Digital certificate generation method and device, electronic equipment and storage medium

Abstract

The invention provides a digital certificate generation method and device, electronic equipment and a storage medium, and the method comprises the steps: receiving a certificate generation request sent by a user terminal, the certificate generation request comprises user information and an identifier of a certificate generation algorithm, and the certificate generation algorithm comprises a post quantum cryptographic algorithm and a preset national cryptographic algorithm; and generating a target mixed public key according to the post-quantum public key of the post-quantum cryptographic algorithm and a national cryptographic public key of a preset national cryptographic algorithm, generating a target digital certificate according to the user information and the target mixed public key, and sending the target digital certificate to the user terminal. The digital certificate is generated based on the post-quantum cryptographic algorithm and the national cryptographic algorithm, so that communication security can be ensured, quantum attacks are resisted, and certificate generation at an unconditional security level is realized.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and more specifically, to a method, device, electronic device and storage medium for generating a digital certificate. Background Art

[0002] With the rapid development of Internet technology, users are gradually completing various operations and obtaining various services online. While online operations bring convenience to users, they also bring potential risks in confidentiality and security.

[0003] In related technologies, public key infrastructure (PKI) is usually used to implement and provide security services. PKI is a universal security service measure that uses asymmetric cryptographic algorithm principles (public key theory) and third-party authentication technology to implement and provide security services.

[0004] However, the security of traditional public key cryptography systems depends on the complexity of calculations, does not have unconditional security, and has certain security risks. Summary of the invention

[0005] In view of this, the present request embodiment provides a digital certificate generation method, device, electronic device and storage medium to generate digital certificates based on post-quantum cryptographic algorithms and national secret algorithms, which can ensure communication security, resist quantum attacks, and achieve unconditional security level certificate generation.

[0006] In a first aspect, the present request embodiment provides a method for generating a digital certificate, which is applied to a certificate issuing system, and the method includes: Receive a certificate generation request sent by a user terminal, wherein the certificate generation request includes: user information and an identifier of a certificate generation algorithm, wherein the certificate generation algorithm includes: a post-quantum cryptographic algorithm and a preset national cryptographic algorithm; Generate a target hybrid public key according to the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm; Generate a target digital certificate according to the user information and the target hybrid public key; The target digital certificate is sent to the user terminal.

[0007] In an optional implementation, the certificate generation request further includes: a first certificate type and / or a second certificate type; the generating a target hybrid public key according to the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm includes: Generate a first hybrid public key according to the first post-quantum public key and the first national secret public key of the first certificate type; and / or, Generate a second hybrid public key according to the second post-quantum public key of the second certificate type and the second national secret public key; The step of generating a target digital certificate according to the user information and the target hybrid public key includes: Generate a signature certificate according to the user information and the first hybrid public key, so as to perform data transmission based on the first hybrid private key and the signature certificate stored in the user terminal itself; and / or, An encryption certificate is generated according to the user information and the second hybrid public key, so as to perform data transmission based on the encryption certificate.

[0008] In an optional implementation, generating a second hybrid public key according to a second post-quantum public key and a second national secret public key of the second certificate type includes: Sending a hybrid key generation request to a key management center, wherein the hybrid key generation request includes: an identifier of the certificate generation algorithm, the second post-quantum public key, and the second national secret public key, so that the key management center generates a second hybrid public key according to the second post-quantum public key and the second national secret public key; Receive the second hybrid public key sent by the key management center.

[0009] In an optional embodiment, the method further comprises: Acquire a temporary hybrid public key from the certificate generation request, wherein the hybrid key generation request also includes: the temporary hybrid public key, so that the key management center generates a second hybrid private key corresponding to the second hybrid public key, and uses the temporary hybrid public key to encrypt the second hybrid private key to obtain an encrypted private key; Receiving the encrypted private key sent by the key management center; The encrypted private key is sent to the user terminal, so that the user terminal uses a temporary hybrid private key to decrypt the encrypted private key to obtain the second hybrid private key, so as to perform data transmission based on the second hybrid private key and the encryption certificate.

[0010] In an optional embodiment, the method further comprises: Receiving a certificate update request for the target digital certificate sent by the user terminal; Regenerate a target hybrid public key and a new target digital certificate according to the certificate update request; A certificate update response is sent to the user terminal to indicate that the target digital certificate is updated using the new target digital certificate.

[0011] In an optional embodiment, the method further comprises: In the case where the signature certificate is lost, receiving a signature certificate recovery request sent by the user terminal, wherein the signature certificate recovery request includes: a new first hybrid public key; Regenerate a signature certificate according to the user information and the new first hybrid public key; A signature certificate recovery response is sent to the user terminal to instruct the user terminal to update the signature certificate using the regenerated signature certificate.

[0012] In an optional embodiment, the method further comprises: In the case where the encryption certificate is lost, receiving an encryption certificate recovery request sent by the user terminal, wherein the encryption certificate recovery request includes: the temporary hybrid public key; Sending a key recovery request to the key management center, wherein the key recovery request includes: the temporary hybrid public key and the identifier of the encryption certificate, so that the key management center queries the second hybrid public key and the second hybrid private key according to the identifier of the encryption certificate, and uses the temporary hybrid public key to re-encrypt the second hybrid private key to obtain an encrypted private key; Receiving the second hybrid public key and the regenerated encrypted private key sent by the key management center; Regenerate an encryption certificate according to the user information and the second hybrid public key; The regenerated encryption certificate and the regenerated encryption private key are sent to the user terminal.

[0013] In an optional embodiment, the method further comprises: receiving a certificate invalidation request for the target digital certificate sent by the user terminal, wherein the certificate invalidation request is: a certificate revocation request or a certificate freezing request; According to the certificate revocation request or certificate freezing request, the target digital certificate is added to the certificate revocation list, and the status of the target digital certificate in the certificate status query system is marked as revoked or frozen.

[0014] In an optional embodiment, the method further comprises: If the certificate invalidation request is a certificate freezing request, receiving a certificate unfreezing request for the target digital certificate sent by the user terminal; According to the certificate thawing request, the target digital certificate is removed from the certificate revocation list, and the status of the target digital certificate in the certificate status query system is marked as in use.

[0015] In an optional embodiment, the method further comprises: receiving a certificate extension request for the signature certificate sent by the user terminal, wherein the certificate extension request includes: an extension time; According to the extension time, a signature certificate extension response is sent to the user terminal to indicate that the end time stored in the signature certificate is updated using the extension time.

[0016] In an optional embodiment, the method further comprises: receiving a certificate extension request for the encryption certificate sent by the user terminal, wherein the certificate extension request includes: an extension time; Sending a hybrid key generation request to the key management center, so that the key management center adopts the certificate generation algorithm to regenerate the second hybrid public key according to the second post-quantum public key and the second national secret public key; regenerating an encryption certificate according to the extension time, the user information and the second hybrid public key; The regenerated encryption certificate is sent to the user terminal.

[0017] In a second aspect, the present request embodiment further provides a digital certificate generation device, including: A receiving module, configured to receive a certificate generation request sent by a user terminal, wherein the certificate generation request includes: user information and an identifier of a certificate generation algorithm, wherein the certificate generation algorithm includes: a post-quantum cryptographic algorithm and a preset national cryptographic algorithm; A processing module, used to generate a target hybrid public key according to the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm; The processing module is further used to generate a target digital certificate according to the user information and the target hybrid public key; A sending module is used to send the target digital certificate to the user terminal.

[0018] In an optional implementation manner, the processing module is specifically used to: Generate a first hybrid public key according to the first post-quantum public key and the first national secret public key of the first certificate type; and / or, Generate a second hybrid public key according to the second post-quantum public key of the second certificate type and the second national secret public key; The processing module is specifically used to: generate a signature certificate according to the user information and the first hybrid public key, so as to perform data transmission based on the first hybrid private key and the signature certificate stored in the user terminal itself; and / or, An encryption certificate is generated according to the user information and the second hybrid public key, so as to perform data transmission based on the encryption certificate.

