WO2024016829A1 - 一种安全设备的实现方法及安全设备 - Google Patents

一种安全设备的实现方法及安全设备 Download PDF

Info

Publication number
WO2024016829A1
WO2024016829A1 PCT/CN2023/095726 CN2023095726W WO2024016829A1 WO 2024016829 A1 WO2024016829 A1 WO 2024016829A1 CN 2023095726 W CN2023095726 W CN 2023095726W WO 2024016829 A1 WO2024016829 A1 WO 2024016829A1
Authority
WO
WIPO (PCT)
Prior art keywords
instruction
certificate
security device
data
preset
Prior art date
Application number
PCT/CN2023/095726
Other languages
English (en)
French (fr)
Inventor
陆舟
Original Assignee
飞天诚信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 飞天诚信科技股份有限公司 filed Critical 飞天诚信科技股份有限公司
Publication of WO2024016829A1 publication Critical patent/WO2024016829A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements

Definitions

  • the present invention relates to the field of information security, and in particular to an implementation method of security equipment and security equipment.
  • the security devices used in the traditional PKI (Public Key Infrastructure) system need to install different plug-ins through different browsers to access the server, which limits the scope of use of the security devices used in the PKI system.
  • the present invention provides a method for implementing safety equipment and a safety equipment, which solves the above technical problems.
  • An implementation method of safety equipment including:
  • Step 1 The security device waits to receive instructions from the client
  • Step 2 When the first interface of the security device receives the command, it determines whether the received command is a preset FIDO (Fast Identity Online) command. If so, execute step 3. If not, execute the corresponding command operation. Step 1;
  • the first interface is the FIDO HID interface;
  • Step 3 The security device parses the preset FIDO command to obtain the preset parameters, obtains the function instruction according to the preset parameters, and determines the type of the function instruction.
  • the function instruction When the function instruction generates an instruction for a certificate request, perform step 4; when the function instruction When writing certificate instructions, perform step 5;
  • Step 4 The security device generates a key pair, stores the key pair in a storage file, uses the private key of the key pair to sign the user input information in the certificate request generation instruction and the public key of the key pair, and generates a signature value. Generate a response to the certificate request generation command based on the signature value, the public key of the key pair and user input information, generate response data based on the response to the certificate request generation command, generate a response to the preset FIDO command based on the response data, and convert the preset FIDO The response to the command is sent to the client and step 1 is performed;
  • Step 5 The security device writes the certificate data in the certificate command into the storage file, composes response data based on the successful status code, generates a response to the preset FIDO command based on the response data, and sends the response to the preset FIDO command to On the client, perform step 1.
  • a safety device that includes:
  • Waiting to receive module used to wait to receive commands sent by the client
  • the receiving module is used to receive instructions sent by the client
  • the first judgment trigger module is used to judge whether the instruction received by the receiving module is a preset FIDO instruction when the receiving module receives the instruction through the first interface, and is also used to judge whether the instruction result of the first judgment module is yes, Trigger the analysis module; when the judgment result of the second judgment module is no, trigger the first operation module; the first interface is the FIDO HID interface;
  • the first operation module is used to execute the corresponding instruction operation when triggered by the first judgment triggering module
  • the parsing module is used to parse the preset FIDO instructions to obtain the preset parameters and obtain the function instructions based on the preset parameters;
  • the second judgment triggering module is used to judge the type of the function instruction obtained by the parsing module.
  • the second operation module is triggered;
  • the function instruction is judged to be a write certificate instruction, the third operation is triggered. module;
  • the second operation module is used to generate a key pair when triggered by the second judgment triggering module, store the key pair in a storage file, and use the private key of the key pair to request the user input information and key in the certificate generation instruction.
  • Sign the public key of the pair generate a signature value
  • the public key of the key pair and user input information generate response data based on the response to the certificate request generation instruction, and generate a preset based on the response data
  • the third operation module is used to write the certificate data written in the certificate command into the storage file, compose the response data according to the successful status code, generate the response of the preset FIDO command according to the response data, and convert the response of the preset FIDO command Sent to the client, triggering the waiting receiving module.
  • the present invention also provides a security device.
  • the security device includes at least one processor, a memory and instructions stored on the memory and executable by the at least one processor.
  • the at least one processor executes the instructions. To realize the implementation method of the above safety equipment.
  • the present invention also provides a computer-readable storage medium.
  • the computer-readable storage medium includes a computer program. When the computer program is run on a computer, it causes the computer to execute the implementation method of the above security device.
  • the present invention also provides a chip, which is coupled to a memory and used to execute a computer program stored in the memory to execute the implementation method of the above security device.
  • the present invention provides a security device implementation method and security device, adds a FIDO interface to the security device used in the PKI system, realizes the operation of certificates through the FIDO interface, and realizes the operation of certificates for different browsers. plug-in installation-free operation, thereby expanding the application scope of security equipment.
  • Figure 1 is a flow chart of a method for implementing a security device provided by Embodiment 1 of the present invention
  • FIGS. 2 and 3 are flow charts of a method for implementing a security device provided in Embodiment 2 of the present invention
  • FIGS 4 and 5 are flow charts of a method for implementing a security device provided in Embodiment 3 of the present invention.
  • the security equipment in this application is the security equipment used in the PKI system.
  • the present invention provides a method for implementing safety equipment, as shown in Figure 1, including the following steps:
  • Step 1 The security device waits to receive instructions from the client
  • Step 2 When the first interface of the security device receives an instruction, it determines whether the received instruction is a preset FIDO instruction. If so, perform step 3. If not, perform the corresponding instruction operation and perform step 1; first The interface is FIDO HID interface;
  • Step 3 The security device parses the preset FIDO command to obtain the preset parameters, obtains the function instruction according to the preset parameters, and determines the type of the function instruction.
  • the function instruction When the function instruction generates an instruction for a certificate request, perform step 4; when the function instruction When writing certificate instructions, perform step 5;
  • Step 4 The security device generates a key pair, stores the key pair in a storage file, uses the private key of the key pair to sign the user input information in the certificate request generation instruction and the public key of the key pair, and generates a signature value. Generate a response to the certificate request generation command based on the signature value, the public key of the key pair and user input information, generate response data based on the response to the certificate request generation command, generate a response to the preset FIDO command based on the response data, and convert the preset FIDO The response to the command is sent to the client and step 1 is performed;
  • Step 5 The security device writes the certificate data in the certificate command into the storage file, composes response data based on the successful status code, generates a response to the preset FIDO command based on the response data, and sends the response to the preset FIDO command to On the client, perform step 1.
  • the storage file is a container file
  • the container file has a corresponding container identifier
  • step 4 the security device generates a key pair and stores the key pair in a storage file. Specifically, the security device generates a key pair and stores the key pair in the certificate request generation instruction. In the container file corresponding to the container ID;
  • step 5 the security device writes the certificate data written in the certificate instruction into the storage file. Specifically, the security device writes the certificate data written in the certificate instruction into the container file corresponding to the container identifier written in the certificate instruction.
  • step 4 is specifically performed as follows:
  • the security device determines whether there is a container file corresponding to the container ID in the certificate request generation instruction. If so, perform step 4. If not, the security device creates a container file corresponding to the container ID in the certificate request generation instruction. Perform steps 4.
  • step 3 also includes:
  • step 6 When the function instruction is a read certificate instruction, perform step 6; when the function instruction is a signature instruction, perform step 7;
  • Step 6 The security device obtains the certificate data from the container file corresponding to the container ID in the read certificate command, sends the obtained certificate data to the client, and performs step 1;
  • Step 7 The security device obtains the container ID and the information to be signed from the signature instruction, reads the private key from the container file corresponding to the container ID, signs the information to be signed based on the found private key, and obtains the signature result.
  • the signature result is composed Preset the response of the FIDO command, send the response of the preset FIDO command to the client, and perform step 1.
  • step 2 further includes: when the second interface of the security device receives an instruction and the received instruction type is a read certificate instruction, the security device obtains it from the container file corresponding to the read certificate instruction. Certificate data and return the certificate data to the client, perform step 1.
  • the storage files include: IKF (Internal Key File) files, public area files and private area files.
  • the public area files include container objects, public key objects, acceleration objects and certificate objects, and the private area files include Private key object, public zone files have corresponding public zone file identifiers, and private zone files have corresponding private zone file identifiers.
  • step 4 the security device generates a key pair and stores the key pair in a storage file as follows:
  • Step 4-1 The security device generates a key pair and key identifier, and stores the key pair and key identifier in the preset IKF file;
  • Step 4-2 The security device creates container objects, public key objects, and private key objects;
  • Step 4-3 The security device associates the container name of the container object, the certificate DN (Distinct Name) value in the user input information in the certificate request generation command, and the key identifier to generate an acceleration object record, and stores the acceleration object record in the acceleration object. In order to update the acceleration object;
  • step 5 the security device writes the certificate data written in the certificate instruction into the storage file. Specifically, the security device creates the certificate object and certificate object identifier based on the certificate data written in the certificate instruction, and compares the certificate object identifier with the certificate object identifier in the acceleration object. The acceleration object record corresponding to the certificate DN value in the certificate data is associated to update the acceleration object.
  • step 3 also includes: when the functional instruction is a read certificate instruction, perform step 6'; when the functional instruction is a signature instruction, perform step 7';
  • Step 6' The security device traverses the acceleration object records in the acceleration object based on the certificate DN value or container name in the read certificate command, and finds the corresponding acceleration object record based on the certificate DN value or container name. From the acceleration object record Obtain the certificate object identifier, obtain the certificate data from the certificate object according to the certificate object identifier, generate response data according to the certificate data, form a response to the preset FIDO instruction based on the response data, send the response to the preset FIDO instruction to the client, and perform step 1 ;
  • Step 7' The security device traverses the acceleration object records in the acceleration object based on the certificate DN value or container name in the signature instruction, finds the acceleration object record corresponding to the certificate DN value or container name, and obtains the password from the acceleration object record.
  • Key identification find the corresponding private key from the IKF file according to the key identification, use the private key to sign the data to be signed in the signature instruction and obtain the signature result, form a response to the preset FIDO instruction based on the signature result, and preset FIDO
  • the response to the command is sent to the client and step 1 is performed.
  • step 2 also includes:
  • step a1 is executed;
  • Step a1 the security device uses the public zone file as the current file
  • step b1 is executed;
  • Step b1 The security device sends the container object, public key object, acceleration object, and certificate object in the current file to the client, and returns to step 1.
  • step 3 the security device parses the preset FIDO instructions to obtain the preset parameters, obtains the function instructions based on the preset parameters, and determines the type of the function instructions as follows:
  • the security device parses the preset FIDO instructions to obtain preset parameters, converts the data of the preset parameters to obtain converted data, uses a predetermined algorithm to decrypt the converted data to obtain decrypted data, and performs the operation of removing padding data on the decrypted data to obtain Functional instruction, the type of functional instruction is obtained according to the instruction identifier in the functional instruction.
  • a response to a preset FIDO instruction is generated based on the response data, and the response to the preset FIDO instruction is sent to the client.
  • the security device fills the response data according to predetermined rules to obtain the filling data. , encrypt the padding data to obtain ciphertext data, use the ciphertext data as verification data parameters, and form a preset FIDO instruction response based on the verification data parameters and return it to the client.
  • This embodiment provides a method for implementing a security device, as shown in Figures 2 and 3, including:
  • the security device waits to receive instructions from the client
  • the security device is a composite USB (Universal Serial Bus) device that supports at least two interfaces.
