A key generation method based on intelligent password key
By generating and encrypting the target private key on the server side, the problem of traditional smart cryptographic keys being unable to interact in a cloud computing environment is solved. This enables key access, digital signature, and encryption/decryption operations in the cloud environment, meeting the business needs of cloud computing.
Patent Information
- Application Number
- CN202610176628.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-02-06
- Publication Date
- 2026-06-09
AI Technical Summary
The traditional use of smart cryptographic keys is difficult to adapt to the business needs of cloud computing environments, and it is impossible to perform key access, digital signature and encryption/decryption operations when accessing cloud services from a remote location.
The target private key is generated on the server side and encrypted with the target encryption public key before being stored in the registry. The target public key is used to interact with the client, ensuring that key access, digital signature and encryption/decryption operations are performed in the cloud computing environment.
It realizes the core operation of smart password keys in the cloud computing environment, overcomes the limitation of traditional smart password keys that cannot interact with the local host machine, and meets the business needs of the cloud computing environment.
Smart Images
Figure CN122179091A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of key security, and in particular to a key generation method based on smart cryptographic keys. Background Technology
[0002] With the widespread adoption of internet technology and the comprehensive advancement of digital transformation, smart password keys, as a lightweight hardware security module integrating a USB interface, a dedicated security chip, and an independent encrypted storage unit, have become the core terminal carrier of the public key infrastructure system and are widely used in key areas such as financial transactions, government services, and enterprise offices.
[0003] Currently, when users use smart password keys, they need to insert the smart password key into the local host machine. The client software on the host machine establishes a communication link with the smart password key, thereby completing core operations such as key retrieval, digital signature, and encryption / decryption.
[0004] However, with the rapid iteration and large-scale application of cloud computing technology, more and more enterprises and users are migrating their business systems and data resources to cloud platforms, enabling business operations through remote access and multi-terminal collaboration. In this scenario, users need to access cloud services from remote locations. However, the physical connection characteristics of smart password keys prevent them from interacting directly with the platform without being located on the local host machine, creating a collaborative contradiction of "business moving to the cloud but security devices remaining trapped locally." This makes the traditional use of smart password keys difficult to adapt to the business needs of the cloud computing environment. Summary of the Invention
[0005] This application provides a key generation method based on smart cryptographic keys, aiming to solve the technical problem that the traditional use of smart cryptographic keys is difficult to adapt to the business needs of cloud computing environments.
[0006] In a first aspect, embodiments of this application provide a key generation method based on a smart cryptographic key, the method being applied to a server, and comprising: Receive a key creation request message sent by a client, the key creation request message including metadata of the target smart cryptographic key, the metadata including the target cryptographic public key; Generate the target private key; Encrypt the target private key using the target public key; The encrypted target private key and metadata are stored in the registry; Generate a target public key based on the target private key; The target public key is returned to the client.
[0007] Optionally, the key creation request message further includes signature data, which is obtained by digitally signing the metadata. Before generating the target private key, the method further includes: Extract the signature verification public key from the key creation request message; Based on the signature verification public key and the signature data, a signature verification operation is performed on the metadata; If the signature verification operation is successful, proceed with the step of generating the target private key.
[0008] Optionally, the metadata also includes the target signing public key, and the extraction of the verification public key from the key creation request message includes: Use the target signature public key as the signature verification public key.
[0009] Optionally, before generating the target private key, the method further includes: If the signature verification operation is successful, a temporary public-private key pair is generated, which includes a temporary public key and a temporary private key. The temporary public key is encrypted using the target encryption public key to obtain the first ciphertext; The first ciphertext is returned to the client so that the client can decrypt the first ciphertext using the target smart key to obtain the temporary public key, and then use the temporary public key to encrypt a first random number to obtain the second ciphertext. The first random number is generated by the target smart key. Receive the second ciphertext sent by the client; The second ciphertext is decrypted using the temporary private key to obtain the first random number; The generation of the target private key includes: The target private key is generated based on the first random number according to the preset key generation rules.