[0019] In an optional implementation manner, the processing module is specifically used to: Sending a hybrid key generation request to a key management center, wherein the hybrid key generation request includes: an identifier of the certificate generation algorithm, the second post-quantum public key, and the second national secret public key, so that the key management center generates a second hybrid public key according to the second post-quantum public key and the second national secret public key; Receive the second hybrid public key sent by the key management center.

[0020] In an optional embodiment, the device further comprises: an acquisition module, configured to acquire a temporary hybrid public key from the certificate generation request, wherein the hybrid key generation request further includes: the temporary hybrid public key, so that the key management center generates a second hybrid private key corresponding to the second hybrid public key, and uses the temporary hybrid public key to encrypt the second hybrid private key to obtain an encrypted private key; The receiving module is further used to receive the encrypted private key sent by the key management center; The sending module is further used to send the encrypted private key to the user terminal, so that the user terminal uses a temporary hybrid private key to decrypt the encrypted private key to obtain the second hybrid private key, so as to perform data transmission based on the second hybrid private key and the encryption certificate.

[0021] In an optional implementation manner, the receiving module is further used for: Receiving a certificate update request for the target digital certificate sent by the user terminal; The processing module is further used to regenerate a target hybrid public key and generate a new target digital certificate according to the certificate update request; The sending module is further used to send a certificate update response to the user terminal to indicate that the target digital certificate is updated using the new target digital certificate.

[0022] In an optional implementation manner, the receiving module is further used for: In the case where the signature certificate is lost, receiving a signature certificate recovery request sent by the user terminal, wherein the signature certificate recovery request includes: a new first hybrid public key; The processing module is further used to regenerate a signature certificate according to the user information and the new first hybrid public key; The sending module is further used to send a signature certificate recovery response to the user terminal to indicate that the signature certificate is updated using the regenerated signature certificate.

[0023] In an optional implementation manner, the receiving module is further used for: In the case where the encryption certificate is lost, receiving an encryption certificate recovery request sent by the user terminal, wherein the encryption certificate recovery request includes: the temporary hybrid public key; The sending module is further used to send a key recovery request to the key management center, wherein the key recovery request includes: the temporary hybrid public key and the identifier of the encryption certificate, so that the key management center queries the second hybrid public key and the second hybrid private key according to the identifier of the encryption certificate, and uses the temporary hybrid public key to re-encrypt the second hybrid private key to obtain an encrypted private key; The receiving module is further used to receive the second hybrid public key and the regenerated encrypted private key sent by the key management center; The processing module is further used to regenerate an encryption certificate according to the user information and the second hybrid public key; The sending module is further used to send the regenerated encryption certificate and the regenerated encryption private key to the user terminal.

[0024] In an optional implementation manner, the receiving module is further used for: receiving a certificate invalidation request for the target digital certificate sent by the user terminal, wherein the certificate invalidation request is: a certificate revocation request or a certificate freezing request; The processing module is further configured to add the target digital certificate to a certificate revocation list according to the certificate revocation request or the certificate freezing request, and mark the status of the target digital certificate in the certificate status query system as revoked or frozen.

[0025] In an optional implementation manner, the receiving module is further used for: If the certificate invalidation request is a certificate freezing request, receiving a certificate unfreezing request for the target digital certificate sent by the user terminal; The processing module is further configured to remove the target digital certificate from a certificate revocation list according to the certificate thawing request, and mark the status of the target digital certificate in the certificate status query system as being in use.

[0026] In an optional implementation manner, the receiving module is further used for: receiving a certificate extension request for the signature certificate sent by the user terminal, wherein the certificate extension request includes: an extension time; The sending module is further used to send a signature certificate extension response to the user terminal according to the extension time to indicate that the end time stored in the signature certificate is updated using the extension time.

[0027] In an optional implementation manner, the receiving module is further used for: receiving a certificate extension request for the encryption certificate sent by the user terminal, wherein the certificate extension request includes: an extension time; The sending module is further used to send a hybrid key generation request to the key management center, so that the key management center adopts the certificate generation algorithm to regenerate the second hybrid public key according to the second post-quantum public key and the second national secret public key; The processing module is further used to regenerate an encryption certificate according to the extension time, the user information and the second hybrid public key; The sending module is further used to send the regenerated encryption certificate to the user terminal.

[0028] In the third aspect, the embodiment of the present request also provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory through the bus, and the processor executes the machine-readable instructions to execute any one of the methods described in the first aspect.

[0029] In a fourth aspect, the present request embodiment further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method described in any one of the first aspects is executed.

[0030] This request provides a digital certificate generation method, device, electronic device and storage medium, wherein the method includes: receiving a certificate generation request sent by a user terminal, the certificate generation request includes: user information and an identifier of a certificate generation algorithm, the certificate generation algorithm includes: a post-quantum cryptographic algorithm and a preset national secret algorithm, generating a target hybrid public key according to the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm, generating a target digital certificate according to the user information and the target hybrid public key, and sending the target digital certificate to the user terminal. By generating a digital certificate based on the post-quantum cryptographic algorithm and the national secret algorithm, it is possible to ensure communication security, resist quantum attacks, and achieve certificate generation at an unconditional security level. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solution of the embodiment of the present request, the drawings required for use in the embodiment will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present request and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 The overall architecture diagram of the digital certificate generation system provided in the embodiment of the present application; Figure 2 A business logic diagram of a digital certificate authentication system provided in an embodiment of the present application; Figure 3 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 1 ; Figure 4 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 2 ; Figure 5 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 3 ; Figure 6 A schematic diagram of a process for generating an encryption certificate provided in an embodiment of the present application; Figure 7 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 4 ; Figure 8 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 5 ; Fig. 9 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 6 ; Fig.10 A schematic diagram of a key recovery process provided in an embodiment of the present application; Fig.11 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 7 ; Fig.12 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 8 ; Fig.13 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 9 ; Fig.14 A schematic diagram of the structure of a digital certificate generation device provided in an embodiment of the present application; Fig.15 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the embodiment of the present request clearer, the technical solution in the embodiment of the present request will be clearly and completely described below in conjunction with the drawings in the embodiment of the present request. Obviously, the described embodiment is only a part of the embodiment of the present request, not all of the embodiments. The components of the embodiment of the present request generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiment of the present request provided in the drawings is not intended to limit the scope of the present request for protection, but merely represents the selected embodiment of the present request. Based on the embodiment of the present request, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present request.

[0034] First, the professional terms involved in this application are explained: PKI: Public Key Infrastructure is an infrastructure consisting of hardware, software, participants, management policies and processes, which aims to create, manage, distribute, use, store and revoke digital certificates.

[0035] PQC: Post-Quantum Cryptography is a branch of cryptography that aims to study and develop encryption algorithms that resist quantum computing attacks. Based on quantum mechanics, its security is based on physical properties such as the uncertainty principle, quantum non-cloning, and quantum coherence, and has been proven to be unconditionally secure. In addition, quantum key distribution technology based on quantum mechanics ensures that the key distribution process cannot be effectively eavesdropped because of the characteristics of quantum states such as non-cloning, uncertainty, and measurement collapse. It is a new generation of cryptographic algorithms that can resist attacks by quantum computers on existing cryptographic algorithms. Traditional public key encryption algorithms (such as RSA, DSA, and ECC) may be threatened with cracking in the case of large-scale quantum computers because quantum computers have the computing power required to crack traditional encryption algorithms.

[0036] ROOTCA: Root Certaficate Authority. The root certificate is the public key certificate of the root certificate authority. It is the starting point of the chain in the public key infrastructure. ROOTCA is optional in the PKI system.

[0037] CA: Certificate Authority system, a certificate authority that grants and manages certificates.

[0038] RA: Record Auditing Authority, i.e., the certificate registration system, reduces the workload of CA by processing certificate registration requests. RA accepts certificate requests, verifies user identity, and determines whether to require CA to issue a certificate. RA is optional in the PKI system. If CA is exposed to direct network access, serious security issues will arise. It is recommended to delegate certain tasks to RA, and then CA can focus on its main task of signing certificates and CRLs.

