Local key pre-installation method, PC terminal and terminal equipment

Abstract

The invention discloses a local key pre-installation method, a PC terminal and a terminal device, which are used for safely pre-installing an exclusive target key of the terminal device. The method comprises the following steps: receiving a key pre-installation request message sent by terminal equipment, wherein the request message comprises a random number, a serial number, an inherent public key and a hash check value of the terminal equipment; legality verification is carried out on the hash check value, if verification is passed, an encryption machine is called to generate a corresponding temporary public and private key pair, and a temporary public key in the temporary public and private key pair is extracted; generating a temporary protection key with a preset byte length according to the inherent public key and the temporary public and private key pair of the terminal equipment; generating a target key of the terminal equipment according to the serial number of the terminal equipment; performing encryption processing on the target key through the temporary protection key to generate a key format block; and sending a key pre-installation response message to the terminal equipment, wherein the response message comprises the random number, the temporary public key and the key format block.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a method for pre-installing local keys, a PC, and a terminal device. Background Technology

[0002] In the digital age, terminal devices have been widely used in key industries, becoming the core carriers for data collection, transmission, processing, and interaction. These terminal devices involve the storage and transmission of large amounts of sensitive information during operation. As a core security element ensuring data encryption, identity authentication, and device authorization, the security, accuracy, and reliability of the key during its pre-installation directly determine the overall security protection capability of the terminal device. It is an indispensable critical security step before the terminal device leaves the factory and is deployed, playing a vital role in preventing security risks such as data leakage, unauthorized device tampering, and identity forgery. In existing technologies, key pre-installation schemes for terminal devices mainly employ an online pre-installation mode. This involves the terminal device establishing a connection with a PC-based host computer via a network. The PC first generates a key using a local algorithm and then transmits the key to the terminal device via the network in plaintext or with simple encryption. The terminal device receives the key and stores it in its local storage area. While some online pre-installation schemes encrypt the transmitted key, the key used for encryption is usually the terminal device's default key or generated using a simple device identifier, lacking a dedicated encryption protection mechanism for each individual terminal device.

[0003] However, in online pre-installation mode, if the key is transmitted in plaintext, it is highly susceptible to network eavesdropping and interception during transmission, leading to key leakage. Even with simple encryption, if a generic default key or an encryption key generated based on a non-unique device identifier is cracked, all terminal devices using that key will face the risk of leakage, and precise security protection for individual terminal devices cannot be achieved. Furthermore, the lack of an effective data verification mechanism between the PC and the terminal device means that the transmitted key may be corrupted due to network packet loss, interference, or other factors, preventing the terminal device from correctly parsing and storing the key. Summary of the Invention

[0004] To address the aforementioned technical issues, this application provides a local key pre-installation method, a PC client, and a terminal device.

[0005] The technical solution provided in this application is described below: The first aspect of this application discloses a method for pre-installing a local key, applied to a PC, wherein the PC is equipped with host computer tools, and the method includes: The terminal device receives a key pre-installation request message, which includes the terminal device's random number, serial number, proprietary public key, and hash check value. The hash verification value is validated for legality. If the validation passes, the encryption machine is invoked to generate a corresponding temporary public-private key pair, and the temporary public key in the temporary public-private key pair is extracted. A temporary protection key of a preset byte length is generated based on the inherent public key of the terminal device and the temporary public-private key pair. Generate the target key for the terminal device based on the serial number of the terminal device; The target key is encrypted using the temporary protection key to generate a key format block; Send a key pre-installation response message to the terminal device. The response message includes the random number, the temporary public key, and the key format block.

[0006] Optionally, the validity verification of the hash check value includes: Extract the random number, the sequence number, and the inherent public key from the request message, and calculate the verification reference value using the same hash algorithm as the terminal device; The verification reference value is compared with the hash verification value. If they match, the verification is deemed successful.

[0007] Optionally, generating a target key specific to the terminal device based on the unique identifier serial number of the terminal device includes: Call the mapping table pre-stored inside the encryption machine; Query the key generation parameters corresponding to the sequence number in the mapping table; Based on the key generation parameters, a symmetric encryption algorithm is used to generate the target key for the terminal device.

[0008] Optionally, the method further includes: After sending a key pre-installation response message to the terminal device, the encryption machine is triggered to delete the temporary public-private key pair and the temporary protection key.

[0009] A second aspect of this application provides another method for pre-installing a local key, applied to a terminal device, the method comprising: A hash algorithm is executed on the random number, serial number, and inherent public key of the terminal device to generate a hash verification value, and a key pre-installation request message containing the random number, the serial number, the inherent public key, and the hash verification value is sent to the PC. The system receives a key pre-installation response message from the PC, the response message containing the random number, a temporary public key, and a key format block. The key format block is generated by the PC after encrypting the target key with a temporary protection key, and the target key is generated by the PC based on the sequence number. Determine whether the random number in the response message is consistent with the random number of the terminal device. If they are consistent, then based on the temporary public key and the inherent public-private key pair, generate a temporary protection key of a preset byte length through a key exchange algorithm. The inherent public-private key pair is a key pair generated and stored by the terminal device through an asymmetric key generation algorithm. The temporary protection key is used to decrypt the key format block, extract the target key, and store it in a secure storage area. Send a key pre-installation success signal to the PC.

