0096] S5005, calculate implicit encryption certificate Cert2 u The hash value h2 u =hash(Cert2 u ), and generates the CA encryption private key reconstruction value r2 based on the hash value of the implicit encryption certificate, the CA temporary encryption private key, and the CA root encryption certificate private key CA .

[0097] CA encrypted private key reconstruction value r2 CA =h2 u ×t CA +e CA . Among them, e CA Encrypt the private key of the CA root certificate.

[0098] S600, PKI / CA system will implicitly encrypt the certificate Cert2 u And CA encrypted private key reconstruction value r2 CA Sent to the password service platform.

[0099] It should be noted that, for an implicit certificate generation system for data encryption without a cryptographic service platform, the transmission of each part of the system is based on ciphertext transmission. The cryptographic service platform set in the implicit certificate generation system proposed by the present invention and the PKI / CA system are deployed in a security domain, that is, the default cryptographic service platform and CA perform information transmission in a secure channel, so the CA system and the cryptographic service platform can use plaintext transmission in the same domain.

[0100] S700, the cryptographic service platform verifies the integrity and signature of the implicit encryption certificate, generates the terminal device encryption private key based on the implicit encryption certificate, the pre-encrypted private key and the CA encryption private key reconstruction value, and encrypts the terminal device encryption private key based on the terminal device signature public key to obtain the terminal device encryption private key ciphertext. The following steps are included:

[0101] S7001, the cryptographic service platform verifies the integrity of the implicit encryption certificate and verifies the signature of the implicit encryption certificate received in response from the PKI / CA system.

[0102] In one embodiment of the present invention, the cryptographic service platform uses h2 u =hash(Cert2 u ) Verify the integrity of the implicit encryption certificate. And verify the signature of the received implicit encryption certificate.

[0103] S7002, if the verification and signature are successful, then based on the implicit encryption certificate Cert2 u , pre-encrypted private key t m And CA encrypted private key reconstruction value r2 CA Generate encrypted private key u =h2 u ×t m +r2 CA .

[0104] S7003: Encrypt the terminal device encryption private key based on the terminal device signature public key to obtain the terminal device encryption private key ciphertext Q u (e u ).

[0105] S800, the cryptographic service platform sends at least the implicit encryption certificate Cert2 to the terminal management platform u And CA encrypted private key reconstruction value r2 CA .

[0106] It should be noted that the implicit encryption certificate Cert2 u The encrypted public key reconstruction value D u Therefore, when the implicit encryption certificate is issued, the encrypted public key reconstruction value is also issued.

[0107] S900, terminal management platform backs up implicit encryption certificate Cert2 u , will at least include the ciphertext Q encrypted by the implicit encryption certificate and the terminal device encrypted private key u (e u )’s packaging information is sent to the terminal device.

[0108] S9001, the terminal management platform backs up the implicit encryption certificate, thereby matching the terminal device with the implicit encryption certificate.

[0109] S9002, the terminal management platform will implicitly encrypt the certificate and the terminal device encrypted private key ciphertext Q u (e u ) is sent to the terminal device.

[0110] S1000, terminal device based on terminal device signature private key q u Decrypt the terminal device encrypted private key ciphertext Q u (e u ) to obtain the terminal device encryption private key e u , and generate the terminal device encryption public key based on the encrypted public key reconstruction value in the implicit encryption certificate and the CA encryption public key.

[0111] Terminal device encryption public key E u =h2 u ×D u +E CA , verify and generate the public and private key pair for the terminal device signature (e u, E u ).

[0112] Among them, E CA Encrypt the public key for the CA root certificate.

[0113] S1100, the terminal device verifies the encryption public key and obtains the encryption key.

[0114] The terminal device verifies whether the terminal device encryption public key satisfies E u =e u G, if satisfied, the terminal device encryption key (e u ,,E u ).

[0115] In another embodiment of the present invention, a system for generating an implicit certificate for data encryption is provided, which runs the above-mentioned method for generating an implicit certificate for data encryption. Figure 2 As shown, an implicit certificate generation system for data encryption includes several terminal devices, several terminal management platforms for managing the IoT terminal devices respectively, a PKI / CA system and a cryptographic service platform arranged between the PKI / CA system and the terminal management platform.