[0039] X.509: The International Telecommunication Union (ITU) standardized format for digital certificates.

[0040] CRL: Certificate Revocation List.

[0041] Encryption: Converting plain text (original data) into cipher text (encrypted data) through a certain algorithm, so that unauthorized people cannot read and understand the data content. The purpose of encryption is to protect the confidentiality of data and prevent data from being stolen or tampered with.

[0042] Decryption: It is the reverse process of encryption, which converts ciphertext into plaintext.

[0043] Digital signature: Use a private key to encrypt the signature summary of a file or data to generate a digital signature. The digital signature contains the ciphertext of the file or data and the private key encryption, which is used to verify the integrity and authenticity of the file or data.

[0044] Signature summary: A fixed-length string obtained by performing a hash calculation on a file or data.

[0045] Digital certificate: A digital document used to prove the identity and authority of an entity. A digital certificate generally contains information such as the entity's identity information, public key, and digital signature.

[0046] Signature certificate: a certificate used in data signing scenarios.

[0047] Encryption certificate: a certificate used in data encryption scenarios.

[0048] Asymmetric encryption: A pair of public and private keys can decrypt the content encrypted by each other, and can only decrypt the content encrypted by each other. After the public key encrypts, only the corresponding private key can decrypt, and after the private key encrypts, only the public key can decrypt. Among them, the public key is open to the public, and the private key is not open to the public.

[0049] Digital envelope: The sender uses a symmetric key to encrypt the information content, and then encrypts the symmetric key with the receiver's public key (this part is called a digital envelope), and then sends it together with the encrypted information to the receiver. The receiver first uses the corresponding private key to open the digital envelope, obtain the symmetric key, and then uses the symmetric key to decrypt the encrypted information.

[0050] Among them, the core of PKI is CA. The existing digital certificate generation system is composed of CA, RA and Key Management Center (KMC). The key data such as keys and certificates transmitted between systems are mainly protected by traditional public key cryptography (digital signatures, digital envelopes, etc.) and communication protocols. However, the security of the traditional public key cryptography system depends on the complexity of calculation. It is a mathematics-based cryptographic system and does not have unconditional security in theory. This makes PKI-based identity authentication always have security risks. With the continuous evolution of supercomputers, this risk will be infinitely magnified.

[0051] Based on this, this application generates digital certificates based on post-quantum cryptographic algorithms and national secret algorithms, and uses quantum keys to realize data encryption and decryption and encrypted data transmission in classical communication networks, which can ensure communication security, resist quantum attacks, and achieve unconditional security level certificate generation.

[0052] Figure 1 The overall architecture diagram of the digital certificate generation system provided in the embodiment of the present application is as follows: Figure 1 As shown, it includes: key management center (KMC), digital certificate authentication system, certificate storage medium, and basic software and hardware environment.

[0053] Among them, the Key Management Center (KMC): provides corresponding key services for the generation of hybrid key digital certificates, deploys quantum key distribution equipment on the KMC side, and KMC calls the corresponding device application programming interface (Application Programming Interface, API) to implement key generation, key storage protection, key transmission protection, digital signature and message hash calculation and other functions to complete the key service in the digital certificate generation process.

[0054] Digital certificate authentication system: provides full-process management functions for the life cycle of digital certificates and certificate keys, including certificate registration, issuance, production, renewal, freezing, thawing, revocation, recovery, and release, and provides certificate query, certificate download, certificate verification and other services for business application systems.

[0055] Certificate storage medium: The digital certificate authentication system calls the API interface of the certificate storage medium (such as smart password key, password card, etc.) to realize the digital certificate production function, and writes the digital certificate and key into the certificate storage medium. Among them, it can be stored in a certificate storage medium (such as USBKEY device) with good compatibility, fast speed and easy use. In addition, the certificate storage medium has complete user management and adopts the authentication method of impact response to achieve high-intensity encryption and strong identity authentication.

[0056] Basic software and hardware environment: provides support for the operation of the digital certificate authentication system, including databases, operating systems, servers, etc.

[0057] Figure 2 The business logic diagram of the digital certificate authentication system provided in the embodiment of the present application is as follows: Figure 2 As shown, the digital certificate authentication system consists of a root certificate issuing system, a certificate issuing system, a certificate registration system, a certificate status query system, and a certificate storage and publishing system.

[0058] Root certificate issuance system: works in an offline mode to implement the issuance and management of the agency certificates of the subordinate certificate issuance system, the issuance and management of the certificate revocation list (CRL) of the subordinate agency, etc. When accessing the trust system, the relevant functions of the root certificate issuance system can be replaced by the trust root, and the subordinate certificate issuance system can use the agency certificate issued by the trust source point to establish a complete trust relationship.

[0059] Certificate Issuance System: Implements certificate management functions such as issuance, revocation, renewal, extension, freezing, thawing, and recovery of encryption certificates and signature certificates, implements issuance and management of certificate revocation lists (CRLs), and performs system maintenance and security management. The certificate issuance system is connected to the upper-level certificate issuance system, accepts management by the upper-level certificate issuance system, and reports system status information such as certificate status revocation to the upper-level certificate issuance system; it accepts access to the lower-level certificate issuance system, implements management of the lower-level certificate issuance system, accepts system status information reported by the lower-level certificate issuance system, and publishes certificate, CRL and other information to the directory service system.

[0060] Certificate registration system: As the agent of the certificate issuance system, it realizes the application, review, production and issuance of various digital certificates, and performs system maintenance and security management. At the same time, it reports system status information to the certificate issuance system.

[0061] Certificate status query system: Provides certificate status query services based on the Online Certificate Status Protocol (OCSP) protocol for external application systems.

[0062] Certificate storage and publishing system: To receive and store certificates, CRL and other information issued by the system, and provide query and download services for certificates, CRL and other information for external application systems. Among them, according to different application environments, the storage and publication of digital certificate lists and certificate revocation lists can be implemented in the form of database or directory services, to achieve the storage, backup and recovery of digital certificate lists and certificate revocation lists, and provide query services. Using the directory service method, a master-slave directory server structure is adopted to protect the security of the master directory server, and users can only access the slave directory server. Among them, the master certificate storage and publishing system is deployed on the master directory server, and the slave certificate storage and publishing system is deployed on the slave directory server.

[0063] During the initialization phase of the root certificate issuance system, the root certificate issuance system configures the institutional information through the client and obtains the institutional key of the root certificate issuance system from the quantum key distribution device. The keys include national secret key pairs (such as SM2 key pairs) and quantum key pairs (PQC key pairs). A self-signed hybrid key institutional certificate is generated based on the configured institutional information and keys.

[0064] During the initialization phase of the certificate issuing system, the certificate issuing system generates an agency certificate application document and submits it to the root certificate issuing system for issuing the system agency certificate.

[0065] During the initialization phase of the certificate registration system, the certificate issuing system is used to register the lower-level certificate registration authority, and the certificate issuing system issues an authority certificate for the certificate registration system.

[0066] During the initialization phase of the certificate status query system, the certificate status query system generates an institutional certificate application document and submits it to the certificate issuance system for issuing the system institutional certificate.

[0067] It is worth noting that the key management center (KMC), registration and review authority, root certificate issuance system, certificate issuance system, certificate registration system, and certificate status query system can be deployed on the same electronic device or on different electronic devices, and this embodiment does not specifically limit this.

[0068] Figure 3 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 1 The execution subject of this embodiment may be applied to a certificate issuing system, and the certificate issuing system may be deployed in an electronic device.

[0069] like Figure 3 As shown, the method may include: S101: Receive a certificate generation request sent by a user terminal.

[0070] The user terminal sends a certificate generation request to the certificate issuing system, and the certificate issuing system receives the certificate generation request sent by the user terminal. The certificate generation request includes: user information and an identifier of the certificate generation algorithm, wherein the user information may be the user's identity information, and the certificate generation algorithm includes: a post-quantum cryptographic algorithm and a preset national cryptographic algorithm.

[0071] Among them, the preset national encryption algorithm can be, for example, any one of SM1, SM2, SM3, SM4, SM7, and SM9.