[0010] Optionally, the step of generating a temporary protection key of a preset byte length based on the temporary public key and the inherent public-private key pair through a key exchange algorithm includes: Extract the terminal device's proprietary private key from the proprietary public-private key pair; Using the temporary public key, a temporary protection key consistent with that of the PC and the encryption machine is calculated using the ECC algorithm. The calculation process is completed within the security chip of the terminal device.

[0011] Optionally, after determining whether the random number in the response message matches the random number in the terminal device, the method further includes: If there is a discrepancy, the decryption operation of the key format block is stopped, and a key pre-installation failure signal is sent to the PC.

[0012] Optionally, after sending a key pre-installation success signal to the PC, the method further includes: Delete the temporary cache of the temporary protection key and the inherent public-private key pair stored locally on the terminal device.

[0013] A third aspect of this application provides a PC client, including: The receiving unit is used to receive a key pre-installation request message sent by the terminal device, wherein the request message contains the terminal device's random number, serial number, inherent public key, and hash check value; The verification unit is used to verify the legality of the hash verification value. If the verification is successful, the encryption machine is called to generate the corresponding temporary public-private key pair, and the temporary public key in the temporary public-private key pair is extracted. The generation unit is configured to generate a temporary protection key of a preset byte length based on the inherent public key of the terminal device and the temporary public-private key pair of the encryption machine; generate a target key specific to the terminal device based on the unique identifier serial number of the terminal device; and encrypt the target key using the temporary protection key to generate a key format block. The sending unit is configured to send a key pre-installation response message to the terminal device, the response message including a random number generated by the terminal device, the temporary public key, and the key format block.

[0014] A fourth aspect of this application provides a terminal device, comprising: The first sending unit is configured to perform a hash algorithm on the random number, serial number, and inherent public key of the terminal device to generate a hash verification value, and send a key pre-installation request message containing the random number, the serial number, the inherent public key, and the hash verification value to the PC. The receiving unit is configured to receive a key pre-installation response message fed back by the PC, the response message containing the random number, the temporary public key, and the key format block, the key format block being generated by the PC after encrypting the target key with a temporary protection key, and the target key being generated by the PC based on the sequence number; The judgment unit is used to determine whether the random number in the response message is consistent with the random number of the terminal device. If they are consistent, a temporary protection key of a preset byte length is generated based on the temporary public key and the inherent public-private key pair through a key exchange algorithm. The inherent public-private key pair is a key pair generated and stored by the terminal device through an asymmetric key generation algorithm. The extraction unit is used to perform a decryption operation on the key format block using the temporary protection key, extract the target key, and store it in a secure storage area; The second sending unit is used to send a key pre-installation success signal to the PC.

[0015] As can be seen from the above technical solutions, the embodiments of this application have the following advantages: For applications on PCs, this application first receives a request message from a terminal device containing a random number, a unique identifier serial number, a proprietary public key, and a hash checksum. By verifying the validity of the hash checksum, the identity of the terminal device can be accurately identified, preventing unauthorized device access and solving the problem of missing authentication under the general default key. Next, an encryption machine is invoked to generate a temporary public-private key pair. This pair is then combined with the terminal's proprietary public key to calculate a temporary protection key. This temporary protection key is generated based on the terminal's unique identifier and bound to the temporary public-private key, achieving dedicated encryption for each terminal and completely avoiding the risk of mass key leakage after the general key is cracked. Subsequently, the target key is encrypted using the temporary protection key to generate a key format block, and a response message containing a random number, a temporary public key, and the key block is sent. This ensures that key transmission is performed in a dedicated encrypted form throughout the entire process, eliminating the risk of plaintext transmission being eavesdropped on and intercepted. For applications on terminal devices, this application first performs a hash algorithm on its own random number, unique identifier serial number, and inherent public key to generate a verification value and sends a request message to the PC, providing a basis for the PC's legitimacy verification and building a foundation for two-way identity verification. After receiving the response message, it first checks whether the random number is consistent with its own generated value, quickly identifying whether the response is for this terminal and avoiding missending or forged responses. Then, it calculates a temporary protection key based on the temporary public key and inherent public-private key pair, forming a dedicated key synchronization with the PC to ensure that only this terminal device can decrypt the key block. Finally, it decrypts and extracts the target key and stores it in a secure area, while sending a success confirmation signal. This ensures the accuracy of key storage through dedicated decryption and allows the PC to monitor the pre-installation result in real time through the confirmation signal, solving the problems of undetectable key transmission damage and storage errors, and achieving accurate and secure key pre-installation. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A schematic flowchart of an embodiment of a local key pre-installation method provided in this application; Figure 2 A schematic diagram illustrating an embodiment of validating a hash check value provided in this application; Figure 3 A schematic flowchart of an embodiment for generating a target key for a terminal device provided in this application; Figure 4 A schematic diagram illustrating an embodiment of receiving a target key by a terminal device provided in this application; Figure 5 A schematic diagram of an embodiment of generating a temporary protection key of a preset byte length provided in this application; Figure 6 A structural diagram of an embodiment of a PC provided in this application; Figure 7 This is a structural diagram of another embodiment of a terminal device provided in this application. Detailed Implementation

[0018] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0019] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0020] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0021] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0022] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0023] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not an embodiment," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0024] Based on this, this application discloses a local key pre-installation method, a PC, and a terminal device for securely pre-installing a target key specific to the terminal device.