  • the first interface is a FIDO HID (Human interface Device) interface
  • the second interface can be a UMS ( Usb Mass Storage) interface, HID interface, CCID (Chip/Smart Card Interface Device) interface or SCSI (Small Computer System Interface) interface.
  • the first interface supports two endpoints, namely an interrupt output endpoint and an interrupt input endpoint.
  • the second interface supports two endpoints, namely the batch output endpoint and the batch input endpoint.
  • the instructions received by the UMS interface, HID interface, CCID interface, and SCSI interface of the security device are sent by the client to the security device through the client's middleware, and the security device sends the instruction processing results to the client's middleware through the above interfaces. .
  • the security device determines whether the first interface has received the instruction. If yes, execute step 103. If not, execute step 105;
  • the security device determines whether the FIDO HID interface has received the instruction. If yes, execute step 103; if not, execute step 105;
  • the security device determines whether the FIDO HID interface has received the instruction. The security device determines whether the interrupt output endpoint has received the instruction data. If so, perform step 103. If not, perform step 105;
  • the security device determines whether the received instruction is a voucher generation instruction. If so, perform step 104. If not, the security device performs other corresponding instruction operations or reports an error, and performs step 101;
  • the security device parses the voucher generation instruction to obtain the display name parameter, processes the display name parameter to obtain the function instruction, and determines the type of the function instruction.
  • steps A1-A4 are executed;
  • step C1 When the function instruction is an enumeration certificate instruction, perform step C1;
  • step C2 is executed;
  • the security device parses the credential generation instruction to obtain the display name parameter, processes the display name parameter to obtain the function instruction, and determines the type of the function instruction specifically as follows:
  • the security device parses the credential generation instruction to obtain the display name parameter (Displayname ), convert the data of the display name parameter to obtain hexadecimal data, use the AES-128 algorithm to decrypt and de-fill the hexadecimal data to obtain the function instruction, and obtain the type of the function instruction according to the instruction identification in the function instruction.
  • the security device parses the credential generation instruction to obtain client data (clientDataHash), relying party identification (rp), user information (user) and algorithm parameters (pubkeyCredParams), and parses the display name parameter (displayname) from the user information. .
  • the security device FIDO HID interface receives the credential generation instruction sent by the client:
  • the security device performs a CBOR decoding operation on the above credential generation instruction and obtains the client data (clientDataHash) from the decoded credential generation instruction: 015820687134968222EC17202E42505F8ED2B16AE22F16BB05B88C25DB9E602645F141;
  • the certificate request generation instruction also includes a key identifier and a certificate type.
  • the acquisition process of the write certificate command, read certificate command, transaction signature command, and enumerate certificate command is the same as the above example certificate request generation command, and will not be described again.
  • the credential generation instruction can be any preset FIDO instruction
  • the display name parameter can be a preset parameter of the FIDO instruction with no length limit.
  • the preset FIDO instruction is a credential generation instruction
  • the preset The parameters can be extension parameters; when the preset FIDO command is a certificate authentication command, the preset parameter is a whitelist parameter.
  • the security device determines whether the second interface has received the instruction. If so, perform step 106. If not, return to step 101;
  • step 106 determines whether the batch output endpoint has received the instruction. If so, execute step 106; if not, return to step 101;
  • the security device can also first determine whether the second interface has received the instruction. If so, perform step 106; if not, then determine whether the first interface has received the instruction. If yes, perform step 103. If not, perform step 103. , return to step 101.
  • the safety device determines the type of instruction received
  • execute step M1 When the instruction is a key pair generation instruction, execute step M1; when the instruction is a read public key instruction, execute step M2; when the instruction is a generate signature instruction, execute step M3; when the instruction is a write container object instruction, Execute step M4; when the instruction is to write a public key object instruction, execute step M5; when the instruction is to write a certificate object instruction, execute step M6; when the instruction is to write a private key object instruction, execute step M7.
  • execute step M8 When the instruction When the instruction is to write an acceleration object, execute step M8; when the instruction is to select a file, execute step M9; when the instruction is to read a binary file, execute step M10; when the instruction is to set a security environment instruction, execute step M11; When the instruction is to send message data, execute step M12; when the instruction is a signature request instruction, execute step M13; when the instruction is to obtain a signature result, execute step M14;
  • the certificate request generation instruction includes the certificate DN value.
  • Step A1 the security device generates a key pair
  • the key device while the key device generates a key pair, it also generates a key identifier corresponding to the key pair, and stores the public key and private key of the key pair.
  • Step A2 The security device uses the private key of the key pair to sign the user input information in the certificate request generation instruction and the public key of the key pair, and generates a signature value. Based on the signature value, the public key of the key pair and the user input information Generate a response to the certificate request generation command;
  • the information entered by the user includes the certificate DN value.
  • the certificate DN value can be pre-issued by the certification center or obtained by the user according to predetermined conditions.
  • the response to the certificate request generation command generated by the security device is as follows:
  • Step A3 The security device creates a container object and the corresponding container object identifier, private key object, and public key object, associates the container object with the corresponding container object identifier, public key object, and private key object, and associates the container object with the public key object.
  • Write to the public zone file write the private key object to the private zone file, and update the acceleration object in the public zone file;
  • the private key object includes the key identifier
  • the public key object includes the key identifier and the public key of the key pair.
  • the security device has a storage area, and the storage area includes IKF files, public area files, and private area files.
  • the IKF file is an internal key file, which is a secret file
  • Public area files have corresponding public area file identifiers
  • private area files have corresponding private area file identifiers. Both public area files and private area files are storage files.
  • step A1 also includes: the security device stores the generated key pair and key identification in the IKF file.
  • the security device creates a container object and the corresponding container object identifier, private key object, and public key object, and associates the container object with the corresponding container object identifier, public key object, and private key object.
  • the security device creates a container.
  • the object and the corresponding container object identifier are hashed according to the public key of the key pair to obtain the container name of the container object.
  • the private key object identifier and the public key object identifier are associated and stored in the container object.
  • updating the acceleration object in the public zone file specifically involves associating the key identifier, certificate DN value, and container name of the container object to generate an acceleration object record, and storing the generated acceleration object record in the acceleration object.
  • this step before updating the acceleration object in the public zone file, it also includes: creating the acceleration object and storing the acceleration object in the public zone file.
  • Step A4 The security device composes a response to the certificate generation instruction based on the response to the certificate request generation instruction and sends it to the client, and executes step 101;
  • the security device receives the instruction from the FIDO HID interface, and the processing result obtained after processing the instruction is returned to the client through the interrupt input endpoint.
  • This step is specifically as follows: the security device responds to the certificate request generation instruction by filling it in according to predetermined rules to obtain filling data, encrypts the filling data to obtain ciphertext data, uses the ciphertext data as verification data parameters, and generates the certificate based on the verification data parameters.
  • the response to the instruction is sent to the client, and step 101 is executed.
  • the predetermined rule is: fill in a byte 0x80 at the end of the response data of the certificate request generation instruction to obtain the data to be processed, and determine whether the filled data is an integer multiple of 16 bytes. If it is an integer multiple of 16 bytes, Then the data to be processed is padding data, otherwise 0x00 will continue to be filled at the end of the data to be processed until the padding data is obtained as an integer multiple of 16 bytes.
  • the security device fills the response to the certificate request generation command to obtain the filling data, encrypts the filling data with the AES_128 algorithm and obtains the encrypted data C35F118D4DDE91CC9E7DBD979F7FB584CDFE08016AF092019C1618C36D0A6EB7D1808717D8A7AB13CEBCE51FB2889DDB000B40E 4C74FBEA0542A26A90E424D9B1EB0EDAC6F0A16FF88C517EE7D96CE568E5BEB1D1ACCFCDBFDDC7E52352A5D6A98EB6BE0F1DC1132B06D513A8108E82BCACD7C87169695E06604A025 4BC2F808A6734E8D5AEDEBCA1CA08B003 , use the encrypted data as the verification data parameter (AuthData), and send the response to the credential generation instruction
  • the display name parameter is a write certificate command, read certificate command, transaction signature command, or enumerate certificate command
  • the response of the certificate generation command is composed in the same manner as the above example certificate request generation command, no longer Repeat.
  • the client after receiving the response to the credential generation instruction sent by the security device, the client sends the response to the credential generation instruction to the authentication server for verification.
  • the authentication server When the verification by the authentication server is successful, the authentication server generates certificate data and sends it to the client. Returns a result including successful verification and certificate data.
  • the authentication server fails to verify, returns a result including verification failure to the client;
  • the user inputs information according to the public key of the key pair, such as the certificate DN value, and uses its own private key to sign, and generates a signature result.
  • the public key of the key pair the user inputs information and signature results to generate certificate data.
  • the client When the client receives the successful verification result and certificate data, the client generates a write certificate command, and uses the write certificate command to form a certificate generation command and send it to the security device.
  • the write certificate instruction includes the certificate DN value and certificate data.
  • the write certificate command can also include the container name and certificate data.
  • Step B1 The security device creates a certificate object based on the certificate data written in the certificate instruction, and assigns the corresponding certificate object identifier to the certificate object;
  • the certificate data includes the public key of the key pair
  • the certificate object created includes the certificate data
  • Step B2 the security device associates the container object and the certificate object
  • This step is specifically: the security device traverses the acceleration object and determines whether it finds the acceleration object record corresponding to the certificate DN value that is the same as the certificate DN value contained in the write certificate command. If so, obtains the acceleration object record found with the same certificate DN value.
  • the container object identifier associated with the certificate DN value finds the corresponding container object according to the container object identifier, and stores the certificate object identifier in the container object. If not, the security device returns an error status code to the client, and performs step 101.
  • This step can also be specifically: the security device traverses the acceleration object, and determines whether it finds the acceleration object record corresponding to the container name that is the same as the container name included in the write certificate instruction. If so, obtains the acceleration object record found with The container object identifier associated with the container name is used to find the corresponding container object according to the container object identifier, and the certificate object identifier is stored in the container object. If not, the security device returns an error status code to the client and executes step 101.
  • Step B3 The security device writes the certificate object to the public zone file, updates the acceleration object of the public zone file, and sends a response to the certificate generation instruction based on the successful status code to the client, and executes step 101;
  • updating the acceleration object of the public zone file is specifically: combining the certificate object identifier, the offset value of the certificate data in the certificate object, and the length of the certificate data with the certificate DN value and the certificate DN value in the acceleration object record found through traversal. close The associated key identifier and the container name of the container object are associated to update the found acceleration object record, and the updated acceleration object record is stored in the acceleration object.
  • the acceleration object for updating the public zone file can also be specifically: combining the certificate object identifier, the offset value of the certificate data in the certificate object, and the length of the certificate data with the container name and its associated password found through traversal.
  • the key identifier and certificate DN value are associated to update the found acceleration object record, and the updated acceleration object record is stored in the acceleration object.
  • composing the response to the voucher generation instruction based on the successful status code specifically involves processing the successful status code to obtain verification data parameters, and composing the response to the voucher generation instruction based on the verification data parameters.
  • the process of processing the successful status code to obtain the verification data parameters is the same as the process of obtaining the verification data parameters based on the response to the certificate request generation instruction in step A4, and will not be described again.
  • Step C1 The security device enumerates all certificate DN values in the acceleration object, composes a response to the credential generation instruction based on all the enumerated certificate DN values and returns it to the client, and executes step 101.
  • This step can also be: the security device traverses the acceleration object records in the acceleration object, enumerates all container names in the acceleration object, composes a response to the credential generation instruction based on all the enumerated container names and returns it to the client, and executes step 101. .