[0072] In an optional implementation, the user terminal sends a certificate generation request to a registration and review authority, and the registration and review authority certificate issuance system reviews the request through the registration and review authority. If the review is passed, the request is sent to the certificate issuance system.

[0073] Among them, the registration review structure is used to review the legality of user information. In addition, the certificate generation application can also include the application date including the start date and end date. The registration review agency can also review whether the application duration meets certain conditions.

[0074] S102. Generate a target hybrid public key based on the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm.

[0075] Among them, the post-quantum public key is the public key corresponding to the post-quantum cryptographic algorithm, and the national secret public key is the public key corresponding to the preset national secret algorithm.

[0076] Obtain the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm, and generate the target mixed public key according to the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm using the preset mixing rule.

[0077] In an optional implementation, the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm are concatenated to generate a target mixed public key. For example, the target mixed public key is: the byte length of the national secret public key + the national secret public key + the post-quantum public key.

[0078] S103: Generate a target digital certificate based on the user information and the target hybrid public key.

[0079] A hash calculation is performed based on the user information and the target mixed public key to obtain a signature summary, the signature summary is encrypted using the private key of the certificate issuing system to obtain a digital signature, and a target digital certificate is generated based on the user information, the target mixed public key and the digital signature, wherein the target digital certificate includes: user information, the target mixed public key and the digital signature.

[0080] In some embodiments, the digital certificate based on the X.509 certificate format follows the general structure of the X.509 certificate and contains information specific to the PQC hybrid key in the extension field. The format of the certificate generally includes the following: Certificate identification information: including the certificate's unique identifier, issuing authority information, etc.

[0081] Key algorithm information: includes information about post-quantum cryptography algorithms and classical encryption algorithms, such as algorithm type, parameter settings, etc.

[0082] Certificate holder information: includes the identity information of the certificate holder, such as name, organizational unit, etc.

[0083] Validity period: Specify the validity period of the certificate, including the start date and end date.

[0084] Public key information: the target mixed public key that is a mixture of the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret encryption algorithm.

[0085] Signature information: A digital signature obtained by encrypting the signature summary using the private key of the certificate issuing system.

[0086] S104: Send the target digital certificate to the user terminal.

[0087] After generating the target digital certificate, the certificate issuing system may also send the target digital certificate to the user terminal through the registration and review authority, and the registration and review authority may also download and store the target digital certificate in the certificate storage medium.

[0088] In this embodiment, a quantum security authentication certificate issuance system is constructed based on the interconnection between the post-quantum cryptographic algorithm and the national secret algorithm, providing users with secure signature services, achieving authentic user identity, and unconditional security of data against tampering and non-repudiation, becoming an important part of the quantum security infrastructure. In addition, digital certificates are generated based on the post-quantum cryptographic algorithm and the national secret algorithm, which can ensure communication security, resist quantum attacks, and achieve unconditional security level certificate generation.

[0089] Figure 4 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 2 ,like Figure 4 As shown, in an optional implementation manner, the certificate generation request also includes: a first certificate type and / or a second certificate type, and the above step S102, generating a target hybrid public key according to the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm, may include step S201 and / or step S202: S201. Generate a first hybrid public key according to a first post-quantum public key and a first national secret public key of a first certificate type.

[0090] Among them, the first certificate type can be a signature certificate type, the post-quantum public key of the post-quantum cryptographic algorithm includes: a first post-quantum public key, the first post-quantum public key is the public key corresponding to the post-quantum cryptographic algorithm under the first certificate type, and the national secret public key of the preset national secret algorithm includes: a first national secret public key, the first national secret public key is the public key corresponding to the preset national secret algorithm under the first certificate type.

[0091] Obtain a first post-quantum public key and a first national secret public key, use a preset mixing rule to mix the first post-quantum public key and the first national secret public key, and generate a first mixed public key. The target mixed public key includes: the first mixed public key.

[0092] In an optional implementation, the first post-quantum public key and the first national secret public key are concatenated to generate a first hybrid public key. For example, the first hybrid public key is: the byte length of the first national secret public key + the first national secret public key + the first post-quantum public key.

[0093] S202. Generate a second hybrid public key according to the second post-quantum public key and the second national secret public key of the second certificate type.

[0094] Among them, the second certificate type can be an encryption certificate type, the post-quantum public key of the post-quantum cryptographic algorithm includes: the second post-quantum public key, the second post-quantum public key is the public key corresponding to the post-quantum cryptographic algorithm under the second certificate type, and the national secret public key of the preset national secret algorithm includes: the second national secret public key, the second national secret public key is the public key corresponding to the preset national secret algorithm under the second certificate type.

[0095] Obtain a second post-quantum public key and a second national secret public key, use a preset mixing rule to mix the second post-quantum public key and the second national secret public key to generate a second mixed public key, and the target mixed public key includes: the second mixed public key.

[0096] In an optional implementation, the second post-quantum public key and the second national secret public key are concatenated to generate a second mixed public key. For example, the second mixed public key is: the byte length of the second national secret public key + the second national secret public key + the second post-quantum public key.

[0097] The above step S103, generating a target digital certificate according to the user information and the target hybrid public key, may include step S203 and / or step S204: S203: Generate a signature certificate according to the user information and the first hybrid public key, so as to perform data transmission based on the first hybrid private key and the signature certificate stored in the user terminal itself.

[0098] Among them, the user terminal itself stores the first quantum public key and the first national secret public key, and the first mixed private key is obtained by the user terminal using a preset mixing rule to mix the first quantum private key corresponding to the first quantum public key and the first national secret private key corresponding to the first national secret public key. The specific mixing method can refer to the mixing method of the first quantum public key and the first national secret public key, which will not be repeated here.

[0099] A signature summary is obtained by performing a hash calculation based on the user information and the first hybrid public key, and the signature summary is encrypted using the private key of the certificate issuance system to obtain a first digital signature, and a signature certificate is generated based on the user information, the first hybrid public key, and the first digital signature, so as to transmit data based on the first hybrid private key and the signature certificate. The signature certificate includes: user information, the first hybrid public key, and the first digital signature.

[0100] During the data transmission process, A uses its own first hybrid private key to sign the transmitted data, obtains the signature data (i.e., digital signature), and sends the signature data to B. A's signature certificate is public. B uses the public key of the certificate issuing system to decrypt the first digital signature in A's signature certificate, obtains the signature digest of the user information and the first hybrid public key, and calculates the signature digest of the user information and the first hybrid public key in the signature certificate. If the calculated signature digest is consistent with the decrypted signature digest, it means that the signature verification is successful and the user information has not been tampered with. If they are inconsistent, it means that the signature verification has failed and the user information has been tampered with.

[0101] If the signature verification is successful, B obtains the first hybrid public key from the signature certificate and uses the first hybrid public key to decrypt the data to be transmitted to obtain the data to be transmitted, thereby achieving secure data transmission based on the first hybrid private key and the signature certificate.

[0102] S204: Generate an encryption certificate according to the user information and the second hybrid public key, so as to perform data transmission based on the encryption certificate.

[0103] A hash calculation is performed based on the user information and the second hybrid public key to obtain a signature summary, the signature summary is encrypted using the private key of the certificate issuance system to obtain a second digital signature, and an encryption certificate is generated based on the user information, the second hybrid public key and the second digital signature to transmit data based on the encryption certificate. The encryption certificate includes: user information, the second hybrid public key and the second digital signature.

[0104] During the data transmission process, B's encryption certificate is public. A verifies B's encryption certificate. After the verification is successful, A obtains B's first hybrid public key from the encryption certificate. Then, A sends the data to be transmitted to B in a digital envelope. A uses B's second hybrid public key to encrypt the random number, and uses the random number to encrypt the data to be transmitted. A sends the encrypted random number and the encrypted data to be transmitted to B. B uses its own second hybrid private key to decrypt the encrypted random number to obtain the random number, and uses the random number to decrypt the encrypted data to be transmitted to obtain the data to be transmitted, thereby realizing secure data transmission based on the encryption certificate. For the specific verification process, please refer to the above related description.

