CN105703904A - Anti-fake method based on public key cipher and system - Google Patents

Abstract

The present invention discloses an anti-counterfeit method and system based on public key cryptography. A first public-private key pair is generated by a factory-made marking device, and a second public-private key pair is generated by an anti-counterfeiting module. By generating a root certificate in the registration step, and the first public-private key pair A manufacturer's certificate related to a public key, a commodity certificate related to the first private key and the second public key, and random challenge information and random challenge response information related to the second private key are generated in the verification step for successive verification, by This improves security.

Description

An anti-counterfeiting method and system based on public key cryptography

technical field

The invention relates to the field of key security, in particular to an anti-counterfeiting method and system based on public key cryptography.

Background technique

Existing password-based anti-counterfeiting systems mainly use symmetric cryptographic algorithms. Symmetric cryptographic algorithms are sometimes called traditional cryptographic algorithms, that is, the encryption key can be deduced from the decryption key, and the decryption key can also be deduced from the encryption key in turn. In most symmetric algorithms, the encryption and decryption keys are the same, which requires the sender and receiver to agree on a key before secure communication, and use the same key for encryption and decryption. Therefore, the security of a system based on a symmetric cryptographic algorithm depends on the key, and leaking the key means that anyone can encrypt and decrypt the message.

The advantages of symmetric encryption algorithms are high efficiency, simple algorithm, low system overhead, and are suitable for encrypting large amounts of data. Although symmetric cryptography has some great properties, it also has significant drawbacks. First, secure communication requires key exchange in a secure manner; and secure key exchange can be difficult or even impossible in some cases. Secondly, the scale is complex; for example, the key between A and B must be different from the key between A and C, otherwise the security of the message to B will be threatened; therefore, when there are In a group of 1000 users, A needs to keep at least 999 keys; for other users in the group, this situation also exists, and this group needs nearly 500,000 different keys in total. By extension, n A community of users requires n ² /2 different keys.

Due to the above shortcomings of the symmetric encryption algorithm itself, the existing anti-counterfeiting system based on the symmetric encryption algorithm faces greater challenges in key management and key distribution; the same key used for encryption and decryption in the symmetric key algorithm, or The decryption key can be easily deduced from the encryption key. Once stolen by an attacker, the entire anti-counterfeiting system will also be cracked.

Contents of the invention

In view of this, the main purpose of the present invention is to provide an anti-counterfeiting method and system based on public key cryptography, which can improve security while avoiding complex key scale.

In order to achieve the above object, the present invention provides a kind of anti-counterfeiting method based on public key cryptography, comprising:

Registration steps:

The anti-counterfeiting certification center generates a root certificate and sends the root certificate to the verification device;

The factory marking equipment generates the first private key, and generates the first public key through the public key cryptography algorithm, and sends the first public key to the anti-counterfeiting certification center;

The anti-counterfeiting certification center generates a manufacturer's certificate according to the first public key, and sends the manufacturer's certificate to the factory marking equipment;

The anti-counterfeit module installed in the product to be anti-counterfeited generates a second private key and a second public key, and sends the second public key to the outgoing marking device;

The ex-factory marking device uses the first private key and the second public key to generate a commodity certificate, and sends the manufacturer certificate and commodity certificate to the anti-counterfeiting module;

Verification steps:

The verification device generates random challenge information and sends the random challenge information to the anti-counterfeiting module;

The anti-counterfeiting module uses the second private key and the random challenge information to generate random challenge response information, and sends the random challenge response information, manufacturer certificate and commodity certificate to the verification device;

The verification device verifies the root certificate, manufacturer certificate, commodity certificate and random challenge response information in sequence.

Further, the root certificate generated by the anti-counterfeiting certification authority in the registration step includes:

The anti-counterfeiting certification center generates a third public key and a third private key;

The anti-counterfeit certification center uses the third private key to sign the third public key to generate the root certificate.

Further, in the registration step, the anti-counterfeiting certification center uses the third private key to sign the first public key to generate the manufacturer certificate.