[0025] The technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0026] The method of this application is applied to a PC or terminal device. The following description takes the PC as the execution subject as an example, where a host computer tool is deployed on the PC.

[0027] Please see Figure 1 This application first provides an embodiment of a local key pre-installation method, which includes the following steps: 101. Receive a key pre-installation request message sent by the terminal device. The request message contains the terminal device's random number, serial number, proprietary public key, and hash check value. The most important element is the random number contained in the key pre-installation request message sent by the receiving terminal device. In encrypted communication, the random number, combined with other key elements, can generate a unique encryption key, effectively preventing attackers from cracking the key by analyzing fixed patterns.

[0028] The serial number is a unique identifier for a terminal device, possessing both uniqueness and specificity. Through the serial number, the PC can accurately identify the terminal device that requested the key pre-installed, thereby enabling targeted key management and authorization operations for that terminal device. The inherent public key is a pre-configured public key on the terminal device, used for asymmetric encryption. In asymmetric encryption, the public key is public, and any device can use it to encrypt data, but only a device with the corresponding private key can decrypt it. The terminal device's inherent public key lays the foundation for secure communication between the PC and the terminal device. The PC can use this public key to encrypt and transmit sensitive information, ensuring the confidentiality of information during transmission. A hash checksum is the result of hashing the content of a request message, used to verify whether the message has been tampered with during transmission. Hash algorithms are one-way and unique; that is, hashing the same message content will yield a fixed and unique hash checksum.

[0029] 102. Verify the validity of the hash verification value. If the verification passes, call the encryption machine to generate the corresponding temporary public-private key pair and extract the temporary public key from the temporary public-private key pair. Upon receiving a request message containing a hash check value, the validity of the hash check value is verified to determine whether the request message has been maliciously tampered with or accidentally damaged during transmission. The one-wayness and uniqueness of hash algorithms are the core criteria for legitimacy verification. One-wayness means that the original message content cannot be derived from the hash value, effectively preventing attackers from hiding message modifications by tampering with the hash value. Uniqueness ensures that even minor changes to the original message will result in a completely different hash value.

[0030] Once the hash verification value passes the validity check, the encryption machine is invoked to generate the corresponding temporary public-private key pair. As a dedicated hardware device for cryptographic operations, the encryption machine possesses high security and reliability, capable of generating high-strength key pairs, providing a solid foundation for subsequent encrypted communication. A temporary public key is used to encrypt data in secure communication, ensuring the confidentiality of data during transmission. A temporary private key is used to decrypt data and for digital signatures. When data encrypted by the client using the temporary public key is received, it is decrypted using the temporary private key to retrieve the original data. 103. Generate a temporary protection key of a preset byte length based on the terminal device's inherent public key and temporary public-private key pair; The purpose of this step is to generate a temporary protection key that can be shared by both the PC and the terminal device without directly transmitting the key. This key will be used to encrypt the terminal's exclusive target key, preventing the target key from being intercepted or tampered with during transmission. It is a key support for ensuring the security of pre-installed keys.

[0031] Using the terminal device's inherent public key received in step 101 and the temporary public-private key pair generated by the encryption machine in step 102 as a basis, an asymmetric key exchange algorithm is used. Specifically, during the generation process, the host computer tool on the PC extracts the temporary private key (used only within the encryption machine) from the temporary public-private key pair in step 102, and simultaneously retrieves the terminal's inherent public key received in step 101. The encryption machine's built-in key exchange module, using the temporary private key and the terminal's inherent public key as input, performs calculations using a preset asymmetric key exchange algorithm to generate initial key data. Finally, the initial key data is truncated or expanded to ensure that the temporary protection key meets the preset byte length requirement.

[0032] The temporary protection key is generated by the terminal's inherent public key and the encryption machine's temporary public-private key pair, ensuring key uniqueness and avoiding the risk of reuse. The temporary protection key cannot be derived from the terminal's inherent public key and the encryption machine's temporary public key alone, and the calculation process is completed inside the encryption machine, ensuring the security of key materials.

[0033] 104. Generate the target key for the terminal device based on its serial number; The generation of the target key is performed by an encryption machine connected to the host computer tool on the PC. The encryption machine pre-stores specific key generation parameters bound to the terminal device's serial number, or uses the terminal device's serial number as input to the key derivation function, combined with the root key stored within the encryption machine, to calculate the key using one or more encryption algorithms. This method ensures that each terminal device obtains a unique key strictly bound to its identity, which cannot be reused by other devices.

[0034] 105. Encrypt the target key using a temporary protection key to generate a key format block; After generating the target key specific to the terminal device in step 104, the target key needs to be encrypted using the temporary protection key negotiated in step 103. This encryption process uses a symmetric encryption algorithm to encrypt the target key. The encrypted data is not the original ciphertext, but is organized into a structured key format block. In addition to containing the encrypted target key ciphertext, this key format block also includes a key version number, a key type identifier, data length, and an integrity checksum.

