Financial certificate and financial key downloading method and system

Abstract

The invention discloses a financial certificate and financial key downloading method and system, and the method comprises the steps: carrying out session key negotiation between a key distribution host end and a key receiving equipment end through employing an ECDH key negotiation algorithm, obtaining a first session key, and building a financial security channel; the secret key receiving equipment side sends a financial certificate downloading request to the secret key distribution host side based on the first session key, the secret key distribution host side generates a financial certificate based on the financial certificate downloading request and sends the financial certificate to the secret key receiving equipment side, and the secret key distribution host side and the secret key receiving equipment side carry out session key negotiation again based on the financial certificate; the secret key receiving device end sends a financial secret key downloading request to the secret key distribution host end based on the second session key and the financial certificate, the secret key distribution host end generates a financial secret key based on the financial secret key downloading request and sends the financial secret key to the secret key receiving device end, and the secret key receiving device end receives the financial secret key. Therefore, the security of downloading the financial certificate and the financial key is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for downloading a financial certificate and a financial key. Background Art

[0002] POS (Point of Sale) machines are increasingly being used, and the security of data transmission needs to be ensured during financial transactions. The existing downloading of financial certificates, or private data downloading, is done by KDH (key distribution host) generating private keys and certificates. After the public key is issued by the certificate authority CA, KDH downloads the private key and certificate to KRD (key receiving device) through a one-way authentication (i.e., KRD authenticating KDH) protocol. The existing way to download financial keys is to use the RSA2048 algorithm (asymmetric encryption algorithm) to generate temporary session keys. At present, the existing downloading methods of financial certificates and financial keys are not very secure. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a method and system for downloading a financial certificate and a financial key, which can improve the security of downloading the financial certificate and the financial key.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0005] A method for downloading a financial certificate and a financial key comprises the steps of:

[0006] The key distribution host and the key receiving device use the ECDH key agreement algorithm to negotiate a session key to obtain a first session key, so as to establish a financial security channel between the key distribution host and the key receiving device;

[0007] The key receiving device sends a financial certificate download request to the key distribution host based on the session key;

[0008] The key distribution host generates a financial certificate based on the financial certificate download request, and sends the financial certificate to the key receiving device;

[0009] The key distribution host and the key receiving device perform session key negotiation based on the financial certificate using an ECDH key negotiation algorithm to obtain a second session key to establish a financial security channel between the key distribution host and the key receiving device;

[0010] The key receiving device sends a financial key download request to the key distribution host based on the second session key and the financial certificate;

[0011] The key distribution host generates a financial key based on the financial key download request, and sends the financial key to the key receiving device.

[0012] In order to solve the above technical problems, another technical solution adopted by the present invention is:

[0013] A financial certificate and financial key downloading system, comprising a key distribution host end and a key receiving device end, wherein the key distribution host end comprises a first memory, a first processor, and a first computer program stored in the first memory and executable on the first processor, and the key receiving device end comprises a second memory, a second processor, and a second computer program stored in the second memory and executable on the second processor, wherein the first processor implements the steps executed by the key distribution host end in the above-mentioned financial certificate and financial key downloading method when executing the first computer program;

[0014] When the second processor executes the second computer program, the steps performed by the key receiving device in the above-mentioned method for downloading a financial certificate and a financial key are implemented.

[0015] The beneficial effects of the present invention are as follows: the key distribution host end and the key receiving device end use the ECDH key negotiation algorithm to perform session key negotiation, obtain a first session key, so as to establish a financial security channel between the two ends; the key receiving device end sends a financial certificate download request to the key distribution host end based on the first session key; the key distribution host end generates a financial certificate based on the financial certificate download request, and sends the financial certificate to the key receiving device end; the key distribution host end and the key receiving device end perform session key negotiation again based on the financial certificate, obtain a second session key, so as to establish a financial security channel between the two ends; the key receiving device end sends a financial key download request to the key distribution host end based on the second session key and the financial certificate; the key distribution host end generates a financial key based on the financial key download request, and sends the financial key to the key receiving device end; thereby, a financial security channel is established twice between the key distribution host end and the key receiving device end through the ECDH key negotiation algorithm, and two-way authentication before downloading the financial certificate and the financial key is realized; and then subsequent financial certificate download and financial key download are performed based on the session key obtained by establishing the security channel, thereby improving the security of the financial certificate and the financial key download. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a method for downloading a financial certificate and a financial key according to an embodiment of the present invention;

[0017] Figure 2 The present invention is a schematic diagram of the structure of a financial certificate and financial key downloading system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in combination with the implementation modes and the accompanying drawings.

