Electronic license authorization application method based on encrypted two-dimensional code

Abstract

According to the electronic license authorization application method based on the encrypted two-dimensional code provided by the invention, the electronic license is externally provided in the form of the encrypted two-dimensional code, so that the privacy of the electronic license is protected; through a precise authorization mechanism, data items are authorized and decrypted as required, and meanwhile, identity authentication and authorization decoding are organically combined to construct a precise authorization application security system; based on an electronic license signing and issuing system, an electronic license authorization system, an electronic license calling system, an electronic license bearing APP and a mechanism for controlling an electronic license authorization application by the electronic license calling system APP, accurate authorization decoding and application of the electronic license are realized, and it is ensured that the electronic license data items can be accurately authorized to be used according to the requirements of a user. And the use safety of the electronic license is greatly improved.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic certificates, and in particular to an electronic certificate authorization application method based on encrypted two-dimensional codes. Background Art

[0002] Electronic certificates refer to electronic documents such as various certificates, proofs, approvals, appraisal reports, and service results issued by various units in accordance with the law and with legal effect, such as electronic versions of identity cards, marriage certificates, bank repayment flow certificates, business licenses, etc. In recent years, the application field of electronic certificates has continued to expand, with numerous application scenarios and diverse and complex users. Most electronic certificates in the existing technology are used directly in plain text like physical certificates. However, in actual applications, it is found that there are still some problems with the use of such plain text electronic certificates. First, in the process of cross-industry and cross-departmental applications, different industries and departments have different needs for electronic certificate data items. If the full amount of electronic certificate data items is directly provided, it may lead to privacy information leakage, and it is difficult to balance between shared applications and privacy protection; second, in the process of electronic certificates being transmitted and used between different network environments and different business systems, if encryption, desensitization and other protection measures are not taken, the risk of privacy leakage will be aggravated. Summary of the invention

[0003] In order to solve the problem of security in the prior art of directly using electronic certificates in plain text like physical certificates, the present invention provides an electronic certificate authorization application method based on encrypted QR codes, which not only protects the privacy of electronic certificates, but also realizes the precise authorization of the use of electronic certificate data items according to the needs of the user, thereby meeting the diversified application needs of different industries and departments.

[0004] The technical solution of the present invention is as follows: an electronic certificate authorization application method based on encrypted two-dimensional code, characterized in that it includes the following steps: S1: System preparation; Set up an electronic certificate issuance system, an electronic certificate authorization system, an electronic certificate calling system, an electronic certificate carrying APP, an electronic certificate calling system APP and a cryptographic machine to manage and control the entire life cycle of electronic certificates; The electronic certificate issuance system issues and generates an electronic certificate, and the electronic certificate is presented in the form of an electronic certificate QR code; The electronic certificate authorization system is used for electronic certificate QR code decoding authorization; The electronic certificate calling system is used to receive the electronic certificate QR code uploaded by the electronic certificate calling system APP and call the electronic certificate authorization system to realize decoding; The cryptographic machine provides cryptographic computing services for the electronic certificate issuance system, the electronic certificate authorization system, and the electronic certificate calling system; The electronic certificate carrying APP is used to download and present the electronic certificate; the electronic certificate calling system APP is used to scan and collect the electronic certificate QR code; The electronic certificate issuance system generates electronic certificate issuance public and private keys and annotation public and private keys, and generates independent encryption and decryption root keys for each data item; the electronic certificate authorization system and the electronic certificate calling system generate their own system public and private keys respectively, and apply for digital certificates simultaneously; the electronic certificate issuance system encrypts and protects the encryption and decryption root keys, issuance public keys and annotation public keys of all data items, and safely imports them into the electronic certificate authorization system; S2: Application and generation of electronic certificates; The electronic certificate holder applies for an electronic certificate from the electronic certificate issuing system through the electronic certificate carrying APP; the electronic certificate issuing system uses different encryption and decryption keys to independently encrypt each data item, and digitally sign it to generate a complete electronic certificate; S3: Download and present electronic certificates and collect QR codes; The electronic certificate holder downloads the electronic certificate from the electronic certificate issuing system through the electronic certificate carrying APP and actively presents the electronic certificate QR code. The electronic certificate calling system APP scans and collects the QR code and uploads it to the electronic certificate calling system; S4: two-way identity authentication between the electronic certificate calling system and the electronic certificate authorization system; The electronic certificate calling system sends an authentication request to the electronic certificate authorization system. After the electronic certificate authorization system verifies that the authentication request is passed, it sends an authentication request to the electronic certificate calling system. After the electronic certificate calling system verifies that the authentication request is passed, the two-way identity authentication is completed; S5: Precise authorization of electronic certificates; The electronic certificate calling system requests decoding from the electronic certificate authorization system and submits a verification log simultaneously; the electronic certificate authorization system determines the electronic certificate data items that are allowed to be authorized according to the needs of the user, calls the cryptographic machine to generate the encryption and decryption keys of the authorized data items, encrypts and generates an authorization token, signs the authorization token and returns it to the electronic certificate calling system, and saves the verification log; S6: Electronic certificate decoding application; After receiving the authorization Token, the electronic certificate calling system calls the cryptographic machine, verifies and decrypts to obtain the encryption and decryption keys of all authorized data items, decrypts the ciphertext of the authorized data items respectively, obtains the plaintext data and carries out subsequent related applications.