[0116] Terminal device: used to generate a pre-signed key, and send a signed certificate application to the terminal management platform based on the device information and the pre-signed public key, and obtain the terminal device signing key and implicit signing certificate based on the returned implicit signing certificate, the platform signing private key reconstruction value ciphertext and the CA signing private key reconstruction value ciphertext, and, based on the signing certificate and device information, initiate an encryption certificate application to the terminal management platform, and obtain the terminal device encryption key based on the returned implicit encryption certificate and the terminal device encryption private key ciphertext.

[0117] Terminal management platform: used to call the cryptographic service platform to generate a temporary platform signature key based on the signature certificate application message sent by the terminal device, thereby sending a signature certificate application to the cryptographic service platform, or to call the cryptographic service platform to generate a pre-encrypted key based on the encryption certificate application message sent by the terminal device, thereby sending an encryption certificate application message to the cryptographic service platform. It is also used to back up the implicit signature certificate and implicit encryption certificate returned by the cryptographic service platform, and send the implicit signature certificate and the corresponding platform signature private key reconstruction value ciphertext and CA signature private key reconstruction value ciphertext, implicit encryption certificate and the corresponding terminal device encryption private key ciphertext to the terminal device.

[0118] Cryptographic service platform: used to verify the integrity and signature of the implicit signature certificate and implicit encryption certificate returned by the PKI / CA system, and also used to generate a temporary platform signature key based on the call of the terminal management platform, and send the pre-signed public key and the temporary platform public key to the PKI / CA system, so as to call the PKI / CA system to apply for a signature certificate, and generate the platform signature private key reconstruction value ciphertext based on the implicit signature certificate and the temporary platform signature private key, the terminal management platform signature private key and the pre-signed public key returned by the PKI / CA system, and send the implicit signature certificate, CA signature private key reconstruction value ciphertext and platform signature private key reconstruction value ciphertext to the terminal management platform, or, used to generate a pre-encrypted key based on the call of the terminal management platform, and send the pre-encrypted public key to the PKI / CA system, so as to call the PKI / CA system to apply for an encryption certificate, and generate the terminal device encryption private key ciphertext based on the implicit encryption certificate and CA encryption private key reconstruction value, the pre-encrypted private key and the terminal device signature public key returned by the PKI / CA system, and send the implicit encryption certificate and the terminal device encryption private key ciphertext to the terminal management platform.

[0119] PKI / CA system: used to generate a CA temporary signature private key based on the signature certificate application of the cryptographic service platform, and obtain the CA temporary signature public key based on the CA temporary signature private key, and calculate the signature public key reconstruction value based on the CA temporary signature public key, the platform temporary signature public key and the pre-signature public key, so as to register the implicit signature certificate and calculate the CA signature private key reconstruction value, and send the implicit signature certificate and the CA signature private key reconstruction value ciphertext to the cryptographic service platform, and, used to generate a CA temporary encryption private key based on the encryption certificate application of the cryptographic service platform, so as to obtain the CA temporary encryption public key, calculate the encryption public key reconstruction value based on the CA temporary encryption public key and the pre-encryption public key, so as to register the implicit encryption certificate and calculate the CA encryption private key reconstruction value, and send the implicit encryption certificate and the CA encryption private key reconstruction value to the cryptographic service platform.

[0120] In one embodiment of the present invention, IoT terminal devices refer to some IoT data collection devices and data transmission devices with encryption functions, such as PLCs with encryption modules, VPN devices with encryption functions, etc. The PKI / CA system is a CA that supports implicit certificates or a CA that supports implicit certificates built by the enterprise itself. The terminal management platform is an application platform that can uniformly manage and control IoT terminal devices within its jurisdiction. It is usually a systematic platform deployed on the server and only performs some non-cryptographic operations such as certificate backup and certificate and device binding. The cryptographic service platform supports the distribution and management of keys, data encryption and decryption, signature verification, digital envelopes and other functions, and can provide cryptographic services and key service interfaces for the underlying system.