[0035] 106. Send a key pre-installation response message to the terminal device. The response message contains a random number, a temporary public key, and a key format block.

[0036] This step is responsible for sending a key pre-installation response message carrying critical information back to the terminal device that requested the key pre-installation. Specifically, the random number sent by the terminal device in the request message is returned unchanged to verify that the response is for this request, thus preventing replay attacks. Then, the terminal device combines the temporary public key generated in step 102 with its own inherent private key to calculate the same temporary protection key as the PC using a key exchange algorithm. Finally, the encrypted target key is encapsulated in the key format block generated in step 105. By sending this response message, the PC has completed all preparations for securely transmitting the target key to the terminal device.

[0037] Optionally, after sending a key pre-installation response message to the terminal device, the encryption machine is triggered to delete the temporary public-private key pair and the temporary protection key.

[0038] After successfully sending a response message containing the encrypted target key on the PC, the temporary public-private key pair and temporary protection key generated for this operation can be deleted. Specifically, the host computer tool sends a command to the encryption machine, triggering a secure cleanup process within the encryption machine to completely remove the temporary public-private key pair and temporary protection key from the encryption machine's memory and working area. This method ensures that each key pre-installation operation is independent and clean, reducing the possibility of key material exposure.

[0039] In this embodiment, a request message containing a random number, a unique identifier serial number, a proprietary public key, and a hash checksum is first received from the terminal device. The validity of the hash checksum is verified to accurately identify the terminal device, preventing unauthorized access and resolving the issue of missing authentication under the general default key. Next, a temporary public-private key pair is generated by calling an encryption machine. This pair is then combined with the terminal's proprietary public key to calculate a temporary protection key. This temporary protection key is generated based on the terminal's unique identifier and bound to the temporary public-private key, achieving dedicated encryption for each terminal and completely avoiding the risk of mass key leakage after the general key is cracked. Subsequently, the target key is encrypted using the temporary protection key to generate a key format block, and a response message containing a random number, a temporary public key, and the key block is sent. This ensures that key transmission is performed in a dedicated encrypted form throughout the entire process, eliminating the risk of plaintext transmission being eavesdropped on and intercepted. Based on step S102 above, please refer to Figure 2 , Figure 2 One embodiment of validating a hash check value includes the following steps: 201. Extract the random number, sequence number, and inherent public key from the request message, and calculate the verification reference value using the same hash algorithm as the terminal device; In this step, a baseline value is generated to compare the validity of the hash checksum, serving as a verification reference. Specifically, the PC-based host computer parses the received request message and extracts the random number generated by the terminal device, the serial number used to uniquely identify the terminal, and the terminal device's proprietary public key. After preparing these three sets of data, the host computer calls a hash algorithm identical to the one preset by the terminal device to perform an encrypted hash operation on the combination of these three sets of data. The result of the operation is a fixed-length verification reference value.

[0040] 202. Compare the verification reference value with the hash verification value. If they match, the verification is considered successful.

[0041] The host computer tool on the PC will compare the verification reference value calculated in step 201 with the hash verification value pre-calculated and attached by the terminal device and directly extracted from the request message. If the two are completely identical at the byte level, it indicates that the random number, sequence number, and inherent public key in the request message have not been tampered with, replaced, or transmitted incorrectly during the transmission from the terminal to the PC, and the sender does indeed possess the original data that generated the hash value. Therefore, the key pre-installation request can be determined to be legitimate and valid. After successful verification, the PC will continue to execute the subsequent key generation and response process.

[0042] In this embodiment, by extracting the random number, sequence number, and inherent public key from the request message, calculating the verification reference value using the same hash algorithm as the terminal device, and comparing it with the hash verification value in the request, it can effectively ensure that the data has not been tampered with during transmission and verify the authenticity of the terminal's identity. At the same time, the key-enhanced hash algorithm improves security, prevents forgery and man-in-the-middle attacks, and is computationally efficient and cross-platform compatible, providing reliable data integrity protection and identity authentication mechanisms for key operations such as key pre-installation.

[0043] Based on step S104 above, please refer to Figure 3 , Figure 3 One embodiment for generating a target key for a terminal device includes the following steps: 301. Call the mapping table pre-stored inside the encryption machine; After determining that a target key needs to be generated for the terminal device, the PC-based host computer tool sends a command to the encryption machine, triggering the encryption machine to call a pre-stored mapping table in its internal secure storage area. This mapping table is a structured data table pre-configured by the encryption machine. Its core function is to establish the correspondence between the terminal device's unique identifier (i.e., serial number) and the basis for generating the exclusive key (i.e., key generation parameters). The table is only accessible within the encryption machine and is not exposed to the outside world.

[0044] 302. Query the key generation parameters corresponding to the sequence number in the mapping table; After the encryption machine accesses the mapping table, the PC-based host computer tool uses the terminal device serial number received in step 101 as a query keyword and passes it to the encryption machine's query module. The encryption machine then performs a precise search in the mapping table based on this serial number, locating the key generation parameter entry that uniquely corresponds to that serial number. Since each serial number in the mapping table corresponds to only one set of key generation parameters, the uniqueness of the query results is ensured, preventing mismatches between the generated target key and the terminal due to incorrect parameter matching.

