Very simple two-dimensional code driven certificate management and use method and system for replacing UKEY with mobile application, and storage medium

Abstract

The invention relates to the technical field of information security, and discloses a method for driving certificate management and use through a very simple two-dimensional code by replacing a UKEY with a mobile application, and the method comprises the following steps: S1, very simple two-dimensional code generation: a server side generates a two-dimensional code only containing a temporary authorization access address; s2, session record management: the server side establishes and statefully stores a unique corresponding token record; s3, requesting and responding: the mobile application terminal scans and analyzes the two-dimensional code; the server side returns an operation instruction and a minimum parameter set to the mobile application side; and S4, certificate installation and business operation: the mobile application side executes certificate installation or business operation according to the operation instruction. The whole process from certificate installation to business operation can be completed by scanning a code through a mobile phone App by a user, and the operation path is extremely short; complex login and session management of a traditional App are eliminated through stateless design of the mobile application, and the lightweight experience of scanning and using is achieved.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically a method, system, and storage medium for managing and using simplified QR code-driven certificates that replace UKEYs with mobile applications. Background Technology

[0002] With the deepening of digital transformation, digital certificates, as the core carrier of network identity authentication and data security, are becoming increasingly important. Traditional digital certificates are usually stored in physical U-keys (such as USB keys), using their internal security chips to generate and store private keys, ensuring the non-exportability of private keys and providing a high level of security.

[0003] However, this solution based on dedicated hardware has many inherent drawbacks: users need to carry the physical device with them, and it is easily lost or damaged. Furthermore, U-keys rely on specific USB interfaces, which cannot meet the needs of mobile work and anytime, anywhere business operations. The procurement, distribution, recycling, and maintenance of U-keys also require considerable hardware and logistics management costs. For large organizations, the initialization, issuance, and lifecycle management processes for certificates are complex and inefficient.

[0004] To replace USB keys, some mobile application-based software certificate solutions have emerged, but they often present new problems: 1. Tight coupling with business systems: Mobile applications often need to be deeply customized for specific business systems. The activation and usage process of certificates is solidified in the business logic, which makes the mobile application bloated and difficult to extend to other systems.

[0005] 2. Complex state management: Mobile devices need to maintain long-term connections or complex session states with the server. This not only increases the complexity and resource consumption of the client, but also makes the long-term storage of session tokens a potential target for security attacks.

[0006] 3. Key security risks: Many solutions fail to fully utilize the hardware-level security capabilities provided by mobile terminals (such as TEE, SE), resulting in the risk that private keys can be extracted or attacked by software, and the security level cannot be compared with hardware UKEY.

[0007] 4. High integration costs: Business systems require extensive adaptation development to connect with different mobile certificate solutions, lacking a lightweight, standardized, and non-intrusive interaction paradigm. Summary of the Invention

[0008] The purpose of this invention is to provide a method, system, and storage medium for managing and using simplified QR code-driven certificates in place of a UKEY via a mobile application, in order to solve the problems mentioned in the background art.

[0009] To achieve the above objectives, the present invention provides the following technical solution: A simplified QR code-driven certificate management and usage method for replacing U-keys with mobile applications includes the following steps: S1. Minimalist QR Code Generation: The server generates a QR code containing only a temporary authorized access address. The address format is: short domain ,in The string is the encoded result of a 128-192 bit entropy random number; and use coding; S2. Session Record Management: The server establishes and maintains stateful records of sessions. A uniquely corresponding token record, which includes: operation type, target system identifier, certificate indication, data reference, callback interface address, validity period, one-time status, used status, risk control strategy, and audit association; S3. Request and Response: After scanning and parsing the QR code, the mobile application initiates a network request to the temporary authorized access address; the server verifies... After verifying the validity of the operation, return the operation instructions to be executed and the minimum set of parameters associated with the operation to the mobile application. S4. Certificate Installation and Business Operations: The mobile application performs certificate installation or business operations in a secure computing environment based on the operation instructions, without any business session.

[0010] As a further aspect of the present invention, the mobile application adopts a stateless design.

[0011] As a further aspect of the present invention: in steps S2 and S3, the communication between the mobile application client and the server is via... Protocol transmission, and configured with Strategies and modern cryptographic suites; In step S3, the server verifies... Effective strategies include: rate limiting of access requests, source verification, and replay detection.

