Key issuing method, system and device, storage medium and program product

Abstract

The invention discloses a secret key issuing method, system and device, a storage medium and a program product, and relates to the technical field of information security, and the method comprises the steps: transmitting a verification public key certificate and a signature to a server through a WebSocket protocol at a client; receiving and verifying a first signature verification result returned by the server to obtain a second signature verification result; signing the random number in the second signature verification result to obtain a first signature value; and sending the first signature value and the random number to the server. After receiving the first signature value and the random number, the server generates a master key and a verification value, and issues the encrypted master key and verification value to the client; and the client decrypts and stores the master key. According to the scheme, bidirectional authentication is realized through an authentication mechanism of a public key certificate, and the credibility of both parties is ensured. And the random number is subjected to signature verification and signature, so that the replay attack is effectively prevented. In the secret key issuing process, the encryption certificate is used for encrypting the equipment information, the safety of the main secret key is ensured, and good expansibility is achieved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a key distribution method, system, device, storage medium and program product. Background Art

[0002] With the rapid development of banking business, smart POS has gradually become the mainstream offline acquiring business acceptance terminal equipment. During the equipment deployment process, the security and convenience requirements for equipment activation and master key issuance are becoming increasingly higher. There are two main ways to issue keys:

[0003] (1) Wired key distribution based on serial port line: This method requires connecting the POS machine via a serial port line in the bank's internal dedicated safe room and security equipment, and using the matching key distribution software to perform device verification and key distribution. However, this method is cumbersome to operate and requires a physical connection. It cannot achieve security risk control based on the merchant's geographic location, and is not safe and convenient enough.

[0004] (2) Remote issuance based on the RSA international algorithm: This method uses a trusted certificate built into the smart POS device when it leaves the factory. When the device is activated, it remotely connects to the TCP interface provided by the bank on the Internet or dedicated line through the TCP protocol, and uses the RSA international algorithm to perform device verification and RSA key issuance. However, the RSA algorithm used in this method has low security and cannot meet the country's requirements for network and financial security. Summary of the invention

[0005] The main purpose of this application is to provide a key distribution method, system, device, storage medium and program product, aiming to solve the technical problem of how to improve the security and scalability of key distribution.

[0006] To achieve the above purpose, the present application proposes a key distribution method, which is applied to a client and includes:

[0007] Sending the verification public key certificate and the signature to the server through the WebSocket protocol, so that the server performs signature verification based on the verification public key certificate and the signature to obtain a first signature verification result;

[0008] Receive the first signature verification result returned by the server, and use the verification public key certificate to perform signature verification on the first signature verification result to obtain a second signature verification result;

[0009] Sign the random number in the second signature verification result to obtain a second signature value, and send the second signature value to the server, so that the server can use the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value;

[0010] Receive the third signature value returned by the server, and use the verification public key certificate to verify the consistency of the third signature value. If the verification is successful, encrypt the device information using the encryption certificate, and send the encrypted device information to the server, so that the server generates a master key and a check value according to the encrypted device information, and encrypts the master key using the encryption public key;

[0011] Receive the encrypted master key and check value sent by the server, and decrypt and store the encrypted master key based on the check value.

[0012] In one embodiment, the step of receiving the encrypted master key and the check value sent by the server, and decrypting and storing the encrypted master key based on the check value includes:

[0013] Receive the encrypted master key and checksum sent by the server;

[0014] Decrypt the encrypted master key using the decryption private key to obtain the decrypted master key;

[0015] Calculate and compare the checksum of the decrypted master key with the checksum returned by the server to see if they are consistent;

[0016] If they are consistent, the decrypted master key is stored in the device security area.

[0017] In one embodiment, after the step of storing the decrypted master key in the device security zone, the method further includes:

[0018] Generate a key distribution result, and send the key distribution result to the server, so that the server can update data based on the key distribution result.

[0019] In addition, to achieve the above purpose, the present application also proposes a key distribution method, which is applied to the server and includes:

[0020] Receive the verification public key certificate and signature sent by the client, and verify the signature according to the verification public key certificate to obtain a first signature verification result;

[0021] Sending the first signature verification result to the client, so that the client uses the verification public key certificate to verify the signature of the first signature verification result to obtain a second signature verification result;

[0022] Receive the second signature value sent by the client, and use the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value, and return the third signature value to the client so that the client can use the verification public key certificate to verify the consistency of the third signature value. After the verification is passed, use the encryption certificate to encrypt the device information, and send the encrypted device information to the server;

[0023] Receive the encrypted device information sent by the client, and generate a master key and a check value according to the encrypted device information;

[0024] After the master key is encrypted using the encryption public key, the encrypted master key and the check value are sent to the client, so that the client can decrypt and store the encrypted master key based on the check value.

[0025] In one embodiment, after the step of encrypting the master key with the encryption public key and sending the encrypted master key and the check value to the client, the method further includes:

[0026] Receive the key distribution result sent by the client, and update the data based on the key distribution result.