Further, the anti-counterfeiting module set in the product to be anti-counterfeited in the registration step generates a second private key and a second public key, and sending the second public key to the factory marking equipment includes:

The anti-counterfeiting module generates a random number, and generates a second private key according to the random number;

The anti-counterfeiting module generates a second public key according to the second private key and a public key cryptographic algorithm;

The anti-counterfeiting module sends the second public key to the factory marking device.

Further, in the registration step, the ex-factory marking device uses the first private key and the second public key to generate a commodity certificate, and sending the manufacturer certificate and commodity certificate to the anti-counterfeiting module includes:

The ex-factory marking device uses the first private key to sign the second public key to generate the commodity certificate;

Send the manufacturer certificate and commodity certificate to the anti-counterfeiting module.

Further, in the verification step, the anti-counterfeiting module uses the second private key and the random challenge information to generate random challenge response information, and sending the random challenge response information, manufacturer certificate and commodity certificate to the verification device includes:

The anti-counterfeiting module uses the second private key to sign the random challenge information to generate the random challenge response information;

The anti-counterfeiting module sends the random challenge response information, manufacturer certificate and commodity certificate to the verification device.

Further, the verification device in the verification step sequentially verifies the root certificate, manufacturer certificate, commodity certificate and random challenge response information including:

The verification device performs signature verification on the root certificate, thereby obtaining a third public key;

The verification device uses the obtained third public key to perform signature verification on the manufacturer certificate to obtain the first public key;

The verification device uses the obtained first public key to perform signature verification on the commodity certificate to obtain a second public key;

The verification device uses the obtained second public key to perform signature verification on the random challenge response information to obtain random challenge information;

The verification device compares the random challenge information obtained from the random challenge response information with the random challenge information generated by the verification device, and if they are consistent, the verification succeeds, and if they are inconsistent, the verification fails.

The present invention also provides an anti-counterfeiting system based on public key cryptography, including: factory marking equipment, an anti-counterfeiting certification center, an anti-counterfeiting module and verification equipment;

Wherein, the factory marking equipment includes a first key generation module and a commodity certificate generation module; the first key generation module is used to generate the first private key in the registration phase, and generate the first public key through the public key cryptography algorithm , and send the first public key to the anti-counterfeiting certification center; the commodity certificate generating module is used to generate a commodity certificate using the first private key and the second public key during the registration phase;

The anti-counterfeiting certification center is used to generate a root certificate during the registration phase, send the root certificate to the verification device, and is used to generate a manufacturer's certificate according to the first public key, and send the manufacturer's certificate to the factory marking device ;

The anti-counterfeiting module is set in the anti-counterfeiting product, including a second key generation module and a random challenge response information module; the second key generation module is used to generate a second private key and a second public key during the registration phase, and Send the second public key to the factory marking device; the random challenge response information module is used to generate random challenge response information using the second private key and random challenge information in the verification phase, and send the random The challenge response information, manufacturer certificate and commodity certificate are sent to the verification device;

The verification device includes a random challenge generating module for generating random challenge information and sending the random challenge information to the anti-counterfeiting module in the verification phase; and for sequentially verifying root certificates, manufacturer certificates, commodity certificates and random challenge responses Information verification module.

Using the anti-counterfeiting method and system based on public key cryptography provided by the present invention, the first public-private key pair is generated by the marking equipment at the factory, the second public-private key pair is generated by the anti-counterfeiting module, and the root certificate is generated in the registration step. The manufacturer's certificate related to the first public key, the commodity certificate related to the first private key and the second public key, and the random challenge information and the random challenge response information related to the second private key are generated in the verification step for successive verification, Security is thereby increased.

Description of drawings

Fig. 1 is a schematic flow chart of an anti-counterfeiting method based on public key cryptography in the present invention;

Fig. 2 is a schematic flow chart of a typical embodiment of an anti-counterfeiting method based on public key cryptography according to the present invention.

detailed description

In order to make the purpose, technical solution and advantages of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings and examples.

The present invention is realized based on the following considerations:

Public key cryptography, also known as asymmetric cryptography, is a cryptographic system, such as the RSA algorithm and the elliptic curve algorithm (SM2), which are currently the most widely used. In an asymmetric cryptosystem, the encryption algorithm and the decryption algorithm use different keys: one is a public key and the other is a private key. Public-key cryptography uses one of two keys to convert plaintext into ciphertext, and uses the other key to recover plaintext from ciphertext. In the prior art, the applications of public key cryptography are mainly encryption/decryption, digital signature and key exchange.