[0010] Optionally, before generating the target private key based on the first random number according to a preset key generation rule, the method further includes: Generate a second random number; The step of generating the target private key based on the first random number according to a preset key generation rule includes: The target private key is generated based on the first random number and the second random number according to the preset key generation rule.
[0011] Optionally, generating the target private key based on the first random number and the second random number according to the preset key generation rule includes: Perform a bitwise XOR operation between the first random number and the second random number to obtain the target private key.
[0012] Optionally, the key creation request message includes a first signing public key, and the step of extracting the verification public key from the key creation request message includes: Determine whether the first signature public key exists in the registry; If so, the first signing public key shall be used as the verification public key.
[0013] Secondly, embodiments of this application provide a key generation method based on a smart cryptographic key, the method being applied to a client, and comprising: Obtain the metadata of the target smart cryptographic key, the metadata including the target cryptographic public key; Send a key creation request message to the server. The key creation request message includes the metadata and is used to instruct the server to generate a target private key and a target public key. Receive the target public key returned by the server.
[0014] Optionally, before receiving the target public key returned by the server, the method further includes: Receive the first encrypted message returned by the server; After obtaining a temporary public key by decrypting the first ciphertext using the target smart cryptographic key, the temporary public key is used to encrypt a first random number to obtain the second ciphertext. The first random number is generated by the target smart cryptographic key. The second ciphertext is sent to the server so that the server generates the target private key based on the second ciphertext.
[0015] Optionally, the key creation request message may further include signature data and a first signing public key, wherein the signature data is obtained by digitally signing the metadata, and the metadata may further include a target signing public key.
[0016] Thirdly, embodiments of this application also provide a key generation device based on a smart cryptographic key, which includes a unit for performing the above-described method.
[0017] Fourthly, embodiments of this application also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.
[0018] Fifthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the above-described method.
[0019] This application provides a key generation method based on a smart cryptographic key. The method is applied to a server and includes: receiving a key creation request message sent by a client, the key creation request message including metadata of a target smart cryptographic key, the metadata including a target encrypted public key; generating a target private key; encrypting the target private key using the target encrypted public key; storing the encrypted target private key and metadata in a registry; generating a target public key based on the target private key; and returning the target public key to the client. Therefore, in this application's technical solution, the server generates a key creation request message sent by a client. The key creation request message includes metadata of the target smart cryptographic key; the metadata includes a target encrypted public key. Next, the target private key is generated and encrypted using the target encrypted public key. Then, the encrypted target private key and metadata are stored in a registry. Finally, a target public key is generated based on the target private key and returned to the client. Thus, in this application's technical solution, after the server generates the target private key, it encrypts the target private key using the target encrypted public key, and stores the encrypted target private key and the smart cryptographic key's metadata together in the registry. When a user needs to access the target private key, they must insert a smart cryptographic key and use the private key corresponding to the target encrypted public key within the smart cryptographic key to perform decryption operations, thereby obtaining the plaintext of the target private key. This mechanism effectively overcomes the technical pain point that traditional smart cryptographic key usage methods are difficult to adapt to the business needs of cloud computing environments, thus enabling core operations such as key retrieval, digital signatures, and encryption / decryption to be performed using smart cryptographic keys in cloud computing environments. Attached Figure Description
[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0022] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.
[0023] Figure 1a One of the flowcharts for a key generation method based on a smart cryptographic key provided in this application embodiment; Figure 1bA timing diagram of a key generation method based on a smart cryptographic key provided in an embodiment of this application; Figure 1c A timing diagram of a key decryption method based on a smart cryptographic key provided in an embodiment of this application; Figure 2 A second schematic flowchart illustrating a key generation method based on a smart cryptographic key, provided for an embodiment of this application; Figure 3 One of the schematic block diagrams of a key generation device based on a smart cryptographic key provided in this application embodiment; Figure 4 A second schematic block diagram of a key generation device based on a smart cryptographic key provided in this application embodiment; Figure 5 A computer device provided in an embodiment of this application. Detailed Implementation
[0024] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0025] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.