[0121] The present invention realizes data encryption of national secret algorithm based on implicit certificate with multi-layer management. Implicit certificate with small storage space and fast signature verification speed is used as signature certificate and encryption certificate of IoT device, and public and private key calculation and identity authentication are completed through public and private key reconstruction, and certificate verification is completed through public and private key matching.

[0122] The upper-level system authenticates the device through the public and private key reconstruction value, and does not need to be directly responsible for the system or device information other than the directly subordinate lower-level system, which optimizes the identity authentication system architecture. In addition, it is compatible with the existing traditional digital certificate and implicit certificate schemes, and has a high degree of freedom in the number of multi-layer management side devices and authentication modes.

[0123] The multi-layer management strategy also effectively optimizes the security issues caused by the reconstruction value of the public and private keys of implicit certificates. In one embodiment of the present invention, other systems except the device body cannot restore the private key or even the complete private key reconstruction value, including the encryption key generation scheme generated by the device management platform. Since the constituent units of the public and private key reconstruction values ​​are complex, the systems involved in the reconstruction are jointly responsible for the certificate, which greatly reduces the security weight of the CA and the device management platform. Compared with a single authentication architecture, it has higher security and a more complete management system. And by using the cryptographic service platform to provide a cryptographic service interface for the terminal service platform, the construction and transformation costs of the terminal service platform using multi-layer certificates are greatly reduced.

[0124] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

Claims

1. A method for generating an implicit certificate based on a cryptographic service platform, characterized in that ,include: The terminal device applies for a signature certificate from the PKI / CA system through the terminal device management platform and the cryptographic service platform and obtains an implicit signature certificate; The terminal device sends the device information and the implicit signature certificate to the terminal management platform to initiate an encryption certificate application; The terminal management platform verifies the signature certificate, thereby registering the encryption certificate application message with the cryptographic service platform, and calling the cryptographic service platform to generate a pre-encrypted private key and a pre-encrypted public key; The cryptographic service platform at least encapsulates the pre-encrypted public key and device information, and calls the PKI / CA system to apply for an encryption certificate based on the encapsulated message; The PKI / CA system generates a CA temporary encryption private key based on the encrypted certificate application message sent by the cryptographic service platform to obtain a CA temporary encryption public key, calculates an encrypted public key reconstruction value based on the CA temporary encryption public key and the pre-encrypted public key to register an implicit encryption certificate, and generates a CA encryption private key reconstruction value based on the implicit encryption certificate; The PKI / CA system sends the implicit encryption certificate and the CA encryption private key reconstruction value to the cryptographic service platform; The cryptographic service platform generates a terminal device encryption private key based on the implicit encryption certificate, the pre-encrypted private key and the CA encryption private key reconstruction value, and encrypts the terminal device encryption private key based on the terminal device signature public key to obtain the terminal device encryption private key ciphertext; The cryptographic service platform at least issues the implicit encryption certificate and the terminal device encryption private key ciphertext to the terminal management platform; The terminal management platform backs up the implicit encryption certificate and sends packaged information including at least the implicit encryption certificate and the ciphertext of the terminal device encryption private key to the terminal device; The terminal device decrypts the terminal device encrypted private key ciphertext based on the terminal device signature private key to obtain the terminal device encrypted private key, and generates the terminal device encrypted public key based on the encrypted public key reconstruction value in the implicit encryption certificate and the CA encrypted public key.

2. According to claim 1, a method for generating an implicit certificate based on a cryptographic service platform is characterized in that: The terminal management platform verifies the signature certificate, thereby registering an encrypted certificate application message with the cryptographic service platform, and calling the cryptographic service platform to generate a pre-encrypted private key and a pre-encrypted public key, specifically including: The terminal management platform calculates the terminal device signature public key; Compare and verify the implicit signature certificate backed up on the terminal management platform with the received implicit signature certificate; If the verification is successful, the terminal management platform registers the encrypted certificate application message with the cryptographic service platform, and calls the cryptographic service platform to randomly generate a random number as a pre-encrypted private key; The cryptographic service platform calculates the pre-encrypted public key based on the pre-encrypted private key.

