Key generation method of key card

Abstract

A key generation method of a key card relates to the technical field of key cards, and by introducing key matrix management and a public key and private key synthesis operation method, acceleration is carried out through a bottom hardware module of a key management card, so that the operation efficiency of a key and the safety and flexibility in a key use process are improved. And the storage and use security of the secret key is ensured through a security management mechanism.

Description

Technical Field

[0001] The present invention relates to the technical field of key cards, and in particular to a key generation method for a key card. Background Art

[0002] ECC cryptography is generally considered to be the successor algorithm of the RSA cryptographic system. Compared with RSA, ECC can achieve the same security by using a shorter key length. For example, the 164-bit key of the ECC algorithm is equivalent to the confidentiality strength provided by the 1024-bit key of the RSA algorithm. In addition, due to the shorter key, it has more advantages in terms of computing speed and bandwidth usage. However, if the key generated by the key card is not properly stored during actual use, it is easy to cause key leakage, which poses a security risk. Summary of the invention

[0003] In order to overcome the deficiencies of the above technologies, the present invention provides a key generation method which improves the security of the key during use.

[0004] The technical solution adopted by the present invention to overcome the technical problems is: A key generation method for a key card, comprising: S1. External PC terminal sends private instructions, key card calls The elliptic curve encryption algorithm generates an asymmetric key pair; S2. The private key in each key pair is stored in the private key storage matrix; S3. The public keys in the key pairs are stored in the public key storage matrix; S4. The external PC terminal sends a private command, and the key card generates an asymmetric key pair after receiving the private command. , is the public key, is the private key; S5. Using public key And the public key storage matrix to get the public key , the public key Outgoing key fob.

[0005] In step S1, the parameters of the elliptic curve encryption algorithm are set, and the key card calls the elliptic curve encryption algorithm through the set parameters of the elliptic curve encryption algorithm.

[0006] Furthermore, after the key card is powered on, the key card firmware program automatically and randomly selects a set of parameters of the elliptic curve encryption algorithm, saves the ID of the parameters of the elliptic curve encryption algorithm to a specified location, and the user sends a SATA private command through the terminal software to obtain the ID of the parameters of the elliptic curve encryption algorithm.

[0007] Furthermore, the terminal user performs authorization authentication at the administrator level with the key card. After the authentication is passed, a SATA private command is sent to reset the parameters of the elliptic curve encryption algorithm of the key card. If the parameter specified in the SATA private command is empty, the key card randomly selects a set of elliptic curve encryption algorithm parameters and updates the ID of the parameters of the elliptic curve encryption algorithm stored in the specified location, and returns the parameters of the elliptic curve encryption algorithm to the terminal user. If the parameter specified in the SATA private command is the ID of the parameter of the elliptic curve encryption algorithm, the key card updates the ID of the parameters of the elliptic curve encryption algorithm stored in the specified location.

[0008] Furthermore, in step S2, a OK The private key storage matrix of the column The private keys in the key pairs are stored in the private key storage matrix in the order of rows first and columns. Line The private key of the column is , , .

[0009] Further, in step S3, a OK The public key storage matrix of the column The public keys in the key pairs are stored in the public key storage matrix in the order of rows first and columns. Line The public key of the column is , , .

[0010] Preferably, the values ​​of n and m are both 32.

[0011] Further, step S5 includes the following steps: S51. The key card obtains the identity information in the external PC terminal input parameter and uses the identity information as the message digest of the HMAC-SHA512 algorithm; S52. The key card obtains the terminal public key transmitted by the external PC terminal ; S53. The terminal public key With public key Perform point addition to obtain the public key ; S54. Call HMAC-SHA512 algorithm with public key Generate a 64-byte HMAC value for key; S55. Use the 64-byte HMAC value in order to find the corresponding public key in the public key storage matrix using every two bytes as the index value. Bytes and The public key corresponding to bytes is , perform point addition operation on the 32 public keys obtained to obtain the public key IPKm; S56. Combine the public key IPKm with the public key Perform point addition to obtain the public key .

[0012] Further, step S6 includes the following steps: S61. The key card obtains the identity information in the input parameter of the external PC terminal and uses the identity information as the message digest of the HMAC-SHA512 algorithm; S62. The key card obtains the terminal public key transmitted by the external PC terminal ; S63. The terminal public key With public key Perform point addition to obtain the public key ; S64. Call the HMAC-SHA512 algorithm with the public key Generate a 64-byte HMAC value for key; S65. Use the 64-byte HMAC value in order, using every two bytes as index values ​​to search for the corresponding private key in the private key storage matrix. Bytes and The private key corresponding to bytes is , perform point addition operation on the 32 private keys obtained to obtain the private key iskm; S66. Combine the private key iskm with the private key Perform point addition to obtain the private key .