[0005] It is further characterized by: In step S1, the system preparation stage, the preparation operation of the electronic certificate issuance system includes the following steps in detail: S11: The electronic certificate issuance system calls the cryptographic machine to randomly generate public and private keys for electronic certificate issuance and annotation public and private keys; S12: The electronic certificate issuance system calls the cryptographic machine to randomly generate a system root key, uses the endorsement field data item number as a dispersion factor, and disperses the system root key to generate the endorsement field data item encryption and decryption root key; uses the annotation field data item number as a dispersion factor, and disperses the system root key to generate the annotation field data item encryption and decryption root key; S13: The electronic certificate authorization system calls the cryptographic machine to randomly generate the public and private keys of the electronic certificate authorization system and apply for the issuance of the electronic certificate authorization system digital certificate; S14: The electronic certificate calling system calls the cryptographic machine, randomly generates the public and private keys of the electronic certificate calling system, and applies for the issuance of the electronic certificate calling system digital certificate; S15: The electronic certificate issuing system uses the public key of the electronic certificate authorization system to encrypt and protect the encryption and decryption root keys, the issuing public key and the annotation public key of all data items to obtain the key ciphertext; S16: The electronic certificate authorization system imports the key ciphertext into the electronic certificate authorization system cipher machine, uses the electronic certificate authorization system private key to decrypt and obtain the encryption and decryption root key of all data items, issues the public key, and annotates the public key plaintext for safe storage; S17: The electronic certificate authorization system determines the type of the user subject of this application, determines the corresponding authorization data item according to the type of the user subject, and simultaneously generates an endorsement field authorization data item table; the endorsement field authorization data item table contains the number of each authorized endorsement field data item; the electronic certificate authorization system sends the endorsement field authorization data item table to the electronic certificate calling system; In step S2, the process of generating the electronic certificate QR code specifically includes the following steps: a1: The electronic certificate holder applies for the electronic certificate from the electronic certificate issuing system through the electronic certificate carrying APP; The data items of the electronic certificate before issuance include the QR code version number, the electronic certificate number, the endorsement field and the annotation field; a2: The electronic certificate issuing system performs binary bit stream encoding on all data items of the electronic certificate before issuance; a3: The electronic certificate issuance system uses the electronic certificate number and the endorsement time as dispersion factors to disperse the endorsement field data item encryption and decryption root key to generate the endorsement field data item encryption and decryption key; uses the electronic certificate number and the endorsement time as dispersion factors to disperse the endorsement field data item encryption and decryption root key to generate the endorsement field data item encryption and decryption key; The electronic certificate issuance system encrypts all data items in the endorsement field using the corresponding endorsement field data item encryption and decryption keys to obtain the endorsement field ciphertext; The electronic certificate issuance system encrypts all data items in the annotation field using the same annotation field data item encryption and decryption key to obtain the annotation field ciphertext; wherein the annotation field ciphertext and the annotation field ciphertext are both binary bit stream strings; a4: The electronic certificate issuance system uses the electronic certificate issuance private key to digitally sign all data items of the ciphertext in the annotation field to obtain the annotation digital signature, and uses the electronic certificate annotation private key to digitally sign all data items of the ciphertext in the annotation field to obtain the annotation digital signature; a5: The electronic certificate issuing system combines the binary bit streams of the two-dimensional code version number, the electronic certificate number, the ciphertext of the endorsement field, the ciphertext of the addition field, the endorsement digital signature and the addition digital signature in order to obtain the issued electronic certificate binary bit stream; a6: The electronic certificate issuing system uses a preset electronic certificate two-dimensional code encoding method to encode the binary bit stream of the issued electronic certificate to generate an electronic certificate two-dimensional code; In step S4, the electronic certificate calling system and the electronic certificate authorization system perform two-way identity authentication, which specifically includes the following steps: b1: Before the electronic certificate calling system requests decoding authorization, it first performs two-way identity authentication with the electronic certificate authorization system, and the authentication adopts digital signature and digital certificate mode; the electronic certificate calling system calls the cryptographic machine, encapsulates and generates an identity authentication request Req1, and sends it to the electronic certificate authorization system; b2: After receiving Req1, the electronic certificate authorization system calls the cryptographic machine to verify Req1. After passing, it confirms that the electronic certificate calling system is legal, encapsulates and generates an identity authentication request Req2, and sends it to the electronic certificate calling system; b3: After receiving Req2, the electronic certificate calling system calls the cryptographic machine to verify Req2. After passing Req2, it is confirmed that the electronic certificate authorization system is legal, and the two-way identity authentication ends; The accurate authorization of the electronic certificate in step S5 specifically includes the following steps: c1: The electronic certificate calling system sends the collected electronic certificate QR code to the electronic certificate authorization system, requests decoding authorization, and simultaneously submits verification information, the verification information including: verification time and usage matters; c2: After receiving the electronic certificate QR code, the electronic certificate authorization system decodes the electronic certificate QR code based on a preset electronic certificate QR code decoding method to obtain a binary bit stream of the issued electronic certificate; c3: The electronic certificate authorization system parses the QR code version number, electronic certificate number, endorsement field ciphertext, annotation field ciphertext, endorsement digital signature and annotation digital signature in sequence, and uses the issuing public key and annotation public key to verify the endorsement digital signature and annotation digital signature respectively. After the verification, the electronic certificate number and the annotation time in the annotation signature are used as dispersion factors to disperse the annotation field data item encryption and decryption root key to generate the annotation field data item encryption and decryption key, and decrypt the annotation field ciphertext to obtain the verification data item, which includes: the purpose and validity period of the electronic certificate QR code; The electronic certificate authorization system checks whether the usage items in the QR code are consistent with the usage items submitted in the verification information, and verifies whether the verification time is within the validity period in the QR code. Authorization is performed after all verifications are passed; c4: The electronic certificate authorization system disperses the root encryption and decryption keys of all authorized annotation field data items according to the annotation field authorization data item table of the electronic certificate calling system, and generates corresponding encryption and decryption keys for each authorized annotation field data item, and the dispersion factor is the electronic certificate number and the annotation time in the annotation signature; The electronic certificate authorization system uses the public key of the electronic certificate calling system to encrypt the encryption and decryption keys of all authorized signed data items respectively, combines the data item encryption and decryption key ciphertext and the corresponding data item number, assembles all the combined data to generate an authorization token, uses the electronic certificate authorization system private key to digitally sign the authorization token, and returns the signed authorization token to the electronic certificate calling system; synchronously records the verification log such as verification time and usage matters; In step S6, the electronic certificate decoding application specifically includes the following steps: d1: After receiving the signed authorization token, the electronic certificate calling system verifies the digital signature using the electronic certificate authorization system public key, decrypts the key ciphertext in each combination in the authorization token using the electronic certificate calling system private key, and records the authorization data item encryption and decryption key and the corresponding data item number; d2: The electronic certificate calling system decodes the electronic certificate QR code based on a preset electronic certificate QR code decoding method to obtain a binary bit stream of the issued electronic certificate; The electronic certificate authorization system sequentially parses the electronic certificate binary bit stream to obtain the ciphertext binary bit stream of the annotation field, decrypts the ciphertext of the data item with the corresponding number in the annotation field according to the obtained authorization data item encryption and decryption key and the corresponding data item number, and finally obtains the plaintext data of the authorized data item in the annotation field, and carries out subsequent related applications; The cryptographic machine provides digital signature verification and encryption and decryption services, and supports at least domestic SM2, SM3 and SM4 algorithms; The electronic certificate issuance system encodes the issued electronic certificate binary bit stream according to a preset electronic certificate two-dimensional code encoding method to generate an electronic certificate two-dimensional code. The electronic certificate two-dimensional code encoding method specifically includes the following steps: The electronic certificate binary bit stream is padded to an integer multiple of 31 bits; the padded electronic certificate binary bit stream is divided into blocks of 31 bits, each block is converted into a decimal number, each decimal number is converted into 6 45-base characters, all the characters are concatenated in order to obtain a final electronic certificate character string, and finally an electronic certificate QR code is generated according to a preset character mode; The electronic certificate two-dimensional code decoding method comprises the following steps: Parse the electronic certificate QR code according to a preset character mode to obtain all characters, divide all character strings into groups of 6 characters, and convert the 6 characters in each group into decimal numbers according to a preset encoding standard; convert the decimal numbers into a 31-bit binary bit stream; and sequentially splice all the 31-bit binary bit streams to obtain the binary bit stream of the issued electronic certificate; When the electronic certificate QR code is generated, all the annotated fields use the same data item number to participate in the calculation.