[0027] In one embodiment, the step of generating a master key and a check value according to the encrypted device information includes:

[0028] Decrypt the encrypted device information using the decryption private key to obtain the decrypted device information;

[0029] Verifying the decrypted device information;

[0030] If the decrypted device information passes the verification, a master key and a verification value are generated.

[0031] In addition, to achieve the above purpose, the present application also proposes a key distribution system, the system includes a client and a server; the client includes:

[0032] A first sending module, configured to send a verification public key certificate and a first signature to a server through a WebSocket protocol, so that the server performs signature verification based on the verification public key certificate and the first signature to obtain a first signature verification result;

[0033] A first receiving module is used to receive a first signature verification result returned by the server, and use the verification public key certificate to perform signature verification on the first signature verification result to obtain a second signature verification result;

[0034] A signature module, used to sign the random number in the second signature verification result to obtain a second signature value, and send the second signature value to the server, so that the server can use the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value;

[0035] A verification module, used to receive the third signature value returned by the server, and use the verification public key certificate to verify the consistency of the third signature value. If the verification is successful, the encryption certificate is used to encrypt the device information, and the encrypted device information is sent to the server;

[0036] A storage module, used to receive the encrypted master key and check value sent by the server, and decrypt and store the encrypted master key based on the check value;

[0037] The server includes:

[0038] The second receiving module is used to receive the verification public key certificate and the first signature sent by the client, and verify the signature according to the verification public key certificate to obtain a first signature verification result;

[0039] A second sending module is used to send the first signature verification result to the client, so that the client uses the verification public key certificate to verify the signature of the first signature verification result to obtain a second signature verification result;

[0040] The signature verification module is used to receive the second signature value sent by the client, and use the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value, and return the third signature value to the client;

[0041] A generation module, used to receive the encrypted device information sent by the client, and generate a master key and a check value according to the encrypted device information;

[0042] The sending module is used to encrypt the master key using the encryption public key, and send the encrypted master key and the check value to the client, so that the client can decrypt and store the encrypted master key based on the check value.

[0043] In addition, to achieve the above-mentioned purpose, the present application also proposes a key distribution device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the key distribution method described above.

[0044] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the key distribution method described above are implemented.

[0045] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the key distribution method described above are implemented.

[0046] The embodiment of the present application proposes a key distribution method, system, device, storage medium and program product, specifically, the client sends a verification public key certificate and signature to the server through the WebSocket protocol; receives and verifies the first signature verification result returned by the server to obtain the second signature verification result; signs the random number in the second signature verification result to obtain the first signature value; sends the first signature value and the random number to the server. After the server receives the first signature value and the random number, it generates a master key and a check value, and sends the encrypted master key and check value to the client; the client decrypts and stores the master key. The scheme implements two-way authentication through the authentication mechanism of the public key certificate to ensure the credibility of both parties. Replay attacks are effectively prevented by verifying and signing the random number. In the process of key distribution, the encryption certificate is used to encrypt the device information to ensure the security of the master key, which has good scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0048] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0049] Figure 1 A flowchart of the first embodiment of the method for issuing a key for this application is provided;

[0050] Figure 2 A flowchart of the second embodiment of the method for issuing a key for this application is provided;

[0051] Figure 3 A flowchart of the third embodiment of the method for issuing a key for this application is provided;

[0052] Figure 4 A flowchart of the fourth embodiment of the method for issuing a key for this application is provided;

[0053] Figure 5 This is the overall scheme diagram of the key distribution method for this application;

[0054] Figure 6 This is the two-way authentication flow chart of the key distribution method for this application;

[0055] Figure 7 This is the challenge response flow chart of the key distribution method for this application;

[0056] Figure 8 This is a key issuing flow chart of the key issuing method for this application;

[0057] Fig. 9 This is a schematic diagram of the module structure of the key distribution system of the embodiment of the present application.

[0058] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0059] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0060] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0061] The main solution of the embodiment of the present application is: the client sends a verification public key certificate and a signature to the server through the network socket WebSocket protocol, so that the server performs signature verification based on the verification public key certificate and the signature to obtain a first signature verification result; receives the first signature verification result returned by the server, and uses the verification public key certificate to perform signature verification on the first signature verification result to obtain a second signature verification result; signs the random number in the second signature verification result to obtain a second signature value, and sends the second signature value to the server, so that the server uses the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value; receives the third signature value returned by the server, and uses the verification public key certificate to verify the consistency of the third signature value. If the verification passes, the encryption certificate is used to encrypt the device information, and the encrypted device information is sent to the server, so that the server generates a master key and a check value based on the encrypted device information, and encrypts the master key using the encryption public key; receives the encrypted master key and check value issued by the server, and decrypts and stores the encrypted master key based on the check value. The server receives the verification public key certificate and signature sent by the client, and verifies the signature according to the verification public key certificate to obtain a first verification result; sends the first verification result to the client so that the client uses the verification public key certificate to verify the signature of the first verification result to obtain a second verification result; receives the second signature value sent by the client, and verifies and signs the second signature value using the verification public key certificate and the signature private key to obtain a third signature value, and returns the third signature value to the client so that the client can use the verification public key certificate to verify the consistency of the third signature value. After the verification is passed, the encryption certificate is used to encrypt the device information, and the encrypted device information is sent to the server; receives the encrypted device information sent by the client, and generates a master key and a check value according to the encrypted device information; after encrypting the master key with the encryption public key, the encrypted master key and the check value are sent to the client, so that the client can decrypt and store the encrypted master key based on the check value.