3. According to claim 1, a method for generating an implicit certificate based on a cryptographic service platform is characterized in that: The PKI / CA system generates a CA temporary encryption private key based on the encrypted certificate application message sent by the cryptographic service platform to obtain a CA temporary encryption public key, calculates an encrypted public key reconstruction value based on the CA temporary encryption public key and the pre-encrypted public key to register an implicit encryption certificate, and generates a CA encryption private key reconstruction value based on the implicit encryption certificate, specifically including: The PKI / CA system obtains the pre-encrypted public key based on the encrypted certificate application message of the terminal device; The PKI / CA system generates a random number as the CA temporary encryption private key, thereby calculating the CA temporary encryption public key; The encrypted public key reconstruction value is calculated based on the pre-encrypted public key and the CA temporary encrypted public key; Registering an implicit encryption certificate based on the encrypted public key reconstructed value; An implicit encryption certificate hash value is calculated based on the implicit encryption certificate, and a CA encryption private key reconstruction value is calculated and generated based on the implicit encryption certificate hash value, the CA temporary encryption private key, and the CA root encryption certificate private key.

4. According to claim 1, a method for generating an implicit certificate based on a cryptographic service platform is characterized in that: The cryptographic service platform verifies the integrity and signature of the implicit encryption certificate, generates a terminal device encryption private key based on the implicit encryption certificate, the pre-encrypted private key and the CA encryption private key reconstruction value, and encrypts the terminal device encryption private key based on the terminal device signature public key to obtain the terminal device encryption private key ciphertext, specifically including: The cryptographic service platform verifies the integrity of the implicit encryption certificate and verifies the signature of the implicit encryption certificate issued by the PKI / CA system. Generate a terminal device encryption private key based on the implicit encryption certificate, the pre-encrypted private key and the CA encryption private key reconstruction value; The terminal device encryption private key is encrypted based on the terminal device signature public key to obtain the terminal device encryption private key ciphertext.

5. The method for generating an implicit certificate based on a cryptographic service platform according to claim 1, characterized in that: The terminal device decrypts the terminal device encrypted private key ciphertext based on the terminal device signature private key to obtain the terminal device encrypted private key, and generates an encrypted public key based on the encrypted public key reconstruction value in the implicit encryption certificate and the CA encrypted public key, specifically including: The terminal device verifies the integrity of the received implicit encryption certificate and verifies the signature; If both integrity verification and signature verification are passed, the terminal device encryption private key is obtained by decryption based on the terminal device signature private key; The terminal device encryption public key is calculated based on the encryption public key reconstruction value in the implicit encryption certificate and the CA root encryption certificate public key; The terminal device encryption key is obtained after verifying the terminal device encryption public key and the terminal device encryption private key.