[0019] Please refer to Figure 1 , a method for downloading a financial certificate and a financial key, comprising the steps of:

[0020] The key distribution host and the key receiving device use the ECDH key agreement algorithm to negotiate a session key to obtain a first session key, so as to establish a financial security channel between the key distribution host and the key receiving device;

[0021] The key receiving device sends a financial certificate download request to the key distribution host based on the session key;

[0022] The key distribution host generates a financial certificate based on the financial certificate download request, and sends the financial certificate to the key receiving device;

[0023] The key distribution host and the key receiving device perform session key negotiation based on the financial certificate using an ECDH key negotiation algorithm to obtain a second session key to establish a financial security channel between the key distribution host and the key receiving device;

[0024] The key receiving device sends a financial key download request to the key distribution host based on the second session key and the financial certificate;

[0025] The key distribution host generates a financial key based on the financial key download request, and sends the financial key to the key receiving device.

[0026] From the above description, it can be seen that the beneficial effect of the present invention is that: the key distribution host end and the key receiving device end use the ECDH key negotiation algorithm to perform session key negotiation, obtain a first session key, so as to establish a financial security channel between the two, the key receiving device end sends a financial certificate download request to the key distribution host end based on the first session key, the key distribution host end generates a financial certificate based on the financial certificate download request, and sends the financial certificate to the key receiving device end, the key distribution host end and the key receiving device end perform session key negotiation again based on the financial certificate, obtain a second session key, so as to establish a financial security channel between the two, the key receiving device end sends a financial key download request to the key distribution host end based on the second session key and the financial certificate, the key distribution host end generates a financial key based on the financial key download request, and sends the financial key to the key receiving device end, thereby establishing a financial security channel between the key distribution host end and the key receiving device end twice through the ECDH key negotiation algorithm, realizing two-way authentication before downloading financial certificates and financial keys, and then performing subsequent financial certificate downloads and financial key downloads based on the session key obtained by establishing a secure channel, thereby improving the security of financial certificate and financial key downloads.

[0027] Furthermore, the key distribution host end and the key receiving device end use the ECDH key agreement algorithm to negotiate a session key, and before obtaining the first session key, the method further includes:

[0028] The key distribution host sends a certificate signing request file creation instruction to the key receiving device;

[0029] The key receiving device generates a first ECC public-private key pair according to the production instruction;

[0030] The key receiving device stores the first ECC public-private key pair as a temporary variable, and generates a certificate signing request file according to the first ECC public-private key pair;

[0031] The key receiving device sends the certificate signing request file to the key distribution host;

[0032] The key distribution host sends the certificate signing request file to the certificate authority CA;

[0033] The key distribution host receives the digital certificate generated by the certificate authority CA according to the certificate signing request file, and sends the digital certificate to the key receiving device;

[0034] The key receiving device obtains a signature certificate chain according to the digital certificate, and stores the signature certificate chain as a temporary variable.

[0035] From the above description, it can be seen that the key distribution host sends the certificate signing request file production instruction to the key receiving device, the key receiving device generates a certificate signing request file according to the production instruction, and the key distribution host uses the certificate signing request file to obtain the signature certificate chain to facilitate subsequent two-way authentication with the key distribution host.

[0036] Further, the first ECC public-private key pair includes a first ECC private key;

[0037] The key distribution host and the key receiving device use the ECDH key agreement algorithm to negotiate a session key to obtain a first session key to establish a financial security channel between the key distribution host and the key receiving device, including:

[0038] The key receiving device generates a first random number and sends the first random number to the key distribution host;

[0039] The key distribution host saves the first random number and generates a second random number;

[0040] The key distribution host generates a first temporary ECC public-private key pair, wherein the first temporary ECC public-private key pair includes a first temporary ECC public key and a first temporary ECC private key;

[0041] The key distribution host generates a first message according to the first temporary ECC public key, the pre-set signature certificate chain, the first random number and the second random number, and signs the first message using the signature certificate private key in the pre-set signature certificate chain to obtain a first message signature;

[0042] The key distribution host sends the first message and the first message signature to the key receiving device;

[0043] The key receiving device end performs session key negotiation based on the first message and the first message signature using an ECDH key negotiation algorithm to obtain a first key receiving device end session key;

[0044] The key receiving device side obtains the temporary certificate chain and uses the first key receiving device side session key to calculate a first key check value;

[0045] The key receiving device generates a second message according to the second temporary ECC public key, the temporary certificate chain and the first key check value, and signs the second message using the first ECC private key to obtain a second message signature;

[0046] The key receiving device sends the second message, the second random number and the second message signature to the key distribution host;

[0047] The key distribution host end performs session key negotiation using an ECDH key negotiation algorithm based on the second random number, the second message and the second message signature to obtain a first key distribution host end session key;

[0048] The key distribution host side calculates a second key check value using the first key distribution host side session key, and compares the second key check value with the first key check value in the second message, and if the result of the comparison is consistent, the key distribution host side generates a first integrated message according to the first random number, the first message, the first message signature, the second message and the second message signature;

[0049] The key distribution host end uses the first key distribution host end session key to perform MAC calculation on the first integrated message to obtain a first MAC result, and sends the first MAC result to the key receiving device end;

[0050] The key receiving device generates a second integrated message according to the first random number, the first message, the first message signature, the second message and the second message signature, and uses the first key receiving device session key to perform MAC calculation on the second integrated message to obtain a second MAC result;

[0051] The key receiving device compares the second MAC result with the first MAC result. If the comparison result is consistent, it is determined that the financial security channel between the key distribution host and the key receiving device is successfully established.