[0012] As a further aspect of the present invention: in step S4, If the operation instruction is certificate installation, the mobile application calls the terminal's local secure computing environment to perform key generation; based on the key, it generates a certificate signing request and calls the certificate application interface provided by the server to complete the certificate issuance and secure download; If the operation instruction is a business operation, the mobile application dynamically filters the available certificate set from the local certificate store based on the target system identifier returned by the server, displays the available certificate set to the user, and receives the user's selection. After the user completes authorization through multi-factor authentication, the local trusted execution environment or collaborative key service is invoked to perform login, signing, signature verification, encryption, or decryption operations. The operation result is then sent back to the callback interface specified by the server, triggering the server to record the corresponding session as used.

[0013] As a further aspect of the present invention: during the certificate installation process, the key generation operation includes the following two modes: Mode 1: Generate non-derivative asymmetric key pairs in a trusted execution environment; Mode 2: Collaborate with a remote key management service to generate fragmented asymmetric key pairs, where the client and server each hold different private key fragments.

[0014] As a further aspect of the present invention: in Mode 1, the specific steps of the key generation operation are as follows: S401. Generate a complete asymmetric key pair within the secure isolation zone of the trusted execution environment on the terminal. S402. Mark the private key as non-exportable to ensure that it never leaves the secure quarantine area in plaintext. S403. Only the public key and the private key handle used for subsequent cryptographic operations are provided to external parties.

[0015] As a further aspect of the present invention: in mode two, the specific steps of the key generation operation are as follows: S411. The mobile application and server-side key management services collaboratively initialize asymmetric key pairs through a security protocol. S412. Cryptographically divide the complete private key into at least two fragments, wherein the first private key fragment is stored in the secure area of ​​the mobile application, and the second private key fragment is stored in the key management service on the server side. S413. The mobile application and the server use their respective private keys to perform partial calculations, and combine the results through a security protocol.

[0016] A simplified QR code-driven certificate management and usage system for replacing USB keys with mobile applications includes: The QR code generation module is used to generate QR code images that only embed temporary authorized access addresses; The token management module is used to statefully establish, maintain, and verify tokens on the server side. The mapping relationship between the token record and the token record; The QR code parsing module, integrated into the mobile application, is used to parse QR codes and extract temporary authorized access addresses; The key management module is used to generate, store, and retrieve asymmetric keys in mobile applications through a trusted execution environment or collaborative key service. The certificate lifecycle management module is used to handle the submission of certificate signing requests, the issuance of digital certificates, downloading and local installation; The authorization and authentication module is used to verify the user's biometrics or password to complete the operation authorization; The cryptographic operation module is used to perform digital signature, verification, data encryption and decryption operations.

[0017] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements steps for a method of managing and using a simplified QR code-driven certificate in place of a UKEY via a mobile application.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention allows users to complete the entire process from certificate installation to business operations simply by scanning a code with a mobile app, resulting in a very short operation path. The stateless design of the mobile application eliminates the complex login and session management of traditional apps, achieving a lightweight experience of scanning and using immediately.

[0019] Hardware-level security of the root key is achieved by forcing the generation of a non-exportable private key in a trusted execution environment on the terminal, or by using collaborative key technology. At the same time, the one-time, short-term QR code mechanism effectively prevents replay attacks and session hijacking.

[0020] Business systems do not need to worry about the mobile implementation; they only need to generate a QR code in a unified format and provide a callback interface to connect to the system. This makes the mobile application a universal digital identity wallet that can serve multiple business systems at the same time, greatly reducing the complexity and cost of system integration and transformation.

[0021] By defining multiple operation types, it can flexibly support various security scenarios such as login, signature, and encryption; the offline QR code distribution capability further expands the application boundaries. Detailed Implementation