[0062] The existing technology has problems such as the need for physical connection, poor security, and complex communication protocols, which is not conducive to the rapid deployment and security management of POS devices. In addition, the existing remote key distribution solution cannot achieve security risk control based on the merchant's geographical location and cannot meet the country's requirements for financial security. In addition, the existing key distribution solution uses the TCP protocol or RSA algorithm, which makes the communication protocol complex and less secure.

[0063] This application provides a solution that implements data exchange in a single secure connection based on the WebSocket protocol, and uses the SM series of domestic cryptographic algorithms to implement encryption and decryption, signature verification, and ensure the security of the remote issuance of the device master key; it supports the uploading of multiple device information such as GPS, can meet various risk control needs, and has good scalability.

[0064] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, etc. The following takes a personal computer as an example to illustrate this embodiment and the following embodiments.

[0065] Based on this, the embodiment of the present application provides a key distribution method, which is applied to the client. Figure 1 , Figure 1 This is a flow chart of the first embodiment of the key distribution method of this application.

[0066] In this embodiment, the key issuing method includes steps S10 to S50:

[0067] Step S10, sending the verification public key certificate and the signature to the server through the WebSocket protocol, so that the server performs signature verification based on the verification public key certificate and the signature to obtain a first signature verification result;

[0068] It should be noted that, in this embodiment, the smart POS device acts as a client and accesses the server through a front-end application interface.

[0069] In addition, it should be noted that the factory built-in POS signature certificate and POS encryption certificate issued by the POS manufacturer's national secret CA (Certificate Authority). And the client uses the POS signature private key to sign the device number, manufacturer code, POS encryption public key certificate, POS signature verification public key certificate and other data.

[0070] Optionally, first, in order to ensure the security of data during transmission, the client and the server establish a WebSocket (network socket) communication, and can exchange data based on the HTTPS protocol during the handshake phase. After the connection is established, full-duplex communication is performed on a single connection. The client and the server can send data directly to each other, and complete data transmission in a secure and reliable connection process, avoiding multiple connection establishments that affect communication efficiency and security.

[0071] Then, the client sends the signature, manufacturer code, POS encryption public key certificate and POS signature verification public key certificate to the front-end application through the WebSocket protocol, and the front-end application sends it to the server. The server uses the POS signature verification public key certificate to verify the signature. After the verification process is completed, the server will return a response to the client through the WebSocket connection based on the verification result, that is, the first signature verification result, indicating whether the authentication is successful.

[0072] Step S20, receiving the first signature verification result returned by the server, and using the verification public key certificate to perform signature verification on the first signature verification result to obtain a second signature verification result;

[0073] It should be noted that the first signature verification result includes but is not limited to the institution's random number, the institution's encryption public key certificate, the institution's signature verification public key certificate, and the first signature value.

[0074] Optionally, after the server returns the first signature result to the client through the WebSocket protocol, the client uses the pre-built-in root certificate of the national secret CA verification agency to verify the authenticity of the agency verification public key certificate in the first verification result received from the server to ensure the validity of the agency identity. If the signature verification passes, it proves that the first verification result sent by the server has not been tampered with, and generates and saves the second verification result for subsequent processing.

[0075] Step S30, signing the random number in the second signature verification result to obtain a second signature value, and sending the second signature value to the server, so that the server can use the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value;

[0076] It is worth noting that since the random number needs to be regenerated during each interaction, the attacker cannot obtain the private key in the device security module, and thus cannot generate the correct signature value, resulting in signature verification failure. Therefore, executing step S30 can avoid the problem of message replay attacks.

[0077] Optionally, the client uses the POS signature private key to concatenate and sign the institution random number, the POS random number and the POS encryption public key certificate to obtain a second signature value, and sends the second signature value and the POS random number to the server for the server to verify and sign the second signature value and the POS random number based on the POS verification public key certificate to obtain a third signature value.

[0078] Step S40, receiving the third signature value returned by the server, and using the verification public key certificate to verify the consistency of the third signature value. If the verification is successful, the encryption certificate is used to encrypt the device information, and the encrypted device information is sent to the server, so that the server generates a master key and a check value according to the encrypted device information, and encrypts the master key using the encryption public key;

[0079] Optionally, the client receives information returned by the server, including the third signature value generated by the server and other data, such as the institution random number, POS random number, and institution encryption public key certificate. Then, the institution's signature verification public key certificate is used to verify the third signature value. The verification process actually decrypts the third signature value returned by the server and compares it with the data to be signed recalculated by the client, that is, the hash value of the institution's random number, POS random number, and institution encryption public key certificate.