[0026] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.
[0027] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.
[0028] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.
[0029] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."
[0030] To address the technical problem that the traditional use of smart cryptographic keys in existing technologies is difficult to adapt to the business needs of cloud computing environments, this application provides a key generation device based on smart cryptographic keys, which enables smart cryptographic keys to adapt to the business needs of cloud computing environments.
[0031] Figure 1a One of the flowcharts for a key generation method based on a smart cryptographic key provided in this application embodiment; Figure 1b This is a timing diagram of a key generation method based on a smart cryptographic key, provided in an embodiment of this application. In one embodiment, the method is applied to a server and includes steps S101-S106.
[0032] S101. Receive the key creation request message sent by the client.
[0033] The key creation request message includes metadata about the target smart cryptographic key. This metadata includes, but is not limited to, the target encryption public key, the target encryption private key, the target signing public key, the target signing private key, and the client identifier. The target encryption public key and the target encryption private key must match. The target signing public key must match the target signing private key. The client identifier can be the client's device serial number. The target smart cryptographic key is a lightweight, portable hardware security module. The client runs on the operator's computer. The server includes, but is not limited to, hardware servers and Kubernetes virtual servers.
[0034] It should be noted that, in implementing this embodiment, the target smart key needs to be inserted into the host machine before running the client. Then, the client sends a key creation request message to the server.
[0035] S102. Generate the target private key.
[0036] After receiving the key creation request message sent by the client, the server generates the target private key.
[0037] S103. Encrypt the target private key using the target encryption public key.
[0038] The server encrypts the target private key using the target's public encryption key, thus binding the target private key to the target smart key. When the server needs to use the target private key, it requires the target encrypted private key provided by the target smart key to decrypt it and obtain the plaintext target private key.
[0039] It should be noted that in this embodiment, the target private key is pre-divided into N parts, and then the divided target private key is encrypted using the target encryption public key. Here, N is an integer greater than or equal to 1. Preferably, N equals 2. Furthermore, Figure 1a In this embodiment, key M0 is the target private key. M0 is segmented according to the length of the session key to generate plaintext segments P0, P1, ..., Pn. Each segment of data is then encrypted with the target encryption public key to generate ciphertext, resulting in M1, M2, ..., Mn. Finally, the segmented ciphertext is stored on the server.
[0040] S104. Store the encrypted target private key and metadata in the registry.
[0041] In this embodiment, the encrypted target private key and the target smart key metadata are stored together in the registry for subsequent retrieval of the target private key ciphertext.
[0042] S105. Generate the target public key based on the target private key.
[0043] In this embodiment of the application, a target public key is generated based on the target private key according to a public key cryptography algorithm.
[0044] It should be noted that this application embodiment can also be used in the scenario of generating private keys for virtual currencies. After the server generates the target private key, it can also generate a target public key and address based on the target private key, and return the target public key and address to the client. In this application embodiment, the target private key can be used as the private key of a blockchain account.
[0045] S106. Return the target public key to the client.
[0046] This application provides a key generation method based on a smart cryptographic key. The method is applied to a server and includes: receiving a key creation request message sent by a client, the key creation request message including metadata of a target smart cryptographic key, the metadata including a target encrypted public key; generating a target private key; encrypting the target private key using the target encrypted public key; storing the encrypted target private key and metadata in a registry; generating a target public key based on the target private key; and returning the target public key to the client. Therefore, in this application's technical solution, the server generates a key creation request message sent by a client. The key creation request message includes metadata of the target smart cryptographic key; the metadata includes a target encrypted public key. Next, the target private key is generated and encrypted using the target encrypted public key. Then, the encrypted target private key and metadata are stored in a registry. Finally, a target public key is generated based on the target private key and returned to the client. Thus, in this application's technical solution, after the server generates the target private key, it encrypts the target private key using the target encrypted public key, and stores the encrypted target private key and the smart cryptographic key's metadata together in the registry. When a user needs to access the target private key, they must insert a smart cryptographic key and use the private key corresponding to the target encrypted public key within the smart cryptographic key to perform decryption operations, thereby obtaining the plaintext of the target private key. This mechanism effectively overcomes the technical pain point that traditional smart cryptographic key usage methods are difficult to adapt to the business needs of cloud computing environments, thus enabling core operations such as key retrieval, digital signatures, and encryption / decryption to be performed using smart cryptographic keys in cloud computing environments.