[0006] The present application provides an electronic certificate authorization application method based on encrypted QR code, which provides electronic certificates to the outside in the form of encrypted QR code, thereby protecting the privacy of electronic certificates; through a precise authorization mechanism, decryption of data items is authorized on demand, and identity authentication and authorization decoding are organically combined to build a precise authorization application security system; based on the mechanism of controlling the authorization application of electronic certificates by an electronic certificate issuance system, an electronic certificate authorization system, an electronic certificate calling system, an electronic certificate carrying APP, and an electronic certificate calling system APP, precise authorization decoding and application of electronic certificates are realized, ensuring that the use of electronic certificate data items can be accurately authorized according to the needs of the user, greatly improving the security of the use of electronic certificates. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 This is a schematic diagram of the electronic certificate authorization application system structure for this application; Figure 2 A schematic diagram of the process of applying for, generating, downloading and presenting electronic certificates and collecting QR codes; Figure 3 Schematic diagram of the process of decrypting electronic certificates; Figure 4 This is a functional diagram of the electronic certificate authorization application system; Figure 5 Generate the QR code for electronic certificates; Figure 6 Provides accurate authorization and decoding application process for electronic certificates. DETAILED DESCRIPTION

[0008] like Figure 1~Figure 4 As shown, the present invention includes an electronic certificate authorization application method based on encrypted two-dimensional code, which includes the following steps.

[0009] S1: System preparation; Set up an electronic certificate issuance system, an electronic certificate authorization system, an electronic certificate calling system, an electronic certificate carrying APP, an electronic certificate calling system APP and a cryptographic machine to manage and control the entire life cycle of electronic certificates; The electronic certificate issuance system issues and generates electronic certificates, which are presented in the form of electronic certificate QR codes; The electronic certificate authorization system is used for electronic certificate QR code decoding authorization; The electronic certificate calling system is used to receive the electronic certificate QR code uploaded by the electronic certificate calling system APP and call the electronic certificate authorization system to realize decoding; The cryptographic machine provides cryptographic operation services for the electronic certificate issuance system, electronic certificate authorization system, and electronic certificate call system; the cryptographic machine provides digital signature verification and encryption and decryption service functions, and supports at least domestic SM2, SM3, and SM4 algorithms; The electronic certificate carrier APP is used to download and present electronic certificates; the electronic certificate calling system APP is used to scan and collect the electronic certificate QR code.

[0010] Generally speaking, an electronic certificate as an identity document will have a certificate holder, but in actual use, each type of electronic certificate will have many users. For example: individuals, commercial companies such as insurance companies, various administrative departments, etc. In this method, when the certificate holder presents the electronic certificate, the electronic certificate QR code is displayed through the electronic certificate carrier APP, and the user uses the electronic certificate to call the system APP to collect the QR code data of the electronic certificate, and the user uses the electronic certificate to carry out related business. The electronic certificate QR code collected by the user can only obtain the corresponding electronic certificate data after encryption and precise authorization, ensuring that the electronic certificate data will not be misread or maliciously collected by unrelated third parties, thereby improving the security of the use of electronic certificates.