[0022] In this embodiment of the invention, a method for managing and using simplified QR code-driven certificates by replacing a UKEY with a mobile application is characterized by comprising the following steps: S1. Minimalist QR Code Generation: The server generates a QR code containing only a temporary authorized access address. The address format is: short domain ,in The string is the encoded result of a 128-192 bit entropy random number; and use When the entropy value is 128 bits, the encoding length is approximately 22 characters, and the total length of the QR code is approximately 34 characters; when the entropy value is 192 bits, the encoding length is approximately 32 characters, and the total length of the QR code is approximately 34 characters. by As a short-field example; suppose we generate a 128-bit entropy random number sequence: ; Perform the 128-bit random number After encoding, a string of approximately 22 characters is obtained, such as: ; After splicing the short domains, the complete for: This string of approximately 34 characters is the entire content of the QR code. Among them, QR codes can be distributed in offline scenarios; that is, the business system generates the QR code online, but the process of distributing the QR code (e.g., printing it on paper, delivering it offline, or displaying it on a temporarily offline device screen) can occur in offline scenarios without network access. Suppose that for a new employee's onboarding: the IT administrator generates a QR code for the new employee "Zhang San" while online, and prints it in the "Onboarding Guide"; after settling into his workstation, Zhang San uses his mobile phone... Scan the QR code on the paper to begin the certificate installation process; S2. Session Record Management: The server establishes and maintains stateful records of sessions. A unique corresponding token record (or session record), wherein the token record (or session record) includes: operation type (e.g., (Installation Certificate) (Authorization) (Log in), (sign), (Verification of signature) (encryption), (Decryption), Target System Identifier (i.e., indicating which business system it serves), Certificate Indicator (i.e., specifying which certificate to use), Data Reference (i.e., pointing to specific business data), Callback Interface Address (i.e., the address for returning the result after the operation is completed), Validity Period (i.e., time window limit), One-Time Status (i.e., whether it is a one-time use), Used Status (i.e., whether it has been used), Risk Control Strategy (i.e., security control rules), Audit Association (i.e., traceability); Assume the token record is as follows: (Primary key); (Operation type: Signature); (Target system identifier: Human Resources Contract System); (Certificate Instruction: Specify the use of Zhang San's SM2 certificate); (Data reference: Pointer to the contract ID to be signed and its hash value); (Callback API address: The address where the result is submitted after signing); (Valid for 5 minutes); (For single use only); (initial state) Status: Not used; (Risk control strategy: Access is restricted to IP addresses in the Beijing area only); (Audit correlation: used to link the entire operation log); S3, Request and Response: Mobile application (e.g., mobile phone) After scanning and parsing the QR code, a network request is initiated to the temporary authorized access address. The mobile application accesses the address when the network is available; the server verifies the access. After verifying the validity of the operation, the system returns the operation instructions to be executed and the minimum set of parameters associated with the operation to the mobile application; wherein, the minimum set of parameters is defined as follows: The returned format includes at least one of the following: operation type, system identifier, certificate reference, data reference, callback interface address, and short-term ticket; the short-term ticket or one-time token issued by the server through the access address for performing the operation expires after a single operation is completed. Assuming, mobile phone After scanning the QR code, you will be directed to... Initiate a Request; after receiving the request, the server uses The token record is used as the primary key for querying; the following checks are performed: Does the record exist? (To prevent invalid requests); Is it ? (Anti-replay attack); Is the current time... and Within (to prevent expired requests)? Does the request source meet the requirements? (Risk control verification); S4. Certificate Installation and Business Operations: The mobile application performs certificate installation or business operations in a secure computing environment based on the operation instructions, without any business session. If the operation command is certificate installation, the mobile application calls the terminal's local secure computing environment to perform a key generation operation; based on the key, a certificate signing request is generated ( The mobile application then calls the certificate application interface provided by the server to complete the certificate issuance and secure download; the mobile application completes the certificate signing request when the network is available. Submit and download the certificate; after downloading, the certificate chain and revocation status will be automatically verified. Suppose a new employee, Zhang San, joins a technology company and needs to be configured with a personal digital certificate for accessing internal systems and electronic signatures. Instructions: The IT administrator generates a certificate installation QR code for Zhang San on the server side. Simultaneously, a token record is created in the database; and the QR code is printed on Zhang San's "Employment Notice"; after Zhang San scans and parses the QR code, he obtains the certificate installation instructions; Generate key: mobile phone hint Generating your identity key Then call the phone Generate a non-exportable pair within the secure isolation zone. Key; the private key is always locked. In the output, the public key is output; Generate and Submit :cell phone Use the public key and the topic template issued by the server (such as...) , company, (Zhang San) generated and use Submit it to Interface; such as interface; Download and verification: The system received the request and verified it. Then, a digital certificate was issued for Zhang San; mobile phone Receive the certificate chain (such as Zhang San's certificate and the intermediate CA certificate); before installation, the mobile phone... Automatically connect to the OCSP server to verify whether the certificate has been revoked and to verify the validity of the certificate chain signature; Installation complete: After successful verification, the certificate is securely stored on your phone. In, and with Private key binding within; simultaneously, mobile phone A receipt will be sent to the server, which will then mark the token corresponding to the original QR code as... Then Zhang San's digital identity for joining the company has been successfully installed. If the operation command is a business operation, the mobile application dynamically selects the available certificate set from the local certificate store based on the target system identifier returned by the server, displays the available certificate set to the user, and accepts the user's selection; thereby enabling a single mobile application to manage and securely use multiple business systems and multiple certificates in parallel. After completing authorization through multi-factor authentication (such as face authentication, password authentication or fingerprint authentication), users can invoke the local trusted execution environment or collaborative key service to perform login, signing, signature verification, encryption or decryption operations. The operation result is sent back to the callback interface specified on the server side, and the server side is triggered to record the corresponding session as used. Suppose Zhang San needs to log into the company's "financial reimbursement system" and submit an encrypted travel expense report; Triggering the business operation: Zhang San accesses the financial reimbursement system on his computer and clicks "Scan QR code to log in and encrypt report"; the financial system backend requests the server to generate a QR code; the server generates the QR code, such as... Simultaneously, a token record is created in the database; Zhang San uses the previously installed token. Digital Identity Scan the QR code on the computer screen to obtain business operation instructions; Certificate selection: mobile phone receive Then, immediately scan the local certificate store to find all Binding Already This is the certificate identified by the system; Assuming Zhang San's phone There are three certificates stored inside: Certificate A: Binding System (Employee onboarding and financial systems); Certificate B: Binding System (internal ); Certificate C: Binding System ( Access); Filter results: mobile phones according to After dynamic filtering, only certificate A is shown as an available option to Zhang San; User Authorization: Zhang San selects to use certificate A, mobile phone A pop-up message appears: "Login operation is about to be performed for the 'Financial Reimbursement System', please authorize"; Zhang San completes the authorization via fingerprint. Login successful: After authorization, the mobile phone Call Using the private key corresponding to certificate A, sign the challenge data, and then combine the signature result with... Submitted to the financial system together ; Result: After the financial system verifies the signature, Zhang San's computer automatically logs in successfully; subsequently, the system encrypts the travel expense report data using the public key of certificate A and sends it to his mobile phone. ,cell phone Then, the private key is used to decrypt, completing the entire process.