[0080] Specifically, the hash values ​​of the institution random number, POS random number, and institution encryption public key certificate are recalculated, and the third signature value is decrypted using the institution signature private key, and the decrypted result is compared with the hash value calculated by the client to see if they are the same. If the two hash values ​​match, it indicates that the third signature is valid, which further indicates that the data has not been tampered with during transmission.

[0081] When the consistency verification of the third signature value is passed, the client uses the institutional encryption public key certificate to encrypt business elements such as device information. The device information includes the merchant number, SMS activation code and device information ciphertext, and the device information ciphertext includes GPS information.

[0082] The encrypted device information is then sent to the server so that the server can decrypt and verify the encrypted device information, and generate the corresponding master key and verification value based on the verified device information.

[0083] Step S50, receiving the encrypted master key and the check value returned by the server, and decrypting and storing the encrypted master key based on the check value.

[0084] Optionally, first, after the client receives the encrypted and signed master key returned by the server, it uses the institution's verification public key to verify the encrypted and signed master key, and uses the POS decryption private key to decrypt the verified master key to obtain the decrypted master key.

[0085] Then, calculate and compare whether the decrypted master key check value is consistent with the master key check value returned by the server. This can be done by respectively calculating the hash value of the master key check value and the hash value of the master key check value returned by the server, and comparing the two hash values ​​to see if they are consistent. If they are consistent, it indicates that the verification is successful.

[0086] If the verification of the check value passes, the decrypted master key will be stored in the device security area. After the POS device has the master key, the POS device can be activated, and it can use the master key to perform subsequent operations such as sign-in and card swiping.

[0087] Through the above-mentioned embodiment method, specifically, the client sends a verification public key certificate and a signature to the server through the network socket WebSocket protocol, so that the server can perform signature verification based on the verification public key certificate and the signature to obtain a first signature verification result; receive the first signature verification result returned by the server, and use the verification public key certificate to perform signature verification on the first signature verification result to obtain a second signature verification result; sign the random number in the second signature verification result to obtain a second signature value, and send the second signature value to the server, so that the server can use the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value; receive the third signature value returned by the server, and use the verification public key certificate to verify the consistency of the third signature value. If the verification is successful, use the encryption certificate to encrypt the device information, and send the encrypted device information to the server, so that the server generates a master key and a check value based on the encrypted device information, and uses the encryption public key to encrypt the master key, and sends the encrypted master key and the check value to the client; receive the encrypted master key and the check value sent by the server, and decrypt and store the encrypted master key based on the check value. This solution implements data exchange in a single secure connection based on the WebSocket protocol, and uses the SM series of domestic cryptographic algorithms to implement encryption and decryption, signature verification and other operations, to achieve the security of the remote distribution process of the device master key; and supports the upload of multiple device information such as GPS, which can meet various risk control needs and has good scalability.

[0088] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can refer to the above introduction, and will not be repeated later. Figure 2 After step S50, the key distribution method further includes step S51:

[0089] Step S51, generating a key distribution result, and sending the key distribution result to the server, so that the server can update data based on the key distribution result.

[0090] Optionally, after completing the key distribution and processing, the client needs to confirm whether the distributed key has been correctly applied or stored. If there are any errors or abnormalities in the key distribution process, these distribution results are also recorded, and the key distribution results are encapsulated into a message or request, and the encapsulated key distribution results are sent back to the server through the WebSocket protocol.

[0091] After receiving the result, the server can update the information about the key status in the database according to the result of the key distribution, or enable new encrypted communication.

[0092] Through the above-mentioned embodiment method, the client sends the key distribution result to the server in real time, which is beneficial for the server to maintain real-time understanding of the client key status and make decisions based on actual conditions, thereby ensuring the security, consistency and availability of the system.

[0093] Based on this, the embodiment of the present application provides a key distribution method, which is applied to the server. Figure 3 , Figure 3 This is a flowchart of the third embodiment of the key distribution method of this application.

[0094] In this embodiment, the key issuing method includes steps S60 to S100:

[0095] Step S60, receiving the verification public key certificate and signature sent by the client, and verifying the signature according to the verification public key certificate to obtain a first signature verification result;

[0096] Optionally, after receiving the signature, manufacturer code, POS encryption public key certificate and POS signature verification public key certificate sent by the client through the WebSocket protocol, the server uses the POS signature verification public key certificate to verify the signature. If the signature verification passes, it means that the data sent by the client has not been tampered with during the transmission process, and a first signature verification result is generated. At the same time, the server uses the built-in POS manufacturer CA certificate to verify the issuer of the POS signature verification public key certificate to ensure that the POS signature verification public key certificate is issued by the manufacturer CA.

[0097] Step S70: sending the first signature verification result to the client, so that the client uses the verification public key certificate to verify the signature of the first signature verification result to obtain a second signature verification result;

[0098] It should be noted that the first signature verification result includes but is not limited to the institution's random number, the institution's encryption public key certificate, the institution's signature verification public key certificate, and the first signature value.