[0105] It is worth noting that, in some cases, data transmission based on the signature certificate and the first hybrid private key is suitable for scenarios where the data to be transmitted is small, and data transmission based on the encryption certificate is suitable for scenarios where the data to be transmitted is large. In the case of large data to be transmitted, data transmission based on the signature certificate and the first hybrid private key may result in slower data transmission speed. In actual situations, different transmission modes can be selected according to needs, and this embodiment does not specifically limit this.

[0106] In this embodiment, quantum keys are used to implement data encryption and decryption and encrypted data transmission, achieving an unconditional security level.

[0107] Figure 5 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 3 ,like Figure 5 As shown, in an optional implementation, the above step S202, generating a second hybrid public key according to the second post-quantum public key of the second certificate type and the second national secret public key, may include: S301. Send a hybrid key generation request to a key management center.

[0108] The certificate issuance system sends a hybrid key generation request to the key management center, and the key management center is used to generate a second hybrid public key based on the second post-quantum public key and the second national secret public key. The hybrid key generation request includes: an identifier of the certificate generation algorithm, the second post-quantum public key, and the second national secret public key.

[0109] S302: Receive a second hybrid public key sent by a key management center.

[0110] The key management center sends the second hybrid public key to the certificate issuing system, and correspondingly, the certificate issuing system receives the second hybrid public key sent by the key management center.

[0111] In an optional embodiment, the method may further include: S303: Obtain a temporary hybrid public key from the certificate generation request.

[0112] Since the hybrid key cannot be used for encryption and decryption, in order to ensure the secure transmission of the first hybrid private key, a temporary encryption pair can also be applied for. The user terminal generates a temporary hybrid public key and a temporary hybrid private key. The certificate generation request includes the temporary hybrid public key, and the temporary hybrid public key is obtained from the certificate generation request.

[0113] Among them, the user terminal generates a temporary quantum public key, a temporary national secret public key, a temporary quantum private key, and a temporary national secret private key. The temporary mixed public key is obtained by the user terminal by mixing the temporary quantum public key and the temporary national secret public key. The temporary mixed private key is obtained by the user terminal by mixing the temporary quantum private key and the temporary national secret private key. The specific mixing method can be found in the above-mentioned relevant description.

[0114] A hybrid key generation request is sent to the key management center, where the hybrid key generation request also includes: a temporary hybrid public key, which the key management center uses to generate a second hybrid private key corresponding to the second hybrid public key, and uses the temporary hybrid public key to encrypt the second hybrid private key to obtain an encrypted private key, and encrypts the private key to the certificate issuing system.

[0115] S304: Receive the encrypted private key sent by the key management center.

[0116] S305: Send the encrypted private key to the user terminal, so that the user terminal uses the temporary hybrid private key to decrypt the encrypted private key to obtain a second hybrid private key, so as to perform data transmission based on the second hybrid private key and the encryption certificate.

[0117] The certificate issuing system receives the encrypted private key sent by the key management center and sends the encrypted private key to the user terminal. The user terminal uses the temporary hybrid private key generated by itself to decrypt the encrypted private key to obtain a second hybrid private key, and transmits data based on the second hybrid private key and the encryption certificate.

[0118] For the specific implementation process of data transmission based on the second hybrid private key and the encryption certificate, please refer to the relevant description in the above step S204, which will not be repeated here.

[0119] In this embodiment, quantum keys are used to implement data encryption and decryption and encrypted data transmission, achieving an unconditional security level.

[0120] Combine the following Figure 6 The embodiment specifically describes the encryption certificate generation process. The user side corresponds to the user terminal, and the CA side corresponds to the certificate issuing system. Figure 6 A schematic diagram of the encryption certificate generation process provided in the embodiment of the present application, such as Figure 6 As shown, the following steps are included: Step 1: The user side generates a temporary PQC+SM2 encryption key pair.

[0121] Among them, the temporary PQC+SM2 encryption key pair includes a temporary PQC+SM2 public key (temporary mixed public key) and a temporary PQC+SM2 private key (temporary mixed private key).

[0122] Step 2: The user side encapsulates the temporary PQC+SM2 public key into the extended attributes of the certificate generation request.

[0123] Step 3: The user sends the certificate generation request to the CA.

[0124] Step 4: The CA parses the certificate generation request, extracts the temporary PQC+SM2 public key, encapsulates it into a hybrid key generation request, and sends the hybrid key generation request to the key management center.

[0125] Step 5: The key management center verifies and parses the hybrid key generation request.

[0126] Step 6: The key management center uses the temporary PQC+SM2 public key to encrypt the second hybrid private key to generate an encrypted private key.

[0127] Among them, the encrypted private key is the response data structure protected by the temporary PQC+SM2 public key pair, and the response data is the PQC+SM2 mixed private key, that is, the second mixed private key.

[0128] Step 7: The CA generates an encryption certificate.

[0129] Step 8: The CA returns the encryption certificate to the user, and the key management center returns the encryption private key to the user through the CA.

[0130] Figure 7 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 4 ,like Figure 7 As shown, in an optional embodiment, the method may further include: S401: Receive a certificate update request for a target digital certificate sent by a user terminal.

[0131] In the event that there are security issues such as leakage of the target hybrid key, the user terminal can send a certificate update request for the target digital certificate to the certificate issuing system, where the certificate update request includes: a new post-quantum public key of the post-quantum cryptographic algorithm and a new national secret public key of the preset national secret algorithm.

[0132] In an optional implementation, the user terminal sends the certificate update request to the registration and review authority, and the registration and review authority conducts a legality review on the certificate update request. If the review is passed, the certificate update request is sent to the certificate issuing system.

[0133] S402: Regenerate the target hybrid public key according to the certificate update request, and generate a new target digital certificate.

[0134] According to the certificate update request, a new post-quantum public key and a new national secret public key are used to regenerate the target hybrid public key, wherein the new post-quantum public key and the new national secret public key can be used with preset mixing rules, such as splicing, to regenerate the target hybrid public key.

[0135] A hash calculation is performed based on the user information and the regenerated target hybrid public key to obtain a signature digest, the signature digest is encrypted using the private key of the certificate issuing system to obtain a digital signature, and a new target digital certificate is generated based on the user information, the regenerated target hybrid public key and the digital signature, wherein the new target digital certificate includes: user information, the regenerated target hybrid public key and the digital signature.

[0136] S403: Send a certificate update response to the user terminal to indicate that the target digital certificate is updated with a new target digital certificate.

[0137] A certificate update response is sent to the user terminal to indicate that a new target digital certificate is used to update the target digital certificate, that is, the target digital certificate is revoked and then a new target digital certificate is issued to the user.

[0138] In an optional implementation, the certificate issuing system may also send a new target digital certificate to the user terminal through the registration and review authority, and the registration and review authority may also use the new target digital certificate to update the target digital certificate stored in the certificate storage medium.

[0139] In this embodiment, certificate update is performed based on the post-quantum cryptographic algorithm and the national secret algorithm, which can ensure communication security and resist quantum attacks.

[0140] Figure 8 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 5 ,like Figure 8 As shown, in an optional embodiment, the method may further include: S501: When a signature certificate is lost, receiving a signature certificate recovery request sent by a user terminal.

[0141] In the case where the signature certificate is lost, the user terminal sends a signature certificate recovery request to the certificate issuing system, and the certificate issuing system receives the signature certificate recovery request, which includes: a new first hybrid public key. The user terminal generates a new first hybrid public key and a new first hybrid private key, and the user terminal itself stores the new first hybrid private key.

[0142] In an optional implementation, the user terminal sends the signature certificate recovery request to the registration review agency, and the registration review agency conducts a legality review on the signature certificate recovery request. If the review is passed, the signature certificate recovery request is sent to the certificate issuing system.

[0143] S502: Regenerate a signature certificate based on the user information and the new first hybrid public key.

[0144] S503: Send a signature certificate recovery response to the user terminal to instruct the user terminal to update the signature certificate using the regenerated signature certificate.