[0047] In one embodiment, the key creation request message further includes signature data, which is obtained by digitally signing the metadata. Before S102 above, the method further includes: S107-S109.
[0048] S107. Extract the signature verification public key from the key creation request message.
[0049] To prevent data tampering in the key creation request message, this embodiment inserts signature data into the key creation request message and uses the signature data and a verification public key to verify the metadata carried in the key creation request message.
[0050] In one embodiment, the metadata also includes the target signature public key, and S107 specifically includes the following steps: S1071.
[0051] S1071. Use the target signature public key as the signature verification public key.
[0052] In this embodiment, the target smart cryptographic key's metadata is signed using its target signature private key to obtain signature data. The server extracts the target signature public key from the metadata and verifies the signature against the target smart cryptographic key's metadata using the signature data.
[0053] It's important to note that before the client sends a key creation request message to the server, the server does not possess any metadata information for the smart key. At this point, the smart key's metadata needs to be signed using its own target signing private key. In other words, the first registered smart key needs to sign its own metadata using its own signing private key. Registration is only successful after the server verifies the signature using the smart key's signing public key.
[0054] In another embodiment, the key creation request message includes a first signing public key, and S107 above further includes the following steps: S1072-S1074.
[0055] S1072. Determine if the first signature public key exists in the registry. If yes, proceed to S1073; otherwise, proceed to S1074.
[0056] S1073. Use the first signature public key as the signature verification public key.
[0057] S1074, Stop the registration of the target smart password key.
[0058] It should be noted that S1072-S1074 will be explained in detail below.
[0059] The first signing public key is the signing public key of any smart key already registered with the server. In other words, except for the first smart key submitting its registration request to the server, where the signing data needs to use its own signing public key, the registration process for other smart keys requires signing its own metadata using the signing public key of the smart key already registered with the server. In practice, the user can first insert the smart key to be registered, extract its metadata, then remove it, insert a registered smart key, and use the registered smart key to sign the metadata of the smart key to be registered, obtaining signed data. Finally, the client sends a key creation request message to the server, ensuring that the smart key to be registered is successfully registered with the server.
[0060] It should be noted that if the first signature public key does not exist in the registration, it means that this key creation request is an invalid request and needs to be terminated.
[0061] S108. Perform signature verification operation on metadata based on the signature verification public key and signature data.
[0062] S109. If the signature verification operation is successful, proceed with the step of generating the target private key.
[0063] In this embodiment of the application, the signature verification public key and signature data are used to verify the metadata. Only when the signature verification is successful can the above S102 be executed.
[0064] In one embodiment, prior to S102, the method further includes S110-S114.
[0065] S110. If the signature verification operation is successful, a temporary public-private key pair is generated.
[0066] A temporary public-private key pair consists of a temporary public key and a temporary private key. In other words, the temporary public key is matched with the temporary private key.
[0067] It should be noted that in this embodiment, the temporary public key is used to encrypt data transmitted between the client and the server. Therefore, the temporary public key needs to be sent to the client for use in encrypting data.
[0068] S111. Encrypt the temporary public key using the target encryption public key to obtain the first ciphertext.
[0069] To ensure that the temporary public key is not tampered with, in this embodiment of the application, the target encryption public key is used to encrypt the temporary public key to generate the first ciphertext.