The advantages of the public key cryptography algorithm make it suitable for identity authentication, and the key transmission method is relatively simple and safe, which improves the security of the entire anti-counterfeiting system and can better enhance the anti-counterfeiting protection of products.

Based on the above considerations, as shown in Figure 1, the present invention provides a method for anti-counterfeiting based on public key cryptography, including:

The anti-counterfeiting certification center generates a root certificate and sends the root certificate to the verification device;

The factory marking equipment generates the first private key, and generates the first public key through the public key cryptography algorithm, and sends the first public key to the anti-counterfeiting certification center;

The anti-counterfeiting certification center generates a manufacturer's certificate according to the first public key, and sends the manufacturer's certificate to the factory marking equipment;

The anti-counterfeit module installed in the product to be anti-counterfeited generates a second private key and a second public key, and sends the second public key to the outgoing marking device;

The ex-factory marking device uses the first private key and the second public key to generate a commodity certificate, and sends the manufacturer certificate and commodity certificate to the anti-counterfeiting module;

Verification steps:

The verification device generates random challenge information and sends the random challenge information to the anti-counterfeiting module;

The anti-counterfeiting module uses the second private key and the random challenge information to generate random challenge response information, and sends the random challenge response information, manufacturer certificate and commodity certificate to the verification device;

The verification device verifies the root certificate, manufacturer certificate, commodity certificate and random challenge response information in sequence.

Below in conjunction with accompanying drawing 2 the typical embodiment of the application is described in detail:

Registration steps:

Step 1.1 The anti-counterfeiting certification center generates the third private key and the third public key;

Step 1.2 The anti-counterfeiting certification center uses the third private key to sign the third public key to generate a root certificate;

Step 1.3 The anti-counterfeit certification center sends the root certificate to the verification device;

Step 1.4 The factory marking equipment generates the first private key, and generates the first public key through the key algorithm;

Step 1.5 The factory marking equipment sends the first public key to the anti-counterfeiting certification center;

Step 1.6 The anti-counterfeiting certification center signs the first public key with the third private key to generate a manufacturer certificate;

Step 1.7 The anti-counterfeiting certification center sends the manufacturer's certificate to the factory marking equipment;

Step 1.8 The anti-counterfeiting module generates a random number;

Step 1.9 The anti-counterfeiting module generates the second private key according to the random number;

Step 2.0 The anti-counterfeiting module generates the second public key according to the second private key and the public key cryptographic algorithm;

Step 2.1 The anti-counterfeiting module sends the second public key to the factory marking equipment;

Step 2.2 The factory marking equipment uses the first private key to sign the second public key to generate a commodity certificate;

Step 2.1 The factory equipment sends the manufacturer certificate and product certificate to the anti-counterfeiting module.

Verification steps:

Step 3.1 Verify that the device generates random challenge information;

Step 3.2 The verification device sends random challenge information to the anti-counterfeiting module;

Step 3.3 The anti-counterfeiting module uses the second private key to sign the random challenge information to generate random challenge response information;

Step 3.4 The anti-counterfeiting module sends the random challenge response information, manufacturer certificate and commodity certificate to the verification device;

Step 3.5 The verification device performs signature verification on the root certificate, thereby obtaining the third public key;

Step 3.6 The verification device uses the third public key to perform signature verification on the manufacturer's certificate, thereby obtaining the first public key;

Step 3.7 The verification device uses the obtained first public key to perform signature verification on the commodity certificate, thereby obtaining the second public key;

Step 3.8 The verification device uses the obtained second public key to perform signature verification on the random challenge response information, thereby obtaining the random challenge information;

Step 3.9 The verification device compares the random challenge information obtained from the random challenge response information with the random challenge information generated by the verification device. If they are consistent, the verification is successful, and if they are inconsistent, the verification fails.

In this embodiment, in this embodiment, the signature performed in the registration step and the verification step can be performed using an existing signature algorithm, such as the SM2 signature algorithm, and the specific steps of the signature are common knowledge in the art, here No more details; further, in the verification step, the verification of the root certificate adopts the existing verification process of the corresponding signature algorithm, which will not be repeated here. If the verification succeeds, it means that the third public key is credible, and the third public key The key is used in subsequent verification steps.