[0145] The signature certificate is regenerated according to the user information and the new first hybrid public key, so as to perform data transmission based on the new first hybrid private key and the regenerated signature certificate stored in the user terminal itself.

[0146] Among them, a signature certificate recovery response can also be sent to the user terminal to indicate that the regenerated signature certificate is used to update the originally generated signature certificate, that is, the certificate issuing system generates a new signature certificate for the user terminal based on the new first hybrid public key and the new first hybrid private key regenerated by the user terminal.

[0147] In an optional implementation, the certificate issuing system may also send the regenerated signature certificate to the user terminal through the registration and review authority, and the registration and review authority may also use the regenerated signature certificate to update the target digital certificate stored in the certificate storage medium.

[0148] In this embodiment, a recovery solution after the loss of a signature certificate is provided based on the post-quantum cryptographic algorithm and the national secret algorithm, which can ensure communication security and resist quantum attacks.

[0149] Fig. 9 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 6 ,like Fig. 9 As shown, in an optional implementation, the method may further include: S601: When an encryption certificate is lost, receiving an encryption certificate recovery request sent by a user terminal.

[0150] In the case where the encryption certificate is lost, the user terminal sends an encryption certificate recovery request to the certificate issuing system, and the certificate issuing system receives the encryption certificate recovery request, which includes: a temporary hybrid public key.

[0151] S602. Send a key recovery request to the key management center, so that the key management center queries the second hybrid public key and the second hybrid private key according to the identifier of the encryption certificate, and uses the temporary hybrid public key to re-encrypt the second hybrid private key to obtain an encrypted private key.

[0152] A key recovery request is sent to a key management center, where the key recovery request includes: an identifier of a temporary hybrid public key and an encryption certificate. The key management center is used to query the second hybrid public key and the second hybrid private key according to the identifier of the encryption certificate, and use the temporary hybrid public key to re-encrypt the second hybrid private key to obtain an encrypted private key, wherein a mapping relationship between the encryption certificate and the second hybrid public key and the second hybrid private key is stored in a preset database, and the second hybrid public key and the second hybrid private key can be determined by querying the preset database.

[0153] S603: Receive the queried second hybrid public key and the regenerated encrypted private key sent by the key management center.

[0154] S604: Regenerate an encryption certificate based on the user information and the second hybrid public key.

[0155] S605: Send the regenerated encryption certificate and the regenerated encryption private key to the user terminal.

[0156] The key management center sends the queried second hybrid public key and the regenerated encrypted private key to the certificate issuing system. The certificate issuing system regenerates the encryption certificate based on the user information and the second hybrid public key, and sends the regenerated encryption certificate and the regenerated encrypted private key to the user terminal, so that the user terminal uses the temporary hybrid private key to decrypt the encrypted private key to obtain the second hybrid private key.

[0157] In an optional implementation, the user terminal sends an encryption certificate recovery request to the registration and review authority, and the registration and review authority reviews the legality of the encryption certificate recovery request. After the review is passed, the encryption certificate recovery request is sent to the certificate issuing system. After the certificate issuing system regenerates the encryption certificate and the encryption private key, the regenerated encryption certificate and encryption private key can be sent to the user terminal through the registration and review authority.

[0158] In an optional implementation, when receiving an encryption certificate recovery request sent by a user terminal, the key management center may also authenticate the certificate issuing system, and after the authentication is passed (ie, CA access is legal), execute steps S602 to S605.

[0159] In this embodiment, the recovery of encryption certificates after loss is performed based on post-quantum cryptographic algorithms and national cryptographic algorithms, which can ensure communication security and resist quantum attacks.

[0160] Combine the following Fig.10 The embodiment specifically describes the key recovery process. The CA side corresponds to the certificate issuing system, and the key management center and the database are deployed on the cryptographic device. Fig.10 A schematic diagram of a key recovery process provided in an embodiment of the present application is shown in FIG. Fig.10 As shown, the following steps are included: Step 1: The CA sends a key recovery request to the key management center.

[0161] Step 2: The key management center parses the key recovery request to obtain the key recovery data.

[0162] The key recovery data is a digital signature made on the CA's identity information using the CA's private key.

[0163] Step 3: The key management center queries the CA organization certificate and CA public key from the database.

[0164] Step 4: The database returns the CA organization certificate and CA public key to the key management center.

[0165] Step 5: The key management center requests the cryptographic device to use the CA public key for signature verification and returns the signature verification result to the key management center.

[0166] Step 6: The key management center determines the legitimacy of CA's access based on the signature verification result.

[0167] Step 7: When CA access is legal, the key management center queries the database for hybrid key information based on the identifier of the encryption certificate.

[0168] The mixed key information includes: a second mixed public key and a second mixed private key.

[0169] Step 8: The database returns the digital envelope for the mixed key information to the key management center.

[0170] The digital envelope is obtained by encrypting the mixed key information with an internal password.

[0171] Step 9: The key management center requests the cryptographic device to parse the digital envelope encrypted by the internal password into plain text (i.e., the mixed key information), and encrypts the mixed key information with the CA public key, obtains the mixed key information encrypted by the CA public key, and returns it to the key management center.

[0172] Step 10: The key management center requests the cryptographic device to recover the response data signature, and the cryptographic device returns the signature value.

[0173] The response data signature is to sign the mixed key information encrypted by the CA public key using the private key of the key management center.

[0174] Step 11: The key management center encapsulates the key recovery response data structure and returns it to the CA side.

[0175] Among them, the key recovery response data structure includes a response data signature. The CA side uses the public key of the key management center to decrypt the response data signature to obtain the mixed key information encrypted by the CA public key, and uses the CA private key to decrypt the mixed key information.

[0176] Step 12: The key management center records the key recovery information in the database, and the database returns the operation result.

[0177] The operation result is the record response.

[0178] Fig.11 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 7 ,like Fig.11 As shown, in an optional implementation, the method may further include: S701: Receive a certificate invalidation request for a target digital certificate sent by a user terminal.

[0179] The user terminal may send a certificate invalidation request for a target digital certificate to the certificate issuing system, and the certificate issuing system receives the certificate invalidation request, wherein the certificate invalidation request is: a certificate revocation request or a certificate freezing request.

[0180] S702: According to the certificate revocation request or the certificate freezing request, the target digital certificate is added to the certificate revocation list, and the status of the target digital certificate in the certificate status query system is marked as revoked or frozen.

[0181] According to the certificate revocation request, the target digital certificate is added to the certificate revocation list, and the status of the target digital certificate in the certificate status query system is marked as revoked, or, according to the certificate freezing request, the target digital certificate is added to the certificate revocation list, and the status of the target digital certificate in the certificate status query system is marked as frozen.

[0182] The certificate status query system stores the target digital certificate and the status information of the target digital certificate.

[0183] In an optional implementation, the user terminal sends a certificate revocation request to the registration review authority, and the registration review authority reviews the legitimacy of the certificate revocation request. After the review is passed, the certificate revocation request is sent to the certificate issuing system.

[0184] In an optional implementation, the user terminal sends a certificate freezing request to the registration review agency, and the registration review agency reviews the legality of the certificate freezing request. After passing the review, the certificate freezing request is sent to the certificate issuing system.

[0185] In an optional embodiment, the method may further include: If the certificate invalidation request is a certificate freezing request, a certificate unfreezing request for the target digital certificate sent by the user terminal is received.

[0186] According to the certificate unfreezing request, the target digital certificate is removed from the certificate revocation list, and the status of the target digital certificate in the certificate status query system is marked as in use.

[0187] If the certificate invalidation request is a certificate freezing request, the user terminal may also send a certificate unfreezing request for the target digital certificate to the certificate issuing system. According to the certificate unfreezing request, the target digital certificate may be removed from the certificate revocation list, and the status of the target digital certificate in the certificate status query system may be marked as in use.

[0188] In an optional implementation, the user terminal sends a certificate unfreezing request to the registration review agency, and the registration review agency reviews the legality of the certificate unfreezing request. After passing the review, the certificate unfreezing request is sent to the certificate issuing system.