[0099] Optionally, when the server verification is passed, the first verification result is returned to the front-end application, and the POS encryption / verification public key is saved in the memory according to the first verification result, a 17-byte institutional random number is generated, and the institutional encryption / verification public key certificate is obtained. The front-end application returns the institutional encryption public key certificate, institutional verification public key certificate, 17-byte institutional random number and the first signature value to the client through the WebSocket protocol, so that the client can use the built-in institutional CA to verify the institutional public key certificate based on the above returned data to ensure the validity of the institutional identity.

[0100] Step S80, receiving the second signature value sent by the client, and using the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value, and returning the third signature value to the client, so that the client can use the verification public key certificate to verify the consistency of the third signature value. After the verification is passed, the encryption certificate is used to encrypt the device information, and the encrypted device information is sent to the server;

[0101] Optionally, after receiving the second signature value and POS random number sent by the client, the server uses the built-in POS verification public key certificate to verify the second signature value and the POS random number, wherein the second signature value is signed by the client using the POS signature private key to concatenate the institution random number, the POS random number and the POS encryption public key certificate.

[0102] After the signature verification is passed, the institution's random number, POS random number, and institution's encryption public key are signed using the institution's signature private key to obtain a third signature value, and the third signature value is returned to the client for the client to verify the consistency of the third signature value and encrypt the device information based on the verification result.

[0103] Step S90, receiving the encrypted device information sent by the client, and generating a master key and a check value according to the encrypted device information;

[0104] It should be noted that the master key refers to a key cryptographic element used for encryption and decryption operations in subsequent communications. The checksum is used to ensure the integrity of subsequent communication data.

[0105] Optionally, after receiving the encrypted device information returned by the client, the server uses the institution's decryption private key to decrypt the encrypted device information to obtain decrypted device information, wherein the encrypted device information is obtained by the client encrypting the device information using the institution's encryption public key certificate.

[0106] Then, the decrypted device information and other business elements are verified, where the verification process includes checking whether the device information conforms to the expected format, logic or business rules. For example, verify whether the device information is valid, exists, or matches the previously stored or expected information. When all business elements are verified, the master key and master key verification value are generated.

[0107] Step S100, encrypt the master key using an encryption public key, and send the encrypted master key and a check value to a client, so that the client can decrypt and store the encrypted master key based on the check value.

[0108] Optionally, after obtaining the master key and the verification value, the master key is encrypted using the POS encryption public key, and then the encrypted master key ciphertext and the master key verification value are returned to the front-end application. The front-end application sends the corresponding signature content to the server based on the encrypted master key ciphertext and the master key verification value. The signature content includes the organization random number, the POS random number, the master key, the master key verification value, and the organization random number, the POS random number, the master key, the master key verification value, etc. are signed to obtain a fourth signature value.

[0109] The server then sends the signed master key, master key check value, and fourth signature value to the client for the client to verify the signature of the master key, master key check value, and fourth signature value, and then use the private key to decrypt and compare the master key check value to finally realize the storage and storage of the master key.

[0110] Through the above-mentioned embodiment method, specifically, the server receives the verification public key certificate and signature sent by the client, and verifies the signature according to the verification public key certificate to obtain the first verification result; sends the first verification result to the client, so that the client verifies the signature of the first verification result using the verification public key certificate to obtain the second verification result; receives the second signature value sent by the client, and verifies and signs the second signature value using the verification public key certificate and the signature private key to obtain the third signature value, and returns the third signature value to the client; receives the encrypted device information sent by the client, and generates the master key and the check value according to the encrypted device information; encrypts the master key using the encryption public key, and sends the encrypted master key and the check value to the client, so that the client can decrypt and store the encrypted master key based on the check value. This solution uses the SM series process cryptographic algorithm to sign and encrypt the transmission data, ensuring the security and controllability of the device and the server in the process of two-way authentication, key transmission, etc. The whole process can be completed through the Internet, without the need for special equipment and network environment, improving the security and convenience of smart POS key issuance.

[0111] Based on the third embodiment of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the third embodiment can be referred to the above description, and will not be described in detail later. Figure 4 After step S100, the key issuing method further includes step S101:

[0112] Step S101, receiving a key distribution result sent by a client, and updating data based on the key distribution result.

[0113] Optionally, after receiving the key delivery result sent by the client via the WebSocket protocol, the server performs corresponding processing according to the key delivery result. If the key delivery is successful, the server updates the information about the key status in the database, such as updating the key management database, marking the key status, or adjusting the key lifecycle management policy.

[0114] Through the above-mentioned embodiment method, the server can maintain real-time knowledge of the client key status based on the key distribution result mirror data update and other related processing, thereby ensuring the security, consistency and availability of the system.

[0115] For example, in order to help understand the implementation process of the key distribution method obtained by combining the above-mentioned embodiment 1 and embodiment 3, please refer to Figure 5 , Figure 5 An overall scheme diagram of a key distribution method is provided, specifically:

[0116] The scheme of this embodiment is divided into four steps: two-way authentication, challenge response, key issuance, and result notification. The smart POS device must complete the interaction with the front-end application in this order. The front-end application controls the execution order of the four steps to prevent attackers from bypassing security authentication.