[0070] S112. Return the first ciphertext to the client so that the client can decrypt the first ciphertext using the target smart key to obtain the temporary public key, and then use the temporary public key to encrypt the first random number to obtain the second ciphertext.
[0071] The first random number is generated for the target smart password key.
[0072] In one embodiment, when the client receives the first ciphertext, the client requests the target smart cryptographic key, so that the target smart cryptographic key uses the target encryption private key to decrypt the first ciphertext and returns the resulting temporary public key to the client. Next, the client requests the target smart cryptographic key to generate a hardware random number, obtaining a first random number, and encrypts the first random number using the temporary public key to obtain the second ciphertext. It should be noted that the first random number and the temporary public key need to be exposed in the client's memory.
[0073] In another embodiment, when the client receives the first ciphertext, it requests the target smart cryptographic key to decrypt the first ciphertext, generate a first random number, and encrypt the first random number using a temporary public key to generate the second ciphertext. It should be noted that the first random number and the temporary public key do not need to be exposed in the client's memory; the three operations of decrypting the first ciphertext, generating the first random number, and encrypting the first random number using the temporary public key are all performed within the target smart cryptographic key. In other words, even if the client is attacked, it will not prevent the first random number and the temporary public key from being leaked. This effectively ensures the security of the first random number and the temporary public key.
[0074] S113, Receive the second ciphertext sent by the client.
[0075] S114. Use the temporary private key to decrypt the second ciphertext and obtain the first random number.
[0076] The above S102 specifically includes the following steps: S1021.
[0077] S1021. Generate the target private key based on the first random number according to the preset key generation rules.
[0078] It should be noted that the preset key generation rule is used to generate the target private key. In this embodiment, the target private key is generated based on a first random number according to the preset key generation rule.
[0079] It should be noted that the quality of the random number generated by the target smart cryptographic key is influenced by the quality of the random number generated by the server. Therefore, the target private key generated based on the first random number is of relatively high quality.
[0080] In one embodiment, prior to S1021, the method further includes S1022.
[0081] S1022, Generate a second random number; The above S1021 specifically includes the following steps: S10211.
[0082] S10211. Generate the target private key based on the first random number and the second random number according to the preset key generation rules.
[0083] It should be noted that the first random number may be exposed in the client's memory, posing a security risk. In order to improve the quality of the target private key, the server generates a second random number and combines it with the first random number to generate the target private key.
[0084] In one embodiment, S10211 specifically includes the following steps: a.
[0085] a. Perform a bitwise XOR operation between the first random number and the second random number to obtain the target private key.
[0086] Please see Figure 1c , Figure 1c This is a timing diagram of a key decryption method based on a smart cryptographic key provided in an embodiment of this application.
[0087] First, the client sends a decryption request message to the server. This message includes the metadata of the target smart key and signature data. The signature data is obtained by signing the metadata of the target smart key. Upon receiving the decryption request message, the server verifies the metadata of the target smart key based on the signature data and the verification public key. If the verification passes, a temporary public-private key pair is generated. This temporary public-private key pair can be reused if it is not destroyed. Next, the server returns the segmented ciphertext M1, M2, ..., Mn of the target private key and the ciphertext of the temporary encryption public key to the client. After receiving the segmented ciphertext, the client requests the target smart key to decrypt it, obtaining the segmented plaintext of the target private key. The client then uses the temporary encryption public key to encrypt the segmented plaintext, obtaining the segmented ciphertext M1. ’ M2 ’ , ..., Mn ’ Then segment the ciphertext M1 ’ M2 ’ , ..., Mn ’ The message is sent to the server, which decrypts it using a temporary private key to obtain the plaintext of the target private key.
