Intelligent password key

Abstract

The invention discloses an intelligent password key. The intelligent password key is internally provided with a self-defined shortcut application special interface; an application opening function module, a container opening function module, a session key importing function module, an encryption initialization function module and a decryption initialization function module are integrated and solidified in the shortcut application special interface, after user authentication, the shortcut application can be started by calling the shortcut application special interface, and rapid starting of the symmetric algorithm is achieved. On the premise that an original safety mechanism of the intelligent password key is not damaged, a quick channel for symmetric algorithm calling is provided for a user.

Description

Technical Field

[0001] The present application belongs to the field of information security technology, and in particular, relates to an intelligent password key. Background Art

[0002] Smart Token refers to a terminal cryptographic device that can perform cryptographic operations, key management functions, and provide cryptographic services. It is generally in the form of a USB interface.

[0003] In the smart password key, the security application is a non-volatile object and will not be lost when the power is off. Figure 1 As shown in the figure, the application contains containers, files, application names, administrator PIN codes, user PIN codes and other attributes. The relevant data is stored in the Flash area of ​​the smart password key security chip. All data is invisible to the outside world. The application layer can only access it in a controlled manner through standard interfaces and object handles. The handle manager works in the SRAM area of ​​the security chip and is responsible for mapping internal security objects to object handles.

[0004] Smart password keys currently on the market are usually developed in accordance with national encryption standards and support standard application interfaces. If users need to use the symmetric algorithm encryption / decryption function of the smart password key, they need to call the standard application interface to open the specified application, open the specified container, import or generate the session key, complete the encryption / decryption initialization and other operations in sequence, and then they can call the symmetric algorithm to implement the data encryption / decryption operation. For application scenarios of symmetric algorithms that require quick opening of applications or frequent switching of applications, the more complicated preparation and initialization process will drag down the efficiency of program execution and greatly reduce the user experience. Summary of the invention

[0005] The purpose of this application is to overcome the problems of the prior art and disclose a smart password key, which integrates and solidifies multiple application layer operations of a conventional smart password key into the underlying firmware program of the smart password key, thereby providing users with a quick channel for calling symmetric algorithms without destroying the original security mechanism of the smart password key.

[0006] The purpose of this application is achieved through the following technical solutions:

[0007] A smart password key, wherein a customized quick application dedicated interface is provided in the smart password key;

[0008] The quick application dedicated interface integrates and solidifies the function modules of opening application, opening container, importing session key, encryption initialization and decryption initialization.

[0009] After user authentication, calling the dedicated interface of the quick application can start the quick application and quickly enable the symmetric algorithm.

[0010] According to a preferred embodiment, the data exchange between the password application interface layer in the quick application and the smart password key device adopts APDU message, and the command word INS code of the APDU message corresponds to a specific APDU command;

[0011] The session key can be securely imported in a secret state when the quick application is started, and the private key is decrypted by the asymmetric encryption key in the container, and then the creation of encryption and decryption objects and the setting of algorithm initialization parameters are completed.

[0012] According to a preferred embodiment, the session key and asymmetric encryption key pair private key of the quick application support being imported in an encrypted and protected manner after user authentication, and being decrypted inside the smart password key and stored in the internal space.

[0013] According to a preferred embodiment, a vector table is used in the smart password key to implement the scheduling of each interface. The corresponding scheduling module locates the vector table offset according to the custom command word, and obtains the function address F of the quick application dedicated interface, and uses the parameter P in the quick application dedicated message as a parameter to call the interface function F(P), thereby completing the quick application startup calling process.

[0014] According to a preferred implementation, the quick application dedicated interface realizes automatic opening of internal applications and containers based on the object management mechanism, and calls the private key in the container to complete the decryption of the secret session key;

[0015] After decryption is successful, an encryption object and a decryption object are created, and encryption initialization and decryption initialization are completed according to the parameters specified by the initialization interface; and the application, container, encryption and decryption objects are registered according to the special interface for quick applications, and the object handle and status code are returned.