[0117] In this embodiment, the smart POS device interacts with the front-end application through WebSocket communication, and the client accesses the server through the front-end application interface. First, the connection is established through domain name TLS authentication, and then the validity of the smart POS device is authenticated through two steps of two-way authentication and challenge response. After the authentication is successful, the key is issued and the result is notified. Finally, the client disconnects the connection.

[0118] Please refer to Figure 6 , Figure 6 This is a two-way authentication flow chart of the key distribution method of this embodiment, specifically:

[0119] It should be noted that two-way authentication means that the client uses the root certificate to authenticate the validity of the server certificate, and the server uses the manufacturer's CA to authenticate the validity of the client certificate to ensure the credibility of both communicating parties.

[0120] Optionally, the smart POS device acts as a client, and is built-in with a POS signature certificate and a POS encryption certificate issued by the POS manufacturer's national secret CA. The client uses the POS signature private key to sign the device number, manufacturer code, POS encryption public key certificate, POS signature verification public key certificate and other data to obtain the signature value, and sends the signature value, manufacturer code, POS encryption public key certificate, and POS signature verification public key certificate to the server.

[0121] The server uses the POS signature verification public key certificate to verify the signature to ensure that the message has not been tampered with. At the same time, it uses the server's built-in POS manufacturer CA verification certificate chain to ensure that the POS signature verification public key certificate is issued by the manufacturer CA.

[0122] When the server passes the verification, it returns the first verification result, including the institution's random number, institution's encryption public key certificate, institution's signature verification public key certificate, and signature value, to the client. The client uses the built-in institution's national secret CA to verify the verification result to ensure the validity of the institution's identity.

[0123] Please refer to Figure 7 , Figure 7 This is a challenge response flow chart of the key distribution method of this embodiment, specifically:

[0124] It should be noted that since a new random number is generated for each interaction, the attacker cannot obtain the private key in the device security module, and therefore cannot generate a valid signature value, which will lead to failure in signature verification. The implementation of the challenge response mechanism can prevent the message replay problem that occurs during the attack.

[0125] Optionally, the client uses the POS signature private key to sign the institution random number, POS random number, and POS encryption public key certificate to obtain a signature value C, and sends the signature value C and the POS random number to the server; the server uses the built-in POS verification public key certificate to verify the corresponding signature value and POS random number, and after verification, uses the institution signature private key to sign the second verification result such as the institution random number, POS random number, and institution encryption public key certificate to obtain a signature value D, and returns the signature value D to the client; the client uses the institution verification public key certificate to verify the consistency of the signature value D.

[0126] Please refer to Figure 8 , Figure 8 This is a key issuing flow chart of the key issuing method of this embodiment, specifically:

[0127] It should be noted that the key distribution process uses the national encryption certificate to encrypt transmission data such as device information and keys.

[0128] Optionally, the client uses the institution's encryption public key certificate to encrypt business elements such as device information and send it to the server; the server uses the institution's decryption private key to decrypt the decrypted device information and then verifies the decrypted device information and other business elements. The device information includes device GPS information. During the key distribution process, when the smart POS device is activated, the device GPS information can be recorded.

[0129] When the verification is passed, the master key and check value are generated, and the master key is encrypted with the POS encryption public key. At the same time, the institution random number, POS random number, master key ciphertext, check value, etc. are signed to obtain the signature value E. The master key ciphertext, check value, signature value E, etc. are sent to the client; after the client verifies the signature with the institution's verification public key, it uses the POS decryption private key to decrypt the master key, calculates and compares the check value with that returned by the server to see if they are consistent, and finally stores the master key in the device security area.

[0130] Finally, the client sends the key distribution result to the server, and the server performs data update and other related processing based on the key distribution result.

[0131] This embodiment uses the process design of two-way authentication, challenge response, key issuance, and result update to implement data exchange in a single secure connection based on the WebSocket protocol, and uses the SM series of domestic cryptographic algorithms to implement encryption and decryption, and signature verification, to ensure the security of the remote issuance process of the device master key; it supports the upload of multiple device information such as GPS, can meet various risk control needs, and has good scalability.

[0132] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the key issuance method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0133] This application also provides a key distribution system, please refer to Fig. 9 , the key distribution system includes:

[0134] The sending module 10 is used to send the verification public key certificate and the first signature to the server through the WebSocket protocol, so that the server performs signature verification based on the verification public key certificate and the first signature to obtain a first signature verification result;

[0135] The receiving module 20 is used to receive the first signature verification result returned by the server, and use the verification public key certificate to perform signature verification on the first signature verification result to obtain a second signature verification result;

[0136] The signature module 30 signs the random number in the second signature verification result to obtain a second signature value, and sends the second signature value to the server, so that the server verifies and signs the second signature value using the verification public key certificate and the signature private key to obtain a third signature value;

[0137] The verification module 40 is used to receive the third signature value returned by the server, and use the verification public key certificate to verify the consistency of the third signature value. If the verification is successful, the encryption certificate is used to encrypt the device information, and the encrypted device information is sent to the server, so that the server generates a master key and a check value according to the encrypted device information, and encrypts the master key using the encryption public key;

