HK1215905B - Usb key, method for writing usb key digital certificate and apparatus - Google Patents

Description

USB Key, USB Key digital certificate writing method and device

Technical Field

The present application relates to the field of information security, and in particular to a USB Key and a method and device for writing a USB Key digital certificate.

Background Art

With the widespread development of internet technology, information security issues have become increasingly prominent, leading to the emergence of USB keys. A USB key is a hardware device with a USB interface. It has a built-in microcontroller or smart card chip and a certain amount of storage space for users' private keys and digital certificates. Digital certificates are issued by a third-party authority, a Certificate Authority (CA). Users of USB key devices use digital certificates to verify their identity.

The process of writing a digital certificate to a USB key is as follows:

1. The client requests the USB Key to generate an asymmetric key pair;

2. The client uses the asymmetric key pair to generate a CSR (Certificate Signing Request) and sends it to the server;

3. The server issues a digital certificate after verifying the legitimacy of the USB Key;

4. The client writes the digital certificate into the USB Key and associates it with the private key.

In the above steps, the server verifies whether the USB key is legitimate by its serial number. However, the USB key serial number is a string of characters that can be easily forged and submitted to the server, making it difficult to ensure that the user's digital certificate is written into a legitimate USB key.

To address the issue of serial numbers being easily forged, a shared key pair can be embedded in the USB key, which is inaccessible to the outside world. The server stores the correspondence between the USB key serial number and the shared key pair. When the client generates a CSR, it encrypts the CSR using the private key of the shared key pair. If the server successfully decrypts the CSR, the USB key is considered legitimate.

However, in such an implementation, an attacker can generate a shared key pair and CSR by himself, and then randomly generate a serial number and send it to the server for verification. It is also difficult to ensure that the user's digital certificate is written into a legitimate USBKey.

Summary of the Invention

In view of this, the present application provides a USB Key, a method and an apparatus for writing a USB Key digital certificate.

Specifically, this application is implemented through the following technical solutions:

A method for writing a USB Key digital certificate, the method comprising:

Receive a first signature certificate request sent by a client, where the first signature certificate request is generated by the client using a built-in identification digital certificate of a USBKey and its corresponding first private key to sign the digital certificate request;

Verify whether the USB Key is legitimate according to the first signature certificate request;

When the USB Key is verified to be legitimate, a digital certificate is issued so that the client can write the digital certificate into the USB Key.

Furthermore, the requesting to verify the legitimacy of the USB Key according to the first signature certificate includes:

Verifying the first signed certificate request;

If the verification of the first signature certificate request is successful, then verifying the legitimacy of the identification certificate;

If the identification certificate is verified to be legal, verify the digital certificate request;

If the digital certificate request is successfully verified, the USB Key is confirmed to be legitimate.

Furthermore, the verifying the first signature certificate request includes:

Obtaining a first public key corresponding to the identification digital certificate carried in the first signature certificate request;

The first signed certificate request is verified using the first public key.

Furthermore, the verifying the legitimacy of the identification certificate includes:

Obtaining the issuer of the identification certificate from the identification certificate;

Find the sub-CA certificate corresponding to the issuer;

The second public key carried in the sub-CA certificate is used to verify whether the identification certificate is legal.

Furthermore, the verifying the legitimacy of the identification certificate includes:

Obtain the serial number of the USB Key from the identification certificate;

Check whether the corresponding relationship between the serial number and the first public key is stored on the device;

If yes, then verify that the identification certificate is legitimate.

A method for writing a USB Key digital certificate, the method comprising:

Use the identification digital certificate built into the USB Key and its corresponding first private key to sign the digital certificate request to generate a first signed certificate request;

Sending the first signature certificate request to the server for the server to verify whether the USB Key is legitimate;

The digital certificate issued by the server when verifying the legitimacy of the USB Key is written into the USB Key.

A USB Key digital certificate writing device, the device comprising:

A receiving unit receives a first signature certificate request sent by a client, where the first signature certificate request is generated by the client using a built-in identification digital certificate of a USB key and its corresponding first private key to sign the digital certificate request;

a verification unit, configured to verify whether the USB Key is legitimate according to the first signature certificate request;

The issuing unit issues a digital certificate when verifying that the USB Key is legitimate, so that the client can write the digital certificate into the USB Key.

Furthermore, the verification unit specifically verifies the first signature certificate request;

When verifying that the first signature certificate request is successful, verifying the legitimacy of the identification certificate;

When verifying the legality of the identification certificate, verifying the digital certificate request;

When the digital certificate request is verified to be successful, the USB Key is confirmed to be legitimate.