[0189] Fig.12 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 8 ,like Fig.12 As shown, in an optional implementation, the method may further include: S801: Receive a certificate extension request for a signature certificate sent by a user terminal.

[0190] When the signing certificate needs to be extended, the user terminal sends a certificate extension request for the signing certificate to the certificate issuing system, and the certificate issuing system receives the certificate extension request, which includes: an extension time.

[0191] S802: Send a signature certificate extension response to the user terminal according to the extension time to indicate that the end time stored in the signature certificate is updated with the extension time.

[0192] According to the extension time, a signature certificate extension response is sent to the user terminal to indicate that the certificate end time stored in the signature certificate is updated with the extension time. For example, if the extension time is one year and the certificate end time is January 1, 2023, the updated certificate end time is January 1, 2024.

[0193] In an optional implementation, the user terminal sends a certificate extension request to the registration review agency, and the registration review agency reviews the legality of the certificate extension request. If the review is passed, the certificate extension request is sent to the certificate issuing system.

[0194] In this embodiment, the signature certificate is extended based on the post-quantum cryptographic algorithm and the national secret algorithm, which can ensure communication security and resist quantum attacks.

[0195] Fig.13 Schematic diagram of the process of generating a digital certificate provided in the embodiment of the present application Figure 9 ,like Fig.13 As shown, in an optional embodiment, the method may further include: S901: Receive a certificate extension request for an encryption certificate sent by a user terminal.

[0196] When the encryption certificate needs to be extended, the user terminal sends a certificate extension request for the encryption certificate to the certificate issuing system, and the certificate issuing system receives the certificate extension request, which includes: an extension time.

[0197] In an optional implementation, the user terminal sends a certificate extension request to the registration review agency, and the registration review agency reviews the legality of the certificate extension request. If the review is passed, the certificate extension request is sent to the certificate issuing system.

[0198] S902. Send a hybrid key generation request to the key management center, so that the key management center uses the certificate generation algorithm to regenerate the second hybrid public key according to the second post-quantum public key and the second national secret public key.

[0199] S903: Regenerate the encryption certificate according to the extension time, user information and the second hybrid public key.

[0200] S904: Send the regenerated encryption certificate to the user terminal.

[0201] A hybrid key generation request is sent to the key management center. The key management center adopts a certificate generation algorithm to regenerate the second hybrid public key according to the second post-quantum public key and the second national secret public key, and regenerates the encryption certificate according to the extension time, user information and the second hybrid public key. The time difference between the certificate end time in the regenerated encryption certificate and the certificate end time of the original encryption certificate is the extension time.

[0202] For the specific process of generating the encryption certificate, please refer to the description of step S204 above, which will not be repeated here.

[0203] That is to say, if the encryption certificate is extended, the certificate issuing system applies to the key management system for the original second hybrid key, and the certificate issuing system issues a new encryption certificate based on the obtained second hybrid key, user information and extension time.

[0204] In this embodiment, the encryption certificate is extended based on the post-quantum cryptographic algorithm and the national secret algorithm, which can ensure communication security and resist quantum attacks.

[0205] Fig.14This is a schematic diagram of the structure of a digital certificate generation device provided in an embodiment of the present application, which can be integrated into a certificate issuance system. Fig.14 As shown, the device may include: The receiving module 1001 is used to receive a certificate generation request sent by a user terminal, where the certificate generation request includes: user information and an identifier of a certificate generation algorithm, where the certificate generation algorithm includes: a post-quantum cryptographic algorithm and a preset national cryptographic algorithm; The processing module 1002 is used to generate a target hybrid public key according to the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm; The processing module 1002 is further used to generate a target digital certificate according to the user information and the target hybrid public key; The sending module 1003 is used to send the target digital certificate to the user terminal.

[0206] In an optional implementation, the processing module 1002 is specifically configured to: Generate a first hybrid public key according to the first post-quantum public key and the first national secret public key of the first certificate type; and / or, Generate a second hybrid public key according to the second post-quantum public key of the second certificate type and the second national secret public key; The processing module 1002 is specifically used to: generate a signature certificate according to the user information and the first hybrid public key, so as to transmit data based on the first hybrid private key and the signature certificate stored in the user terminal itself; and / or, An encryption certificate is generated according to the user information and the second mixed public key, so as to transmit data based on the encryption certificate.

[0207] In an optional implementation, the processing module 1002 is specifically configured to: Sending a hybrid key generation request to a key management center, the hybrid key generation request including: an identifier of a certificate generation algorithm, a second post-quantum public key, and a second national secret public key, so that the key management center generates a second hybrid public key according to the second post-quantum public key and the second national secret public key; Receive the second hybrid public key sent by the key management center.

[0208] In an optional embodiment, the device further comprises: The acquisition module 1004 is used to obtain a temporary hybrid public key from the certificate generation request, wherein the hybrid key generation request also includes: the temporary hybrid public key, so that the key management center generates a second hybrid private key corresponding to the second hybrid public key, and uses the temporary hybrid public key to encrypt the second hybrid private key to obtain an encrypted private key; The receiving module 1001 is also used to receive the encrypted private key sent by the key management center; The sending module 1003 is further used to send the encrypted private key to the user terminal, so that the user terminal uses the temporary hybrid private key to decrypt the encrypted private key to obtain a second hybrid private key, so as to perform data transmission based on the second hybrid private key and the encryption certificate.

[0209] In an optional implementation manner, the receiving module 1001 is further configured to: Receiving a certificate update request for a target digital certificate sent by a user terminal; The processing module 1002 is further used to regenerate the target hybrid public key and generate a new target digital certificate according to the certificate update request; The sending module 1003 is further configured to send a certificate update response to the user terminal to indicate that a new target digital certificate is used to update the target digital certificate.

[0210] In an optional implementation manner, the receiving module 1001 is further configured to: In the case where the signature certificate is lost, receiving a signature certificate recovery request sent by the user terminal, the signature certificate recovery request including: a new first hybrid public key; The processing module 1002 is further used to regenerate a signature certificate according to the user information and the new first hybrid public key; The sending module 1003 is further configured to send a signature certificate recovery response to the user terminal to indicate that the signature certificate is updated using the regenerated signature certificate.

[0211] In an optional implementation manner, the receiving module 1001 is further configured to: In the case where the encryption certificate is lost, receiving an encryption certificate recovery request sent by the user terminal, the encryption certificate recovery request including: a temporary hybrid public key; The sending module 1003 is further used to send a key recovery request to the key management center, where the key recovery request includes: the identifier of the temporary hybrid public key and the encryption certificate, so that the key management center queries the second hybrid public key and the second hybrid private key according to the identifier of the encryption certificate, and uses the temporary hybrid public key to re-encrypt the second hybrid private key to obtain the encrypted private key; The receiving module 1001 is further used to receive the second hybrid public key and the regenerated encrypted private key sent by the key management center; The processing module 1002 is further used to regenerate an encryption certificate according to the user information and the second hybrid public key; The sending module 1003 is further used to send the regenerated encryption certificate and the regenerated encryption private key to the user terminal.

[0212] In an optional implementation manner, the receiving module 1001 is further configured to: Receiving a certificate invalidation request for a target digital certificate sent by a user terminal, where the certificate invalidation request is: a certificate revocation request or a certificate freezing request; The processing module 1002 is further configured to add the target digital certificate to the certificate revocation list according to the certificate revocation request or the certificate freezing request, and mark the status of the target digital certificate in the certificate status query system as revoked or frozen.

[0213] In an optional implementation manner, the receiving module 1001 is further configured to: If the certificate invalidation request is a certificate freezing request, receiving a certificate unfreezing request for the target digital certificate sent by the user terminal; The processing module 1002 is further configured to remove the target digital certificate from the certificate revocation list according to the certificate thawing request, and mark the status of the target digital certificate in the certificate status query system as being in use.

[0214] In an optional implementation manner, the receiving module 1001 is further configured to: Receiving a certificate extension request for a signature certificate sent by a user terminal, the certificate extension request including: an extension time; The sending module 1003 is further configured to send a signature certificate extension response to the user terminal according to the extension time, so as to indicate that the end time stored in the signature certificate is updated with the extension time.