[0088] It should be noted that after the client receives the segmented ciphertext of the target private key returned by the server, it first uses the encryption function of the target smart key to decrypt and extract the plaintext of the server's temporary encrypted public key. Next, it calls the target smart key's import session key interface to import the server's segmented ciphertext M1, M2, ..., Mn into the target smart key. Then, it calls the target smart key's session key decryption output interface using an external public key, inputting the server's temporary encrypted public key plaintext and outputting the session key ciphertext M1. ’ M2 ’ , ..., Mn ’ The entire process is executed within the target smart key; the client device cannot see the plaintext information regarding the server key segments. The server receives the segmented ciphertext M1. ’ M2 ’ , ..., Mn ’Then, the temporary private key is used for decryption to obtain the segmented plaintext P1, P2, ..., Pn. Next, the server key M0 is reassembled according to the segmentation rules. The server can then use the target private key M0 to perform relevant cryptographic operations. Similar to the process of creating the server key, after decrypting the server key, the server needs to encrypt the decryption result using the target encryption public key and return it to the client. After receiving the returned ciphertext data, the client calls the encryption private key of the target smart cryptographic key to decrypt the ciphertext and obtain the plaintext decryption result.
[0089] In one embodiment, server-side key backup is achieved by adding smart keys. Different smart keys store different encryption key pairs. Once a new smart key is registered with the server, the server obtains the public key of the new smart key and uses it to encrypt the plaintext segments P0, P1...Pn of the server key, generating corresponding ciphertext segments Ma1, Ma2...Man, which are then stored on the server. This completes the server-side key backup. When a smart key is lost or malfunctions, other backed-up smart keys can be used to decrypt the ciphertext and reuse the key.
[0090] Figure 2 This is a second schematic flowchart illustrating a key generation method based on a smart cryptographic key, provided as an embodiment of this application. In one embodiment, the method is applied to a client and includes steps S201-S203.
[0091] S201. Obtain the metadata of the target smart key.
[0092] The metadata includes the target encrypted public key.
[0093] It should be noted that the target smart cryptographic key and metadata have been described in detail in S101 above. This application will not repeat them here.
[0094] S202. Send a key creation request message to the server.
[0095] The key creation request message includes metadata. It instructs the server to generate the target private key and the target public key.
[0096] It should be noted that the above embodiments have described in detail the key creation request message and how the server generates the target private key and target public key. This application will not repeat these details here.
[0097] S203, Receive the target public key returned by the server.
[0098] It should be noted that after the server creates the target private key, it returns the target public key to the client. Additionally, in blockchain cryptocurrency scenarios, after the server creates the blockchain account private key, it returns the blockchain account to the client.
[0099] In one embodiment, prior to S203, the method further includes S204-S206.
[0100] S204, Receive the first encrypted message returned by the server; S205. After obtaining the temporary public key by decrypting the first ciphertext using the target smart cryptographic key, use the temporary public key to encrypt the first random number to obtain the second ciphertext. The first random number is generated by the target smart cryptographic key.
[0101] S206. Send the second ciphertext to the server so that the server can generate the target private key based on the second ciphertext.
[0102] It should be noted that S110-S114 correspond to S204-S206, and will not be repeated here.
[0103] In one embodiment, the key creation request message further includes signature data and a first signing public key, wherein the signature data is obtained by digitally signing the metadata, and the metadata further includes a target signing public key.
[0104] It should be noted that the above embodiments have described the signature data, the first signature public key, and the target signature public key in detail. Therefore, this application will not repeat them here.
[0105] See Figure 3 , Figure 3 This is one of the schematic block diagrams of a key generation device based on a smart key provided in this application. Corresponding to the above-described key generation method based on a smart key, this application also provides a key generation device based on a smart key. This key generation device includes a unit for executing the above-described key generation method based on a smart key, and can be configured in a terminal such as a desktop computer, tablet computer, or laptop computer. Specifically, the device is applied to a server, and the key generation device based on a smart key includes: The first receiving unit 301 is used to receive a key creation request message sent by the client, wherein the key creation request message includes metadata of the target smart cryptographic key, and the metadata includes the target cryptographic public key; The first generation unit 302 is used to generate the target private key; Encryption unit 303 is used to encrypt the target private key using the target public key; Storage unit 304 is used to store the encrypted target private key and metadata in the registry; The second generation unit 305 is used to generate a target public key based on the target private key; Return unit 306 is used to return the target public key to the client.