According to the above-mentioned signature process, the specific process of verifying the signature of the manufacturer's certificate in this embodiment also adopts the verification process corresponding to the existing signature algorithm. If the verification is successful, it is considered that the first public key in the manufacturer's certificate is credible. In this way, the first public key is obtained; similar to this process, if the signature authentication of the commodity certificate is successful, the second public key in the commodity certificate is considered to be credible, and the second public key is thus obtained; similarly, the random challenge response If the signature authentication of the information is successful, the random challenge information in the random challenge response information is deemed credible.

Corresponding to the anti-counterfeiting method based on public key cryptography provided by the present invention, the present invention also provides an anti-counterfeiting system based on public key cryptography, including factory marking equipment, an anti-counterfeiting certification center, an anti-counterfeiting module and verification equipment;

Anti-counterfeiting system based on public key cryptography, including: factory marking equipment, anti-counterfeiting certification center, anti-counterfeiting module and verification equipment;

Wherein, the factory marking equipment includes a first key generation module and a commodity certificate generation module; the first key generation module is used to generate the first private key in the registration phase, and generate the first public key through the public key cryptography algorithm , and send the first public key to the anti-counterfeiting certification center; the commodity certificate generating module is used to generate a commodity certificate using the first private key and the second public key during the registration phase;

The anti-counterfeiting certification center is used to generate a root certificate during the registration phase, send the root certificate to the verification device, and is used to generate a manufacturer's certificate according to the first public key, and send the manufacturer's certificate to the factory marking device ;

The anti-counterfeiting module is set in the anti-counterfeiting product, including a second key generation module and a random challenge response information module; the second key generation module is used to generate a second private key and a second public key during the registration phase, and Send the second public key to the factory marking device; the random challenge response information module is used to generate random challenge response information using the second private key and random challenge information in the verification phase, and send the random The challenge response information, manufacturer certificate and commodity certificate are sent to the verification device;

The verification device includes a random challenge generating module for generating random challenge information and sending the random challenge information to the anti-counterfeiting module in the verification phase; and for sequentially verifying root certificates, manufacturer certificates, commodity certificates and random challenge responses Information verification module.

It should be noted that, the factory-made marking equipment, anti-counterfeiting certification center, anti-counterfeiting module and verification equipment in the above-mentioned anti-counterfeiting system, as well as the specific functions performed in the aforementioned method flow respectively, can be embedded by those skilled in the art based on the hardware equipment. software implementation, and will not be repeated here.

To sum up, using the anti-counterfeiting method and system based on public key cryptography provided by the present invention, the first public-private key pair is generated by the factory marking equipment, and the second public-private key pair is generated by the anti-counterfeiting module. Generate a root certificate, a vendor certificate associated with the first public key, a commodity certificate associated with the first private key and the second public key, and generate a random challenge message and a random challenge response message associated with the second private key in the verification step , performing successive verifications, thereby improving security.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the present invention. within the scope of protection.

Claims (8)

1. the method for anti-counterfeit based on public key cryptography, it is characterised in that including:

Registration step:

Anti-fake certificate is centrally generated root certificate, sends root certificate to verifying equipment；

The marking equipment that dispatches from the factory generates the first private key, and generates the first PKI by public key algorithm, and sends the first PKI to anti-fake certificate center；

Described anti-fake certificate center generates manufacturer's certificate according to described first PKI, and sends described manufacturer certificate to the marking equipment that dispatches from the factory；

It is arranged at the false proof module treating in anti-fake product and generates the second private key and the second PKI, and by the marking equipment that dispatches from the factory described in described second PKI transmission extremely；

The described marking equipment that dispatches from the factory utilizes described first private key and the second PKI to generate commercial product certificate, and sends described manufacturer certificate and commercial product certificate to described false proof module；

Verification step:

Checking equipment generates random challenge information and sends described random challenge information to described false proof module；

Described false proof module utilizes described second private key and described random challenge information to generate random challenge response message, and sends described random challenge response message, manufacturer's certificate and commercial product certificate to described checking equipment；