[0138] The storage module 50 is used to receive the encrypted master key and the check value sent by the server, and decrypt and store the encrypted master key based on the check value;

[0139] The server includes:

[0140] The receiving module 20 is used to receive the verification public key certificate and the first signature sent by the client, and verify the signature according to the verification public key certificate to obtain a first signature verification result;

[0141] The sending module 10 is used to send the first signature verification result to the client, so that the client uses the verification public key certificate to verify the signature of the first signature verification result to obtain a second signature verification result;

[0142] The signature verification module 60 is used to receive the second signature value sent by the client, and use the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value, and return the third signature value to the client so that the client can use the verification public key certificate to verify the consistency of the third signature value. After the verification is passed, the encryption certificate is used to encrypt the device information, and the encrypted device information is sent to the server;

[0143] A generating module 70, configured to receive the encrypted device information sent by the client, and generate a master key and a check value according to the encrypted device information;

[0144] The sending module 80 is used to encrypt the master key using the encryption public key, and send the encrypted master key and the check value to the client, so that the client can decrypt and store the encrypted master key based on the check value.

[0145] The key issuing system provided by the present application adopts the key issuing method in the above embodiment, which can solve the technical problem of how to improve the security and scalability of key issuing. Compared with the prior art, the beneficial effects of the key issuing system provided by the present application are the same as the beneficial effects of the key issuing method provided by the above embodiment, and other technical features of the key issuing system are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0146] The present application provides a key issuing device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the key issuing method in the above-mentioned embodiment one.

[0147] The key issuing device in the embodiments of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Android Devices), PMPs (Portable Media Players), etc., as well as fixed terminals such as digital TVs, desktop computers, etc.

[0148] The key distribution device may include a processing system (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage system into a random access memory (RAM: Random Access Memory). In the RAM, various programs and data required for the operation of the key distribution device are also stored. The processing system, ROM, and RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus. Typically, the following systems can be connected to the I / O interface: an input system including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output system including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage system including, for example, a magnetic tape, a hard disk, etc.; and a communication system. The communication system may allow the key distribution device to communicate wirelessly or wired with other devices to exchange data.

[0149] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication system, or installed from a storage system, or installed from a ROM. When the computer program is executed by a processing system, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0150] The key issuing device provided by the present application adopts the key issuing method in the above embodiment, which can solve the technical problem of how to improve the security and scalability of key issuing. Compared with the prior art, the beneficial effects of the key issuing device provided by the present application are the same as the beneficial effects of the key issuing method provided by the above embodiment, and other technical features in the key issuing device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0151] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0152] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0153] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the key distribution method in the above-mentioned embodiment.

[0154] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0155] The computer-readable storage medium may be included in the key issuing device; or may exist independently without being assembled into the key issuing device.

[0156] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the key issuing device, the key issuing device: sends a verification public key certificate and a signature to a server through the WebSocket protocol on the client side, so that the server side performs signature verification based on the verification public key certificate and the signature to obtain a first signature verification result; receives the first signature verification result returned by the server side, and uses the verification public key certificate to perform signature verification on the first signature verification result to obtain a second signature verification result; signs a random number in the second signature verification result to obtain a second signature value, and converts the second signature value into a signature. Send it to the server so that the server can use the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value; receive the third signature value returned by the server, and use the verification public key certificate to verify the consistency of the third signature value. If the verification passes, use the encryption certificate to encrypt the device information, and send the encrypted device information to the server, so that the server can generate a master key and a check value based on the encrypted device information, and use the encryption public key to encrypt the master key; receive the encrypted master key and check value returned by the server, and decrypt and store the encrypted master key based on the check value. The server receives the verification public key certificate and signature sent by the client, and verifies the signature according to the verification public key certificate to obtain a first verification result; sends the first verification result to the client so that the client uses the verification public key certificate to verify the signature of the first verification result to obtain a second verification result; receives the second signature value sent by the client, and verifies and signs the second signature value using the verification public key certificate and the signature private key to obtain a third signature value, and returns the third signature value to the client so that the client can use the verification public key certificate to verify the consistency of the third signature value. After the verification is passed, the encryption certificate is used to encrypt the device information, and the encrypted device information is sent to the server; receives the encrypted device information sent by the client, and generates a master key and a check value according to the encrypted device information; after encrypting the master key using the encryption public key, the encrypted master key and the check value are sent back to the client, so that the client can decrypt and store the encrypted master key based on the check value.

[0157] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0158] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0159] The modules involved in the embodiments of the present application may be implemented by software or hardware, wherein the name of the module does not limit the unit itself in some cases.

[0160] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned key distribution method, and can solve the technical problem of how to improve the security and scalability of key distribution. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the key distribution method provided in the above-mentioned embodiment, and will not be repeated here.

[0161] The present application also provides a computer program product, including a computer program, which implements the steps of the key distribution method as described above when executed by a processor.