  • the response to the credential generation instruction composed of all the enumerated certificate DN values or container names is specifically: process all the enumerated certificate DN values or container names to obtain verification data parameters, and form the response of the credential generation instruction based on the verification data parameters.
  • the process of processing all enumerated certificate DN values or container names to obtain verification data parameters is the same as the process of obtaining verification data parameters based on the response to the certificate request generation instruction in step A4, and will not be described again.
  • the client displays all enumerated certificate DN values or container names based on the response to the certificate generation instruction for the user to select, and composes a read certificate instruction based on the certificate DN value or container name selected by the user.
  • Step C2 The security device traverses the acceleration object, finds the acceleration object record including the certificate DN value in the read certificate instruction, and obtains the certificate object identifier associated with the certificate DN value in the acceleration object record and the location of the certificate data in the certificate object. offset and the length of the certificate data, find the corresponding certificate object according to the certificate object identifier, obtain the certificate data from the certificate object according to the offset of the certificate data in the certificate object and the length of the certificate data, and compose the certificate generation instruction based on the certificate data
  • the response is sent to the client and step 101 is executed;
  • the certificate DN value can also be the container name.
  • the client after receiving the response to the certificate generation instruction, the client sends the certificate data in the response to the certificate generation instruction to the transaction server, so that the transaction server uses the certificate data to verify the signature result sent by the client.
  • the response to the voucher generation instruction composed of the certificate data is specifically: the certificate data is processed to obtain verification data parameters, and the response to the voucher generation instruction is composed according to the verification data parameters.
  • the process of processing the certificate data to obtain the verification data parameters is the same as the process of obtaining the verification data parameters based on the response to the certificate request generation instruction in step A4, and will not be described again.
  • Step D1 The security device parses the transaction signature instruction to obtain the certificate DN value and message data;
  • This step can also be: the security device parses the transaction signature instruction to obtain the container name and message data;
  • the certificate DN value or container name in the transaction signature instruction is the certificate DN value or container name selected by the user when all certificate DN values or container names are enumerated.
  • Step D2 The security device traverses the acceleration object, finds the acceleration object record that includes the same certificate DN value in the acceleration object, obtains the key identifier associated with the certificate DN value in the acceleration object record, and finds the key identifier based on the key identifier.
  • the corresponding private key
  • This step can also be: the security device traverses the acceleration object, finds the acceleration object record that includes the same container name in the acceleration object, obtains the key identifier associated with the container name in the acceleration object record, and finds the IKF file based on the key identifier.
  • Step D3 The security device parses the message data to obtain the data to be signed and key information
  • the key information is, for example, transaction information or partial information extracted from the transaction information.
  • Step D4 the security device displays key information and prompts the user for confirmation
  • Step D5 After receiving the user's confirmation information, the security device signs the data to be signed based on the found private key to obtain the signature result. Based on the signature result, a response to the certificate generation instruction is formed and returned to the client. Step 101 is executed;
  • the response to the voucher generation instruction is composed according to the signature result as follows: the signature result is processed to obtain the verification data parameters, and the response to the voucher generation instruction is composed according to the verification data parameters.
  • the process of processing the signature result to obtain the verification data parameters is the same as the processing method of the verification data parameters obtained according to the response to the certificate request generation instruction in step A4, and will not be described again.
  • the client sends the signature result obtained by sending a response to the certificate generation instruction to the transaction server, and the transaction server verifies the signature result based on the certificate data.
  • Step M1 The security device generates a key pair, returns a successful status code to the client, and executes step 101;
  • the key device while the key device generates the key pair, it also generates a key identifier corresponding to the key pair.
  • the security device determines that the UMS interface has received an instruction, it processes the instruction and returns the processing result to the client through the batch input endpoint.
  • Step M2 the security device sends the public key of the key pair to the client, and executes step 101;
  • step 101 the security device sends the public key of the key pair to the client's middleware, and executes step 101;
  • the client after receiving the public key of the key pair, the client sends the public key of the key pair to the verification server for signature verification. After successful verification, the verification server generates certificate data and sends the certificate data to the client. middleware;
  • Step M3 The security device uses the private key of the generated key pair to sign the user input information in the signature generation instruction and the public key of the key pair to obtain a signature value, and sends the signature value to the client, executing step 101;
  • the client's middleware receives the signature value, composes a certificate generation request based on the public key of the key pair, the signature value and user input information, and sends the certificate generation request to the server; the server The public key of the key pair in the certificate generation request verifies the signature value in the certificate generation request.
  • the server successfully verifies the signature value, the server generates certificate data and returns the verification success result and certificate data to the client middleware;
  • the server fails to verify the signature value, the server returns a verification failure message to the client middleware.
  • Step M4 The security device stores the container object in the public zone file, returns a successful status code, and executes step 101;
  • Step M5 The security device stores the public key object in the public zone file, returns a successful status code, and executes step 101;
  • Step M6 The security device stores the certificate object in the public zone file, returns a successful status code, and executes step 101;
  • the client's middleware after receiving the certificate data sent by the verification server, creates a certificate object based on the certificate data, and writes certificate object instructions based on the composition of the certificate object.
  • Step M7 The security device stores the private key object in the private area file, returns a successful status code, and executes step 101;
  • Step M8 The security device updates the acceleration object in the public zone file, returns a successful status code, and executes Step 101.
  • the acceleration object in the security device update public zone file is specifically: the security device will write the associated key ID, key type, certificate type, container object ID, certificate DN value, and container object container in the acceleration object instruction.
  • the name, certificate object identifier, offset value of the certificate data in the certificate object, and the length of the certificate data are associated and stored in the acceleration object.
  • the write container object instruction, the write public key object instruction, the write certificate instruction, the write private key object instruction, and the write acceleration object instruction are all write binary instructions;
  • the write container object instruction includes the container object ;
  • the write public key object instruction includes the public key object;
  • the write certificate object instruction includes the certificate object;
  • the write private key object instruction includes the private key object.
  • Step M9 The security device uses the file corresponding to the file identifier in the file selection command as the current file, returns a successful status code, and executes step 101;
  • the file identification is a public area file identification or a private area file identification
  • the file corresponding to the file instruction identification is a public area file or a private area file.
  • Step M10 The security device reads the current file, sends the read data of the current file to the client, and executes step 101;
  • this step is specifically: the security device reads the public zone file and sends the container object, public key object, certificate object and acceleration object in the public zone file to the client's middleware , execute step 101.
  • the client's middleware after the client's middleware obtains the container object, public key object, certificate object, and acceleration object of the security device, it associates the container object, public key object, and certificate object. According to the certificate object, The certificate generates a certificate list for the user to select the required certificate. After receiving the certificate selected by the user, the container name is calculated based on the public key in the certificate data of the certificate, the acceleration object is traversed, and the container name associated with the calculation is found in the acceleration object. key identification, and generate security environment setting instructions based on the obtained key identification.
  • the client's middleware after the client's middleware obtains the security device container object, public key object, certificate object, and acceleration object, it associates the container object, public key object, and certificate object.
  • the certificate generation object list allows the user to select the required certificate.
  • the container name is calculated based on the public key in the certificate data of the certificate, the container object corresponding to the container name is found, and the public key is obtained after parsing the container object.
  • Key object and private key object obtain the key identifier from the public key object, or obtain the key identifier from the private key object, and generate a set security environment instruction based on the obtained key identifier.
  • Step M11 the security device parses the security environment setting instruction, obtains the key identification and saves it, returns a successful status code, and executes step 101;
  • Step M12 The security device parses the message data, obtains the data to be signed and the transaction information, displays the transaction message, and prompts the user to confirm. After receiving the user confirmation information, it sends the user confirmed information to the client, and executes step 101;
  • Step M13 The security device finds the private key corresponding to the key identification based on the key identification obtained and saved by setting the security environment instruction, signs the data to be signed to obtain the signature result, returns a successful status code, and executes step 101;
  • the security device implements enumeration and use of certificates created through the FIDO interface through the PKI interface.
  • step M14 the security device returns the signature result to the client and executes step 101.
  • determining the type of the function instruction in step 104 may also include: when the type of the function instruction is a PIN code verification instruction, the security device verifies the PIN code in the PIN code verification instruction. If the verification is successful, Safety The device's own security status identifier is set to a predetermined value, a voucher generation instruction response is generated based on the successfully verified status code, and returned to the client, and step 101 is executed;
  • step 101 If the verification fails, generate a voucher generation instruction response based on the status code of the verification failure, return it to the client, and execute step 101;
  • Determining the received instruction type in step 106 may also include: when the type of instruction is a PIN code verification instruction, the security device verifies the PIN code in the PIN code verification instruction. If the verification is successful, the security device itself identifies the security status. Set to a predetermined value and return a status code of successful verification to the client. If verification fails, return a status code of failed verification to the client;
  • a security device Before a security device reads or writes a public zone file or private zone file, the security device needs to determine whether its own security status identifier meets the read and write permissions of the current file. If so, execute the public zone file or private zone file. For read and write operations, the read data or the status code of successful writing is returned. If not, the status code of failure to read and write data is returned.
  • This embodiment provides a method for implementing a security device, as shown in Figures 4 and 5, including:
  • Step 401 The security device waits to receive instructions sent by the client
  • Step 402 The security device determines whether the FIDO HID interface has received the instruction. If yes, execute step 403. If not, execute step 405;
  • the security device is a composite USB device that supports at least two interfaces.
  • the first interface is a FIDO HID interface
  • the second interface can be a UMS interface, HID interface, CCID interface or SCSI interface.
  • the second interface is a UMS interface as an example for explanation, but this does not constitute a limitation on the present invention.
  • Step 403 The security device determines whether the received command is a preset FIDO command. If so, execute step 404. If not, the security device executes other corresponding command operations or reports an error and executes step 401;
  • Step 404 The security device parses the preset FIDO instruction to obtain the preset parameters, processes the preset parameters to obtain the function instruction, and determines the type of the function instruction.
  • step A11 is executed.
  • step B11 is executed.
  • step C11 is an enumeration container instruction
  • step C12 executes the functional instruction is a transaction signature instruction
  • execute step D11 executes the functional instruction to obtain the function instruction.
  • the preset FIDO instruction can be any FIDO instruction, and the preset parameters are parameters with no length limit in the corresponding preset FIDO instruction.
  • the preset FIDO instruction can be a voucher generation instruction, then
  • the preset parameters can be display name parameters or extension parameters; the preset FIDO instructions can also be certificate authentication instructions, and the preset parameters are whitelist parameters.
  • Step 405 The security device determines whether the UMS interface has received the instruction. If yes, execute step 406. If not, return to step 401;
  • Step 406 The security device determines the type of the received instruction.
  • step N1 When the instruction is a key pair generation instruction, step N1 is executed; when the instruction is a read public key instruction, step N2 is executed; when the instruction is a write certificate instruction, step N2 is executed.