6. According to claim 1, a method for generating an implicit certificate based on a cryptographic service platform is characterized in that: The terminal device applies for a signature certificate from the PKI / CA system through the terminal device management platform and the cryptographic service platform and obtains an implicit signature certificate, specifically including: The terminal device generates a pre-signed private key and calculates a pre-signed public key based on the pre-signed private key; The terminal device at least encapsulates the device information of the terminal device and the information of the pre-signed public key and then initiates a signature certificate application request to the terminal management platform; The terminal management platform registers the signature certificate application message to the cryptographic service platform, and calls the cryptographic service platform to generate a temporary platform signature private key. The cryptographic service platform calculates the temporary platform signature public key based on the temporary platform signature private key. The cryptographic service platform at least encapsulates the pre-signed public key, the platform temporary signature public key and the device information, and then calls the PKI / CA system to apply for the terminal device signature certificate; The PKI / CA system generates a CA temporary signature private key based on the signature certificate application message, and calculates the CA temporary signature public key based on the CA temporary signature private key, and calculates the signature public key reconstruction value based on the CA temporary signature public key, the platform temporary signature public key and the pre-signature public key to register the implicit signature certificate, and generates a CA signature private key reconstruction value based on the implicit signature certificate, the CA temporary signature private key and the CA root signature certificate private key, and encrypts the CA signature private key reconstruction value based on the pre-signature public key to obtain the CA signature private key reconstruction value ciphertext; The PKI / CA system sends the implicit signature certificate and the CA signature private key reconstruction value ciphertext to the cryptographic service platform; The cryptographic service platform verifies the integrity and signature of the implicit encryption certificate, thereby generating a platform signature private key reconstruction value based on the implicit signature certificate and the platform temporary signature private key, and encrypts the platform signature private key reconstruction value based on the pre-signed public key to obtain the platform signature private key reconstruction value ciphertext; The cryptographic service platform at least sends the implicit signature certificate, the CA signature private key reconstruction value ciphertext and the platform signature private key reconstruction value ciphertext to the terminal management platform; The terminal management platform backs up the implicit signature certificate and sends packaged information including at least the implicit signature certificate, the CA signature private key reconstruction value ciphertext and the platform signature private key reconstruction value ciphertext to the terminal device; The terminal device decrypts the received encapsulated message based on the pre-signed private key to obtain the platform signature private key reconstruction value and the CA signature private key reconstruction value, and generates the terminal device signature private key and the terminal device signature public key respectively based on the implicit signature certificate, the CA signature private key reconstruction value, the platform signature private key reconstruction value and the pre-signed private key; The terminal device obtains the terminal device signature key after verifying the terminal device signature public key and the terminal device signature private key.

7. According to claim 6, a method for generating an implicit certificate based on a cryptographic service platform is characterized in that: The PKI / CA system generates a CA temporary signature private key based on the signature certificate application message, calculates a CA temporary signature public key based on the CA temporary signature private key, and calculates a signature public key reconstruction value based on the CA temporary signature public key, the platform temporary signature public key and the pre-signature public key to register an implicit signature certificate, generates a CA signature private key reconstruction value based on the implicit signature certificate, the CA temporary signature private key and the CA root signature certificate private key, and encrypts the CA signature private key reconstruction value based on the pre-signature public key to obtain the CA signature private key reconstruction value ciphertext specifically including: The PKI / CA system obtains the pre-signed public key and the platform temporary signature public key based on the signature certificate application message; The PKI / CA system generates a random number as the CA temporary signature private key, and calculates the CA temporary signature public key based on the CA temporary signature private key; The signature public key reconstruction value is calculated based on the pre-signature public key, the platform temporary signature public key and the CA temporary signature public key; Calculate and register an implicit signature certificate based on the signature public key reconstruction value; Calculate the implicit signature certificate hash value based on the implicit signature certificate, and calculate and generate the CA signature private key reconstruction value based on the implicit signature certificate hash value, the CA temporary signature private key and the CA root signature certificate private key; The CA signature private key reconstruction value is encrypted based on the pre-signed public key to obtain the CA signature private key reconstruction value ciphertext.

8. The method for generating an implicit certificate based on a cryptographic service platform according to claim 6, characterized in that: The cryptographic service platform verifies the integrity and signature of the implicit encryption certificate, thereby generating a platform signature private key reconstruction value based on the implicit signature certificate and the platform temporary signature private key, and encrypts the platform signature private key reconstruction value based on the pre-signed public key to obtain the platform signature private key reconstruction value ciphertext, specifically including: The cryptographic service platform verifies the integrity of the implicit signature certificate and verifies the signature of the implicit signature certificate issued by the PKI / CA system. Generate a platform signature private key reconstruction value based on the implicit signature certificate, the platform temporary signature private key and the terminal management platform signature private key; The platform signature private key reconstruction value is encrypted based on the pre-signed public key to obtain the platform signature private key reconstruction value ciphertext.