[0023] Preferably, the mobile application adopts a stateless design and does not persist any server-side sessions related to business logic locally; For example, when a mobile application (such as a mobile APP) scans a QR code, it can directly initiate a request without checking whether there is an incomplete session on its local machine; For example, when a mobile app receives a task description returned by the server, it treats it as an independent and complete instruction package, without needing to associate it with any previously received instructions; Once the mobile app completes its operation, it will clear or ignore the task description and will not save any business context for subsequent operations.

[0024] Preferably, in steps S2 and S3, communication between the mobile application client and the server is via... Protocol transmission, and configured with Strategies and modern cryptographic suites; Suppose employee Zhang San is about to scan a QR code to sign an important employment contract; Zhang San uses his mobile phone... After scanning the QR code, you need to access ;but, Protocol transmission: mobile phone With server First establish a Encrypted channel; all data is transmitted within this encrypted channel; even if data packets are intercepted by network eavesdroppers, they will only see encrypted gibberish. Strategy: The server side includes Instruction; therefore, for the next year, Zhang San's browser only needs to visit [website name] again. Any subdomain will be forced to use It can effectively prevent attackers from attempting to compromise users' accounts. Request to downgrade to insecure ask; Modern cryptographic suites: in the establishment During the connection process, both parties agree to use a strong cipher suite, such as ;in, It provides forward confidentiality, meaning that even if the server's private key is leaked in the future, past communication records cannot be decrypted; It provides strong encryption and integrity verification, thereby ensuring that the encrypted link itself is robust and resistant to known cryptographic attacks. In step S3, server-side verification Effective strategies include: rate limiting of access requests, source verification, and replay detection; among which, Rate limiting: The server records the number of times each IP address or device ID accesses the / t / interface within a unit of time (e.g., 1 minute); for example, the server confirms the access frequency of Zhang San's office. This request was made only once in the last minute; grant permission. Source verification: The server checks whether the request's origin conforms to the predefined security policy; for example, if the server confirms that the requesting IP originates from Beijing, it checks the token's... Policy matching, proceed; Replay detection: Ensure that every It can only be used once; if the server checks the database and finds that... of for (Unused), release.