[0016] According to a preferred embodiment, after the quick application is started, the application layer uses the encryption / decryption object handle returned when the quick application is started to call the standard interface Encrypt / Decrypt of the symmetric algorithm according to application requirements to implement encryption / decryption of a single packet of data.

[0017] According to a preferred embodiment, the object handle returned by the shortcut application supports closing the key handle by calling the standard interface CloseHandle, closing the container by calling CloseContainer, and closing the application by calling CloseApplication and releasing the corresponding resources;

[0018] Alternatively, the quick application directly calls CloseApplication to close the application handle, and the CloseApplication interface automatically releases the internal resources of the smart password key device. The release process is the opposite of the initialization process.

[0019] According to a preferred embodiment, when the quick application is closed, the container opened in the application is automatically closed first; and before closing the container, the encryption / decryption object opened in the container is closed first, and finally the application handle is closed.

[0020] According to a preferred embodiment, the secret key of the quick application includes an asymmetric key pair of a smart password key and a symmetric algorithm session key.

[0021] The asymmetric key pair is imported from outside, the public key can be exported, and the private key cannot be exported;

[0022] The symmetric algorithm session key supports internal generation and export of the device, and the exported symmetric algorithm session key can be shared with other smart cryptographic keys holding the same encryption key pair.

[0023] According to a preferred embodiment, for smart cryptographic keys UK holding different encryption key pairs A ,UK B When a shared session key is needed, the key negotiation mechanism is used to negotiate the shared session key, and the device layer ECCExportSessionKeyEx interface and the respective public keys are called to export the corresponding key into ciphertext EncryptedSymmKeyA and EncryptedSymmKeyB;

[0024] UK A 、UK B After the end starts the quick application again with the encrypted session keys EncryptedSymmKeyA and EncryptedSymmKeyB, the originally negotiated shared session key is restored.

[0025] The aforementioned main scheme of the present application and its further options can be freely combined to form multiple schemes, all of which are schemes that can be adopted and claimed for protection in the present application. After understanding the scheme of the present application, those skilled in the art can understand that there are multiple combinations based on the prior art and common knowledge, all of which are technical schemes to be protected by the present application, and they are not exhaustively listed here.

[0026] Beneficial effects of this application:

[0027] 1. The smart password key has a special interface for quick application, which maintains all the functions and security performance of the general smart password key;

[0028] 2. The dedicated interface for quick applications supports setting session keys in the open state and importing session keys in the secret state;

[0029] 3. The dedicated interface for quick applications can automatically open applications and containers, create encryption / decryption objects according to the key, algorithm and algorithm initialization vector specified by the parameters, and return four object handles;

[0030] 4. The dedicated interface for quick applications can automatically complete the encryption / decryption initialization operation and prepare for the encryption / decryption of single-packet data;

[0031] 5. After the quick application is started, the object handle returned by it is the same as the handle returned by the standard interface. Use the returned encryption / decryption handle to call the standard interface Encrypt / Decrypt to implement single-packet data encryption / decryption operations. The number of calls is unlimited.

[0032] 6. The functions implemented by the special interface of the quick application are exactly the same as those implemented by calling the standard interface in sequence to open the application, open the container, import the session key, and initialize encryption / decryption;

[0033] 7. Intelligent password keys with special interfaces for quick applications can quickly build security solutions based on symmetric and asymmetric algorithms, especially for security application scenarios with pre-set session keys;

[0034] 8. The intelligent password key with built-in special interface for quick application can quickly enable symmetric algorithms in embedded systems without national secret standard interface drivers due to the simplified calling method. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is the internal security application structure diagram of the smart password key firmware program;

[0036] Figure 2 It is a quick application initialization flow chart. DETAILED DESCRIPTION

[0037] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0038] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0039] The present application discloses a smart password key, in which a customized quick application dedicated interface is provided; the quick application dedicated interface integrates and solidifies the function modules of opening application, opening container, importing session key, encryption initialization and decryption initialization. After user authentication, calling the quick application dedicated interface can start the quick application and realize the rapid activation of the symmetric algorithm.