[0011] Specifically, in the system preparation stage, the preparation operations of the electronic certificate issuance system include the following in detail: S11: The electronic certificate issuance system calls the cryptographic machine to randomly generate public and private keys for electronic certificate issuance and annotation public and private keys; S12: The electronic certificate issuance system calls the cryptographic machine to randomly generate a system root key, uses the endorsement field data item number as a dispersion factor, and disperses the system root key to generate the endorsement field data item encryption and decryption root key; uses the annotation field data item number as a dispersion factor, and disperses the system root key to generate the annotation field data item encryption and decryption root key; S13: The electronic certificate authorization system calls the cryptographic machine to randomly generate the public and private keys of the electronic certificate authorization system and apply for the issuance of the electronic certificate authorization system digital certificate; S14: The electronic certificate calling system calls the cryptographic machine, randomly generates the public and private keys of the electronic certificate calling system, and applies for the issuance of the electronic certificate calling system digital certificate; S15: The electronic certificate issuing system uses the public key of the electronic certificate authorization system to encrypt and protect the encryption and decryption root keys, the issuing public key and the annotation public key of all data items to obtain the key ciphertext; S16: The electronic certificate authorization system imports the key ciphertext into the electronic certificate authorization system cipher machine, uses the electronic certificate authorization system private key to decrypt and obtain the encryption and decryption root key of all data items, issues the public key, and annotates the public key plaintext for safe storage; S17: The electronic certificate authorization system determines the type of user of this application, determines the corresponding authorization data item according to the type of user, and simultaneously generates an annotation field authorization data item table; the annotation field authorization data item table contains the number of each authorized annotation field data item; the electronic certificate authorization system sends the annotation field authorization data item table to the electronic certificate calling system.

[0012] S2: Application and generation of electronic certificates; The certificate holder applies for an electronic certificate from the electronic certificate issuing system through the electronic certificate carrier APP; the electronic certificate issuing system uses different encryption and decryption keys to independently encrypt each data item, and digitally sign it to generate a complete electronic certificate.

[0013] In step S2, the process of generating the electronic certificate QR code specifically includes the following steps.

[0014] a1: The electronic certificate holder applies for an electronic certificate from the electronic certificate issuance system through the electronic certificate bearer APP; The data items of the electronic certificate before issuance include the QR code version number, the electronic certificate number, the endorsement field and the annotation field; The endorsement field and the annotation field refer to the definitions of electronic certificate originals and annotations in the standards "GB / T 36901-2018 Overall Technical Architecture of Electronic Certificates" and "GB / T 36905-2018 Technical Requirements for Electronic Certificates". The endorsement field is defined as: the field in the electronic certificate original issued by the electronic certificate issuing agency. The annotation field is defined as: the purpose, validity period and other fields added to the original electronic certificate for the purpose of handling related matters.

[0015] In this embodiment, the endorsement field is composed of data items such as license plate number, vehicle type, vehicle identification code, engine number, etc., and the remark field is composed of data items such as purpose and validity period.

[0016] a2: The electronic certificate issuance system encodes all data items of the electronic certificate before issuance in a binary bit stream.

[0017] a3: The electronic certificate issuance system uses the electronic certificate number and the endorsement time as the dispersion factors to disperse the root key for encryption and decryption of the endorsement field data item to generate the encryption and decryption key for the endorsement field data item; uses the electronic certificate number and the endorsement time as the dispersion factors to disperse the root key for encryption and decryption of the endorsement field data item to generate the encryption and decryption key for the endorsement field data item; The electronic certificate issuance system encrypts all data items in the endorsement field using the corresponding endorsement field data item encryption and decryption keys to obtain the endorsement field ciphertext. Specifically, the encryption adopts the CFB mode of the SM4 algorithm; The electronic certificate issuance system uses the same annotated field data item encryption and decryption key to encrypt all data items in the annotated field to obtain the annotated field ciphertext. Specifically, the encryption adopts the CFB mode of the SM4 algorithm; wherein the annotation field ciphertext and the annotated field ciphertext are both binary bit stream strings.

[0018] a4: The electronic certificate issuance system uses the electronic certificate issuance private key to digitally sign all data items of the ciphertext in the annotation field to obtain the annotation digital signature, and uses the electronic certificate annotation private key to digitally sign all data items of the ciphertext in the annotation field to obtain the annotation digital signature; In this embodiment, the endorsed digital signature includes a 4-bit digest algorithm identifier, a 4-bit signature algorithm identifier, a 33-bit endorsement time and a 512-bit endorsement signature value; the added digital signature includes a 4-bit digest algorithm identifier, a 4-bit signature algorithm identifier, a 33-bit addition time and a 512-bit addition signature value.

[0019] a5: The electronic certificate issuance system combines the binary bit streams of the QR code version number, the electronic certificate number, the ciphertext of the endorsement field, the ciphertext of the addition field, the endorsement digital signature and the addition digital signature in sequence to obtain the binary bit stream of the issued electronic certificate.

[0020] a6: The electronic certificate issuance system encodes the binary bit stream of the issued electronic certificate based on the preset electronic certificate QR code encoding method to generate the electronic certificate QR code.

[0021] S3: Download and present electronic certificates and collect QR codes; When the electronic certificate holder needs to provide the electronic certificate to the electronic certificate calling system, the electronic certificate holder downloads the electronic certificate from the electronic certificate issuing system through the electronic certificate carrier APP. The electronic certificate issuing system reviews the user's download request and returns the final electronic certificate QR code to the electronic certificate carrier APP after approval. The electronic certificate carrier APP displays the electronic certificate in the form of a QR code.