[0052] From the above description, it can be seen that the session key negotiation is performed using the ECDH key negotiation algorithm, and the obtained session key is symmetric, which can ensure the security of data transmission between the subsequent key distribution host and the key receiving device.

[0053] Further, the key receiving device end performs session key negotiation based on the first message and the first message signature using an ECDH key negotiation algorithm to obtain a first key receiving device end session key, including:

[0054] The key receiving device verifies the first random number in the first message once, and if the result of the verification is successful, saves the second random number;

[0055] The key receiving device performs a secondary verification on the preset signature certificate chain in the first message. If the result of the secondary verification is successful, the first message signature is verified three times using the preset signature certificate chain. If the result of the three verifications is successful, a second temporary ECC public-private key pair is generated, where the second temporary ECC public-private key pair includes a second temporary ECC private key and a second temporary ECC public key;

[0056] The key receiving device end performs session key negotiation using an ECDH key negotiation algorithm based on the second temporary ECC private key and the first temporary ECC public key in the first message to obtain a first key receiving device end session key.

[0057] From the above description, it can be seen that the key receiving device ensures the reliability of the received information by verifying the first message and the first message signature, and then performs session key negotiation after the verification is successful, thereby achieving more effective authentication of the key distribution host.

[0058] Further, the key distribution host end performs session key negotiation using an ECDH key negotiation algorithm based on the second random number, the second message, and the second message signature to obtain a first key distribution host end session key, including:

[0059] The key distribution host performs a check on the second random number once. If the result of the first check is successful, the temporary certificate chain is used to perform a second check on the second message signature. If the result of the second check is successful, the ECDH key agreement algorithm is used to negotiate a session key based on the first temporary ECC private key and the second temporary ECC public key in the second message to obtain the first key distribution host session key.

[0060] From the above description, it can be seen that the key distribution host verifies the second random number and the second message sent by the key receiving device. If successful, it uses the second message to negotiate the session key, authenticates the key receiving device more securely, and ensures the reliability of two-way authentication.

[0061] Further, the key receiving device sends a financial certificate download request to the key distribution host based on the session key, including:

[0062] The key receiving device generates a third random number and certificate request configuration information, and generates a financial certificate download request according to the second random number, the third random number and the certificate request configuration information;

[0063] The key receiving device uses the first key receiving device session key to perform MAC calculation on the financial certificate download request to obtain a third MAC result, and sends the third MAC result to the key distribution host.

[0064] From the above description, it can be seen that the key receiving device generates a financial certificate download request based on the second random number, the third random number and the certificate request configuration information, and then uses the first key receiving device session key to perform MAC calculation on the financial certificate download request, thereby ensuring that the certificate request configuration information is not easily obtained by others, thereby improving the security of financial certificate downloading.

[0065] Further, the key distribution host generates a financial certificate based on the financial certificate download request, and sends the financial certificate to the key receiving device, including:

[0066] The key distribution host verifies the second random number in the third MAC result, and if the verification result is successful, saves the third random number in the third MAC result, and generates a financial certificate in a first preset format according to the certificate request configuration information in the third MAC result;

[0067] The key distribution host sends the financial certificate and the third random number to the key receiving device;

[0068] After the key distribution host generates a financial certificate based on the financial certificate download request and sends the financial certificate to the key receiving device, the key distribution host further includes:

[0069] The key receiving device verifies the third random number, and if the verification result is successful, saves the financial certificate.

[0070] From the above description, it can be seen that the key distribution host generates a financial certificate only after successfully verifying the second random number in the third MAC result. After receiving the key receiving device, the third random number sent together is verified, and the financial certificate is saved only after success, thereby improving the security of financial certificate generation and downloading.

[0071] Further, the key receiving device sends a financial key download request to the key distribution host based on the second session key and the financial certificate, including:

[0072] The key receiving device generates a fourth random number;

[0073] The key receiving device generates a financial key download request according to the second random number, the fourth random number, the key ID in the financial certificate, and the key system number, and performs MAC calculation on the financial key download request based on the second session key to obtain a fourth MAC result;

[0074] The key receiving device sends the MAC result to the key distribution host.

[0075] From the above description, it can be seen that the key receiving device generates a financial key download request based on the second random number, the fourth random number, the key ID in the financial certificate and the key system number, and performs MAC calculation on the financial key download request based on the second session key and sends it to the key distribution host, thereby preventing the basic data of the financial key from being obtained by others and improving the security of the financial key.

[0076] Further, the key distribution host generates a financial key based on the financial key download request, and sends the financial key to the key receiving device, including:

[0077] The key distribution host verifies the second random number in the fourth MAC result, and if the verification result is successful, saves the fourth random number in the fourth MAC result, and generates a financial key according to the key ID and the key system number in the fourth MAC result in a second preset format;

[0078] The key distribution host sends the financial key and the fourth random number to the key receiving device;

[0079] After the key distribution host generates a financial key based on the financial key download request and sends the financial key to the key receiving device, the method further includes:

[0080] The key receiving device verifies the fourth random number, and if the verification result is successful, saves the financial key.