Furthermore, the verification unit verifies the first signature certificate request including: obtaining a first public key corresponding to the identification digital certificate carried in the first signature certificate request;

The first signed certificate request is verified using the first public key.

Furthermore, the verification unit verifies the legitimacy of the identification certificate including:

Obtaining the issuer of the identification certificate from the identification certificate;

Find the sub-CA certificate corresponding to the issuer;

The second public key carried in the sub-CA certificate is used to verify whether the identification certificate is legal.

Furthermore, the verification unit verifies the legitimacy of the identification certificate including:

Obtain the serial number of the USB Key from the identification certificate;

Check whether the corresponding relationship between the serial number and the first public key is stored on the device;

When the corresponding relationship between the serial number and the first public key is stored on the device, the legality of the identification certificate is confirmed and verified.

A USB Key digital certificate writing device, the device comprising:

The signature unit uses the identification digital certificate built into the USB key and its corresponding first private key to sign the digital certificate request to generate a first signature certificate request;

A sending unit, sending the first signature certificate request to a server, so that the server can verify whether the USB Key is legitimate;

The writing unit writes the digital certificate issued by the service end when verifying the legitimacy of the USB Key into the USB Key.

A USB Key, comprising: a USB Key interface, a USB Key chip and a storage module,

The USB Key storage module has a built-in identification digital certificate and its corresponding first private key, so that the client can generate a first signature certificate request according to the identification digital certificate and the corresponding first private key;

The client is connected to the USB Key via the USB Key interface.

Furthermore, the USB Key chip generates a third private key and a corresponding third public key according to the client's request, so that the client can generate a digital certificate request based on the third private key and the third public key; and the client can sign the digital certificate request based on the identification digital certificate and the corresponding first private key to generate the first signature certificate request.

Furthermore, the USB Key chip stores, in accordance with an instruction from the client, a digital certificate issued by the server when verifying the legitimacy of the USB Key according to the first signature certificate request in the storage module.

Furthermore, the identification digital certificate is issued by the USB Key manufacturer or a third-party CA.

As can be seen from the above description, this application uses the standard USB Key certificate writing process to pre-set the identification certificate for the USB Key. When the server issues a digital certificate, it verifies the legitimacy of the USB Key by verifying the legitimacy of the identification certificate, thereby ensuring that the issued digital certificate can be written into a legal USB Key.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a method for writing a USB Key digital certificate in one embodiment of the present application.

FIG2 is a flow chart of a method for writing a USB Key digital certificate in another embodiment of the present application.

FIG3 is a flow chart of a method for writing a USB Key digital certificate in another embodiment of the present application.

FIG4 is a schematic diagram of the structure of the server in one embodiment of the present application.

FIG5 is a schematic structural diagram of a USB Key digital certificate writing device in an embodiment of the present application.

FIG6 is a schematic diagram of the structure of a client in an embodiment of the present application.

FIG7 is a schematic structural diagram of a USB Key digital certificate writing device in another embodiment of the present application.

FIG8 is a schematic diagram of the structure of a USB Key in an embodiment of the present application.

DETAILED DESCRIPTION

Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

To address the above issues, the present application provides a USB Key digital certificate writing solution, which pre-stores an identification certificate in the USB Key and verifies the legitimacy of the identification certificate on the server to verify the legitimacy of the USB Key.

The implementation process of this application is described below with reference to specific embodiments.

This application provides a method for writing a digital certificate to a USB key, which is applied to both the client and the server. Referring to FIG1 , the method for writing a digital certificate to the client includes the following steps:

Step 101: Use the identification digital certificate built into the USB Key and its corresponding first private key to sign a digital certificate request to generate a first signed certificate request.

Step 102: Send the first signature certificate request to the server so that the server can verify whether the USB Key is legitimate.

Step 103: Write the digital certificate issued by the server when verifying the legitimacy of the USB Key into the USB Key.

Referring to Figure 2, the method for writing a digital certificate on the server side includes the following steps:

Step 201: Receive a first signature certificate request sent by a client, where the first signature certificate request is generated by the client using a built-in identification digital certificate in a USB Key and its corresponding first private key to sign the digital certificate request.

Step 202: Verify whether the USB Key is legitimate according to the first signature certificate request.

Step 203: When the USB Key is verified to be legitimate, a digital certificate is issued, so that the client can write the digital certificate into the USB Key.

In this application, after receiving the first signature certificate request sent by the client, the server can determine the legitimacy of the USB Key by verifying the legitimacy of the USB Key identification certificate. The identification certificate is usually written before the USB Key is sold. It can be written by the USB Key manufacturer or by a third-party CA service before the USB Key is sold. For example, a bank writes an identification certificate into the USB Key before selling it to the user. Specifically, the writing process of the identification certificate can use the standard USB Key certificate writing process described in the background technology:

1. After connecting to the USB Key, the client requests the USB Key to generate an asymmetric key pair: a first private key and a first public key.