[0022] When it is necessary to read the QR code of the electronic certificate, use the electronic certificate retrieval system APP to scan the QR code of the electronic certificate actively presented by the certificate holder, collect and upload it to the electronic certificate retrieval system.

[0023] S4: Two-way identity authentication between the electronic certificate calling system and the electronic certificate authorization system; The electronic certificate calling system sends an authentication request to the electronic certificate authorization system. After the electronic certificate authorization system verifies that the authentication request is passed, it sends an authentication request to the electronic certificate calling system. After the electronic certificate calling system verifies that the authentication request is passed, the two-way identity authentication is completed.

[0024] In step S4, the electronic certificate calling system and the electronic certificate authorization system perform two-way identity authentication, which specifically includes the following steps: b1: Before the electronic certificate calling system requests decoding authorization, it first performs two-way identity authentication with the electronic certificate authorization system, using digital signature and digital certificate. The electronic certificate calling system calls the cryptographic machine, encapsulates and generates an identity authentication request Req1, and sends it to the electronic certificate authorization system. b2: After receiving Req1, the electronic certificate authorization system calls the cryptographic machine to verify Req1. After passing, it confirms that the electronic certificate calling system is legal, encapsulates and generates an identity authentication request Req2, and sends it to the electronic certificate calling system; b3: After receiving Req2, the electronic certificate calling system calls the cryptographic machine to verify Req2. After passing, it confirms that the electronic certificate authorization system is legal, and the two-way identity authentication ends.

[0025] S5: Precise authorization of electronic certificates; The electronic certificate calling system requests decoding from the electronic certificate authorization system and submits the verification log synchronously; the electronic certificate authorization system determines the electronic certificate data items that are allowed to be authorized based on the needs of the user, calls the cryptographic machine to generate the encryption and decryption keys of the authorized data items, and encrypts and generates an authorization Token. After signing the authorization Token, it is returned to the electronic certificate calling system and the verification log is saved.

[0026] Before using the data items of the electronic certificate, the user will request permission from the electronic certificate authorization system through the electronic certificate calling system. In this method, the electronic certificate calling system and the electronic certificate authorization system will define the data items that each user can authorize in advance according to the type of the user who issues the request. When authorizing, it will be accurately authorized according to the defined authorization scope. Data items beyond the scope of authority will not be authorized, ensuring the safe use of electronic certificate data.

[0027] The accurate authorization of the electronic certificate in step S5 specifically includes the following steps: c1: The electronic certificate calling system sends the collected electronic certificate QR code to the electronic certificate authorization system, requests decoding authorization, and simultaneously submits verification information, which includes: verification time and purpose matters; c2: After receiving the electronic certificate QR code, the electronic certificate authorization system decodes it based on the preset electronic certificate QR code decoding method to obtain the issued electronic certificate binary bit stream; c3: The electronic certificate authorization system parses the QR code version number, electronic certificate number, endorsement field ciphertext, annotation field ciphertext, endorsement digital signature and annotation digital signature in sequence, and uses the issuing public key and annotation public key to verify the endorsement digital signature and annotation digital signature respectively. After the verification is passed, the electronic certificate number and the annotation time in the annotation signature are used as dispersion factors to disperse the encryption and decryption root key of the annotation field data item to generate the encryption and decryption key of the annotation field data item, and decrypt the annotation field ciphertext to obtain the verification data item. The verification data item includes: the purpose and validity period of the electronic certificate QR code; The electronic certificate authorization system verifies whether the usage items in the QR code are consistent with the usage items submitted in the verification information, and verifies whether the verification time is within the validity period in the QR code. Authorization is performed after all verifications are passed; c4: The electronic certificate authorization system disperses the root encryption and decryption keys of all authorized annotation field data items according to the endorsement field authorization data item table of the electronic certificate calling system, and generates corresponding encryption and decryption keys for each authorized annotation field data item. The dispersion factor is the electronic certificate number and the endorsement time in the endorsement signature. The electronic certificate authorization system uses the public key of the electronic certificate calling system to encrypt the encryption and decryption keys of all authorized signed data items respectively, combines the data item encryption and decryption key ciphertext and the corresponding data item number, assembles all the combined data to generate an authorization Token, uses the private key of the electronic certificate authorization system to digitally sign the authorization Token, and returns the signed authorization Token to the electronic certificate calling system; simultaneously records verification logs such as verification time and usage matters for subsequent supervision.

[0028] S6: Electronic certificate decoding application; After receiving the authorization Token, the electronic certificate calling system calls the cryptographic machine to verify and decrypt to obtain the encryption and decryption keys of all authorized data items, decrypts the ciphertext of the authorized data items respectively, obtains the plaintext data and carries out subsequent related applications.

[0029] The electronic certificate decoding application specifically includes the following steps: d1: After receiving the signed authorization token, the electronic certificate calling system uses the electronic certificate authorization system public key to verify the digital signature, uses the electronic certificate calling system private key to decrypt the key ciphertext in each combination in the authorization token, and records the authorization data item encryption and decryption key and the corresponding data item number; d2: The electronic certificate calling system decodes the electronic certificate QR code based on the preset electronic certificate QR code decoding method to obtain the binary bit stream of the issued electronic certificate; The electronic certificate authorization system parses the electronic certificate binary bit stream in sequence to obtain the ciphertext binary bit stream of the annotation field. Based on the obtained authorization data item encryption and decryption key and the corresponding data item number, it decrypts the ciphertext of the data item with the corresponding number in the annotation field, and finally obtains the plaintext data of the authorized data item in the annotation field to carry out subsequent related applications.