[0040] Preferably, the data exchange between the password application interface layer and the smart password key device in the quick application adopts APDU messages, and the APDU message command word INS code corresponds to a specific APDU command. For example, INS is 0x02, which represents the SetLabel subcommand of the APDU command set. According to GM / T 0017-2023 "Smart Password Key Password Application Interface Data Format Specification", there are still multiple undefined INS values ​​that can be used for extension, such as 0xE8, 0xEA, etc., which can be used for custom interfaces. Using an undefined INS value as a special interface command word for a quick application will not cause any conflict with national secret standards and existing systems.

[0041] Furthermore, the session key supports secure import in a secret state when the quick application is started, and the private key is decrypted by the asymmetric encryption key in the container, and then the creation of encryption objects and decryption objects and the setting of algorithm initialization parameters are completed.

[0042] The import of encryption key pairs in the container is a national secret standard interface. The secret session key can be obtained by other means that comply with the relevant cryptographic specifications, or it can be generated and exported through the standard interface of this smart password key. The session key of the quick application and the private key of the asymmetric encryption key pair can be imported in an encrypted and secure manner after user authentication, and decrypted inside the smart password key and stored in the internal security space.

[0043] Preferably, a vector table is used in the smart password key to implement the scheduling of each interface. The corresponding scheduling module locates the vector table offset according to the custom command word, and obtains the function address F of the quick application dedicated interface, and uses the parameter P in the quick application dedicated message as a parameter to call the interface function F(P), thereby completing the quick application startup calling process.

[0044] Furthermore, the quick application dedicated interface realizes automatic opening of internal applications and containers based on the object management mechanism, and calls the private key in the container to complete the decryption of the secret session key.

[0045] After decryption is successful, an encryption object and a decryption object are created, and encryption initialization and decryption initialization are completed according to the parameters specified by the initialization interface; and the application, container, encryption and decryption objects are registered according to the special interface for quick applications, and the object handle and status code are returned.

[0046] Preferably, after the quick application is started, the application layer uses the encryption / decryption object handle returned when the quick application is started to call the standard interface Encrypt / Decrypt of the symmetric algorithm according to application requirements to implement encryption / decryption of single packet data. Quick applications support standard specifications and do not require dedicated encryption / decryption interfaces.

[0047] Preferably, the quick application supports standard specifications, and the object handle returned by it supports closing the key handle by calling the standard interface CloseHandle, calling CloseContainer to close the container, calling CloseApplication to close the application and release the corresponding resources; or, the quick application directly calls CloseApplication to close the application handle, and the CloseApplication interface automatically releases the internal resources of the smart password key device, and the release process is the opposite of the initialization process.

[0048] When the quick application is closed, the container opened in the application is automatically closed first; and before closing the container, the encryption / decryption object opened in the container is closed first, and finally the application handle is closed.

[0049] Preferably, the secret key of the quick application includes an asymmetric key pair of a smart cryptographic key and a symmetric algorithm session key, wherein the asymmetric key pair is imported from the outside, the public key can be exported, and the private key cannot be exported; the symmetric algorithm session key supports internal generation and export of the device, and the exported symmetric algorithm session key can be shared with other smart cryptographic keys holding the same encryption key pair.

[0050] Furthermore, for smart cryptographic keys UK holding different encryption key pairs A ,UK B When a shared session key is needed, the key negotiation mechanism is used to negotiate a shared session key, and the device layer ECCExportSessionKeyEx interface and the respective public keys are called to export the corresponding keys into ciphertexts EncryptedSymmKeyA and EncryptedSymmKeyB; UK A 、UK B After the end starts the quick application again with the encrypted session keys EncryptedSymmKeyA and EncryptedSymmKeyB, the originally negotiated shared session key is restored.

[0051] Preferably, the quick application dedicated interface is an integrated implementation of multiple standard interfaces, and the functions completed by the interface are no different from the functions implemented by using standard interfaces step by step; the object handle returned by the quick application is no different from the object handle returned by using the standard interface. Therefore, the quick application interface has good compatibility.