2. The client generates a CSR based on the first public key and the first private key, and sends it to the server.

3. The server verifies the CSR using the first public key. If the verification is successful, the server issues the identification certificate to the client.

4. The client writes the identification certificate into the USB Key and associates the identification certificate with the first private key.

In this process, since the identification certificate is written into the USB Key before the sale, the client and the server can use the intranet to communicate, thereby ensuring that the legal identification certificate is written into the USB Key.

After writing the identification certificate into the USB Key, the USB Key can be sold to the user. After purchasing the USB Key, the user needs to request a digital certificate from the CA when using the USB Key for the first time, and then write the digital certificate issued by the CA into the USB Key. When using the USB Key in the future, the user can directly use the digital certificate to prove his or her identity. Of course, in actual applications, the USB Key seller can also assist the user in writing his or her digital certificate into the USB Key. The CA can be an independent CA server, or the CA function can be integrated into the merchant's service end, which is not limited in this application. The following description takes the server-side integrated CA function module as an example.

Please refer to Figure 3. In the process of obtaining the user digital certificate, according to the standard USB Key certificate writing process, the following steps are included:

Step 301: The client requests the USB Key to generate an asymmetric key pair.

For the purpose of distinction, in this step, the asymmetric key pair generated by the USB Key is referred to as a third public key and a third private key.

Step 302: The client generates a digital certificate request for the user based on the third public key and the third private key.

In this step, the third private key is used to sign the user's application content and the third public key to generate a third signature. The digital certificate request typically includes the user's application content, the third public key, and the third signature. The user's application content includes user information, such as username, password, email address, etc. The digital certificate request can use the PKCS10 standard.

In step 303 , the client uses the identification certificate built into the USB Key and its corresponding first private key to sign the digital certificate request to generate a first signed certificate request.

In this step, the digital certificate request may be signed using the PKCS7 standard, and the generated first signature certificate request carries the identification certificate.

Step 304: The client sends the first signature certificate request to the server.

Step 305: The server receives the first signature certificate request sent by the client.

Step 306: The server verifies the first signature certificate request.

In this step, the server obtains the first public key corresponding to the identification certificate from the identification certificate carried in the first signature certificate request, and then uses the first public key to verify the signature of the first signature certificate. If the verification is successful, go to step 307. If the verification is unsuccessful, end the process.

Step 307: The server verifies the legitimacy of the identification certificate.

In this step, the server obtains the issuer of the identification certificate from the identification certificate. Specifically, taking the identification certificate issued by the USB Key manufacturer as an example, the issuer of the identification certificate is the USB Key manufacturer. The server then searches for the corresponding sub-CA certificate based on the USB Key manufacturer, that is, searches for the certificate of the USB Key manufacturer. Specifically, the certificates of each USB Key manufacturer can be pre-stored on the server. If the certificate of the USB Key manufacturer is not found based on the issuer of the identification certificate, the process ends. If the certificate of the USB Key manufacturer is found based on the identification certificate, the public key of the USB Key manufacturer is obtained from the certificate of the USB Key manufacturer, referred to as the second public key in this application, and then the second public key is used to verify the legitimacy of the identification certificate. Specifically, a legitimate identification certificate will be signed by the USB Key manufacturer, so the public key of the USB Key manufacturer, that is, the second public key, can be used to verify the legitimacy of the identification certificate. If the identification certificate is legitimate, the process proceeds to step 308. If the identification certificate is not legitimate, the process ends.

In another embodiment of the present application, the serial number of the USB Key can also be used to verify the legitimacy of the identification certificate. Specifically, the USB Key manufacturer can store the serial number of the USB Key in the identification certificate, such as setting the subject of the identification certificate to the serial number of the USB Key. The correspondence between the serial number and the first public key corresponding to the identification certificate is then recorded and pre-stored by the server. When verifying the legitimacy of the identification certificate, the server obtains the serial number of the USB Key from the identification certificate, and then checks whether the correspondence between the serial number and the first public key is stored on the device. If so, the identification certificate is confirmed to be legal and the process is terminated. If not, the process is terminated. By using the serial number to verify the legitimacy of the identification certificate, when the private key of the USB Key manufacturer is leaked, the attacker still cannot forge the correspondence between the serial number and the first public key, which can further improve the security of the USB Key.

Step 308: The server verifies the digital certificate request.