[0081] From the above description, it can be seen that after the key distribution host verifies the fourth MAC result, it generates a financial key according to the key ID and the key system number in the fourth MAC result according to the second preset format, and then sends the financial key and the fourth random number to the key receiving device. The key receiving device verifies the fourth random number and saves the financial key after the verification is successful, thereby improving the security of financial key generation and downloading.

[0082] Please refer to Figure 2Another embodiment of the present invention provides a financial certificate and financial key downloading system, including a key distribution host end and a key receiving device end, the key distribution host end includes a first memory, a first processor and a first computer program stored in the first memory and executable on the first processor, the key receiving device end includes a second memory, a second processor and a second computer program stored in the second memory and executable on the second processor, the first processor implements the steps performed by the key distribution host end in the above-mentioned financial certificate and financial key downloading method when executing the first computer program;

[0083] When the second processor executes the second computer program, the steps performed by the key receiving device in the above-mentioned method for downloading a financial certificate and a financial key are implemented.

[0084] The financial certificate and financial key downloading method and system of the present invention can be applied to commercial device products based on OpenHarmony (the open source version of Hongmeng system) and Android system, and are described below through specific implementation methods:

[0085] Please refer to Figure 1 , Embodiment 1 of the present invention is:

[0086] A method for downloading a financial certificate and a financial key comprises the steps of:

[0087] S1. The key distribution host KDH sends a certificate signing request file CSR creation instruction to the key receiving device KRD.

[0088] S2. The key receiving device generates a first ECC public-private key pair according to the production instruction.

[0089] The first ECC public-private key pair includes a first ECC private key ECC_temp_priKey and a first ECC public key ECC_temp_pubKey.

[0090] S3. The key receiving device stores the first ECC public-private key pair as a temporary variable, and generates a certificate signing request file according to the first ECC public-private key pair.

[0091] Among them, the advantage of storing it as a temporary variable is that it can be deleted after use and will not be permanently retained in the memory, saving memory space.

[0092] S4. The key receiving device sends the certificate signing request file to the key distribution host.

[0093] S5. The key distribution host sends the certificate signing request file to a certificate authority CA.

[0094] In an optional implementation, the process further includes: a certificate authority CA verifies the certificate signing request file, and generates a digital certificate after successful verification.

[0095] The certificate authority (CA) verifies the submitted CSR to ensure that the applicant has control over the corresponding private key and verifies the applicant's identity information. If the verification is successful, the certificate authority (CA) will use its own private key to sign the public key in the CSR and generate a digital certificate, which contains the public key, applicant information, and CA's digital signature.

[0096] S6. The key distribution host receives the digital certificate generated by the certificate issuing authority CA according to the certificate signing request file, and sends the digital certificate to the key receiving device.

[0097] S7. The key receiving device obtains a signature certificate chain CA_Chain_ECC according to the digital certificate, and stores the signature certificate chain as a temporary variable.

[0098] S8, the key distribution host and the key receiving device use the ECDH key agreement algorithm to negotiate a session key to obtain a first session key to establish a financial security channel between the key distribution host and the key receiving device, wherein the first session key includes a first key receiving device session key and a first key distribution host session key, specifically including S81-S814:

[0099] S81. The key receiving device generates a first random number and sends the first random number to the key distribution host.

[0100] S82. The key distribution host saves the first random number and generates a second random number.

[0101] In an optional implementation, when the key receiving device sends the first random number to the key distribution host, it also sends parameters such as the ECC algorithm suite, ECC curve list, signature block algorithm, etc. to the key distribution host; when the key distribution host generates the second random number, it also selects supported ECC algorithm suites, ECC curves, signature block algorithms, etc., and subsequently generates data using these selected parameters.

[0102] S83. The key distribution host generates a first temporary ECC public-private key pair, wherein the first temporary ECC public-private key pair includes a first temporary ECC public key ECC_KDH_temp_pubKey2 and a first temporary ECC private key ECC_KDH_temp_priKey2.

[0103] S84. The key distribution host generates a first message according to the first temporary ECC public key, the pre-set signature certificate chain, the first random number and the second random number, and signs the first message using the signature certificate private key in the pre-set signature certificate chain to obtain a first message signature.

[0104] The pre-set signature certificate chain is a signature certificate chain pre-set in the key distribution host.

[0105] S85. The key distribution host sends the first message and the first message signature to the key receiving device.

[0106] S86, the key receiving device end performs session key negotiation based on the first message and the first message signature using the ECDH key negotiation algorithm to obtain the first key receiving device end session key, specifically including S861-S863:

[0107] S861. The key receiving device verifies the first random number in the first message once, and if the result of the verification is successful, saves the second random number.