  • Step N3 when the instruction is to enumerate the container, execute step N4; when the instruction is to read the certificate, execute step N5; when the instruction is to set the security environment instruction, execute step N6; when the instruction is to send the message data instruction, Execute step N7; when the instruction is to generate a signature instruction, execute step N8;
  • Step A11 The security device determines whether the container file corresponding to the incoming container ID exists. If yes, execute step A13. If not, execute step A12;
  • Step A12 The security device creates a container file corresponding to the container ID
  • Step A13 The security device generates a key pair and saves the key pair in the container file corresponding to the container ID;
  • Step A14 The security device uses the private key of the key pair to sign the user input information in the certificate request generation instruction and the public key of the key pair, and generates a signature value. According to the signature value, the public key of the key pair and the user input information Generate a response to the certificate request generation command;
  • Step A15 The security device composes the response of the preset FIDO command according to the response of the certificate request generation command and sends it to the client, and executes step 401;
  • Step B11 the security device writes the certificate data into the specified container file, composes a preset FIDO command response based on the successful status code and sends it to the client, and executes step 401;
  • Step C11 the security device enumerates all existing container identifiers to form a response to the preset FIDO command and returns it to the client, and executes step 401;
  • Step C12 The security device obtains certificate data from the container file specified by the incoming container ID, and composes a preset FIDO command response based on the certificate data and sends it to the client, and executes step 401;
  • Step D11 the security device parses the transaction signature instruction to obtain the container identification and message data
  • Step D12 The security device reads the private key in the container file corresponding to the container ID;
  • Step D13 The security device parses the message data to obtain the data to be signed and key information
  • Step D14 the security device displays key information and prompts the user for confirmation
  • Step D15 After receiving the user's confirmation information, the security device signs the data to be signed based on the found private key to obtain the signature result. Based on the signature result, a preset FIDO command response is formed and returned to the client, and step 401 is executed;
  • Step N1 The security device generates a key pair, returns a successful status code, and executes step 401;
  • Step N2 The security device sends the public key of the key pair to the client and executes step 401;
  • Step N3 The security device stores the certificate in the container file, returns a successful status code, and executes step 401;
  • Step N4 The security device returns all container identifiers to the client and executes step 401;
  • Step N5 The security device returns the certificate stored in the container file corresponding to the container ID in the read certificate command to the client, and executes step 401;
  • Step N6 The security device parses the security environment setting instruction, obtains the key identification and saves it, returns a successful status code, and executes step 401;
  • Step N7 The security device parses the message data, obtains the data to be signed and the transaction information, displays the transaction message, and prompts the user to confirm. After receiving the user confirmation information, it sends the user confirmed information to the client, and executes step 401;
  • Step N8 The security device finds the corresponding private key of the key pair through the key identification obtained and saved by setting the security environment instruction, uses the private key of the key pair to sign the data to be signed to obtain the signature value, and sends the signature value to the client. end, perform step 401.
  • the middleware after the security device sends the certificates stored in all container files to the client, the middleware generates a certificate list based on the certificates for the user to select. When the user selects the required certificate, the middleware The container ID corresponding to the above certificate generates a set security environment instruction.
  • the security device implements enumeration and use of certificates created through the FIDO interface through the PKI interface.
  • An embodiment of the present application also provides a safety device, including:
  • Waiting to receive module used to wait to receive commands sent by the client
  • the receiving module is used to receive instructions sent by the client
  • the first judgment trigger module is used to judge whether the instruction received by the receiving module is a preset FIDO instruction when the receiving module receives the instruction through the first interface, and is also used to judge whether the instruction result of the first judgment module is yes, Trigger the analysis module; when the judgment result of the second judgment module is no, trigger the first operation module; the first interface is the FIDO HID interface;
  • the first operation module is used to execute the corresponding instruction operation when triggered by the first judgment triggering module
  • the parsing module is used to parse the preset FIDO instructions to obtain the preset parameters and obtain the function instructions based on the preset parameters;
  • the second judgment triggering module is used to judge the type of the function instruction obtained by the parsing module.
  • the second operation module is triggered;
  • the function instruction is judged to be a write certificate instruction, the third operation is triggered. module;
  • the second operation module is used to generate a key pair when triggered by the second judgment triggering module, store the key pair in a storage file, and use the private key of the key pair to request the user input information and key in the certificate generation instruction.
  • Sign the public key of the pair generate a signature value