[0045] 303. Based on the key generation parameters, use a symmetric encryption algorithm to generate the target key for the terminal device.

[0046] After obtaining the key generation parameters corresponding to the terminal serial number through the encryption machine, it calls the symmetric encryption algorithm module built into the encryption machine, using the key generation parameters as core input data for computation. During the computation, the encryption machine leverages the efficiency and security of symmetric encryption algorithms, combined with the uniqueness of the parameters, to generate a target key strongly bound to the terminal device. This target key corresponds only to the current terminal, and the generation process is entirely completed within the encryption machine, without disclosing intermediate computation data, ensuring the uniqueness, security, and availability of the target key, and meeting the key requirements for subsequent secure communication and data encryption scenarios of the terminal.

[0047] In this embodiment, by calling the mapping table pre-stored inside the encryption machine, the core data carrier for generating the target key is confined to the security scope of the encryption machine, preventing the mapping table from being exposed to the external environment, reducing the risk of data tampering or theft, and eliminating the need to obtain additional data from the outside, reducing transmission links, improving the efficiency of subsequent target key generation, and avoiding external transmission security risks. Querying the mapping table using the terminal serial number as a keyword can accurately locate the key generation parameters uniquely corresponding to the terminal, ensuring that each terminal only matches exclusive parameters, guaranteeing the unique binding of the target key and the terminal device from the source, and avoiding key confusion or misuse between different terminals. Furthermore, the query process is completed internally within the encryption machine, without exposing parameter content externally, thus enhancing the security of key generation parameters. The target key is generated by combining a symmetric encryption algorithm with dedicated key generation parameters. This leverages the efficient computational characteristics of the symmetric encryption algorithm to quickly generate the target key required by the terminal, adapting to the large-scale terminal key pre-installation requirements. At the same time, the dedicated parameters achieve a strong binding between the target key and the terminal, reducing the risk of batch key cracking or reuse. Meanwhile, the generation process is executed entirely within the encryption machine in a closed manner, avoiding intermediate data leakage. This ensures the high security and reliability of the target key from the generation stage, providing a solid guarantee for subsequent secure communication and data encryption scenarios of the terminal.

[0048] The following describes the process of the terminal device receiving and installing the target key, using the terminal device as the execution subject as an example. Please refer to [link / reference needed]. Figure 4 , Figure 4 One embodiment of receiving a target key for a terminal device includes the following steps: 401. Perform a hash algorithm on the random number, serial number, and inherent public key of the terminal device to generate a hash verification value, and send a key pre-installation request message containing the random number, serial number, inherent public key, and hash verification value to the PC. This step corresponds to step 101 in the first embodiment. When the terminal device needs to pre-install a key, it first generates a 16-byte random number using its built-in secure random number generation module. This random number will be used to verify the relevance of the response message and prevent replay attacks. The terminal device retrieves its unique serial number and its proprietary public key, generated before leaving the factory using the RSA asymmetric key generation algorithm and stored in a secure storage area. It then concatenates the data according to a fixed order of the random number, serial number, and proprietary public key. A hash algorithm pre-agreed with the PC is then used to process the concatenated data, generating a hash verification value. This hash verification value is used by the PC to verify the integrity and authenticity of the request message. Finally, the terminal device sends a key pre-installation request message containing the aforementioned random number, serial number, proprietary public key, and hash verification value to the host computer tool on the PC. Throughout this process, all data generation and concatenation are completed within the trusted execution environment of the terminal device, ensuring that the data is not tampered with or leaked.

[0049] 402. Receive the key pre-installed response message from the PC. The response message contains a random number, a temporary public key, and a key format block. The key format block is generated by the PC after encrypting the target key with a temporary protection key. The target key is generated by the PC based on the serial number. In step 401 above, the terminal device has sent a key pre-installation request message. After sending the request message, the terminal device continuously listens for feedback signals on the communication link. When the PC completes receiving the message, verifying the hash value, generating a temporary public-private key pair, generating a temporary protection key, generating the target key, and generating a key format block, the terminal device receives the key pre-installation response message from the PC through the communication link. Subsequently, the terminal device extracts three types of key information from the response message through its built-in message parsing module: the first type is a random number generated by the terminal device itself, which is returned unchanged by the PC and used to verify the validity of the response; the second type is a temporary public key generated by the PC's encryption machine (using the same RSA algorithm as the terminal device's inherent public key), which is used by the terminal device to generate a temporary protection key; the third type is a key format block generated by the PC, which is structured data obtained by encrypting the terminal device's exclusive target key with the temporary protection key generated by the PC, and temporarily storing it in the terminal device's own secure cache.

[0050] Specifically, the terminal device first decrypts the temporary public key using its inherent private key to obtain the initial shared key data. Then, it performs SHA-256 hash processing on the initial shared key data and extracts the first 256 bits to generate a temporary protection key of a preset byte length. This temporary protection key is exactly the same as the temporary protection key generated in step 103 on the PC. The entire calculation process is completed inside the security chip of the terminal device, and the inherent private key and the temporary protection key never leave the secure hardware environment.