[0030] In this method, the electronic certificate issuance system encodes the issued electronic certificate binary bit stream according to the preset electronic certificate two-dimensional code encoding method to generate an electronic certificate two-dimensional code; wherein the electronic certificate two-dimensional code encoding method specifically includes the following steps: The electronic certificate binary bit stream is padded to an integer multiple of 31 bits; the padded electronic certificate binary bit stream is divided into blocks of 31 bits; each block is converted into a decimal number, each decimal number is converted into 6 45-base characters, all characters are concatenated in order to obtain the final electronic certificate string, and finally the electronic certificate QR code is generated according to the character mode in GB / T 18284-2000. The binary bit stream is divided into blocks of 31 bits, converted into decimal numbers, and then each decimal number is converted into 6 45-base characters, and the electronic certificate QR code is generated according to the character mode. Compared with the byte mode in GB / T 18284-2000, the compression rate is improved, the number of characters that can be stored is increased, and the QR code generated by the electronic certificate binary bit stream of the same length is more readable, which improves the efficiency of QR code scanning and collection. At the same time, visible characters are directly obtained after scanning, which improves the QR code processing efficiency and software compatibility.

[0031] The specific encoding process is as follows: Binary bit stream: 111111111111111111111111; Fill 31 bits: 11111111111111111111111100000000; After conversion to decimal: 16777215 Convert to base 45: 0th digit (16777215 / (45^0)) MOD 45 = 0 =>'0'; 1st digit (16777215 / (45^1)) MOD 45 = 2 =>'2'; The second digit (16777215 / (45^2)) MOD 45 = 5 =>'5'; The third digit (16777215 / (45^3)) MOD 45 = 4 =>'4'; The 4th digit (16777215 / (45^4)) MOD 45 = 31 =>'4'; The fifth bit (16777215 / (45^5)) MOD 45 = 11 =>'0'; The converted data stream is: "025440".

[0032] Based on the electronic certificate QR code encoding method in this method, binary stream: 111001001110010001100010011000100110011101100000011001000110010101010001001000000100001010101; The converted data flow is: 8ODNH69Z97.6CIB203L00000.

[0033] Binary stream: 11111100000011111111111110010011100100011000100100110001001100110110000001100100011001010100010010111111111111111111111111111001000000100001010101; The converted data flow is: $+8$ 1B+ / JD9 / EI91-VFVSB$SKXL0.

[0034] Corresponding to the electronic certificate QR code encoding method, the electronic certificate QR code decoding method includes the following steps: Parse the electronic certificate QR code according to the character mode in GB / T 18284-2000 to obtain all 45-base characters, divide all character strings into groups of 6 characters, convert the 6 characters in each group into decimal numbers; convert the decimal numbers into 31-bit binary bit streams; concatenate all 31-bit binary bit streams in sequence to obtain the binary bit stream of the electronic certificate after issuance.

[0035] In actual applications, because the annotation fields need to be provided to all types of users, in order to improve the efficiency of generating the electronic certificate QR code, when generating the electronic certificate QR code, all the annotation fields use the same data item number to participate in the key distribution calculation of the encryption and decryption key; that is, all the annotation fields share one encryption and decryption key, and each annotation field is not encrypted independently, but all the annotation fields are combined and encrypted, and the encryption is performed only once. At the same time, because different types of users can apply for different data items of the annotation field, each data item of the annotation field is encrypted and generated using an independent data item number to generate the electronic certificate QR code, thereby improving the security of the use of the annotation field data.

[0036] After using the technical solution of the present invention, the electronic certificate is provided to the outside in the form of an encrypted QR code, thereby protecting the privacy of the electronic certificate; the encrypted QR code mechanism independently encrypts the electronic certificate data items and displays the electronic certificate in the form of a QR code, thereby meeting the needs of privacy protection and convenient application; the precise authorization mechanism decrypts the data items through on-demand authorization, while organically combining identity authentication with authorization decoding to build a precise authorization application security system. Through the above methods, the present invention realizes the encryption protection of electronic certificate data, avoids the leakage of the privacy of the electronic certificate subject, authenticates the legitimacy of the identity of the electronic certificate caller, eliminates illegal access to third-party systems, implements precise authorization decoding, realizes the refined authority management of electronic certificate data information, and balances shared applications and privacy protection, while recording verification logs for subsequent supervision.