[0108] S862. The key receiving device performs a secondary verification on the preset signature certificate chain in the first message. If the result of the secondary verification is successful, the preset signature certificate chain is used to perform a tertiary verification on the signature of the first message. If the result of the tertiary verification is successful, a second temporary ECC public-private key pair is generated. The second temporary ECC public-private key pair includes a second temporary ECC private key ECC_KRD_temp_priKey2 and a second temporary ECC public key ECC_KRD_temp_pubKey2.

[0109] S863. The key receiving device end performs session key negotiation using an ECDH key negotiation algorithm based on the second temporary ECC private key and the first temporary ECC public key in the first message to obtain a first key receiving device end session key.

[0110] S87. The key receiving device obtains the temporary certificate chain and uses the first key receiving device session key to calculate a first key check value KCV.

[0111] S88. The key receiving device generates a second message according to the second temporary ECC public key, the temporary certificate chain and the first key check value, and signs the second message using the first ECC private key to obtain a second message signature.

[0112] S89. The key receiving device sends the second message, the second random number and the second message signature to the key distribution host.

[0113] S810. The key distribution host performs session key negotiation using an ECDH key negotiation algorithm based on the second random number, the second message and the second message signature to obtain a first key distribution host session key.

[0114] Specifically, the key distribution host performs a verification on the second random number once. If the result of the first verification is successful, the temporary certificate chain is used to perform a second verification on the second message signature. If the result of the second verification is successful, the ECDH key negotiation algorithm is used to negotiate the session key based on the first temporary ECC private key and the second temporary ECC public key in the second message to obtain the first key distribution host session key.

[0115] S811. The key distribution host uses the first key distribution host session key to calculate a second key check value, and compares the second key check value with the first key check value in the second message. If the comparison result is consistent, the key distribution host generates a first integrated message based on the first random number, the first message, the first message signature, the second message and the second message signature.

[0116] S812: The key distribution host uses the first key distribution host session key to perform MAC calculation on the first integrated message to obtain a first MAC result, and sends the first MAC result to the key receiving device.

[0117] S813. The key receiving device generates a second integrated message according to the first random number, the first message, the first message signature, the second message and the second message signature, and uses the first key receiving device session key to perform MAC calculation on the second integrated message to obtain a second MAC result.

[0118] S814. The key receiving device compares the second MAC result with the first MAC result. If the comparison result is consistent, it is determined that the financial security channel between the key distribution host and the key receiving device is successfully established.

[0119] S9, the key receiving device sends a financial certificate download request to the key distribution host based on the session key, specifically including S91-S92:

[0120] S91. The key receiving device generates a third random number and certificate request configuration information, and generates a financial certificate download request according to the second random number, the third random number and the certificate request configuration information.

[0121] The certificate request configuration information includes the certificate number, key system number, key ID, key usage and key algorithm, etc.

[0122] S92. The key receiving device uses the first key receiving device session key to perform MAC calculation on the financial certificate download request to obtain a third MAC result, and sends the third MAC result to the key distribution host.

[0123] S10, the key distribution host generates a financial certificate based on the financial certificate download request, and sends the financial certificate to the key receiving device, specifically including S101-S102:

[0124] S101, the key distribution host verifies the second random number in the third MAC result, and if the verification result is successful, saves the third random number in the third MAC result, and generates a financial certificate in a first preset format according to the certificate request configuration information in the third MAC result. The generated financial certificate includes the information in the certificate request configuration information.

[0125] S102: The key distribution host sends the financial certificate and the third random number to the key receiving device.

[0126] S11. The key receiving device verifies the third random number, and if the verification result is successful, saves the financial certificate.

[0127] S12, the key distribution host and the key receiving device perform session key negotiation based on the financial certificate using the ECDH key negotiation algorithm to obtain a second session key to establish a financial security channel between the key distribution host and the key receiving device, wherein the second session key includes a second key receiving device session key and a second key distribution host session key, specifically including S121-S1214:

[0128] S121. The key receiving device generates a fifth random number and sends the fifth random number to the key distribution host.

[0129] S122. The key distribution host saves the fifth random number and generates a sixth random number.

[0130] In an optional implementation, when the key receiving device sends the fifth random number to the key distribution host, it also sends parameters such as the ECC algorithm suite, ECC curve list, signature block algorithm, etc. to the key distribution host; when the key distribution host generates the sixth random number, it also selects supported ECC algorithm suites, ECC curves, signature block algorithms, etc., and subsequently generates data using these selected parameters.

[0131] S123. The key distribution host generates a third temporary ECC public-private key pair, wherein the third temporary ECC public-private key pair includes a third temporary ECC public key and a third temporary ECC private key.

[0132] S124. The key distribution host generates a third message according to the third temporary ECC public key, the preset signature certificate chain, the fifth random number and the sixth random number, and signs the third message using the signature certificate private key in the preset signature certificate chain to obtain a third message signature.

[0133] S125. The key distribution host sends the third message and the third message signature to the key receiving device.

[0134] S126, the key receiving device end performs session key negotiation based on the third message and the third message signature using the ECDH key negotiation algorithm to obtain a second key receiving device end session key, specifically including S1261-S1263:

[0135] S1261. The key receiving device verifies the fifth random number in the third message once, and if the result of the verification is successful, saves the sixth random number.