[0025] Preferably, during the certificate installation process, the key generation operation includes the following two modes: Mode 1: In a trusted execution environment ( Generate non-derivative asymmetric key pairs in the following steps: S401, Trusted Execution Environment (TEE) on the terminal locality ( Generate a complete asymmetric key pair within the secure isolation zone; Let's say we're installing an office certificate for a new employee, Zhang San, using his mobile phone. After scanning the QR code for the installation certificate, your mobile phone... Initiate a secure call to the phone's operating system; this call is then routed to the phone's chip. Execution in; in Within the secure isolation zone, a pair is generated. Asymmetric key, i.e., private key and public key ; S402. Mark the private key as non-exportable to ensure it never leaves the secure isolation zone in plaintext; if the key is generated... It will transfer the private key according to the app's instructions. The attribute is marked as "non-exportable"; S403. Only the public key and the handle to the private key used for subsequent cryptographic operations are provided to external parties; such as Only the public key is returned to external users. and private key handle Among them, the public key It's public information, mobile phone Use it to generate a Certificate Signing Request (CSR); private key handle It is an opaque, meaningless reference identifier that does not represent the private key. itself; When Zhang San needs an autograph, the phone... The data to be signed and the private key handle will be sent. Send together And it says, "Please sign with the private key corresponding to this handle"; Find the real private key inside The calculation is completed, and then the signature result is output to the mobile phone. Private key It itself has never moved.

[0026] Mode 2: Coordinate with a remote key management service to generate fragmented asymmetric key pairs, where the client and server each hold different private key fragments; the specific steps are as follows: S411. The mobile application and server-side key management services collaboratively initialize asymmetric key pairs through a security protocol. Suppose Zhang San needs to log into the company's financial reimbursement system; Zhang San uses a "digital identity". Scan the QR code; mobile phone Upon accessing the address, the server returned a command requesting the initialization of the collaboration key; mobile phone With the company's key management service ( Establish a secure encrypted channel and begin executing a secure distributed key generation protocol (e.g., a threshold cryptography-based protocol). S412. Cryptographically divide the complete private key into at least two fragments, wherein the first private key fragment is stored in the secure area of ​​the mobile application, and the second private key fragment is stored in the server-side key management service; for example... First private key fragmentation ( ): By Zhang San's mobile phone In the local security zone (such as This fragment is generated and saved within the phone's security chip. It is marked as non-exportable and securely locked. Second private key fragmentation ( ): By the company Generate and store in its high-security-level hardware security module ( In the middle; this segment is related to Zhang San's employee identity. Strict binding; S413. The mobile application and the server each use their respective private key fragments for partial computation, and combine the computation results through a security protocol, while the complete private key is never reconstructed throughout its entire lifecycle; for example, Mobile application-side calculations: Zhang San's mobile phone Locally, use the first private key for sharding. The challenge code is processed to generate a partial signature. ; Server-side calculations: mobile phone Will Send to ; Fragmentation using the second private key Perform calculations on the same challenge code to generate partial signature results. ; Will Return to phone ; cell phone Through specific cryptographic synthesis algorithms (such as Lagrange interpolation), and Combined, this ultimately generates a standard, complete, and publicly key-verifiable result. 2. Digital Signatures .

[0027] A simplified QR code-driven certificate management and usage system for replacing USB keys with mobile applications includes: The QR code generation module is used to generate QR code images that only embed temporary authorized access addresses; The token management module (or session management module) is used to statefully establish, maintain, and verify tokens on the server side. Mapping relationship with token records (or session records); The QR code parsing module, integrated into the mobile application, is used to parse QR codes and extract temporary authorized access addresses; The key management module is used to generate, store, and retrieve asymmetric keys in mobile applications through a trusted execution environment or collaborative key service. The certificate lifecycle management module is used to handle the submission of certificate signing requests, the issuance of digital certificates, downloading and local installation; The authorization and authentication module is used to verify the user's biometrics or password to complete the operation authorization; The cryptographic operation module is used to perform digital signature, verification, data encryption and decryption operations.

[0028] A computer-readable storage medium having a computer program stored thereon, the steps of which, when executed by a processor, are used for a method of managing and using a simplified QR code-driven certificate in place of a UKEY via a mobile application.