Claims

1. An electronic certificate authorization application method based on encrypted QR code, characterized in that: It includes the following steps: S1: System preparation; Set up an electronic certificate issuance system, an electronic certificate authorization system, an electronic certificate calling system, an electronic certificate carrying APP, an electronic certificate calling system APP and a cryptographic machine to manage and control the entire life cycle of electronic certificates; The electronic certificate issuance system issues and generates an electronic certificate, and the electronic certificate is presented in the form of an electronic certificate QR code; The electronic certificate authorization system is used for electronic certificate QR code decoding authorization; The electronic certificate calling system is used to receive the electronic certificate QR code uploaded by the electronic certificate calling system APP and call the electronic certificate authorization system to realize decoding; The cryptographic machine provides cryptographic computing services for the electronic certificate issuance system, the electronic certificate authorization system, and the electronic certificate calling system; The electronic certificate carrying APP is used to download and present the electronic certificate; the electronic certificate calling system APP is used to scan and collect the electronic certificate QR code; The electronic certificate issuance system generates electronic certificate issuance public and private keys and annotation public and private keys, and generates independent encryption and decryption root keys for each data item; the electronic certificate authorization system and the electronic certificate calling system generate their own system public and private keys respectively, and apply for digital certificates simultaneously; the electronic certificate issuance system encrypts and protects the encryption and decryption root keys, issuance public keys and annotation public keys of all data items, and safely imports them into the electronic certificate authorization system; S2: Application and generation of electronic certificates; The electronic certificate holder applies for an electronic certificate from the electronic certificate issuing system through the electronic certificate carrying APP; the electronic certificate issuing system uses different encryption and decryption keys to independently encrypt each data item, and digitally sign it to generate a complete electronic certificate; S3: Download and present electronic certificates and collect QR codes; The electronic certificate holder downloads the electronic certificate from the electronic certificate issuing system through the electronic certificate carrying APP and actively presents the electronic certificate QR code. The electronic certificate calling system APP scans and collects the QR code and uploads it to the electronic certificate calling system; S4: two-way identity authentication between the electronic certificate calling system and the electronic certificate authorization system; The electronic certificate calling system sends an authentication request to the electronic certificate authorization system. After the electronic certificate authorization system verifies that the authentication request is passed, it sends an authentication request to the electronic certificate calling system. After the electronic certificate calling system verifies that the authentication request is passed, the two-way identity authentication is completed; S5: Precise authorization of electronic certificates; The electronic certificate calling system requests decoding from the electronic certificate authorization system and submits a verification log simultaneously; the electronic certificate authorization system determines the electronic certificate data items that are allowed to be authorized according to the needs of the user, calls the cryptographic machine to generate the encryption and decryption keys of the authorized data items, encrypts and generates an authorization token, signs the authorization token and returns it to the electronic certificate calling system, and saves the verification log; S6: Electronic certificate decoding application; After receiving the authorization Token, the electronic certificate calling system calls the cryptographic machine, verifies and decrypts to obtain the encryption and decryption keys of all authorized data items, decrypts the ciphertext of the authorized data items respectively, obtains the plaintext data and carries out subsequent related applications.

2. According to claim 1, the electronic certificate authorization application method based on encrypted two-dimensional code is characterized by: In step S1, the system preparation stage, the preparation operation of the electronic certificate issuance system includes the following steps in detail: S11: The electronic certificate issuance system calls the cryptographic machine to randomly generate public and private keys for electronic certificate issuance and annotation public and private keys; S12: The electronic certificate issuance system calls the cryptographic machine to randomly generate a system root key, uses the endorsement field data item number as a dispersion factor, and disperses the system root key to generate the endorsement field data item encryption and decryption root key; uses the annotation field data item number as a dispersion factor, and disperses the system root key to generate the annotation field data item encryption and decryption root key; S13: The electronic certificate authorization system calls the cryptographic machine to randomly generate the public and private keys of the electronic certificate authorization system and apply for the issuance of the electronic certificate authorization system digital certificate; S14: The electronic certificate calling system calls the cryptographic machine, randomly generates the public and private keys of the electronic certificate calling system, and applies for the issuance of the electronic certificate calling system digital certificate; S15: The electronic certificate issuing system uses the public key of the electronic certificate authorization system to encrypt and protect the encryption and decryption root keys, the issuing public key and the annotation public key of all data items to obtain the key ciphertext; S16: The electronic certificate authorization system imports the key ciphertext into the electronic certificate authorization system cipher machine, uses the electronic certificate authorization system private key to decrypt and obtain the encryption and decryption root key of all data items, issues the public key, and annotates the public key plaintext for safe storage; S17: The electronic certificate authorization system determines the type of user of this application, determines the corresponding authorization data item according to the type of user, and simultaneously generates an annotation field authorization data item table; the annotation field authorization data item table contains the number of each authorized annotation field data item; the electronic certificate authorization system sends the annotation field authorization data item table to the electronic certificate calling system.

3. According to claim 1, the electronic certificate authorization application method based on encrypted two-dimensional code is characterized in that: In step S2, the process of generating the electronic certificate QR code specifically includes the following steps: a1: The electronic certificate holder applies for the electronic certificate from the electronic certificate issuing system through the electronic certificate carrying APP; The data items of the electronic certificate before issuance include the QR code version number, the electronic certificate number, the endorsement field and the annotation field; a2: The electronic certificate issuing system performs binary bit stream encoding on all data items of the electronic certificate before issuance; a3: The electronic certificate issuance system uses the electronic certificate number and the endorsement time as dispersion factors to disperse the endorsement field data item encryption and decryption root key to generate the endorsement field data item encryption and decryption key; uses the electronic certificate number and the endorsement time as dispersion factors to disperse the endorsement field data item encryption and decryption root key to generate the endorsement field data item encryption and decryption key; The electronic certificate issuance system encrypts all data items in the endorsement field using the corresponding endorsement field data item encryption and decryption keys to obtain the endorsement field ciphertext; The electronic certificate issuance system encrypts all data items in the annotation field using the same annotation field data item encryption and decryption key to obtain the annotation field ciphertext; wherein the annotation field ciphertext and the annotation field ciphertext are both binary bit stream strings; a4: The electronic certificate issuance system uses the electronic certificate issuance private key to digitally sign all data items of the ciphertext in the annotation field to obtain the annotation digital signature, and uses the electronic certificate annotation private key to digitally sign all data items of the ciphertext in the annotation field to obtain the annotation digital signature; a5: The electronic certificate issuing system combines the binary bit streams of the two-dimensional code version number, the electronic certificate number, the ciphertext of the endorsement field, the ciphertext of the addition field, the endorsement digital signature and the addition digital signature in order to obtain the issued electronic certificate binary bit stream; a6: The electronic certificate issuing system uses a preset electronic certificate two-dimensional code encoding method to encode the binary bit stream of the electronic certificate after issuance to generate an electronic certificate two-dimensional code.