[0106] In one embodiment, the key creation request message further includes signature data, which is obtained by digitally signing the metadata, and the apparatus further includes: Extraction unit 307 is used to extract the signature verification public key from the key creation request message; The execution unit 308 is used to perform a signature verification operation on the metadata based on the signature verification public key and the signature data; The first generation unit 302 is specifically used to: generate the target private key if the signature verification operation is successful.
[0107] In one embodiment, the metadata further includes the target signature public key, and the extraction unit 307 is specifically used for: Use the target signature public key as the signature verification public key.
[0108] In one embodiment, before generating the target private key, the first generation unit 302 is further configured to: if the signature verification operation is successful, generate a temporary public-private key pair, the temporary public-private key pair including a temporary public key and a temporary private key; The encryption unit 303 is further configured to: encrypt the temporary public key using the target encryption public key to obtain the first ciphertext; The return unit 306 is further configured to: return the first ciphertext to the client, so that the client can decrypt the first ciphertext using the target smart key to obtain the temporary public key, and then use the temporary public key to encrypt the first random number to obtain the second ciphertext, wherein the first random number is generated by the target smart key; The first receiving unit 301 is further configured to: receive the second ciphertext sent by the client; The device further includes a first decryption unit 309, used to decrypt the second ciphertext using the temporary private key to obtain the first random number; The first generation unit 302 is specifically used to: generate the target private key based on the first random number according to a preset key generation rule.
[0109] In one embodiment, before generating the target private key based on the first random number according to a preset key generation rule, the first generation unit 302 is further configured to: Generate a second random number; The target private key is generated based on the first random number and the second random number according to the preset key generation rule.
[0110] In one embodiment, the first generation unit 302 is further specifically used for: Perform a bitwise XOR operation between the first random number and the second random number to obtain the target private key.
[0111] In one embodiment, the key creation request message includes a first signing public key, and the extraction unit 307 is further configured to: Determine whether the first signature public key exists in the registry; If so, the first signing public key shall be used as the verification public key.
[0112] See Figure 4 , Figure 4 This is a second schematic block diagram of a key generation device based on a smart key, provided in an embodiment of this application. Corresponding to the above-described key generation method based on a smart key, this application also provides a key generation device based on a smart key. This key generation device includes a unit for executing the above-described key generation method based on a smart key, and can be configured in terminals such as desktop computers, tablet computers, and laptops. Specifically, the device is applied to a client, and the key generation device based on a smart key includes: The acquisition unit 401 is used to acquire metadata of the target smart cryptographic key, the metadata including the target cryptographic public key; Sending unit 402 is used to send a key creation request message to the server. The key creation request message includes the metadata and is used to instruct the server to generate a target private key and a target public key. The second receiving unit 403 is used to receive the target public key returned by the server.
[0113] In one embodiment, before receiving the target public key returned by the server, the second receiving unit 403 is further configured to: receive the first ciphertext returned by the server; The device further includes: a second decryption unit 404, used to decrypt the first ciphertext with the target smart key to obtain a temporary public key, and then use the temporary public key to encrypt a first random number to obtain the second ciphertext, wherein the first random number is generated by the target smart key; The sending unit 402 is further configured to: send the second ciphertext to the server so that the server generates the target private key based on the second ciphertext.
[0114] In one embodiment, the key creation request message further includes signature data and a first signing public key, wherein the signature data is obtained by digitally signing the metadata, and the metadata further includes a target signing public key.
[0115] like Figure 5 As shown, this application provides a computer device including a processor 51, a communication interface 52, a memory 53, and a communication bus 54. The processor 51, the communication interface 52, and the memory 53 communicate with each other through the communication bus 54. The memory 53 is used to store computer programs. In one embodiment of this application, when the processor 51 executes the program stored in the memory 53, it implements the key generation control method based on the smart cryptographic key provided in any of the foregoing method embodiments.