In this step, the server verifies the third signature using the third public key carried in the digital certificate request. If the verification succeeds, the USB Key is confirmed to be legitimate, and the process goes to step 309. If the verification fails, the process ends.

Step 309: The server issues a digital certificate.

Step 310: The client writes the digital certificate into the USB Key.

As can be seen from the above description, this application uses the standard USB Key certificate writing process to pre-set the identification certificate for the USB Key. When the server issues a digital certificate, it verifies the legitimacy of the USB Key by verifying the legitimacy of the identification certificate, thereby ensuring that the issued digital certificate can be written into a legal USB Key.

Corresponding to the above-mentioned USB Key digital certificate writing method, in another embodiment of the present application, a USB Key digital certificate writing device 400 is provided. Referring to Figures 4 and 5 , the device 400 is applied on the server and includes: a receiving unit 401 , a verification unit 402 , and an issuing unit 403 .

The receiving unit 401 receives a first signature certificate request sent by a client, where the first signature certificate request is generated by the client using a built-in identification digital certificate in a USB key and its corresponding first private key to sign the digital certificate request.

The verification unit 402 verifies whether the USB Key is legitimate according to the first signature certificate request.

The issuing unit 403 issues a digital certificate when verifying that the USB Key is legitimate, so that the client can write the digital certificate into the USB Key.

Furthermore, the verification unit 402 specifically verifies the first signature certificate request;

When verifying that the first signature certificate request is successful, verifying the legitimacy of the identification certificate;

When verifying the legality of the identification certificate, verifying the digital certificate request;

When the digital certificate request is verified to be successful, the USB Key is confirmed to be legitimate.

Furthermore, the verification unit 402 verifies the first signature certificate request including: obtaining a first public key corresponding to the identification digital certificate carried in the first signature certificate request;

The first signed certificate request is verified using the first public key.

Furthermore, the verification unit 402 verifies the legitimacy of the identification certificate including:

Obtaining the issuer of the identification certificate from the identification certificate;

Find the sub-CA certificate corresponding to the issuer;

The second public key carried in the sub-CA certificate is used to verify whether the identification certificate is legal.

Furthermore, the verification unit 402 verifies the legitimacy of the identification certificate including:

Obtain the serial number of the USB Key from the identification certificate;

Check whether the corresponding relationship between the serial number and the first public key is stored on the device;

When the corresponding relationship between the serial number and the first public key is stored on the device, the legality of the identification certificate is confirmed and verified.

In another embodiment of the present application, a USB Key digital certificate writing device 500 is provided. Referring to FIG6 and FIG7 , the device is applied on a client and includes: a signing unit 501 , a sending unit 502 , and a writing unit 503 .

The signature unit 501 uses the identification digital certificate built into the USB Key and its corresponding first private key to sign the digital certificate request to generate a first signature certificate request.

The sending unit 502 sends the first signature certificate request to the server, so that the server can verify whether the USB Key is legal.

The writing unit 503 writes the digital certificate issued by the server when verifying the legitimacy of the USB Key into the USB Key.

The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art can understand and implement it without paying any creative work.

Referring to FIG8 , the present application also provides a USB key. The USB key includes a USB key interface, a USB key chip, and a storage module. Of course, the USB key may also include hardware circuits. The storage module is typically provided on the USB key chip and is used to store various digital certificates.

Specifically, the storage module of the USB Key has a built-in identification digital certificate and its corresponding first private key, so that the client can generate a first signature certificate request according to the identification digital certificate and the corresponding first private key;

The client is connected to the USB Key via the USB Key interface.

Furthermore, the USB Key chip generates a third private key and a corresponding third public key according to the client's request, so that the client can generate a digital certificate request based on the third private key and the third public key; and the client can sign the digital certificate request based on the identification digital certificate and the corresponding first private key to generate the first signature certificate request.

Furthermore, the USB Key chip stores, in accordance with an instruction from the client, a digital certificate issued by the server when verifying the legitimacy of the USB Key according to the first signature certificate request in the storage module.

Furthermore, the identification digital certificate is issued by the USB Key manufacturer or a third-party CA.

The above-mentioned specific implementation of the USB Key can refer to the description in the embodiment of the method of this application, and will not be repeated here.