4. According to claim 1, the electronic certificate authorization application method based on encrypted two-dimensional code is characterized in that: In step S4, the electronic certificate calling system and the electronic certificate authorization system perform two-way identity authentication, which specifically includes the following steps: b1: Before the electronic certificate calling system requests decoding authorization, it first performs two-way identity authentication with the electronic certificate authorization system, and the authentication adopts digital signature and digital certificate mode; the electronic certificate calling system calls the cryptographic machine, encapsulates and generates an identity authentication request Req1, and sends it to the electronic certificate authorization system; b2: After receiving Req1, the electronic certificate authorization system calls the cryptographic machine to verify Req1. After passing, it confirms that the electronic certificate calling system is legal, encapsulates and generates an identity authentication request Req2, and sends it to the electronic certificate calling system; b3: After receiving Req2, the electronic certificate calling system calls the cryptographic machine to verify Req2. After passing, it is confirmed that the electronic certificate authorization system is legal, and the two-way identity authentication is completed.

5. According to claim 1, the electronic certificate authorization application method based on encrypted two-dimensional code is characterized in that: The accurate authorization of the electronic certificate in step S5 specifically includes the following steps: c1: The electronic certificate calling system sends the collected electronic certificate QR code to the electronic certificate authorization system, requests decoding authorization, and simultaneously submits verification information, the verification information including: verification time and usage matters; c2: After receiving the electronic certificate QR code, the electronic certificate authorization system decodes the electronic certificate QR code based on a preset electronic certificate QR code decoding method to obtain a binary bit stream of the issued electronic certificate; c3: The electronic certificate authorization system parses the QR code version number, electronic certificate number, endorsement field ciphertext, annotation field ciphertext, endorsement digital signature and annotation digital signature in sequence, and uses the issuing public key and annotation public key to verify the endorsement digital signature and annotation digital signature respectively. After the verification, the electronic certificate number and the annotation time in the annotation signature are used as dispersion factors to disperse the annotation field data item encryption and decryption root key to generate the annotation field data item encryption and decryption key, and decrypt the annotation field ciphertext to obtain the verification data item, which includes: the purpose and validity period of the electronic certificate QR code; The electronic certificate authorization system checks whether the usage items in the QR code are consistent with the usage items submitted in the verification information, and verifies whether the verification time is within the validity period in the QR code. Authorization is performed after all verifications are passed; c4: The electronic certificate authorization system disperses the root encryption and decryption keys of all authorized annotation field data items according to the annotation field authorization data item table of the electronic certificate calling system, and generates corresponding encryption and decryption keys for each authorized annotation field data item, and the dispersion factor is the electronic certificate number and the annotation time in the annotation signature; The electronic certificate authorization system uses the public key of the electronic certificate calling system to encrypt the encryption and decryption keys of all authorized signed data items respectively, combines the data item encryption and decryption key ciphertext and the corresponding data item number, assembles all the combined data to generate an authorization Token, uses the private key of the electronic certificate authorization system to digitally sign the authorization Token, and returns the signed authorization Token to the electronic certificate calling system; and simultaneously records verification logs such as verification time and usage matters.

6. According to claim 1, the electronic certificate authorization application method based on encrypted two-dimensional code is characterized in that: In step S6, the electronic certificate decoding application specifically includes the following steps: d1: After receiving the signed authorization token, the electronic certificate calling system verifies the digital signature using the electronic certificate authorization system public key, decrypts the key ciphertext in each combination in the authorization token using the electronic certificate calling system private key, and records the authorization data item encryption and decryption key and the corresponding data item number; d2: The electronic certificate calling system decodes the electronic certificate QR code based on a preset electronic certificate QR code decoding method to obtain a binary bit stream of the issued electronic certificate; The electronic certificate authorization system parses the electronic certificate binary bit stream in sequence to obtain the ciphertext binary bit stream of the annotation field, decrypts the ciphertext of the data item with the corresponding number in the annotation field according to the obtained authorization data item encryption and decryption key and the corresponding data item number, and finally obtains the plaintext data of the authorized data item in the annotation field to carry out subsequent related applications.

7. According to claim 1, the electronic certificate authorization application method based on encrypted two-dimensional code is characterized by: The cryptographic machine provides service functions such as digital signature verification and encryption and decryption, and supports at least domestic SM2, SM3 and SM4 algorithms.

8. According to claim 3, the electronic certificate authorization application method based on encrypted two-dimensional code is characterized in that: The electronic certificate issuance system encodes the issued electronic certificate binary bit stream according to a preset electronic certificate two-dimensional code encoding method to generate an electronic certificate two-dimensional code. The electronic certificate two-dimensional code encoding method specifically includes the following steps: The electronic certificate binary bit stream is padded to an integer multiple of 31 bits in length; the padded electronic certificate binary bit stream is divided into blocks of 31 bits in length, each block is converted into a decimal number, each decimal number is converted into 6 base 45 characters, all the characters are concatenated in order to obtain the final electronic certificate character string, and finally an electronic certificate QR code is generated according to a preset character pattern.

9. According to claim 6, an electronic certificate authorization application method based on encrypted two-dimensional code is characterized in that: The electronic certificate two-dimensional code decoding method comprises the following steps: Parse the electronic certificate QR code according to the preset character mode to obtain all characters, divide all character strings into groups of 6 characters, convert the 6 characters in each group into decimal numbers according to the preset encoding standard; convert the decimal number into a 31-bit binary bit stream; splice all 31-bit binary bit streams in sequence to obtain the binary bit stream of the electronic certificate after issuance.

10. The electronic certificate authorization application method based on encrypted two-dimensional code according to claim 3 is characterized by: When the electronic certificate QR code is generated, all the annotated fields use the same data item number to participate in the calculation.

Images