9. The method for generating an implicit certificate based on a cryptographic service platform according to claim 6, characterized in that: The terminal device decrypts the received encapsulated message based on the pre-signed private key to obtain the platform signature private key reconstruction value and the CA signature private key reconstruction value, and generates the terminal device signature private key and the terminal device signature public key based on the implicit signature certificate, the CA signature private key reconstruction value, the platform signature private key reconstruction value and the pre-signed private key, specifically including: The terminal device decrypts the pre-signed private key to obtain the platform signature private key reconstruction value and the CA signature private key reconstruction value; The terminal device signature private key is calculated based on the implicit signature certificate hash value, the platform signature private key reconstruction value, the pre-signature private key and the CA signature private key reconstruction value; The terminal device signature public key is calculated based on the implicit signature certificate hash value, the signature public key reconstruction value in the implicit signature certificate, the CA root signature certificate public key and the terminal management platform signature public key.

10. An implicit certificate generation system based on a cryptographic service platform, running an implicit certificate generation method based on a cryptographic service platform according to any one of claims 1 to 9, characterized in that: It includes at least several terminal devices, several terminal management platforms that manage the IoT terminal devices respectively, a PKI / CA system, and a cryptographic service platform set between the PKI / CA system and the terminal management platform. Terminal device: used to generate a pre-signed key, and send a signature certificate application to the terminal management platform based on the device information and the pre-signed public key, and obtain the terminal device signature key and implicit signature certificate based on the returned implicit signature certificate, platform signature private key reconstruction value ciphertext and CA signature private key reconstruction value ciphertext. And, based on the signature certificate and device information, initiate an encryption certificate application to the terminal management platform, and obtain the terminal device encryption key based on the returned implicit encryption certificate and the terminal device encryption private key ciphertext; Terminal management platform: used to call the cryptographic service platform to generate a temporary platform signature key based on the signature certificate application message sent by the terminal device, thereby sending a signature certificate application to the cryptographic service platform. Alternatively, it is used to call the cryptographic service platform to generate a pre-encrypted key according to the encrypted certificate application message sent by the terminal device, thereby sending the encrypted certificate application message to the cryptographic service platform, And, back up the implicit signature certificate and implicit encryption certificate returned by the password service platform, and send the implicit signature certificate and the corresponding platform signature private key reconstruction value ciphertext and CA signature private key reconstruction value ciphertext, implicit encryption certificate and the corresponding terminal device encryption private key ciphertext to the terminal device; Cryptographic service platform: used to verify the integrity and signature of implicit signature certificates and implicit encryption certificates returned by the PKI / CA system. It is also used to generate a temporary platform signature key based on the call of the terminal management platform, and send the pre-signed public key and the temporary platform public key to the PKI / CA system, thereby calling the PKI / CA system to apply for a signature certificate, and based on the implicit signature certificate returned by the PKI / CA system and the temporary platform signature private key, the terminal management platform signature private key and the pre-signed public key, generate the platform signature private key reconstruction value ciphertext, and send the implicit signature certificate, CA signature private key reconstruction value ciphertext and platform signature private key reconstruction value ciphertext to the terminal management platform. Alternatively, it is used to generate a pre-encrypted key based on the call of the terminal management platform, and send the pre-encrypted public key to the PKI / CA system, thereby calling the PKI / CA system to apply for an encryption certificate, and generating a terminal device encryption private key ciphertext based on the implicit encryption certificate and CA encryption private key reconstruction value, the pre-encrypted private key and the terminal device signature public key returned by the PKI / CA system, and sending the implicit encryption certificate and the terminal device encryption private key ciphertext to the terminal management platform; PKI / CA system: used to generate CA temporary signature private key based on the signature certificate application of the cryptographic service platform, and obtain CA temporary signature public key based on CA temporary signature private key, and calculate the signature public key reconstruction value based on CA temporary signature public key, platform temporary signature public key and pre-signature public key, so as to register implicit signature certificate and calculate CA signature private key reconstruction value, and send the implicit signature certificate and CA signature private key reconstruction value ciphertext to the cryptographic service platform, Also, it is used to generate a CA temporary encryption private key based on the encryption certificate application of the cryptographic service platform, thereby obtaining the CA temporary encryption public key, and calculate the encryption public key reconstruction value based on the CA temporary encryption public key and the pre-encrypted public key to register the implicit encryption certificate and calculate the CA encryption private key reconstruction value, and send the implicit encryption certificate and the CA encryption private key reconstruction value to the cryptographic service platform.

Images