The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims (16)

1. A method for writing a USB Key digital certificate, characterized in that the method includes: The system receives a first signature certificate request sent by the client. The first signature certificate request is generated by the client signing the digital certificate request using the identity certificate built into the USB Key and its corresponding first private key; wherein, the identity certificate and the first private key are associated. Verify the validity of the USB Key according to the first signature certificate request; Upon verifying the validity of the USB Key, a digital certificate is issued, which the client can then write to the USB Key. 2. The method according to claim 1, characterized in that, The step of verifying the legitimacy of the USB Key according to the first signature certificate request includes: Verify the first signature certificate request; If the verification of the first signature certificate request is successful, then the validity of the identification certificate is verified. If the identity certificate is verified to be valid, then the digital certificate request is verified. If the verification of the digital certificate request is successful, the USB Key is confirmed to be valid. 3. The method according to claim 2, characterized in that, The verification request for the first signature certificate includes: Obtain the first public key corresponding to the identifier certificate carried in the first signature certificate request; Use the first public key to verify the first signature certificate request. 4. The method according to claim 2, characterized in that, The verification of the legitimacy of the identifier certificate includes: Obtain the issuer of the identity certificate from the identity certificate; Locate the sub-CA certificate corresponding to the issuer; The second public key carried in the sub-CA certificate is used to verify whether the identity certificate is valid. 5. The method according to claim 3, characterized in that, The verification of the legitimacy of the identifier certificate includes: Obtain the serial number of the USB Key from the identification certificate; Check whether the device stores the correspondence between the serial number and the first public key; If so, verify the validity of the identification certificate. 6. A method for writing a USB Key digital certificate, characterized in that the method includes: The first signature certificate request is generated by signing the digital certificate request using the built-in identifier certificate of the USB Key and its corresponding first private key; wherein the identifier certificate and the first private key are associated. The first signature certificate request is sent to the server so that the server can verify whether the USB Key is valid; Write the digital certificate issued by the server when verifying the validity of the USB Key into the USB Key. 7. A USB Key digital certificate writing device, characterized in that the device comprises: The receiving unit receives a first signature certificate request sent by the client. The first signature certificate request is generated by the client signing the digital certificate request using the identifier certificate built into the USB Key and its corresponding first private key; wherein, the identifier certificate and the first private key are associated. The verification unit verifies whether the USB Key is valid based on the first signature certificate request. The issuing unit issues a digital certificate when verifying the validity of the USB Key, so that the client can write the digital certificate into the USB Key. 8. The apparatus according to claim 7, characterized in that, The verification unit specifically verifies the first signature certificate request; Upon successful verification of the first signature certificate request, the validity of the identification certificate is verified. While verifying the validity of the identification certificate, verify the digital certificate request; If the digital certificate request is successfully verified, the USB Key is confirmed to be valid. 9. The apparatus according to claim 8, characterized in that, The verification unit verifies the first signature certificate request by: obtaining the first public key corresponding to the identifier certificate carried in the first signature certificate request; Use the first public key to verify the first signature certificate request. 10. The apparatus according to claim 8, characterized in that, The verification unit verifies the legality of the identifier certificate by including: Obtain the issuer of the identity certificate from the identity certificate; Locate the sub-CA certificate corresponding to the issuer; The second public key carried in the sub-CA certificate is used to verify whether the identity certificate is valid. 11. The apparatus according to claim 6, characterized in that, The verification unit verifies the legality of the identifier certificate by including: Obtain the serial number of the USB Key from the identification certificate; Check whether the device stores the correspondence between the serial number and the first public key; When the device stores the correspondence between the serial number and the first public key, the validity of the identification certificate is verified. 12. A USB Key digital certificate writing device, characterized in that the device comprises: The signing unit uses the identifier certificate built into the USB Key and its corresponding first private key to sign the digital certificate request, thereby generating a first signature certificate request; wherein, the identifier certificate and the first private key are associated. The sending unit sends the first signature certificate request to the server so that the server can verify whether the USB Key is valid; The writing unit writes the digital certificate issued by the server when verifying the validity of the USB Key into the USB Key. 13. A USB Key, comprising: a USB Key interface, a USB Key chip, and a storage module, characterized in that, The USB Key's storage module contains a built-in identification certificate and its corresponding first private key, which allows the client to generate a first signature certificate request based on the identification certificate and the corresponding first private key; wherein, the identification certificate and the first private key are associated. The client connects to the USB Key via the USB Key interface. 14. The USB Key according to claim 13, characterized in that, The USB Key chip generates a third private key and a corresponding third public key according to the client's request, so that the client can generate a digital certificate request based on the third private key and the third public key; so that the client can sign the digital certificate request based on the identification certificate and the corresponding first private key to generate the first signature certificate request. 15. The USB Key according to claim 13, characterized in that, The USB Key chip stores the digital certificate issued by the server when verifying the validity of the USB Key according to the first signature certificate request in the storage module, according to the client's instructions. 16. The USB Key according to claim 13, characterized in that, The identification certificate is issued by the USB Key manufacturer or a third-party CA.