[0052] refer to Figure 2 As shown, in the quick application dedicated interface, the key type is determined according to the length of the passed-in session key. When it is 16 bytes, it is a clear test key. When the key length is the corresponding asymmetric algorithm ciphertext length, the corresponding encryption private key and algorithm in the container are called for decryption. After the decryption is successful, an encryption object and a decryption object are created, and the symmetric algorithm initialization is completed in the manner specified by the parameters, and the object handle and status code are returned.

[0053] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A smart password key, characterized in that: The smart password key is provided with a customized quick application dedicated interface; The quick application dedicated interface integrates and solidifies the function modules of opening application, opening container, importing session key, encryption initialization and decryption initialization. After user authentication, calling the dedicated interface of the quick application can start the quick application and quickly enable the symmetric algorithm.

2. The smart password key according to claim 1, characterized in that: The data exchange between the password application interface layer and the smart password key device in the quick application adopts APDU message, and the command word INS code of the APDU message corresponds to a specific APDU command; The session key can be securely imported in a secret state when the quick application is started, and the private key is decrypted by the asymmetric encryption key in the container, and then the creation of encryption and decryption objects and the setting of algorithm initialization parameters are completed.

3. The smart password key according to claim 2, characterized in that: The session key and asymmetric encryption key pair private key of the quick application support being imported in an encrypted and protected manner after user authentication, and being decrypted inside the smart password key and stored in the internal space.

4. The smart password key according to claim 1, characterized in that: The smart password key uses a vector table to implement the scheduling of each interface. The corresponding scheduling module locates the vector table offset according to the custom command word, and obtains the function address F of the quick application dedicated interface, and uses the parameter P in the quick application dedicated message as a parameter to call the interface function F(P), thereby completing the quick application startup calling process.

5. The smart password key according to claim 4, characterized in that: The quick application dedicated interface realizes automatic opening of internal applications and containers based on the object management mechanism, and calls the private key in the container to complete the decryption of the secret session key; After decryption is successful, an encryption object and a decryption object are created, and encryption initialization and decryption initialization are completed according to the parameters specified by the initialization interface; and the application, container, encryption and decryption objects are registered according to the special interface for quick applications, and the object handle and status code are returned.

6. The smart password key according to claim 5, characterized in that: After the quick application is started, the application layer uses the encryption / decryption object handle returned when the quick application is started to call the standard interface Encrypt / Decrypt of the symmetric algorithm according to application requirements to implement encryption / decryption of single packet data.

7. The smart password key according to claim 5, characterized in that: The object handle returned by the shortcut application supports calling the standard interface CloseHandle to close the key handle, calling CloseContainer to close the container, and calling CloseApplication to close the application and release the corresponding resources; Alternatively, the quick application directly calls CloseApplication to close the application handle, and the CloseApplication interface automatically releases the internal resources of the smart password key device. The release process is the opposite of the initialization process.

8. The smart password key according to claim 7, characterized in that: When the quick application is closed, the container opened in the application is automatically closed first; and before closing the container, the encryption / decryption object opened in the container is closed first, and finally the application handle is closed.

9. The smart password key according to claim 1, characterized in that: The secret key of the quick application includes an asymmetric key pair of the smart password key and a symmetric algorithm session key. The asymmetric key pair is imported from outside, the public key can be exported, and the private key cannot be exported; The symmetric algorithm session key supports internal generation and export of the device, and the exported symmetric algorithm session key can be shared with other smart cryptographic keys holding the same encryption key pair.

10. The smart password key according to claim 9, characterized in that: For smart password keys UK holding different encryption key pairs A ,UK B When a shared session key is needed, the key negotiation mechanism is used to negotiate the shared session key, and the device layer ECCExportSessionKeyEx interface and the respective public keys are called to export the corresponding key into ciphertext EncryptedSymmKeyA and EncryptedSymmKeyB; UK A 、UK B After the end starts the quick application again with the encrypted session keys EncryptedSymmKeyA and EncryptedSymmKeyB, the originally negotiated shared session key is restored.

Images