[0136] S1262. The key receiving device performs a secondary verification on the preset signature certificate chain in the third message. If the result of the secondary verification is successful, the preset signature certificate chain is used to perform a tertiary verification on the signature of the third message. If the result of the tertiary verification is successful, a fourth temporary ECC public-private key pair is generated. The fourth temporary ECC public-private key pair includes a fourth temporary ECC private key and a fourth temporary ECC public key.

[0137] S1263. The key receiving device end performs session key negotiation using an ECDH key negotiation algorithm based on the fourth temporary ECC private key and the third temporary ECC public key in the third message to obtain a second key receiving device end session key.

[0138] S127. The key receiving device obtains the signature certificate chain in the financial certificate, and uses the second key receiving device session key to calculate a third key check value.

[0139] S128. The key receiving device generates a fourth message according to the fourth temporary ECC public key, the signature certificate chain in the financial certificate and the third key check value, and signs the fourth message using the first ECC private key to obtain a fourth message signature.

[0140] S129. The key receiving device sends the fourth message, the sixth random number and the fourth message signature to the key distribution host.

[0141] S1210. The key distribution host performs session key negotiation using an ECDH key negotiation algorithm based on the sixth random number, the fourth message and the fourth message signature to obtain a second key distribution host session key.

[0142] Specifically, the key distribution host performs a verification on the sixth random number once. If the result of the first verification is successful, the signature certificate chain in the financial certificate is used to perform a second verification on the signature of the second message. If the result of the second verification is successful, the ECDH key negotiation algorithm is used to negotiate the session key based on the third temporary ECC private key and the fourth temporary ECC public key in the fourth message to obtain the second key distribution host session key.

[0143] S1211. The key distribution host uses the second key distribution host session key to calculate a fourth key check value, and compares the fourth key check value with the third key check value in the fourth message. If the comparison result is consistent, the key distribution host generates a third integrated message based on the fifth random number, the third message, the third message signature, the fourth message and the fourth message signature.

[0144] S1212: The key distribution host uses the second key distribution host session key to perform MAC calculation on the third integrated message to obtain a fifth MAC result, and sends the fifth MAC result to the key receiving device.

[0145] S1213. The key receiving device generates a fourth integrated message according to the fifth random number, the third message, the third message signature, the fourth message and the fourth message signature, and uses the second key receiving device session key to perform MAC calculation on the fourth integrated message to obtain a sixth MAC result.

[0146] S1214, the key receiving device compares the sixth MAC result with the fifth MAC result. If the comparison result is consistent, it is determined that the financial security channel between the key distribution host and the key receiving device is successfully established. That is to say, before downloading the financial certificate, a financial security channel is established between the key distribution host and the key receiving device, and before downloading the financial key, a financial security channel is established between the key distribution host and the key receiving device. The difference between the establishment steps of S12 and S8 is that S12 uses the signature certificate chain downloaded during the financial certificate download stage, and S8 uses a temporary certificate chain.

[0147] S13, the key receiving device sends a financial key download request to the key distribution host based on the second session key and the financial certificate, specifically including S131-S133:

[0148] S131. The key receiving device generates a fourth random number.

[0149] S132. The key receiving device generates a financial key download request according to the second random number, the fourth random number, the key ID in the financial certificate, and the key system number, and performs MAC calculation on the financial key download request based on the second session key to obtain a fourth MAC result.

[0150] The performing MAC calculation on the financial key download request based on the second session key to obtain a fourth MAC result includes:

[0151] The second key receiving device-side session key is used to perform MAC calculation on the financial key download request to obtain a fourth MAC result.

[0152] S133: The key receiving device sends the MAC result to the key distribution host.

[0153] S14, the key distribution host generates a financial key based on the financial key download request, and sends the financial key to the key receiving device, specifically including S141-S142:

[0154] S141. The key distribution host verifies the second random number in the fourth MAC result. If the verification result is successful, the fourth random number in the fourth MAC result is saved, and a financial key is generated according to the key ID and key system number in the fourth MAC result in accordance with a second preset format.

[0155] S142: The key distribution host sends the financial key and the fourth random number to the key receiving device.

[0156] S15. The key receiving device verifies the fourth random number, and if the verification result is successful, saves the financial key.

[0157] The key receiving device can parse the financial key to obtain key information including key algorithm, key storage area, key usage, etc.

[0158] In an optional implementation, if any of the verification or validation results is a failure, and any of the comparison results is inconsistent, the process is terminated.

[0159] Please refer to Figure 2 , Embodiment 2 of the present invention is:

[0160] A financial certificate and financial key downloading system, comprising a key distribution host end and a key receiving device end, wherein the key distribution host end comprises a first memory, a first processor, and a first computer program stored in the first memory and executable on the first processor, and the key receiving device end comprises a second memory, a second processor, and a second computer program stored in the second memory and executable on the second processor, wherein the first processor implements the steps executed by the key distribution host end in the above-mentioned financial certificate and financial key downloading method when executing the first computer program;

[0161] When the second processor executes the second computer program, the steps performed by the key receiving device in the above-mentioned method for downloading a financial certificate and a financial key are implemented.