  • the public key of the key pair and user input information generate response data based on the response to the certificate request generation instruction, and generate a preset based on the response data
  • the response to the preset FIDO command is sent to the client, triggering the waiting receiving module;
  • the third operation module is used to write the certificate data written in the certificate command into the storage file, compose the response data according to the successful status code, generate the response of the preset FIDO command according to the response data, and convert the response of the preset FIDO command Sent to the client, triggering the waiting receiving module.
  • inventions of the present application also provide a security device.
  • the security device includes at least one processor, a memory, and instructions stored on the memory and executable by at least one processor.
  • the at least one processor executes the instructions to implement the methods in the above embodiments.
  • the device is a chip system, it may be composed of a chip or may include a chip and other discrete devices, which are not specifically limited in the embodiments of the present application; the chip is coupled to a memory and is used to execute the computer program stored in the memory to execute the above Methods disclosed in the Examples.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • a software program it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer programs.
  • the computer program When the computer program is loaded and executed, the processes or functions described in the embodiments of the present application are generated in whole or in part.
  • the computer program may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another, for example, the computer instructions may be transmitted from a base station, server or data center via wired (e.g.
  • Coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless means to transmit to another base station, server or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by the device of the present invention or include one or more data storage devices such as servers and data centers that can be integrated with the medium.
  • the available media may be magnetic media (eg, floppy disk, hard disk, tape), optical media (eg, DVD (Digital Video Disc)), or semiconductor media (eg, solid state disk (SSD)), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本发明公开了一种安全设备的实现方法及安全设备，方法包括：安全设备的FIDO HID接口接收指令，当判断接收到的指令为预置的FIDO指令时，安全设备对预置的FIDO指令进行解析后得到预置参数，根据预置参数得到功能指令，判断功能指令的类型，当功能指令为证书请求生成指令时，安全设备生成密钥对，将密钥对存储到存储文件，使用密钥对的私钥对证书请求生成指令中的用户输入信息和密钥对的公钥进行签名，生成签名值，将签名值、密钥对的公钥和用户输入信息发送给客户端，当功能指令为写入证书指令时，安全设备将写入证书指令中的证书数据写入存储文件，并返回操作成功的响应。本发明扩展了安全设备的使用范围。

Description

一种安全设备的实现方法及安全设备
本申请要求于2022年07月21日提交中国专利局、申请号为202210855758.8、申请名称为“一种安全设备的实现方法及安全设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及信息安全领域，特别涉及一种安全设备的实现方法及安全设备。
背景技术
现有技术中传统的PKI(Public Key Infrastructure)体系中使用的安全设备通过不同的浏览器需要安装不同的插件才能够访问服务器，限制了PKI体系中使用的安全设备的使用范围。
发明内容
本发明提供了一种安全设备的实现方法及安全设备，解决了上述技术问题。
一种安全设备的实现方法，包括：
步骤1，安全设备等待接收客户端发送指令；
步骤2，当安全设备的第一接口接收到指令时，判断接收到的指令是否为预置的FIDO(Fast Identity Online)指令，如果是，执行步骤3，如果否，执行相应的指令操作，执行步骤1；第一接口为FIDO HID接口；
步骤3，安全设备对预置的FIDO指令进行解析后得到预置参数，根据预置参数得到功能指令，判断功能指令的类型，当功能指令为证书请求生成指令时，执行步骤4；当功能指令为写入证书指令时，执行步骤5；
步骤4，安全设备生成密钥对，将密钥对存储到存储文件，使用密钥对的私钥对证书请求生成指令中的用户输入信息和密钥对的公钥进行签名，生成签名值，根据签名值、密钥对的公钥和用户输入信息生成证书请求生成指令的响应，根据证书请求生成指令的响应生成响应数据，根据响应数据生成预置的FIDO指令的响应，将预置的FIDO指令的响应发送给客户端，执行步骤1；
步骤5，安全设备将写入证书指令中的证书数据写入存储文件，根据成功的状态码组成响应数据，根据响应数据生成预置的FIDO指令的响应，将预置的FIDO指令的响应发送给客户端，执行步骤1。
一种安全设备，包括：
等待接收模块，用于等待接收客户端发送命令；
接收模块，用于接收客户端发送的指令；
第一判断触发模块，用于当接收模块通过第一接口接收到指令时，判断接收模块接收到的指令是否为预置的FIDO指令，还用于当第一判断模块的判断结果为是时，触发解析模块；当第二判断模块的判断结果为否时，触发第一操作模块；第一接口为FIDO HID接口；
第一操作模块，用于被第一判断触发模块触发时，执行相应的指令操作；
解析模块，用于对预置的FIDO指令进行解析后得到预置参数并根据预置参数得到功能指令；
第二判断触发模块，用于判断解析模块得到的功能指令的类型，当判断功能指令为证书请求生成指令时，触发第二操作模块；当判断功能指令为写入证书指令时，触发第三操作模块；
第二操作模块，用于被第二判断触发模块触发时，生成密钥对，将密钥对存储到存储文件，使用密钥对的私钥对证书请求生成指令中的用户输入信息和密钥对的公钥进行签名，生成签名值，根据签名值、密钥对的公钥和用户输入信息生成证书请求生成指令的响应，根据证书请求生成指令的响应生成响应数据，根据响应数据生成预置的FIDO指令的响应，将预置的FIDO指令的响应发送给客户端，触发等待接收模块；
第三操作模块，用于将写入证书指令中的证书数据写入存储文件，根据成功的状态码组成响应数据，根据响应数据生成预置的FIDO指令的响应，将预置的FIDO指令的响应发送给客户端，触发等待接收模块。
本发明还提供了一种安全设备，该安全设备包括至少一个处理器、存储器及存储在所述存储器上并可被所述至少一个处理器执行的指令，所述至少一个处理器执行所述指令以实现上述安全设备的实现方法。
本发明还提供了一种计算机可读存储介质，该计算机可读存储介质包括计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述安全设备的实现方法。
本发明还提供了一种芯片，该芯片与存储器耦合，用于执行所述存储器中存储的计算机程序，以执行上述安全设备的实现方法。
本发明的有益效果：本发明提供了一种安全设备的实现方法及安全设备，在PKI体系中使用的安全设备上增加FIDO接口，通过FIDO接口实现了对证书的操作，实现了针对不同浏览器的免插件安装的操作，从而扩大了安全设备的应用范围。
附图说明
图1为本发明实施例一提供的一种安全设备的实现方法的流程图；
图2和图3为本发明实施例二提供的一种安全设备的实现方法的流程图；
图4和图5为本发明实施例三提供的一种安全设备的实现方法的流程图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本申请中的安全设备为PKI体系中使用的安全设备。
实施例一
本发明提供了一种安全设备的实现方法，如图1所示，包括如下步骤：
步骤1，安全设备等待接收客户端发送指令；
步骤2，当安全设备的第一接口接收到指令时，判断接收到的指令是否为预置的FIDO指令，如果是，执行步骤3，如果否，执行相应的指令操作，执行步骤1；第一接口为FIDO HID接口；
步骤3，安全设备对预置的FIDO指令进行解析后得到预置参数，根据预置参数得到功能指令，判断功能指令的类型，当功能指令为证书请求生成指令时，执行步骤4；当功能指令为写入证书指令时，执行步骤5；
步骤4，安全设备生成密钥对，将密钥对存储到存储文件，使用密钥对的私钥对证书请求生成指令中的用户输入信息和密钥对的公钥进行签名，生成签名值，根据签名值、密钥对的公钥和用户输入信息生成证书请求生成指令的响应，根据证书请求生成指令的响应生成响应数据，根据响应数据生成预置的FIDO指令的响应，将预置的FIDO指令的响应发送给客户端，执行步骤1；
步骤5，安全设备将写入证书指令中的证书数据写入存储文件，根据成功的状态码组成响应数据，根据响应数据生成预置的FIDO指令的响应，将预置的FIDO指令的响应发送给客户端，执行步骤1。
在一种可能的实施方式中，存储文件为容器文件，容器文件有对应的容器标识。
在一种可能的实施方式中，步骤4中安全设备生成密钥对，将密钥对存储到存储文件具体为：安全设备生成密钥对，将密钥对存储到与证书请求生成指令中的容器标识所对应的容器文件中；
步骤5中安全设备将写入证书指令中的证书数据写入存储文件具体为：安全设备将写入证书指令中的证书数据写入与写入证书指令中的容器标识所对应的容器文件中。
在一种可能的实施方式中，当功能指令为证书请求生成指令时，执行步骤4具体为：
安全设备判断是否存在与证书请求生成指令中的容器标识所对应的容器文件，如果是，执行步骤4，如果否，安全设备创建与证书请求生成指令中的容器标识所对应的容器文件，执行步骤4。
在一种可能的实施方式中，步骤3还包括：
当功能指令为读取证书指令时，执行步骤6；当功能指令为签名指令，执行步骤7；
步骤6，安全设备从与读取证书指令中的容器标识对应的容器文件中获取证书数据，将获取的证书数据发送给客户端，执行步骤1；
步骤7，安全设备从签名指令中获取容器标识和待签名信息，从与容器标识对应的容器文件中读取私钥，根据找到的私钥对待签名信息进行签名后得到签名结果，根据签名结果组成预置FIDO指令的响应，将预置FIDO指令的响应发送给客户端，执行步骤1。
在一种可能的实施方式中，步骤2还包括：当安全设备的第二接口接收到指令并且接收到的指令类型为读证书指令时，安全设备从与读证书指令所对应的容器文件中获取证书数据，并将证书数据返回给客户端，执行步骤1。
在一种可能的实施方式中，存储文件包含：IKF(Internal Key File)文件、公有区文件和私有区文件，公有区文件包括容器对象、公钥对象、加速对象和证书对象，私有区文件包括私钥对象，公有区文件具有对应的公有区文件标识，私有区文件具有对应的私有区文件标识。
在一种可能的实施方式中，步骤4中，安全设备生成密钥对，将密钥对存储到存储文件具体为：
步骤4-1，安全设备生成密钥对和密钥标识，将密钥对和密钥标识存储到预置的IKF文件中；
步骤4-2，安全设备创建容器对象、公钥对象、私钥对象；
步骤4-3，安全设备将容器对象的容器名称、证书请求生成指令中的用户输入信息中的证书DN(Distinct Name)值和密钥标识关联生成加速对象记录，将加速对象记录存储到加速对象中以更新加速对象；
步骤5中，安全设备将写入证书指令中的证书数据写入存储文件具体为：安全设备根据写入证书指令中的证书数据创建证书对象及证书对象标识，将证书对象标识与加速对象中的与证书数据中的证书DN值相对应的加速对象记录相关联以更新加速对象。
在一种可能的实施方式中，步骤3中还包括：当功能指令为读取证书指令时，执行步骤6’；当功能指令为签名指令时，执行步骤7’；
步骤6’，安全设备根据读取证书指令中的证书DN值或容器名称对加速对象中的加速对象记录进行遍历，根据证书DN值或容器名称找到与其对应的加速对象记录，从加速对象记录中获取证书对象标识，根据证书对象标识从证书对象中获取证书数据，根据证书数据生成响应数据，根据响应数据组成预置FIDO指令的响应，将预置FIDO指令的响应发送给客户端，执行步骤1；