[0116] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.
[0117] Therefore, embodiments of this application also provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the key generation method based on a smart cryptographic key as provided in any of the foregoing method embodiments.
[0118] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code. The computer-readable storage medium can be non-volatile or volatile.
[0119] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.
[0120] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.
[0121] The steps in the methods of this application embodiment can be adjusted, merged, or deleted according to actual needs. The units in the apparatus of this application embodiment can be merged, divided, or deleted according to actual needs. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.
[0122] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.
[0123] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.
[0124] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Since these modifications and variations fall within the scope of the claims and their equivalents, this application also intends to include these modifications and variations.
[0125] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A key generation method based on a smart cryptographic key, characterized in that, The method is applied to the server side, and the method includes: Receive a key creation request message sent by a client, the key creation request message including metadata of the target smart cryptographic key, the metadata including the target cryptographic public key; Generate the target private key; Encrypt the target private key using the target public key; The encrypted target private key and metadata are stored in the registry; Generate a target public key based on the target private key; The target public key is returned to the client.
2. The method according to claim 1, characterized in that, The key creation request message also includes signature data, which is obtained by digitally signing the metadata. Before generating the target private key, the method further includes: Extract the signature verification public key from the key creation request message; Based on the signature verification public key and the signature data, a signature verification operation is performed on the metadata; If the signature verification operation is successful, proceed with the step of generating the target private key.
3. The method according to claim 2, characterized in that, The metadata also includes the target signing public key, and the extraction of the verification public key from the key creation request message includes: Use the target signature public key as the signature verification public key.
4. The method according to claim 3, characterized in that, Before generating the target private key, the method further includes: If the signature verification operation is successful, a temporary public-private key pair is generated, which includes a temporary public key and a temporary private key. The temporary public key is encrypted using the target encryption public key to obtain the first ciphertext; The first ciphertext is returned to the client so that the client can decrypt the first ciphertext using the target smart key to obtain the temporary public key, and then use the temporary public key to encrypt a first random number to obtain the second ciphertext. The first random number is generated by the target smart key. Receive the second ciphertext sent by the client; The second ciphertext is decrypted using the temporary private key to obtain the first random number; The generation of the target private key includes: The target private key is generated based on the first random number according to the preset key generation rules.
5. The method according to claim 4, characterized in that, Before generating the target private key based on the first random number according to the preset key generation rule, the method further includes: Generate a second random number; The step of generating the target private key based on the first random number according to a preset key generation rule includes: The target private key is generated based on the first random number and the second random number according to the preset key generation rule.
6. The method according to claim 5, characterized in that, The step of generating the target private key based on the first random number and the second random number according to the preset key generation rule includes: Perform a bitwise XOR operation between the first random number and the second random number to obtain the target private key.
7. The method according to claim 2, characterized in that, The key creation request message includes a first signing public key, and the step of extracting the verification public key from the key creation request message includes: Determine whether the first signature public key exists in the registry; If so, the first signing public key shall be used as the verification public key.
8. A key generation method based on a smart cryptographic key, characterized in that, The method is applied to a client, and the method includes: Obtain the metadata of the target smart cryptographic key, the metadata including the target cryptographic public key; Send a key creation request message to the server. The key creation request message includes the metadata and is used to instruct the server to generate a target private key and a target public key. Receive the target public key returned by the server.
9. The method according to claim 8, characterized in that, Before receiving the target public key returned by the server, the method further includes: Receive the first encrypted message returned by the server; After obtaining a temporary public key by decrypting the first ciphertext using the target smart cryptographic key, the temporary public key is used to encrypt a first random number to obtain the second ciphertext. The first random number is generated by the target smart cryptographic key. The second ciphertext is sent to the server so that the server generates the target private key based on the second ciphertext.
10. The method according to claim 8 or 9, characterized in that, The key creation request message also includes signature data and a first signing public key. The signature data is obtained by digitally signing the metadata, and the metadata also includes a target signing public key.