[0051] 403. Determine whether the random number in the response message is consistent with the random number of the terminal device. If they are consistent, generate a temporary protection key of a preset byte length based on the temporary public key and the inherent public-private key pair through a key exchange algorithm. The inherent public-private key pair is a key pair generated and stored by the terminal device through an asymmetric key generation algorithm. The terminal device retrieves the random number from the security buffer in step 402, and simultaneously retrieves the original random number generated and stored in the security storage area in step 401. It verifies the consistency of the two by comparing them byte-by-byte. If the comparison results are consistent, it indicates that the response message is a valid response from the PC to this key pre-installation request, and not a replayed historical response or a response to another terminal. After the random number verification is successful, the terminal device retrieves the inherent private key from the inherent public-private key pair within the security chip. This private key has never been exported since the factory and can only be accessed internally by commands within the security chip; it cannot be read through external interfaces. Combined with the temporary public key extracted from the response message, the built-in key exchange algorithm module is activated to generate a temporary protection key.

[0052] Optionally, if there is a discrepancy, the decryption operation of the key format block is stopped, and a key pre-installation failure signal is sent to the PC.

[0053] If the comparison is inconsistent, the optional failure handling procedure will be triggered: The terminal device stops all subsequent operations related to the key format block, including the generation of temporary protection keys and the decryption of key format blocks, to prevent key generation errors or decryption failures due to the misuse of other requests or response data from other terminal devices, which could lead to damage to sensitive information. Then, it generates a key pre-installation failure signal containing the specific reason for the error. In addition to the status code indicating the pre-installation failure, the signal also includes the error type, the terminal serial number, and the timestamp of this request. This signal is sent to the PC host computer via the communication link to facilitate PC maintenance personnel to quickly locate the problem.

[0054] 404. Decrypt the key format block using the temporary protection key to extract the target key and store it in a secure storage area; After generating a temporary protection key identical to that of the PC, the terminal device retrieves the key format block received in step 402 from the security buffer and preprocesses it: extracting the last 4 bytes of checksum, performing a CRC32 check on the remaining 296 bytes of data in the key format block to confirm that no tampering occurred during data transmission; then parsing out the key version number and key purpose identifier to verify their consistency with the terminal device's preset key format rules. After successful preprocessing, the terminal device calls the decryption module built into the security chip, using the temporary protection key as the decryption key, to perform a decryption operation on the encrypted target key data in the key format block, restoring the unique target key generated by the PC for the terminal device. After decryption, the terminal device stores the target key in its own secure storage area using a dedicated write command from the security chip.

[0055] 405. Send a key pre-installation success signal to the PC.

[0056] After successfully storing the target key in the secure storage area, the terminal device immediately generates a key pre-installation success signal. This success signal includes the terminal's unique serial number, status code, and timestamp. The terminal device sends this success signal to the PC host computer via the communication link. Upon receiving the signal, the PC confirms that the terminal device has completed the reception, decryption, and storage of the target key. Simultaneously, the terminal locally records the successful pre-installation log in the secure log area.

[0057] Optionally, after sending a key pre-installation success signal to the PC, the temporary cache of the temporary protection key and the inherent public-private key pair stored locally on the terminal device is deleted.

[0058] The terminal device invokes the cache clearing command of the security chip to delete the temporary protection key generated in step 403 and the temporary cache of the inherent private key invoked in step 403, preventing unauthorized access to the private key cache. The clearing process employs a dual mechanism of overwriting and erasing: first, the cache area is overwritten with random data, and then a hardware-level erasure command is executed to ensure that sensitive data is completely removed without any residual traces. This operation does not affect the original storage and subsequent use of the terminal device's inherent public-private key pair, while reducing the risk of leakage of temporary key materials, further enhancing the security of the entire key pre-installation process, and ensuring that the terminal device's key environment is always in a clean and secure state.

[0059] In this embodiment, a hash algorithm is first applied to the device's own random number, unique identifier sequence number, and inherent public key to generate a verification value, and a request message is sent to the PC. This provides a basis for the PC's legitimacy verification and establishes a foundation for two-way identity verification. After receiving the response message, the device first checks whether the random number is consistent with its own generated value to quickly identify whether the response is specific to this terminal, avoiding missending or forged responses. Then, a temporary protection key is calculated based on the temporary public key and the inherent public-private key pair, forming a dedicated key synchronization with the PC to ensure that only this terminal device can decrypt the key block. Finally, the target key is decrypted, extracted, and stored in a secure area, while a success confirmation signal is sent. This ensures the accuracy of key storage through dedicated decryption and allows the PC to monitor the pre-installation result in real time through the confirmation signal. This solves the problems of undetectable key transmission damage and incorrect storage, achieving accurate and secure key pre-installation.

[0060] Based on step S403 above, please refer to Figure 5 , Figure 5 One embodiment for generating a temporary protection key of a preset byte length includes the following steps: 501. Extract the terminal device's proprietary private key from the proprietary public-private key pair; After the terminal device completes the consistency verification of the random number in the response message, it starts the key extraction module built into the security chip. Through hardware-level instructions, it accurately extracts the inherent private key from the inherent public-private key pair stored in the security chip. This inherent private key is generated by the ECCP-256 curve algorithm before the terminal device leaves the factory and is always stored inside the security chip after generation. It can only be called within the chip and cannot be exported or read through external interfaces.