步骤7’，安全设备根据签名指令中的证书DN值或者容器名称对加速对象中的加速对象记录进行遍历，找到与证书DN值或者容器名称相对应的加速对象记录，从加速对象记录中获取密钥标识，根据密钥标识从IKF文件中找到对应的私钥，使用私钥对签名指令中的待签名数据进行签名后得到签名结果，根据签名结果组成预置FIDO指令的响应，将预置FIDO指令的响应发送给客户端，执行步骤1。
在一种可能的实施方式中，步骤2还包括：
当安全设备的第二接口接收到指令并且接收到的指令的类型为选择文件指令且选择文件指令中的文件标识为公有区文件标识时，执行步骤a1；
步骤a1，安全设备将公有区文件作为当前文件；
当安全设备的第二接口接收到指令并且接收到的指令的类型为读指令时，执行步骤b1；
步骤b1，安全设备将当前文件中容器对象、公钥对象、加速对象、证书对象发送给客户端，返回步骤1。
在一种可能的实施方式中，步骤3中安全设备对预置的FIDO指令进行解析后得到预置参数，根据预置参数得到功能指令，判断功能指令的类型具体为：
安全设备对预置的FIDO指令进行解析得到预置参数，将预置参数的数据进行转换得到转换数据，使用预定算法对转换数据进行解密后得到解密数据，对解密数据执行去除填充数据操作后得到功能指令，根据功能指令中的指令标识获得功能指令的类型。
在一种可能的实施方式中，根据响应数据生成预置的FIDO指令的响应，将预置的FIDO指令的响应发送给客户端具体为：安全设备将响应数据按照预定的规则进行填充得到填充数据，对填充数据进行加密得到密文数据，将密文数据作为验证数据参数，根据验证数据参数组成预置的FIDO指令的响应返回给客户端。
实施例二
本实施例提供了一种安全设备的实现方法，如图2和图3所示，包括：
101，安全设备等待接收客户端发送指令；
在本实施例中，安全设备为复合USB(Universal Serial Bus)设备，支持至少两个接口，在本实施例中，第一接口为FIDO HID(Human interface Device)接口，第二接口可以为UMS(Usb Mass Storage)接口、HID接口、CCID(Chip/Smart Card Interface Device)接口或SCSI(Small Computer System Interface)接口。
第一接口支持两个端点，分别为中断输出端点和中断输入端点。
第二接口支持两个端点，分别为批量输出端点和批量输入端点。
具体的，安全设备的UMS接口、HID接口、CCID接口、SCSI接口接收到的指令是客户端通过客户端的中间件发送给安全设备的，安全设备通过上述接口将指令处理结果发送给客户端的中间件。
102，安全设备判断第一接口是否接收到指令，如果是，执行步骤103，如果否，执行步骤105；
本步骤具体为：安全设备判断FIDO HID接口是否接收到指令，如果是，执行步骤103，如果否，执行步骤105；
安全设备判断FIDO HID接口是否接收到指令具体为：安全设备判断中断输出端点是否收到指令数据，如果是，执行步骤103，如果否，执行步骤105；
103，安全设备判断接收到的指令是否为凭证生成指令，如果是，执行步骤104，如果否，安全设备执行其他相应指令操作或者报错，执行步骤101；
104，安全设备对凭证生成指令进行解析得到显示名称参数，对显示名称参数进行处理得到功能指令，判断功能指令的类型，
当功能指令为证书请求生成指令时，执行步骤A1-A4；
当功能指令为写入证书指令时，执行步骤B1-B3；
当功能指令为枚举证书指令时，执行步骤C1；
当功能指令为读取证书指令时，执行步骤C2；
当功能指令为交易签名指令时，执行步骤D1-D5；
在本步骤中，安全设备对凭证生成指令进行解析得到显示名称参数，对显示名称参数进行处理得到功能指令，判断功能指令的类型具体为：安全设备对凭证生成指令进行解析得到显示名称参数(Displayname)，将显示名称参数的数据进行转换得到16进制数据，使用AES-128算法对16进制数据进行解密和去填充操作后得到功能指令，根据功能指令中的指令标识获得功能指令的类型。
具体的，安全设备对凭证生成指令进行解析得到客户端数据(clientDataHash)、依赖方标识(rp)、用户信息(user)和算法参数(pubkeyCredParams)，从用户信息中解析出显示名称参数(displayname)。
例如，安全设备FIDO HID接口接收到客户端发送的凭证生成指令：
01A4015820687134968222EC17202E42505F8ED2B16AE22F16BB05B88C25DB9E602645F14102A26269646861636D652E636F6D646E616D656441636D6503A462696458203082019330820138A0030201023082019330820138A0030201023082019330826469636F6E782868747470733A2F2F706963732E61636D652E636F6D2F30302F702F61426A6A6A707150622E706E67646E616D65766A6F686E70736D697468406578616D706C652E636F6D6B646973706C61794E616D6578803 3463839313238453933453230373346314332334238323743434335464145454638383538313842304135304338344646343741374133373731303633343836453439454333344341313735414632383632413534414644333444454445343538383530443037453235304638333235313031444438324445343344323437360482A263616C672664747970656A7075626C69632D6B6579A263616C6739010064747970656A7075626C69632D6B6579。
安全设备对上述凭证生成指令进行CBOR解码操作，从解码后的凭证生成指令中获取客户端数据(clientDataHash)：015820687134968222EC17202E42505F8ED2B16AE22F16BB05B88C25DB9E602645F141；
依赖方标识(rp):02A26269646861636D65；
用户信息(user)：03A462696458203082019330820138A0030201023082019330820138A0030201023082019330826469636F6E782868747470733A2F2F706963732E61636D652E636F6D2F30302F702F61426A6A6A707150622E706E67646E616D65766A6F686E70736D697468406578616D706C652E636F6D6B646973706C61794E616D65；
算法参数(pubkeyCredParams)：0482A263616C672664747970656A7075626C69632D6B6579A263616C6739010064747970656A7075626C69632D6B6579；
从用户信息中解析出显示名称参数：3346383931323845393345323037334631433233423832374343433546414545463838353831384230413530433834464634374137413337373130363334383645343945433334434131373541463238363241353441464433344445444534353838353044303745323530463833323531303144443832444534334432343736；
将显示名称参数的数据进行转换得到16进制数据3F89128E93E2073F1C23B827CCC5FAEEF885818B0A50C84FF47A7A3771063486E49EC34CA175AF2862A54AFD34DEDE458850D07E250F8325101DD82DE43D2476，使用AES-128算法对16进制数据进行解密和去填充操作后得到功能指令04002D1025D55AD283AA400AF464C76D713C07AD1B520301434E3D5445535430322C4F553D544553542C4F3D49434243，根据功能指令中的指令标识04获得功能指令的类型为证书请求生成指令，执行步骤A1-A4。
在本实施例中，证书请求生成指令中还包括密钥标识和证书类型。
在本实施例中，写入证书指令、读取证书指令、交易签名指令、枚举证书指令的获取过程与上述示例证书请求生成指令相同，不再赘述。
在本实施例中，凭证生成指令可以为任何预置的FIDO指令，显示名称参数可以为FIDO指令的无长度限制的预置参数，例如，当预置的FIDO指令为凭证生成指令时，预置参数可以为扩展项参数；当预置的FIDO指令为凭证认证指令，预置参数为白名单参数。
105，安全设备判断第二接口是否接收到指令，如果是，执行步骤106，如果否，返回步骤101；
本步骤具体为：安全设备判断批量输出端点是否接收到指令，如果是，执行步骤106，如果否，返回步骤101；
在本实施例中，安全设备还可以先判断第二接口是否接收到指令，如果是，则执行步骤106；如果否，则判断第一接口是否接收到指令，如果是，执行步骤103，如果否，返回步骤101。
106，安全设备判断接收到的指令的类型，
当指令为密钥对生成指令时，执行步骤M1，当指令为读取公钥指令时，执行步骤M2，当指令为生成签名指令时，执行步骤M3；当指令为写入容器对象指令时，执行步骤M4；当指令为写入公钥对象指令时，执行步骤M5；当指令为写入证书对象指令时，执行步骤M6；当指令为写入私钥对象指令时，执行步骤M7，当指令为写入加速对象指令时，执行步骤M8；当指令为选择文件指令时，执行步骤M9；当指令为读二进制文件指令时，执行步骤M10；当指令为设置安全环境指令时，执行步骤M11；当指令为发送报文数据指令时，执行步骤M12；当指令为签名请求指令时，执行步骤M13；当指令为获取签名结果指令时，执行步骤M14；
在本实施例中，证书请求生成指令中包括证书DN值。
步骤A1，安全设备生成密钥对；
在本步骤中，密钥设备生成密钥对的同时，还生成与密钥对所对应的密钥标识，并存储密钥对的公钥和私钥。
步骤A2，安全设备使用密钥对的私钥对证书请求生成指令中的用户输入信息和密钥对的公钥进行签名，生成签名值，根据签名值、密钥对的公钥和用户输入信息生成证书请求生成指令的响应；
在本步骤中，用户输入的信息包括证书DN值，证书DN值可以为发证中心预先颁发的，或者用户按照预定的条件获取的。
例如，安全设备生成的证书请求生成指令的响应如下：
424B423074495A6D6956654432677534693972777A764244504B477852506A66774F745448436B61366F5633792B30567450384E4732787A58644F52352B722B42647A444275306A5A516A327A32494239436B565246553D26264D4948724D494750416745424D433878447A414E42674E5642414D4D426C5246553151774D6A454E4D4173474131554543777745564556545644454E4D417347413155454367774553554E43517A425A4D424D4742797147534D34394167454743437142484D39564159497441304941424B423074495A6D6956654432677534693972777A764244504B477852506A66774F745448436B61366F5633792B30567450384E4732787A58644F52352B722B42647A444275306A5A516A327A32494239436B5652465577444159494B6F45637A3155426733554641414E4A41444247416945417670756574493835673267754D7A6C4B4D35472B52372F2F4E306B654C5144434C6E50716A4F3339555951434951447876677267354C4C45644C72353264585A4F6343596B712F4955534D496F3079304566465331754E6D65413D3D9000；
步骤A3，安全设备创建容器对象和对应的容器对象标识、私钥对象和公钥对象，将容器对象和对应的容器对象标识、公钥对象，私钥对象进行关联，将容器对象和公钥对象写入到公有区文件，将私钥对象写入到私有区文件，更新公有区文件中的加速对象；
在本实施例中，私钥对象包括密钥标识，公钥对象包括密钥标识和密钥对的公钥。
在本实施例中，安全设备具有存储区，存储区包括IKF文件、公有区文件和私有区文件。
IKF文件为internal key file，即秘密文件；
公有区文件有对应的公有区文件标识，私有区文件有对应的私有区文件标识，公有区文件和私有区文件均属于存储文件。
在本实施例中，步骤A1还包括：安全设备将生成的密钥对和密钥标识存储到IKF文件中。
本步骤中，安全设备创建容器对象和对应的容器对象标识、私钥对象和公钥对象，将容器对象和对应的容器对象标识、公钥对象，私钥对象进行关联具体为：安全设备创建容器对象和对应的容器对象标识，根据密钥对的公钥进行哈希计算得到容器对象的容器名称，将私钥对象标识和公钥对象标识进行关联后，存储到容器对象中。
本步骤中，更新公有区文件中的加速对象具体为：将密钥标识、证书DN值、容器对象的容器名称相关联生成一条加速对象记录，并将生成的加速对象记录存储到加速对象中。
在本步骤中，更新公有区文件中的加速对象之前还包括：创建加速对象，并将加速对象存储到公有区文件。
步骤A4，安全设备根据证书请求生成指令的响应组成凭证生成指令的响应发送给客户端，执行步骤101；
在本实施例中，具体的，安全设备从FIDO HID接口接收到指令，并对指令进行处理后获得的处理结果具体的通过中断输入端点返回给客户端。
本步骤具体为：安全设备对证书请求生成指令的响应按照预定的规则进行填充得到填充数据，对填充数据进行加密得到密文数据，将密文数据作为验证数据参数，根据验证数据参数组成凭证生成指令的响应发送给客户端，执行步骤101。
其中，其中预定的规则为：在证书请求生成指令的响应数据的最后填充一个字节0x80得到待处理数据，判断填充后的数据是否为16字节的整数倍，如果为16字节整数倍，则待处理数据为填充数据，否则在待处理数据的末尾继续填充0x00，直至16字节的整数倍得到填充数据。