[0162] In summary, the present invention provides a financial certificate and financial key downloading method and system. The key distribution host end and the key receiving device end use the ECDH key negotiation algorithm to perform session key negotiation to obtain a first session key to establish a financial security channel between the two. The key receiving device end sends a financial certificate download request to the key distribution host end based on the first session key. The key distribution host end generates a financial certificate based on the financial certificate download request and sends the financial certificate to the key receiving device end. The key distribution host end and the key receiving device end perform session key negotiation again based on the financial certificate to obtain a second session key to establish a financial security channel between the two. The key receiving device end sends a financial key download request to the key distribution host end based on the second session key and the financial certificate. The key distribution host end generates a financial key based on the financial key download request and sends the financial key to the key receiving device end, thereby establishing two key distribution hosts through the ECDH key negotiation algorithm. The financial security channel between the machine end and the key receiving device end realizes two-way authentication before downloading the financial certificate and the financial key, and then performs subsequent downloading of the financial certificate and the financial key based on the session key obtained by establishing the security channel, thereby improving the security of downloading the financial certificate and the financial key; in addition, the key distribution host end generates the financial certificate only after successfully verifying the second random number in the third MAC result. After receiving the financial certificate, the key receiving device end verifies the third random number sent together, and saves the financial certificate only after success, thereby improving the security of generating and downloading the financial certificate; and, after verifying the fourth MAC result, the key distribution host end generates the financial key according to the key ID and the key system number in the fourth MAC result in accordance with the second preset format, and then sends the financial key and the fourth random number to the key receiving device end. The key receiving device end verifies the fourth random number, and saves the financial key after successful verification, thereby improving the security of generating and downloading the financial key.

[0163] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for downloading a financial certificate and a financial key, characterized in that: Includes steps: The key distribution host and the key receiving device use the ECDH key agreement algorithm to negotiate a session key to obtain a first session key, so as to establish a financial security channel between the key distribution host and the key receiving device; The key receiving device sends a financial certificate download request to the key distribution host based on the session key; The key distribution host generates a financial certificate based on the financial certificate download request, and sends the financial certificate to the key receiving device; The key distribution host and the key receiving device perform session key negotiation based on the financial certificate using an ECDH key negotiation algorithm to obtain a second session key to establish a financial security channel between the key distribution host and the key receiving device; The key receiving device sends a financial key download request to the key distribution host based on the second session key and the financial certificate; The key distribution host generates a financial key based on the financial key download request, and sends the financial key to the key receiving device.

2. A method for downloading a financial certificate and a financial key according to claim 1, characterized in that: The key distribution host end and the key receiving device end use the ECDH key agreement algorithm to negotiate a session key, and before obtaining the first session key, the method further includes: The key distribution host sends a certificate signing request file creation instruction to the key receiving device; The key receiving device generates a first ECC public-private key pair according to the production instruction; The key receiving device stores the first ECC public-private key pair as a temporary variable, and generates a certificate signing request file according to the first ECC public-private key pair; The key receiving device sends the certificate signing request file to the key distribution host; The key distribution host sends the certificate signing request file to the certificate authority CA; The key distribution host receives the digital certificate generated by the certificate authority CA according to the certificate signing request file, and sends the digital certificate to the key receiving device; The key receiving device obtains a signature certificate chain according to the digital certificate, and stores the signature certificate chain as a temporary variable.

3. A method for downloading a financial certificate and a financial key according to claim 2, characterized in that: The first ECC public-private key pair includes a first ECC private key; The key distribution host and the key receiving device use the ECDH key agreement algorithm to negotiate a session key to obtain a first session key to establish a financial security channel between the key distribution host and the key receiving device, including: The key receiving device generates a first random number and sends the first random number to the key distribution host; The key distribution host saves the first random number and generates a second random number; The key distribution host generates a first temporary ECC public-private key pair, wherein the first temporary ECC public-private key pair includes a first temporary ECC public key and a first temporary ECC private key; The key distribution host generates a first message according to the first temporary ECC public key, the pre-set signature certificate chain, the first random number and the second random number, and signs the first message using the signature certificate private key in the pre-set signature certificate chain to obtain a first message signature; The key distribution host sends the first message and the first message signature to the key receiving device; The key receiving device end performs session key negotiation based on the first message and the first message signature using an ECDH key negotiation algorithm to obtain a first key receiving device end session key; The key receiving device side obtains the temporary certificate chain and uses the first key receiving device side session key to calculate a first key check value; The key receiving device generates a second message according to the second temporary ECC public key, the temporary certificate chain and the first key check value, and signs the second message using the first ECC private key to obtain a second message signature; The key receiving device sends the second message, the second random number and the second message signature to the key distribution host; The key distribution host end performs session key negotiation using an ECDH key negotiation algorithm based on the second random number, the second message and the second message signature to obtain a first key distribution host end session key; The key distribution host side calculates a second key check value using the first key distribution host side session key, and compares the second key check value with the first key check value in the second message, and if the result of the comparison is consistent, the key distribution host side generates a first integrated message according to the first random number, the first message, the first message signature, the second message and the second message signature; The key distribution host end uses the first key distribution host end session key to perform MAC calculation on the first integrated message to obtain a first MAC result, and sends the first MAC result to the key receiving device end; The key receiving device generates a second integrated message according to the first random number, the first message, the first message signature, the second message and the second message signature, and uses the first key receiving device session key to perform MAC calculation on the second integrated message to obtain a second MAC result; The key receiving device compares the second MAC result with the first MAC result. If the comparison result is consistent, it is determined that the financial security channel between the key distribution host and the key receiving device is successfully established.