[0061] 502. Combine the temporary public key with the ECC algorithm to calculate a temporary protection key that is consistent with the PC and the encryption machine. The calculation process is completed within the security chip of the terminal device.

[0062] The terminal device retrieves the temporary public key from the response message in the security buffer, and passes the inherent private key and the temporary public key as dual input parameters to the key exchange algorithm module built into the security chip. It performs a scalar multiplication operation on the elliptic curve points corresponding to the temporary public key using the inherent private key to obtain the shared key point; it then performs SHA-256 hash processing on the x-coordinate of the shared key point, extracting the first 256 bits as the initial key; finally, it normalizes the initial key according to preset rules to generate a 256-bit temporary protection key that is completely identical to that of the PC and the encryption machine.

[0063] In this embodiment, the inherent private key is extracted within the trusted execution environment through the built-in module of the security chip. The extraction process does not involve external caches or transmission links, fundamentally eliminating the risk of the inherent private key being stolen or tampered with, ensuring the security of the core private key material, and not affecting the solidified storage of the inherent public and private key pair within the security chip, thus guaranteeing its original integrity and subsequent reusability. The temporary protection key is calculated by combining the inherent private key and the temporary public key. It leverages the advantages of the ECC algorithm—short key length and high computational efficiency—to adapt to the limited hardware resources of terminal devices and the large-scale key pre-installation requirements. Furthermore, through the same algorithm logic as the PC and encryption machine, it ensures that the temporary protection key is completely synchronized, providing crucial protection for the decryption of the target key.

[0064] Please see Figure 6 This application provides a PC-based solution, which deploys host computer tools, including: The receiving unit 601 is used to receive a key pre-installation request message sent by the terminal device. The request message contains the terminal device's random number, serial number, inherent public key, and hash check value. The verification unit 602 is used to verify the validity of the hash verification value. If the verification is successful, the encryption machine is called to generate the corresponding temporary public-private key pair and the temporary public key in the temporary public-private key pair is extracted. Optionally, verification unit 602 is also used for: Extract the random number, sequence number, and inherent public key from the request message, and calculate the verification reference value using the same hash algorithm as the terminal device; The verification reference value is compared with the hash verification value. If they match, the verification is considered successful.

[0065] The generation unit 603 is used to generate a temporary protection key of a preset byte length based on the inherent public key of the terminal device and the temporary public-private key pair of the encryption machine; generate a target key exclusive to the terminal device based on the unique identifier serial number of the terminal device; and encrypt the target key using the temporary protection key to generate a key format block. Optionally, the generating unit 603 is also used for: Call the mapping table pre-stored inside the encryption machine; Query the key generation parameters corresponding to the sequence number in the mapping table; Based on the key generation parameters, a symmetric encryption algorithm is used to generate the target key for the terminal device.

[0066] The sending unit 604 is used to send a key pre-installation response message to the terminal device. The response message includes a random number generated by the terminal device, a temporary public key, and a key format block.

[0067] Optionally, a deletion unit 605 is also included, used for: After sending a key pre-installation response message to the terminal device, the encryption machine is triggered to delete the temporary public-private key pair and the temporary protection key.

[0068] Please see Figure 7 This application provides a terminal device, including: The first sending unit 701 is used to perform a hash algorithm on the random number, serial number and inherent public key of the terminal device to generate a hash verification value, and send a key pre-installation request message containing the random number, serial number, inherent public key and hash verification value to the PC. The receiving unit 702 is used to receive a key pre-installed response message from the PC. The response message contains a random number, a temporary public key, and a key format block. The key format block is generated by the PC after encrypting the target key with a temporary protection key. The target key is generated by the PC based on the sequence number. The judgment unit 703 is used to judge whether the random number in the response message is consistent with the random number of the terminal device. If they are consistent, a temporary protection key of a preset byte length is generated based on the temporary public key and the inherent public-private key pair through a key exchange algorithm. The inherent public-private key pair is a key pair generated and stored by the terminal device through an asymmetric key generation algorithm. Optionally, the judgment unit 703 is also used for: Extract the terminal device's proprietary private key from the proprietary public-private key pair; By combining the temporary public key, a temporary protection key consistent with that of the PC and the encryption machine is calculated using the ECC algorithm. The calculation process is completed within the security chip of the terminal device.

[0069] Optionally, a stop unit 704 is also included, for: If there is a discrepancy, the decryption operation of the key format block is stopped, and a key pre-installation failure signal is sent to the PC.

[0070] Extraction unit 705 is used to perform decryption operation on key format block using temporary protection key, extract target key and store it in secure storage area; The second sending unit 706 is used to send a key pre-installation success signal to the PC.

[0071] Optionally, a deletion unit 707 is also included, used for: Delete the temporary cache of the temporary protection key and the inherent public-private key pair stored locally on the terminal device.

[0072] For detailed implementation methods, please refer to... Figures 1 to 5 Examples are not detailed here.