[0215] In an optional implementation manner, the receiving module 1001 is further configured to: Receiving a certificate extension request for an encryption certificate sent by a user terminal, the certificate extension request including: an extension time; The sending module 1003 is further used to send a hybrid key generation request to the key management center, so that the key management center uses the certificate generation algorithm to regenerate the second hybrid public key according to the second post-quantum public key and the second national secret public key; The processing module 1002 is further used to regenerate the encryption certificate according to the extension time, the user information and the second hybrid public key; The sending module 1003 is further configured to send the regenerated encryption certificate to the user terminal.

[0216] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0217] Fig.15 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Fig.15As shown, the device may include: a processor 1101, a memory 1102 and a bus 1103. The memory 1102 stores machine-readable instructions executable by the processor 1101. When the electronic device is running, the processor 1101 communicates with the memory 1102 through the bus 1103, and the processor 1101 executes the machine-readable instructions to perform the above method.

[0218] The present request embodiment also provides a computer-readable storage medium, on which a computer program is stored. The computer program is executed when a processor is running, and the processor executes the above method.

[0219] In the present request embodiment, the computer program can also execute other machine-readable instructions when being run by the processor to execute other methods described in the embodiments. For the specific execution method steps and principles, please refer to the description of the embodiments, which will not be repeated here.

[0220] In the embodiments provided in this request, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interface, the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.

[0221] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0222] In addition, each functional unit in the embodiment provided in this request may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0223] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this request, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of this request. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0224] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0225] Finally, it should be noted that the above-mentioned embodiments are only specific implementation methods of this request, which are used to illustrate the technical solution of this request, rather than to limit it. The protection scope of this request is not limited thereto. Although this request is described in detail with reference to the above-mentioned embodiments, ordinary technicians in this field should understand that any technician familiar with this technical field can still modify the technical solution recorded in the above-mentioned embodiments within the technical scope disclosed in this request, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solution deviate from the spirit and scope of the technical solution of the embodiment of this request. They should all be covered within the protection scope of this request. Therefore, the protection scope of this request should be based on the protection scope of the claims.

Claims

1. A method for generating a digital certificate, characterized in that: Applied to a certificate issuing system, the method comprises: Receive a certificate generation request sent by a user terminal, wherein the certificate generation request includes: user information and an identifier of a certificate generation algorithm, wherein the certificate generation algorithm includes: a post-quantum cryptographic algorithm and a preset national cryptographic algorithm; Generate a target hybrid public key according to the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm; Generate a target digital certificate according to the user information and the target hybrid public key; The target digital certificate is sent to the user terminal.

2. The method according to claim 1, characterized in that The certificate generation request also includes: a first certificate type and / or a second certificate type; the generating a target hybrid public key according to the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm includes: Generate a first hybrid public key according to the first post-quantum public key and the first national secret public key of the first certificate type; and / or, Generate a second hybrid public key according to the second post-quantum public key of the second certificate type and the second national secret public key; The step of generating a target digital certificate according to the user information and the target hybrid public key includes: Generate a signature certificate according to the user information and the first hybrid public key, so as to perform data transmission based on the first hybrid private key and the signature certificate stored in the user terminal itself; and / or, An encryption certificate is generated according to the user information and the second hybrid public key, so as to perform data transmission based on the encryption certificate.

3. The method according to claim 2, characterized in that The generating a second hybrid public key according to the second post-quantum public key and the second national secret public key of the second certificate type comprises: Sending a hybrid key generation request to a key management center, wherein the hybrid key generation request includes: an identifier of the certificate generation algorithm, the second post-quantum public key, and the second national secret public key, so that the key management center generates a second hybrid public key according to the second post-quantum public key and the second national secret public key; Receive the second hybrid public key sent by the key management center.

4. The method according to claim 3, characterized in that The method further comprises: Acquire a temporary hybrid public key from the certificate generation request, wherein the hybrid key generation request also includes: the temporary hybrid public key, so that the key management center generates a second hybrid private key corresponding to the second hybrid public key, and uses the temporary hybrid public key to encrypt the second hybrid private key to obtain an encrypted private key; Receiving the encrypted private key sent by the key management center; The encrypted private key is sent to the user terminal, so that the user terminal uses a temporary hybrid private key to decrypt the encrypted private key to obtain the second hybrid private key, so as to perform data transmission based on the second hybrid private key and the encryption certificate.

5. The method according to claim 1, characterized in that The method further comprises: Receiving a certificate update request for the target digital certificate sent by the user terminal; Regenerate a target hybrid public key and a new target digital certificate according to the certificate update request; A certificate update response is sent to the user terminal to indicate that the target digital certificate is updated using the new target digital certificate.

6. The method according to claim 2, characterized in that The method further comprises: In the case where the signature certificate is lost, receiving a signature certificate recovery request sent by the user terminal, wherein the signature certificate recovery request includes: a new first hybrid public key; Regenerate a signature certificate according to the user information and the new first hybrid public key; A signature certificate recovery response is sent to the user terminal to instruct the user terminal to update the signature certificate using the regenerated signature certificate.

7. The method according to claim 4, characterized in that The method further comprises: In the case where the encryption certificate is lost, receiving an encryption certificate recovery request sent by the user terminal, wherein the encryption certificate recovery request includes: the temporary hybrid public key; Sending a key recovery request to the key management center, wherein the key recovery request includes: the temporary hybrid public key and the identifier of the encryption certificate, so that the key management center queries the second hybrid public key and the second hybrid private key according to the identifier of the encryption certificate, and uses the temporary hybrid public key to re-encrypt the second hybrid private key to obtain an encrypted private key; Receiving the second hybrid public key and the regenerated encrypted private key sent by the key management center; Regenerate an encryption certificate according to the user information and the second hybrid public key; The regenerated encryption certificate and the regenerated encryption private key are sent to the user terminal.

8. The method according to claim 1, characterized in that The method further comprises: receiving a certificate invalidation request for the target digital certificate sent by the user terminal, wherein the certificate invalidation request is: a certificate revocation request or a certificate freezing request; According to the certificate revocation request or certificate freezing request, the target digital certificate is added to the certificate revocation list, and the status of the target digital certificate in the certificate status query system is marked as revoked or frozen.

9. The method according to claim 8, characterized in that The method further comprises: If the certificate invalidation request is a certificate freezing request, receiving a certificate unfreezing request for the target digital certificate sent by the user terminal; According to the certificate thawing request, the target digital certificate is removed from the certificate revocation list, and the status of the target digital certificate in the certificate status query system is marked as in use.

10. The method according to claim 2, characterized in that The method further comprises: receiving a certificate extension request for the signature certificate sent by the user terminal, wherein the certificate extension request includes: an extension time; According to the extension time, a signature certificate extension response is sent to the user terminal to indicate that the end time stored in the signature certificate is updated using the extension time.

11. The method according to claim 2, characterized in that The method further comprises: receiving a certificate extension request for the encryption certificate sent by the user terminal, wherein the certificate extension request includes: an extension time; Sending a hybrid key generation request to a key management center, so that the key management center adopts the certificate generation algorithm to regenerate the second hybrid public key according to the second post-quantum public key and the second national secret public key; regenerating an encryption certificate according to the extension time, the user information and the second hybrid public key; The regenerated encryption certificate is sent to the user terminal.

12. A digital certificate generating device, characterized in that: include: A receiving module, configured to receive a certificate generation request sent by a user terminal, wherein the certificate generation request includes: user information and an identifier of a certificate generation algorithm, wherein the certificate generation algorithm includes: a post-quantum cryptographic algorithm and a preset national cryptographic algorithm; A processing module, used to generate a target hybrid public key according to the post-quantum public key of the post-quantum cryptographic algorithm and the national secret public key of the preset national secret algorithm; The processing module is further used to generate a target digital certificate according to the user information and the target hybrid public key; A sending module is used to send the target digital certificate to the user terminal.

13. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory via the bus, and the processor executes the machine-readable instructions to perform the method described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 11 is executed.

Images