4. A method for downloading a financial certificate and a financial key according to claim 3, characterized in that: The key receiving device end performs session key negotiation based on the first message and the first message signature using the ECDH key negotiation algorithm, and obtains the first key receiving device end session key, including: The key receiving device verifies the first random number in the first message once, and if the result of the verification is successful, saves the second random number; The key receiving device performs a secondary verification on the preset signature certificate chain in the first message. If the result of the secondary verification is successful, the first message signature is verified three times using the preset signature certificate chain. If the result of the three verifications is successful, a second temporary ECC public-private key pair is generated, where the second temporary ECC public-private key pair includes a second temporary ECC private key and a second temporary ECC public key; The key receiving device end performs session key negotiation using an ECDH key negotiation algorithm based on the second temporary ECC private key and the first temporary ECC public key in the first message to obtain a first key receiving device end session key.

5. A method for downloading a financial certificate and a financial key according to claim 3, characterized in that: The key distribution host end performs session key negotiation based on the second random number, the second message and the second message signature using the ECDH key negotiation algorithm to obtain the first key distribution host end session key, including: The key distribution host performs a check on the second random number once. If the result of the first check is successful, the temporary certificate chain is used to perform a second check on the second message signature. If the result of the second check is successful, the ECDH key agreement algorithm is used to negotiate a session key based on the first temporary ECC private key and the second temporary ECC public key in the second message to obtain the first key distribution host session key.

6. A method for downloading a financial certificate and a financial key according to claim 3, characterized in that: The key receiving device sends a financial certificate download request to the key distribution host based on the session key, comprising: The key receiving device generates a third random number and certificate request configuration information, and generates a financial certificate download request according to the second random number, the third random number and the certificate request configuration information; The key receiving device uses the first key receiving device session key to perform MAC calculation on the financial certificate download request to obtain a third MAC result, and sends the third MAC result to the key distribution host.

7. A method for downloading a financial certificate and a financial key according to claim 6, characterized in that: The key distribution host generates a financial certificate based on the financial certificate download request, and sends the financial certificate to the key receiving device, including: The key distribution host verifies the second random number in the third MAC result, and if the verification result is successful, saves the third random number in the third MAC result, and generates a financial certificate in a first preset format according to the certificate request configuration information in the third MAC result; The key distribution host sends the financial certificate and the third random number to the key receiving device; After the key distribution host generates a financial certificate based on the financial certificate download request and sends the financial certificate to the key receiving device, the key distribution host further includes: The key receiving device verifies the third random number, and if the verification result is successful, saves the financial certificate.

8. A method for downloading a financial certificate and a financial key according to claim 3, characterized in that: The key receiving device sends a financial key download request to the key distribution host based on the second session key and the financial certificate, comprising: The key receiving device generates a fourth random number; The key receiving device generates a financial key download request according to the second random number, the fourth random number, the key ID in the financial certificate, and the key system number, and performs MAC calculation on the financial key download request based on the second session key to obtain a fourth MAC result; The key receiving device sends the MAC result to the key distribution host.

9. A method for downloading a financial certificate and a financial key according to claim 8, characterized in that: The key distribution host generates a financial key based on the financial key download request, and sends the financial key to the key receiving device, including: The key distribution host verifies the second random number in the fourth MAC result, and if the verification result is successful, saves the fourth random number in the fourth MAC result, and generates a financial key according to the key ID and the key system number in the fourth MAC result in a second preset format; The key distribution host sends the financial key and the fourth random number to the key receiving device; After the key distribution host generates a financial key based on the financial key download request and sends the financial key to the key receiving device, the method further includes: The key receiving device verifies the fourth random number, and if the verification result is successful, saves the financial key.

10. A financial certificate and financial key download system, comprising a key distribution host end and a key receiving device end, wherein the key distribution host end comprises a first memory, a first processor, and a first computer program stored in the first memory and executable on the first processor, and the key receiving device end comprises a second memory, a second processor, and a second computer program stored in the second memory and executable on the second processor, characterized in that: When the first processor executes the first computer program, the steps performed by the key distribution host in the method for downloading a financial certificate and a financial key according to any one of claims 1 to 9 are implemented; When the second processor executes the second computer program, the steps performed by the key receiving device in the method for downloading a financial certificate and a financial key as described in any one of claims 1 to 9 are implemented.

Images