[0073] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0074] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0075] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0076] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0077] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for pre-installing a local key, applied on a PC, wherein the PC is equipped with host computer tools, the method comprising: The terminal device receives a key pre-installation request message, which includes the terminal device's random number, serial number, proprietary public key, and hash check value. The hash verification value is validated for legality. If the validation passes, the encryption machine is invoked to generate a corresponding temporary public-private key pair, and the temporary public key in the temporary public-private key pair is extracted. A temporary protection key of a preset byte length is generated based on the inherent public key of the terminal device and the temporary public-private key pair. Generate the target key for the terminal device based on the serial number of the terminal device; The target key is encrypted using the temporary protection key to generate a key format block; Send a key pre-installation response message to the terminal device. The response message includes the random number, the temporary public key, and the key format block.

2. The local key pre-installation method according to claim 1, characterized in that, The process of validating the hash verification value includes: Extract the random number, the sequence number, and the inherent public key from the request message, and calculate the verification reference value using the same hash algorithm as the terminal device; The verification reference value is compared with the hash verification value. If they match, the verification is deemed successful.

3. The local key pre-installation method according to claim 1 or 2, characterized in that, The step of generating a target key specific to the terminal device based on the unique identifier serial number of the terminal device includes: Call the mapping table pre-stored inside the encryption machine; Query the key generation parameters corresponding to the sequence number in the mapping table; Based on the key generation parameters, a symmetric encryption algorithm is used to generate the target key for the terminal device.

4. The local key pre-installation method according to claim 1, characterized in that, The method further includes: After sending a key pre-installation response message to the terminal device, the encryption machine is triggered to delete the temporary public-private key pair and the temporary protection key.

5. A method for pre-installing a local key, applied to a terminal device, the method comprising: A hash algorithm is executed on the random number, serial number, and inherent public key of the terminal device to generate a hash verification value, and a key pre-installation request message containing the random number, the serial number, the inherent public key, and the hash verification value is sent to the PC. The system receives a key pre-installation response message from the PC, the response message containing the random number, a temporary public key, and a key format block. The key format block is generated by the PC after encrypting the target key with a temporary protection key, and the target key is generated by the PC based on the sequence number. Determine whether the random number in the response message is consistent with the random number of the terminal device. If they are consistent, then based on the temporary public key and the inherent public-private key pair, generate a temporary protection key of a preset byte length through a key exchange algorithm. The inherent public-private key pair is a key pair generated and stored by the terminal device through an asymmetric key generation algorithm. The temporary protection key is used to decrypt the key format block, extract the target key, and store it in a secure storage area. Send a key pre-installation success signal to the PC.

6. The local key pre-installation method according to claim 5, characterized in that, The process of generating a temporary protection key of a preset byte length based on the temporary public key and the inherent public-private key pair through a key exchange algorithm includes: Extract the terminal device's proprietary private key from the proprietary public-private key pair; Using the temporary public key, a temporary protection key consistent with that of the PC and the encryption machine is calculated using the ECC algorithm. The calculation process is completed within the security chip of the terminal device.

7. The local key pre-installation method according to claim 5, characterized in that, After determining whether the random number in the response message matches the random number in the terminal device, the method further includes: If there is a discrepancy, the decryption operation of the key format block is stopped, and a key pre-installation failure signal is sent to the PC.

8. The local key pre-installation method according to any one of claims 5 to 7, characterized in that, After sending a key pre-installation success signal to the PC, the method further includes: Delete the temporary cache of the temporary protection key and the inherent public-private key pair stored locally on the terminal device.

9. A PC terminal, characterized in that, The PC is equipped with host computer tools, including: The receiving unit is used to receive a key pre-installation request message sent by the terminal device, wherein the request message contains the terminal device's random number, serial number, inherent public key, and hash check value; The verification unit is used to verify the legality of the hash verification value. If the verification is successful, the encryption machine is called to generate the corresponding temporary public-private key pair, and the temporary public key in the temporary public-private key pair is extracted. The generation unit is configured to generate a temporary protection key of a preset byte length based on the inherent public key of the terminal device and the temporary public-private key pair of the encryption machine; generate a target key specific to the terminal device based on the unique identifier serial number of the terminal device; and encrypt the target key using the temporary protection key to generate a key format block. The sending unit is configured to send a key pre-installation response message to the terminal device, the response message including a random number generated by the terminal device, the temporary public key, and the key format block.

10. A terminal device, characterized in that, include: The first sending unit is configured to perform a hash algorithm on the random number, serial number, and inherent public key of the terminal device to generate a hash verification value, and send a key pre-installation request message containing the random number, the serial number, the inherent public key, and the hash verification value to the PC. The receiving unit is configured to receive a key pre-installation response message fed back by the PC, the response message containing the random number, the temporary public key, and the key format block, the key format block being generated by the PC after encrypting the target key with a temporary protection key, and the target key being generated by the PC based on the sequence number; The judgment unit is used to determine whether the random number in the response message is consistent with the random number of the terminal device. If they are consistent, a temporary protection key of a preset byte length is generated based on the temporary public key and the inherent public-private key pair through a key exchange algorithm. The inherent public-private key pair is a key pair generated and stored by the terminal device through an asymmetric key generation algorithm. The extraction unit is used to perform a decryption operation on the key format block using the temporary protection key, extract the target key, and store it in a secure storage area; The second sending unit is used to send a key pre-installation success signal to the PC.

Images