[0029] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for minimal 2D barcode driven certificate management and usage for replacing UKEY with mobile application, characterized in that, The method comprises the following steps: S1, minimal two-dimensional code generation: server-side generation of a two-dimensional code containing only a temporary authorized access address, address format: Short domain Wherein 128-192 bit entropy random number after encoding string; and Adopt Encoding; S2, session record management: the server side establishes and has state to save with The unique corresponding token record, wherein the token record contains: operation type, target system identification, certificate indication, data reference, callback interface address, validity period, one-time state, used state, risk control policy and audit association; S3, Request and Response: After scanning and parsing the two-dimensional code, the mobile application initiates a network request to the temporary authorized access address; the server verifies the validity and returns the current operation instruction and the minimum parameter set associated with the operation to the mobile application. end. S4, certificate installation and business operation: the mobile application end executes certificate installation or business operation in a secure computing environment according to an operation instruction under the premise of no service session state.

2. A method for minimalistic 2D code driven certificate management and usage for replacing UKEY with mobile application as claimed in claim 1, wherein, The mobile application end adopts a stateless design.

3. A method for minimalistic 2D code driven certificate management and usage for replacing UKEY with mobile application as claimed in claim 1, wherein, In the S2 and S3 steps, the communication between the mobile application and the server is via a protocol transport, and configured with policies and modern cryptography suites; In the S3 step, the server-side verifies The policies for validating the effectiveness include: implementing rate limiting on access requests, source verification, and replay detection.

4. A method for minimalistic 2D code driven certificate management and usage for replacing UKEY with mobile application as claimed in claim 1, wherein, In the S4 step, if the operation instruction is certificate installation, the mobile application end calls a secure computing environment locally of the terminal to execute a key generation operation; based on the key generation, a certificate signing request is generated, and a certificate application interface provided by the server end is called to complete certificate issuance and secure download; if the operation instruction is business operation, the mobile application end dynamically screens out a set of available certificates from a local certificate library according to a target system identifier returned by the server end, and shows the set of available certificates to the user and receives the user's selection; after the user completes authorization through multi-factor identity authentication, a local trusted execution environment or a collaborative key service is called to execute login, signature, verification, encryption or decryption operation; and the operation result is returned to a callback interface specified by the server end, and the server end triggers the corresponding session to be recorded as used state.

5. A method for minimalistic 2D code driven certificate management and usage for replacing UKEY with mobile application as claimed in claim 4, wherein, In the certificate installation process, the key generation operation comprises the following two modes: Mode one: generating a non-exportable asymmetric key pair in a trusted execution environment; Mode two: generating a fragmented asymmetric key pair in cooperation with a remote key management service, wherein the client and the server end hold different private key fragments respectively.

6. A method for minimalistic 2D code driven certificate management and usage for replacing UKEY with mobile application as claimed in claim 5, wherein, In the mode one, the specific steps of the key generation operation are as follows: S401, generating a complete asymmetric key pair in a secure isolation area of a trusted execution environment locally of the terminal; S402, marking the private key as a non-exportable attribute to ensure that it never leaves the secure isolation area in plaintext form; S403, providing only the public key and the private key handle for subsequent cryptographic operations to the outside.

7. A method for minimalistic 2D code driven certificate management and usage for replacing UKEY with mobile application as claimed in claim 5, wherein, In the mode two, the specific steps of the key generation operation are as follows: S411, the mobile application end and the server end key management service cooperatively initialize an asymmetric key pair through a secure protocol; S412, the complete private key is cryptographically split into at least two fragments, wherein the first private key fragment is saved in the secure area of the mobile application end, and the second private key fragment is saved in the server end key management service; S413, the mobile application end and the server end respectively use their own private key fragments for partial calculation, and combine the operation results through a secure protocol.

8. A system for implementing the method of claim 1-7 for minimal two-dimensional code driven certificate management and use for replacing UKEY with mobile application, characterized in that, It comprises: a two-dimensional code generation module for generating a two-dimensional code image embedded with only a temporary authorized access address; A token management module is configured to establish, maintain and verify the mapping relationship between the token record and the server side statefully with the token record; a two-dimensional code analysis module integrated in the mobile application for analyzing the two-dimensional code and extracting the temporary authorized access address; a key management module for generating, storing and calling an asymmetric key through a trusted execution environment or a collaborative key service on the mobile application end; a certificate life cycle management module for processing the submission of a certificate signing request, the issuance, download and local installation of a digital certificate; an authorization authentication module for verifying the biological characteristics or password of the user to complete operation authorization; a cryptographic operation module for executing digital signature, verification, data encryption and decryption operations.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The program, when executed by the processor, implements the steps of the method for minimal two-dimensional code driven certificate management and use with mobile application replacing UKEY according to any one of claims 1-7.

Images