[0013] Further, in step S66, the key card and the external PC terminal are connected to the private key through the session key pair. Encrypt and send the encrypted private key Outgoing key fob.

[0014] The beneficial effects of the present invention are: BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 A flowchart for generating a public key of the present invention; Figure 2 Flow chart of private key generation of the present invention. DETAILED DESCRIPTION

[0015] The following is combined with Figure 1 , Attachment Figure 2The present invention is further described.

[0016] A key generation method for a key card, comprising: S1. External PC terminal sends private instructions, key card calls The elliptic curve encryption algorithm generates an asymmetric key pair.

[0017] S2. The private key in each key pair is stored in the private key storage matrix.

[0018] S3. The public keys in the key pairs are stored in the public key storage matrix.

[0019] S4. The external PC terminal sends a private command, and the key card generates an asymmetric key pair after receiving the private command. , is the public key, For the private key.

[0020] S5. Using public key And the public key storage matrix to get the public key , the public key Outgoing key fob.

[0021] By utilizing the elliptic curve encryption algorithm parameter settings, key matrix generation and management, and key synthesis operation methods, the security of keys during use is greatly improved, enriching the security application scenarios of password card products.

[0022] In one embodiment of the present invention, in step S1, the parameters of the elliptic curve encryption algorithm are set, and the key card calls the elliptic curve encryption algorithm through the set parameters of the elliptic curve encryption algorithm.

[0023] In one embodiment of the present invention, there are two ways to set the parameters of the elliptic curve encryption algorithm: The first method is to automatically set the parameters of the elliptic curve encryption algorithm. Specifically, after the key card is powered on, the key card firmware program automatically and randomly selects a set of parameters of the elliptic curve encryption algorithm, saves the ID of the parameters of the elliptic curve encryption algorithm to a specified location, and the user sends a SATA private command through the terminal software to obtain the ID of the parameters of the elliptic curve encryption algorithm. This process requires permission authentication. In this way, the terminal user can obtain the current elliptic curve encryption algorithm parameters of the key card, and can synchronously set the elliptic curve encryption algorithm and its parameters corresponding to the key card.

[0024] The second method is that the terminal user actively configures the parameters of the elliptic curve encryption algorithm. The terminal user and the key card perform authorization authentication at the administrator level. After the authentication is passed, the SATA private command is sent to reset the parameters of the elliptic curve encryption algorithm of the key card. If the specified parameter in the SATA private command is empty, the key card randomly selects a group of elliptic curve encryption algorithm parameters and updates the ID of the parameters of the elliptic curve encryption algorithm stored in the specified position, and returns the parameters of the elliptic curve encryption algorithm to the terminal user. If the specified parameter in the SATA private command is the ID of the parameter of the elliptic curve encryption algorithm, the key card updates the ID of the parameters of the elliptic curve encryption algorithm stored in the specified position.

[0025] In one embodiment of the present invention, step S2 establishes a OK The private key storage matrix of the column The private keys in the key pairs are stored in the private key storage matrix in the order of rows first and columns. Line The private key of the column is , , .

[0026] In one embodiment of the present invention, step S3 establishes a OK The public key storage matrix of the column The public keys in the key pairs are stored in the public key storage matrix in the order of rows first and columns. Line The public key of the column is , , .

[0027] In this embodiment, the values ​​of n and m are both 32. The location of the private key storage matrix and the public key storage matrix is ​​a private space inside the key card, which can be protected by encrypted storage to prevent brute force cracking or illegal reading. The private key storage matrix and the public key storage matrix can respond to private commands sent by an external PC terminal to perform update or destruction processing.

[0028] Step S5 includes the following steps: S51. The key card obtains the identity information (ACCOUNT) in the input parameter of the external PC terminal and uses the identity information as the message digest of the HMAC-SHA512 algorithm; S52. The key card obtains the terminal public key transmitted by the external PC terminal ; S53. The terminal public key With public key Perform point addition to obtain the public key ; S54. Call HMAC-SHA512 algorithm with public key Generate a 64-byte HMAC value for key; S55. Use the 64-byte HMAC value in order to find the corresponding public key in the public key storage matrix using every two bytes as the index value. Bytes and The public key corresponding to bytes is , perform point addition operation on the 32 public keys obtained to obtain the public key IPKm; S56. Combine the public key IPKm with the public key Perform point addition to obtain the public key .