[0162] The computer program product provided by this application can solve the technical problem of how to improve the security and scalability of key distribution. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the key distribution method provided by the above embodiment, which will not be repeated here.

[0163] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A key distribution method, characterized in that: The method is applied to a client, and the method comprises: Sending the verification public key certificate and the signature to the server through the WebSocket protocol, so that the server performs signature verification based on the verification public key certificate and the signature to obtain a first signature verification result; Receive the first signature verification result returned by the server, and use the verification public key certificate to perform signature verification on the first signature verification result to obtain a second signature verification result; Sign the random number in the second signature verification result to obtain a second signature value, and send the second signature value to the server, so that the server can use the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value; Receive the third signature value returned by the server, and use the verification public key certificate to verify the consistency of the third signature value. If the verification is successful, use the encryption certificate to encrypt the device information, and send the encrypted device information to the server, so that the server generates a master key and a check value according to the encrypted device information, and encrypts the master key using the encryption public key; Receive the encrypted master key and check value sent by the server, and decrypt and store the encrypted master key based on the check value.

2. The method according to claim 1, characterized in that The step of receiving the encrypted master key and check value sent by the server, and decrypting and storing the encrypted master key based on the check value includes: Receive the encrypted master key and checksum sent by the server; Decrypt the encrypted master key using the decryption private key to obtain the decrypted master key; Calculate and compare the checksum of the decrypted master key with the checksum returned by the server to see if they are consistent; If they are consistent, the decrypted master key is stored in the device security area.

3. The method according to claim 2, characterized in that After the step of storing the decrypted master key in the device security zone, the method further includes: Generate a key distribution result, and send the key distribution result to the server, so that the server can update data based on the key distribution result.

4. A key distribution method, characterized in that: The method is applied to the server, and the method includes: Receive the verification public key certificate and signature sent by the client, and verify the signature according to the verification public key certificate to obtain a first signature verification result; Sending the first signature verification result to the client, so that the client uses the verification public key certificate to verify the signature of the first signature verification result to obtain a second signature verification result; Receive the second signature value sent by the client, and use the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value, and return the third signature value to the client so that the client can use the verification public key certificate to verify the consistency of the third signature value. After the verification is passed, use the encryption certificate to encrypt the device information, and send the encrypted device information to the server; Receive the encrypted device information sent by the client, and generate a master key and a check value according to the encrypted device information; After the master key is encrypted using the encryption public key, the encrypted master key and the check value are sent to the client, so that the client can decrypt and store the encrypted master key based on the check value.

5. The method according to claim 4, characterized in that After the step of encrypting the master key with the encryption public key and sending the encrypted master key and the check value to the client, the method further includes: Receive the key distribution result sent by the client, and update the data based on the key distribution result.

6. The method according to claim 4, characterized in that The step of generating a master key and a check value according to the encrypted device information comprises: Decrypt the encrypted device information using the decryption private key to obtain the decrypted device information; Verifying the decrypted device information; If the decrypted device information passes the verification, a master key and a verification value are generated.

7. A key distribution system, characterized in that: The system includes a client and a server; the client includes: A sending module, used for sending a verification public key certificate and a first signature to a server through a WebSocket protocol, so that the server performs signature verification based on the verification public key certificate and the first signature to obtain a first signature verification result; A receiving module is used to receive the first signature verification result returned by the server, and use the verification public key certificate to perform signature verification on the first signature verification result to obtain a second signature verification result; The signature module signs the random number in the second signature verification result to obtain a second signature value, and sends the second signature value to the server, so that the server verifies and signs the second signature value using the verification public key certificate and the signature private key to obtain a third signature value; A verification module, configured to receive the third signature value returned by the server, and verify the consistency of the third signature value using the verification public key certificate; if the verification is successful, encrypt the device information using the encryption certificate, and send the encrypted device information to the server, so that the server generates a master key and a check value according to the encrypted device information, and encrypts the master key using the encryption public key; A storage module, used to receive the encrypted master key and check value returned by the server, and decrypt and store the encrypted master key based on the check value; The server includes: A receiving module, configured to receive a verification public key certificate and a first signature sent by a client, and verify the signature according to the verification public key certificate to obtain a first signature verification result; a sending module, configured to send the first signature verification result to the client, so that the client uses the verification public key certificate to verify the signature of the first signature verification result to obtain a second signature verification result; a signature verification module, configured to receive the second signature value sent by the client, and use the verification public key certificate and the signature private key to verify and sign the second signature value to obtain a third signature value, and return the third signature value to the client so that the client can use the verification public key certificate to verify the consistency of the third signature value. After the verification is passed, the encryption certificate is used to encrypt the device information, and the encrypted device information is sent to the server; A generation module, used to receive the encrypted device information sent by the client, and generate a master key and a check value according to the encrypted device information; The sending module is used to encrypt the master key using the encryption public key, and send the encrypted master key and the check value to the client, so that the client can decrypt and store the encrypted master key based on the check value.

8. A key issuing device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the key issuing method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the key distribution method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the key issuing method according to any one of claims 1 to 6 are implemented.

Images