例如，安全设备对证书请求生成指令的响应424B423074495A6D6956654432677534693972777A764244504B477852506A66774F745448436B61366F5633792B30567450384E4732787A58644F52352B722B42647A444275306A5A516A327A32494239436B565246553D26264D4948724D494750416745424D433878447A414E42674E5642414D4D426C5246553151774D6A454E4D4173474131554543777745564556545644454E4D417347413155454367774553554E43517A425A4D424D4742797147534D34394167454743437142484D39564159497441304941424B423074495A6D6956654432677534693972777A764244504B477852506A66774F745448436B61366F5633792B30567450384E4732787A58644F52352B722B42647A444275306A5A516A327A32494239436B5652465577444159494B6F45637A3155426733554641414E4A41444247416945417670756574493835673267754D7A6C4B4D35472B52372F2F4E306B654C5144434C6E50716A4F3339555951434951447876677267354C4C45644C72353264585A4F6343596B712F4955534D496F3079304566465331754E6D65413D3D9000进行填充，得到填充数据，对填充数据进行AES_128算法加密后得到加密数据C35F118D4DDE91CC9E7DBD979F7FB584CDFE08016AF092019C1618C36D0A6EB7D1808717D8A7AB13CEBCE51FB2889DDB000B40E4C74FBEA0542A26A90E424D9B1EB0EDAC6F0A16FF88C517EE7D96CE568E5BEB1D1ACCFCDBFDDC7E52352A5D6A98EB6BE0F1DC1132B06D513A8108E82BCACD7C87169695E06604A0254BC2F808A6734E8D5AEDEBCA1CA08B003 E7D1FB2CBDFBB854850D702421A21F0C2D7013CB13E46EEE939710F60C28F3B20744973BF172BB0E9F662474F2ED938A543282780CB3A349E13D700145E41715448A06DC6D70FEA9A6737B6A8EEA320007B90A96DB26F0DF2AE466FA76576852FF467E3BCD29CFBD3A7751E12E7E05457D16277257035026438887F5A05F7709A169B6ED01E64D6E084A657DAFEE1C4860A23521AF1313B030478FEF72182905F504F9D60F3930900ADCC48EBF286FC4E641405C8367D42DC1636E5AE3AFA1CB1D537FD6FFE8C2B6B31166E63C11CA9ABBA2559BE21394149ABCEA9D0CED41C0CAA0C5E898B07BB475C6ED3E9847E3F9A2D86893FB460E2E252CB24E532357E81E10EA8CD90218FECC459A3080EAAD833F3CE4F，将加密数据作为验证数据参数(AuthData)，根据验证数据参数组成凭证生成指令的响应发送给客户端。
在本实施例中，当显示名称参数为写入证书指令、读取证书指令、交易签名指令、枚举证书指令时，凭证生成指令的响应的组成方式与上述示例证书请求生成指令相同，不再赘述。
在本实施例中，客户端接收到安全设备发送的凭证生成指令的响应后将凭证生成指令的响应发送给认证服务器进行验证，当认证服务器验证成功时，认证服务器生成证书数据，并向客户端返回包括验证成功的结果以及证书数据，当认证服务器验证失败时，向客户端返回包括验证失败的结果；
在本实施例中，认证服务验证成功后，根据密钥对公钥，用户输入信息，如证书DN值，使用自身的私钥进行签名，生成签名结果，根据密钥对公钥、用户输入信息和签名结果生成证书数据。
当客户端接收到验证成功的结果和证书数据时，客户端生成写入证书指令，根据写入证书指令组成凭证生成指令发送给安全设备。
具体的，写入证书指令中包含证书DN值和证书数据。
写入证书指令还可以为：包含容器名称和证书数据。
步骤B1，安全设备根据写入证书指令中的证书数据创建证书对象，并为证书对象分配对应的证书对象标识；
在本步骤中，证书数据包括密钥对的公钥，创建的证书对象中包括证书数据。
步骤B2，安全设备将容器对象和证书对象进行关联；
本步骤具体为：安全设备对加速对象进行遍历，判断是否找到与写入证书指令中包含的证书DN值相同的证书DN值所对应的加速对象记录，如果是，获取找到的加速对象记录中与证书DN值相关联的容器对象标识，根据容器对象标识找到对应的容器对象，将证书对象标识存储到容器对象中，如果否，安全设备向客户端返回错误的状态码，执行步骤101。
本步骤还可以具体为：安全设备对加速对象进行遍历，判断是否找到与写入证书指令中包含的容器名称相同的容器名称所对应的加速对象记录，如果是，获取找到的加速对象记录中与容器名称相关联的容器对象标识，根据容器对象标识找到对应的容器对象，将证书对象标识存储到容器对象中，如果否，安全设备向客户端返回错误的状态码，执行步骤101。
步骤B3，安全设备将证书对象写入到公有区文件，并更新公有区文件的加速对象，根据成功的状态码组成凭证生成指令的响应发送给客户端，执行步骤101；
在本步骤中，更新公有区文件的加速对象具体为：将证书对象标识、证书数据在证书对象中的偏移值以及证书数据的长度与通过遍历找到加速对象记录中的证书DN值以及其所关 联的密钥标识、容器对象的容器名称相关联以更新找到的加速对象记录，并将更新的加速对象记录存储到加速对象中。
在本步骤中，更新公有区文件的加速对象还可以具体为：将证书对象标识、证书数据在证书对象中的偏移值以及证书数据的长度与通过遍历找到的容器名称以及其所关联的密钥标识、证书DN值相关联以更新找到的加速对象记录，并将更新的加速对象记录存储到加速对象中。
在本实施例中，根据成功的状态码组成凭证生成指令的响应具体为将成功的状态码进行处理得到验证数据参数，根据验证数据参数组成凭证生成指令的响应。
具体的，将成功的状态码进行处理得到验证数据参数的过程与步骤A4中根据证书请求生成指令的响应得到验证数据参数的处理方式相同，不再赘述。
步骤C1，安全设备枚举加速对象中的所有的证书DN值，根据枚举的所有证书DN值组成凭证生成指令的响应返回给客户端，执行步骤101。
本步骤还可以为：安全设备对加速对象中的加速对象记录进行遍历，枚举加速对象中的所有容器名称，根据枚举的所有容器名称组成凭证生成指令的响应返回给客户端，执行步骤101。
根据枚举的所有证书DN值或容器名称组成凭证生成指令的响应具体为：将枚举的所有证书DN值或容器名称进行处理得到验证数据参数，根据验证数据参数组成凭证生成指令的响应。
具体的，将枚举的所有证书DN值或容器名称进行处理得到验证数据参数的过程与步骤A4中根据证书请求生成指令的响应得到验证数据参数的处理方式相同，不再赘述。
在本步骤中，客户端根据凭证生成指令的响应显示所枚举的所有证书DN值或者容器名称，供用户选择，根据用户选择的证书DN值或者容器名称组成读取证书指令。
步骤C2，安全设备对加速对象进行遍历，找到包括读取证书指令中的证书DN值的加速对象记录，获取加速对象记录中与证书DN值相关联的证书对象标识、证书数据在证书对象中的偏移以及证书数据的长度，根据证书对象标识找到对应的证书对象，根据证书数据在证书对象中的偏移以及证书数据的长度从证书对象中获取证书数据，并根据证书数据组成凭证生成指令的响应发送给客户端，执行步骤101；
在本步骤中，证书DN值还可以为容器名称。
在本实施例中，客户端接收到凭证生成指令的响应后，将凭证生成指令的响应中的证书数据发送给交易服务器，用于交易服务器使用证书数据对客户端发送的签名结果进行验签。
根据证书数据组成凭证生成指令的响应具体为：将证书数据进行处理得到验证数据参数，根据验证数据参数组成凭证生成指令的响应。
具体的，将证书数据进行处理得到验证数据参数的过程与步骤A4中根据证书请求生成指令的响应得到验证数据参数的处理方式相同，不再赘述。
步骤D1，安全设备对交易签名指令进行解析得到证书DN值和报文数据；
本步骤还可以为：安全设备对交易签名指令进行解析得到容器名称和报文数据；
在本实施例中，交易签名指令中的证书DN值或容器名称为枚举所有的证书DN值或容器名称时，用户所选择的证书DN值或容器名称。
步骤D2，安全设备对加速对象进行遍历，找到加速对象中包括相同证书DN值的加速对象记录，获取加速对象记录中与证书DN值相关联的密钥标识，根据密钥标识找到与密钥标识对应的私钥；
本步骤还可以为：安全设备对加速对象进行遍历，找到加速对象中包括相同容器名称的加速对象记录，获取加速对象记录中与容器名称相关联的密钥标识，根据密钥标识找到IKF文件中与密钥标识对应的私钥；
步骤D3，安全设备对报文数据进行解析得到待签名数据和关键信息；
本实施例中，关键信息例如为交易信息或从交易信息中提取的部分信息。
步骤D4，安全设备显示关键信息，并提示用户进行确认；
步骤D5，安全设备接收到用户的确认信息后，根据找到的私钥对待签名数据进行签名，得到签名结果，根据签名结果组成凭证生成指令的响应返回给客户端，执行步骤101；
在本步骤中，根据签名结果组成凭证生成指令的响应具体为：将签名结果进行处理得到验证数据参数，根据验证数据参数组成凭证生成指令的响应。
具体的，将签名结果进行处理得到验证数据参数的过程与步骤A4中根据证书请求生成指令的响应得到的验证数据参数的处理方式相同，不再赘述。
在本实施例中，客户端将通过发送凭证生成指令的响应得到的签名结果发送给交易服务器，交易服务器根据证书数据对签名结果进行验签。
步骤M1，安全设备生成密钥对，向客户端返回成功的状态码，执行步骤101；
在本步骤中，密钥设备生成密钥对的同时，还生成与密钥对所对应的密钥标识。
在本实施例中，具体的，当安全设备判断UMS接口接收到指令时，对指令进行处理后，将处理结果通过批量输入端点返回客户端。
步骤M2，安全设备将密钥对的公钥发送给客户端，执行步骤101；
本步骤具体为：安全设备将密钥对的公钥发送给客户端的中间件，执行步骤101；
在本实施例中，客户端接收到密钥对的公钥后，将密钥对的公钥发送给验证服务器进行验签，验证服务器验证成功后，生成证书数据，将证书数据发送给客户端的中间件；
步骤M3，安全设备使用生成的密钥对的私钥对生成签名指令中的用户输入信息和密钥对的公钥进行签名得到签名值，并将签名值发送给客户端，执行步骤101；
在本实施例中，步骤M3执行之后，客户端的中间件接收签名值，并根据密钥对的公钥、签名值和用户输入信息组成证书生成请求，并将证书生成请求发送给服务器；服务器根据证书生成请求中的密钥对的公钥对证书生成请求中的签名值进行验签，当服务器验证签名值成功时，服务器生成证书数据，并向客户端中间件返回验证成功结果和证书数据；当服务器验证签名值失败时，服务器向客户端中间件返回验证失败的消息。
步骤M4，安全设备将容器对象存储到公有区文件，返回成功的状态码，执行步骤101；
步骤M5，安全设备将公钥对象存储在公有区文件，返回成功的状态码，执行步骤101；
步骤M6，安全设备将证书对象存储在公有区文件，返回成功的状态码，执行步骤101；
在本实施例中，客户端的中间件接收到验证服务器发送的证书数据后，根据证书数据创建证书对象，根据证书对象组成写入证书对象指令。
步骤M7，安全设备将私钥对象存储在私有区文件，返回成功的状态码，执行步骤101；
步骤M8，安全设备更新公有区文件中的加速对象，返回成功的状态码，执行步骤101。
本步骤中安全设备更新公有区文件中的加速对象具体为：安全设备将写入加速对象指令中关联的密钥标识、密钥类型、证书类型、容器对象标识、证书DN值、容器对象的容器名称、证书对象标识、证书数据在证书对象中的偏移值以及证书数据的长度相关联并存储在加速对象中。
在本实施例中，写入容器对象指令、写入公钥对象指令、写入证书指令和写入私钥对象指令、写入加速对象指令均为写二进制指令；写入容器对象指令包括容器对象；写入公钥对象指令包括公钥对象；写入证书对象指令包括证书对象；写入私钥对象指令中包括私钥对象。
步骤M9，安全设备将选择文件指令中的文件标识所对应的文件作为当前文件，返回成功的状态码，执行步骤101；
在本步骤中，文件标识为公有区文件标识或者私有区文件标识，文件指令标识所对应的文件为公有区文件或者私有区文件。
步骤M10，安全设备读取当前文件，将读取的当前文件的数据发送给客户端，执行步骤101；
当步骤M9中的当前文件为公有区文件时，本步骤具体为：安全设备读取公有区文件，将公有区文件中的容器对象、公钥对象、证书对象和加速对象发送给客户端的中间件，执行步骤101。
在一种可能的实施方式中，当客户端的中间件获取到安全设备的容器对象、公钥对象、证书对象和加速对象后，将容器对象、公钥对象和证书对象进行关联，根据证书对象中的证书生成证书列表供用户选择所需的证书，接收到用户选择的证书后，根据证书的证书数据中的公钥计算容器名称，对加速对象进行遍历，找到加速对象中与计算的容器名称关联的密钥标识，并根据获取的密钥标识生成设置安全环境指令。
在一种可能的实施方式中，当客户端的中间件获取到安全设备容器对象、公钥对象、证书对象和加速对象后，将容器对象、公钥对象和证书对象进行关联，根据证书对象中的证书生成对象列表供用户选择所需的证书，接收到用户选择的证书后，根据证书的证书数据中的公钥计算容器名称，找到与容器名称对应的容器对象，对容器对象进行解析后得到公钥对象和私钥对象，从公钥对象中获取密钥标识，或者从私钥对象中获取密钥标识，并根据获取的密钥标识生成设置安全环境指令。
步骤M11，安全设备对设置安全环境指令进行解析，得到密钥标识并保存，返回成功的状态码，执行步骤101；
步骤M12，安全设备对报文数据进行解析，得到待签名数据和交易信息，并显示交易消息，提示用户进行确认，收到用户确认信息后，向客户端发送用户已确认信息，执行步骤101；
步骤M13，安全设备根据通过设置安全环境指令得到并保存的密钥标识，找到与密钥标识对应的私钥，对待签名数据进行签名得到签名结果，返回成功的状态码，执行步骤101；
在本实施例中，通过步骤M9、M10、M11和M13安全设备实现了通过PKI接口来枚举和使用通过FIDO接口创建的证书。
步骤M14，安全设备将签名结果返回客户端，执行步骤101。
在本实施例中，步骤104中判断功能指令的类型还可以包括，当功能指令的类型为PIN码验证指令时，安全设备对PIN码验证指令中的PIN码进行验证，如果验证成功，则将安全 设备自身的安全状态标识设置为预定值，根据验证成功的状态码生成凭证生成指令响应，返回给客户端，执行步骤101；
如果验证失败，根据验证失败的状态码生成凭证生成指令响应，返回给客户端，执行步骤101；