Checking equipment verifies root certificate, manufacturer's certificate, commercial product certificate and random challenge response message successively。

2. method according to claim 1, it is characterised in that anti-fake certificate described in registration step is centrally generated root certificate and includes:

Described anti-fake certificate is centrally generated the 3rd PKI and the 3rd private key；

Described anti-fake certificate center utilizes described 3rd private key that described 3rd PKI is signed, and generates described certificate。

3. method according to claim 2, it is characterised in that in registration step, described anti-fake certificate center utilizes described 3rd private key that described first PKI is signed, and generates described manufacturer certificate。

4. method according to claim 3, it is characterised in that be arranged at the false proof module treating in anti-fake product in registration step and generate the second private key and the second PKI, and the marking equipment that dispatches from the factory described in described second PKI transmission extremely is included:

Described false proof module becomes random number, according to described generating random number the second private key；

Described false proof module generates the second PKI according to described second private key and public key algorithm；

Described false proof module is by the marking equipment that dispatches from the factory described in described second PKI transmission extremely。

5. method according to claim 4, it is characterised in that the marking equipment that dispatches from the factory described in registration step utilizes described first private key and the second PKI to generate commercial product certificate, and described manufacturer certificate and commercial product certificate transmission is included to described false proof module:

The described marking equipment that dispatches from the factory utilizes described first private key that described second PKI is signed, and generates described commercial product certificate；

Described manufacturer certificate and commercial product certificate are sent to described false proof module。

6. method according to claim 5, it is characterized in that, false proof module described in verification step utilizes described second private key and described random challenge information to generate random challenge response message, and the extremely described checking equipment that described random challenge response message, manufacturer's certificate and commercial product certificate sent includes:

Described false proof module utilizes described second private key that described random challenge information is signed, and generates described random challenge response message；

Described random challenge response message, manufacturer's certificate and commercial product certificate are sent to described checking equipment by described false proof module。

7. method according to claim 6, it is characterised in that the described checking equipment in verification step verifies that root certificate, manufacturer's certificate, commercial product certificate and random challenge response message include successively:

Described certificate is carried out signature authentication by described checking equipment, is derived from the 3rd PKI；

Described manufacturer certificate is carried out signature verification by the 3rd PKI that described checking equipment utilization obtains, it is thus achieved that the first PKI；

Described commercial product certificate is carried out signature verification by the first PKI that described checking equipment utilization obtains, it is thus achieved that the second PKI；

Described random challenge response message is carried out signature verification by the second PKI that described checking equipment utilization obtains, it is thus achieved that random challenge information；

The random challenge information that the contrast of described checking equipment is generated with described checking equipment by the random challenge information obtained in described random challenge response message, if consistent, is proved to be successful, if inconsistent, authentication failed。

8. the Antiforge system based on public key cryptography, it is characterised in that including: the marking equipment that dispatches from the factory, anti-fake certificate center, false proof module and checking equipment；

Wherein, the marking equipment that dispatches from the factory described in includes the first key production module and commercial product certificate generation module；Described first key production module, for generating the first private key at registration phase, generates the first PKI by public key algorithm, and sends the first PKI to described anti-fake certificate center；Described commercial product certificate generation module is for utilizing described first private key and the second PKI to generate commercial product certificate at registration phase；

Described anti-fake certificate center is used for, at registration phase generation root certificate, sending root certificate to verifying equipment, and for generating manufacturer's certificate according to described first PKI, and by the marking equipment that dispatches from the factory described in the certificate transmission extremely of described manufacturer；

Described false proof module is arranged to be treated in anti-fake product, including the second key production module and random challenge response message module；Described second key production module is used for generating the second private key and the second PKI at registration phase, and by the marking equipment that dispatches from the factory described in described second PKI transmission extremely；Described random challenge response message module is for utilizing described second private key and random challenge information to generate random challenge response message at Qualify Phase, and sends described random challenge response message, manufacturer's certificate and commercial product certificate to described checking equipment；

Described checking equipment includes at Qualify Phase for generating random challenge information and described random challenge information being sent the random challenge generation module to described false proof module；And the authentication module for checking root certificate, manufacturer's certificate, commercial product certificate and random challenge response message successively。