[0029] Step S6 includes the following steps: S61. The key card obtains the identity information (ACCOUNT) in the input parameter of the external PC terminal and uses the identity information as the message digest of the HMAC-SHA512 algorithm; S62. The key card obtains the terminal public key transmitted by the external PC terminal ; S63. The terminal public key With public key Perform point addition to obtain the public key ; S64. Call the HMAC-SHA512 algorithm with the public key Generate a 64-byte HMAC value for key; S65. Use the 64-byte HMAC value in order, using every two bytes as index values ​​to search for the corresponding private key in the private key storage matrix. Bytes and The private key corresponding to bytes is , perform point addition operation on the 32 private keys obtained to obtain the private key iskm; S66. Combine the private key iskm with the private key Perform point addition to obtain the private key .

[0030] In step S66, the key card and the external PC terminal are connected through the session key pair private key Encrypt and send the encrypted private key Outgoing key fob.

[0031] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A key generation method for a key card, characterized in that: include: S1. External PC terminal sends private instructions, key card calls The elliptic curve encryption algorithm generates an asymmetric key pair; S2. The private key in each key pair is stored in the private key storage matrix; S3. The public keys in the key pairs are stored in the public key storage matrix; S4. The external PC terminal sends a private command, and the key card generates an asymmetric key pair after receiving the private command. , is the public key, is the private key; S5. Using public key And the public key storage matrix to get the public key , the public key Outgoing key fob.

2. The key generation method of a key card according to claim 1, characterized in that: In step S1, the parameters of the elliptic curve encryption algorithm are set, and the key card calls the elliptic curve encryption algorithm through the set parameters of the elliptic curve encryption algorithm.

3. The key generation method of a key card according to claim 2, characterized in that: After the key card is powered on, the key card firmware program automatically and randomly selects a set of parameters of the elliptic curve encryption algorithm, and saves the ID of the parameters of the elliptic curve encryption algorithm to a specified location. The user sends a SATA private command through the terminal software to obtain the ID of the parameters of the elliptic curve encryption algorithm.

4. The key generation method of a key card according to claim 2, characterized in that: The terminal user performs an authorization authentication at the administrator level with the key card. After the authentication is passed, a SATA private command is sent to reset the parameters of the elliptic curve encryption algorithm of the key card. If the parameter specified in the SATA private command is empty, the key card randomly selects a set of elliptic curve encryption algorithm parameters and updates the ID of the parameters of the elliptic curve encryption algorithm stored in the specified position, and returns the parameters of the elliptic curve encryption algorithm to the terminal user. If the parameter specified in the SATA private command is the ID of the parameter of the elliptic curve encryption algorithm, the key card updates the ID of the parameters of the elliptic curve encryption algorithm stored in the specified position.

5. The key generation method of a key card according to claim 1, characterized in that: In step S2, a OK The private key storage matrix of the column The private keys in the key pairs are stored in the private key storage matrix in the order of rows first and columns later. Line The private key of the column is , , .

6. The key generation method of a key card according to claim 5, characterized in that: In step S3, a OK The public key storage matrix of the column The public keys in the key pairs are stored in the public key storage matrix in the order of rows first and columns. Line The public key of the column is , , .

7. The key generation method of a key card according to claim 6, characterized in that: The values ​​of n and m are both 32.

8. The key generation method of a key card according to claim 7, characterized in that: Step S5 includes the following steps: S51. The key card obtains the identity information in the external PC terminal input parameter and uses the identity information as the message digest of the HMAC-SHA512 algorithm; S52. The key card obtains the terminal public key transmitted by the external PC terminal ; S53. The terminal public key With public key Perform point addition to obtain the public key ; S54. Call HMAC-SHA512 algorithm with public key Generate a 64-byte HMAC value for key; S55. Use the 64-byte HMAC value in order to find the corresponding public key in the public key storage matrix using every two bytes as the index value. Bytes and The public key corresponding to bytes is , perform point addition operation on the 32 public keys obtained to obtain the public key IPKm; S56. Combine the public key IPKm with the public key Perform point addition to obtain the public key .

9. The key generation method of a key card according to claim 7, characterized in that: Step S6 includes the following steps: S61. The key card obtains the identity information in the external PC terminal input parameter and uses the identity information as the message digest of the HMAC-SHA512 algorithm; S62. The key card obtains the terminal public key transmitted by the external PC terminal ; S63. The terminal public key With public key Perform point addition to obtain the public key ; S64. Call the HMAC-SHA512 algorithm with the public key Generate a 64-byte HMAC value for key; S65. Use the 64-byte HMAC value in order, using every two bytes as index values ​​to search for the corresponding private key in the private key storage matrix. Bytes and The private key corresponding to bytes is , perform point addition operation on the 32 private keys obtained to obtain the private key iskm; S66. Combine the private key iskm with the private key Perform point addition to obtain the private key .

10. The key generation method of a key card according to claim 9, characterized in that: In step S66, the key card and the external PC terminal are connected through the session key pair private key Encrypt and send the encrypted private key Outgoing key fob.

Images