步骤106中判断接收到指令类型还可以包括，当指令的类型为PIN码验证指令时，安全设备对PIN码验证指令中的PIN码进行验证，如果验证成功，则将安全设备自身的安全状态标识设置为预定值并向客户端返回验证成功的状态码，如果验证失败，则返回验证失败的状态码给客户端；
相应的，当安全设备对公有区文件或者私有区文件进行读写之前，安全设备需要判断自身的安全状态标识是否满足当前文件的读写权限，如果是，则执行对公有区文件或者私有区文件的读写操作，返回读取的数据或者写成功的状态码，如果否，则返回读写数据失败的状态码。
实施例三
本实施例提供了一种安全设备的实现方法，如图4和图5所示，包括：
步骤401，安全设备等待接收客户端发送指令；
步骤402，安全设备判断FIDO HID接口是否接收到指令，如果是，执行步骤403，如果否，执行步骤405；
在本实施例中，安全设备为复合USB设备，支持至少两个接口，在本实施例中，第一接口为FIDO HID接口，第二接口可以为UMS接口、HID接口、CCID接口或SCSI接口。
本实施例中以第二接口为UMS接口为例进行阐述，但并不构成对本发明的限制。
步骤403，安全设备判断接收到的指令是否为预置的FIDO指令，如果是，执行步骤404，如果否，安全设备执行其他相应指令操作或者报错，执行步骤401；
步骤404，安全设备对预置的FIDO指令进行解析得到预置的参数，对预置的参数进行处理得到功能指令，判断功能指令的类型，当功能指令为证书请求生成指令时，执行步骤A11，当功能指令为写入证书指令时，执行步骤B11，当功能指令为枚举容器指令时，执行步骤C11，当功能指令为读取证书指令时，执行步骤C12，当功能指令为交易签名指令时，执行步骤D11；
在本实施例中，预置的FIDO指令可以为任何FIDO指令，预置的参数为相应的预置的FIDO指令中的无长度限制的参数，例如预置的FIDO指令可以为凭证生成指令，则预置的参数可以为显示名称参数或扩展项参数；预置的FIDO指令还可以为凭证认证指令，预置的参数为白名单参数。
步骤405，安全设备判断UMS接口是否接收到指令，如果是，执行步骤406，如果否，返回步骤401；
步骤406，安全设备判断接收到的指令的类型，当指令为密钥对生成指令时，执行步骤N1；当指令为读取公钥指令时，执行步骤N2；当指令为写入证书时，执行步骤N3；当指令为枚举容器指令时，执行步骤N4；当指令为读证书时，执行步骤N5；当指令为设置安全环境指令时，执行步骤N6；当指令为发送报文数据指令时，执行步骤N7；当指令为生成签名指令时，执行步骤N8；
步骤A11，安全设备判断传入的容器标识对应的容器文件是否存在，如果是，执行步骤A13，如果否，执行步骤A12；
步骤A12，安全设备创建与容器标识对应的容器文件；
步骤A13，安全设备产生密钥对，并将密钥对保存在容器标识对应的容器文件中；
步骤A14，安全设备使用密钥对的私钥对证书请求生成指令中的用户输入信息和密钥对的公钥进行签名，生成签名值，根据签名值、密钥对的公钥和用户输入信息生成证书请求生成指令的响应；
步骤A15，安全设备根据证书请求生成指令的响应组成预置的FIDO指令的响应发送给客户端，执行步骤401；
步骤B11，安全设备将证书数据写入到指定的容器文件中，根据成功的状态码组成预置的FIDO指令的响应发送给客户端，执行步骤401；
步骤C11，安全设备枚举存在的所有的容器标识组成预置的FIDO指令的响应返回给客户端，执行步骤401；
步骤C12，安全设备从传入的容器标识指定的容器文件中，获取证书数据，并根据证书数据组成预置的FIDO指令的响应发送给客户端，执行步骤401；
步骤D11，安全设备对交易签名指令进行解析得到容器标识和报文数据；
步骤D12，安全设备读取容器标识所对应的容器文件中的私钥；
步骤D13，安全设备对报文数据进行解析得到待签名数据和关键信息；
步骤D14，安全设备显示关键信息，并提示用户进行确认；
步骤D15，安全设备接收到用户的确认信息后，根据找到的私钥对待签名数据进行签名，得到签名结果，根据签名结果组成预置的FIDO指令的响应返回给客户端，执行步骤401；
步骤N1，安全设备生成密钥对，返回成功的状态码，执行步骤401；
步骤N2，安全设备将密钥对的公钥发送给客户端，执行步骤401；
步骤N3，安全设备将证书存储到容器文件中，返回成功的状态码，执行步骤401；
步骤N4，安全设备将所有容器标识返回客户端，执行步骤401；
步骤N5，安全设备根据读证书指令中的容器标识对应的容器文件中存储的证书返回客户端，执行步骤401；
步骤N6，安全设备对设置安全环境指令进行解析，得到密钥标识并保存，返回成功的状态码，执行步骤401；
步骤N7，安全设备对报文数据进行解析，得到待签名数据和交易信息，并显示交易消息，提示用户进行确认，收到用户确认信息后，向客户端发送用户已确认信息，执行步骤401；
步骤N8，安全设备通过设置安全环境指令得到并保存的密钥标识找到所对应的密钥对私钥，使用密钥对的私钥对待签名数据进行签名得到签名值，并将签名值发送给客户端，执行步骤401。
在一种可能的实施例中，安全设备将所有容器文件中存储的证书发送给客户端后，中间件根据证书生成证书列表供用户进行选择，当用户选择所需的证书后，中间件根据所述证书所对应的容器标识生成设置安全环境指令。
在本实施例中，通过步骤N4、N5、N6和N8，安全设备实现了通过PKI接口来枚举和使用通过FIDO接口创建的证书。
本申请的实施例还提供了一种安全设备，包括：
等待接收模块，用于等待接收客户端发送命令；
接收模块，用于接收客户端发送的指令；
第一判断触发模块，用于当接收模块通过第一接口接收到指令时，判断接收模块接收到的指令是否为预置的FIDO指令，还用于当第一判断模块的判断结果为是时，触发解析模块；当第二判断模块的判断结果为否时，触发第一操作模块；第一接口为FIDO HID接口；
第一操作模块，用于被第一判断触发模块触发时，执行相应的指令操作；
解析模块，用于对预置的FIDO指令进行解析后得到预置参数并根据预置参数得到功能指令；
第二判断触发模块，用于判断解析模块得到的功能指令的类型，当判断功能指令为证书请求生成指令时，触发第二操作模块；当判断功能指令为写入证书指令时，触发第三操作模块；
第二操作模块，用于被第二判断触发模块触发时，生成密钥对，将密钥对存储到存储文件，使用密钥对的私钥对证书请求生成指令中的用户输入信息和密钥对的公钥进行签名，生成签名值，根据签名值、密钥对的公钥和用户输入信息生成证书请求生成指令的响应，根据证书请求生成指令的响应生成响应数据，根据响应数据生成预置的FIDO指令的响应，将预置的FIDO指令的响应发送给客户端，触发等待接收模块；
第三操作模块，用于将写入证书指令中的证书数据写入存储文件，根据成功的状态码组成响应数据，根据响应数据生成预置的FIDO指令的响应，将预置的FIDO指令的响应发送给客户端，触发等待接收模块。
可选的，本申请的实施例还提供了一种安全设备，此安全设备包括至少一个处理器、存储器及存储在该存储器上并可被至少一个处理器执行的指令，至少一个处理器执行该指令以实现上述实施例中的方法。该设备是芯片***时，可以由芯片构成，也可以包含芯片和其他分立器件，本申请实施例对此不作具体限定；该芯片与存储器耦合，用于执行存储器中存储的计算机程序，以执行上述实施例中公开的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件程序实现时，可以全部或部分地以计算机程序产品的形式来实现。该计算机程序产品包括一个或多个计算机程序。在加载和执行计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。该计算机程序可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个基站、服务器或者数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个基站、服务器或数据中心进行传输。所述计算机可读存储介质可以是本发明的设备能够存取的任何可用介质或者是包含一个或多个可以用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)，光介质(例如，DVD(Digital Video Disc))、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
尽管在此结合各实施例对本申请进行了描述，然而，在实施所要求保护的本申请过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并实现所述公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其他单元可以实现权利要求中列举的若 干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应所述以权利要求的保护范围为准。

Claims (16)

  1. 一种安全设备的实现方法，其特征在于，所述方法包括：
    步骤1，所述安全设备等待接收客户端发送指令；
    步骤2，当所述安全设备的第一接口接收到所述指令时，判断接收到的指令是否为预置的线上快速身份验证FIDO指令，如果是，执行步骤3，如果否，执行相应的指令操作，执行步骤1；所述第一接口为线上快速身份验证人机对话接口设备FIDO HID接口；
    步骤3，所述安全设备对所述预置的FIDO指令进行解析后得到预置参数，根据所述预置参数得到功能指令，判断所述功能指令的类型，当所述功能指令为证书请求生成指令时，执行步骤4；当所述功能指令为写入证书指令时，执行步骤5；
    步骤4，所述安全设备生成密钥对，将所述密钥对存储到存储文件，使用所述密钥对的私钥对所述证书请求生成指令中的用户输入信息和所述密钥对的公钥进行签名，生成签名值，根据所述签名值、所述密钥对的公钥和所述用户输入信息生成证书请求生成指令的响应，根据所述证书请求生成指令的响应生成响应数据，根据所述响应数据生成预置的FIDO指令的响应，将所述预置的FIDO指令的响应发送给所述客户端，执行步骤1；
    步骤5，所述安全设备将所述写入证书指令中的证书数据写入所述存储文件，根据成功的状态码组成响应数据，根据所述响应数据生成预置的FIDO指令的响应，将所述预置的FIDO指令的响应发送给客户端，执行步骤1。
  2. 如权利要求1所述的方法，其特征在于，所述存储文件为容器文件，所述容器文件有对应的容器标识。
  3. 如权利要求2所述的方法，其特征在于，所述步骤4中，所述安全设备生成密钥对，将所述密钥对存储到存储文件包括：所述安全设备生成所述密钥对，将所述密钥对存储到与所述证书请求生成指令中的容器标识所对应的容器文件中；
    所述步骤5中，所述安全设备将所述写入证书指令中的证书数据写入存储文件包括：所述安全设备将所述写入证书指令中的证书数据写入与所述写入证书指令中的容器标识所对应的容器文件中。
  4. 如权利要求2所述的方法，其特征在于，当所述功能指令为证书请求生成指令时，执行步骤4包括：
    所述安全设备判断是否存在与所述证书请求生成指令中的容器标识所对应的容器文件，如果是，执行步骤4，如果否，所述安全设备创建与所述证书请求生成指令中的容器标识所对应的容器文件，执行步骤4。
  5. 如权利要求3所述的方法，其特征在于，所述步骤3还包括：
    当所述功能指令为读取证书指令时，执行步骤6；当所述功能指令为签名指令，执行步骤7；
    步骤6，所述安全设备从与所述读取证书指令中的容器标识对应的容器文件中获取证书数据，将获取的所述证书数据发送给所述客户端，执行步骤1；
    步骤7，所述安全设备从所述签名指令中获取容器标识和待签名信息，从与所述容器标识对应的容器文件中读取私钥，根据找到的所述私钥对待签名信息进行签名后得到签名结果，根据所述签名结果组成预置FIDO指令的响应，将所述预置FIDO指令的响应发送给所述客户端，执行步骤1。
  6. 如权利要求2所述的方法，其特征在于，所述步骤2还包括：当所述安全设备的第二接口接收到所述指令并且接收到的指令类型为读证书指令时，所述安全设备从与所述读证书指令所对应的容器文件中获取证书数据，并将所述证书数据返回给所述客户端，执行步骤1。
  7. 如权利要求1所述的方法，其特征在于，所述存储文件包含：内部秘钥文件IKF文件、公有区文件和私有区文件，所述公有区文件包括容器对象、公钥对象、加速对象和证书对象，所述私有区文件包括私钥对象，所述公有区文件具有对应的公有区文件标识，所述私有区文件具有对应的私有区文件标识。
  8. 如权利要求7所述的方法，其特征在于，所述步骤4中，所述安全设备生成密钥对，将所述密钥对存储到存储文件包括：
    步骤4-1，所述安全设备生成所述密钥对和密钥标识，将所述密钥对和所述密钥标识存储到预置的IKF文件中；
    步骤4-2，所述安全设备创建容器对象、公钥对象、私钥对象；
    步骤4-3，所述安全设备将所述容器对象的容器名称、所述证书请求生成指令中的用户输入信息中的证书标识名DN值和密钥标识关联生成加速对象记录，将所述加速对象记录存储到加速对象中以更新加速对象；
    所述步骤5中，所述安全设备将所述写入证书指令中的证书数据写入所述存储文件包括：所述安全设备根据所述写入证书指令中的证书数据创建证书对象及证书对象标识，将所述证书对象标识与所述加速对象中的与证书数据中的证书DN值相对应的加速对象记录相关联以更新加速对象。
  9. 如权利要求8所述的方法，其特征在于，所述步骤3中还包括：当所述功能指令为读取证书指令时，执行步骤6’；当所述功能指令为签名指令时，执行步骤7’；
    步骤6’，所述安全设备根据所述读取证书指令中的证书DN值或容器名称对加速对象中的加速对象记录进行遍历，根据所述证书DN值或所述容器名称找到与其对应的加速对象记录，从所述加速对象记录中获取证书对象标识，根据所述证书对象标识从证书对象中获取证书数据，根据所述证书数据生成响应数据，根据所述响应数据组成预置FIDO指令的响应，将所述预置FIDO指令的响应发送给所述客户端，执行步骤1；
    步骤7’，所述安全设备根据所述签名指令中的证书DN值或者容器名称对加速对象中的加速对象记录进行遍历，找到与所述证书DN值或者所述容器名称相对应的加速对象记录，从所述加速对象记录中获取密钥标识，根据所述密钥标识从IKF文件中找到对应的私钥，使用所述私钥对所述签名指令中的待签名数据进行签名后得到签名结果，根据所述签名结果组成预置FIDO指令的响应，将所述预置FIDO指令的响应发送给所述客户端，执行步骤1。
  10. 如权利要求7所述的方法，其特征在于，所述步骤2还包括：
    当所述安全设备的第二接口接收到所述指令并且接收到的所述指令的类型为选择文件指令且选择文件指令中的文件标识为公有区文件标识时，执行步骤a1；
    步骤a1，所述安全设备将公有区文件作为当前文件；
    当所述安全设备的第二接口接收到所述指令并且接收到的所述指令的类型为读指令时，执行步骤b1；
    步骤b1，所述安全设备将当前文件中容器对象、公钥对象、加速对象、证书对象发送给所述客户端，返回步骤1。
  11. 如权利要求1所述的方法，其特征在于，所述步骤3中，所述安全设备对所述预置的FIDO指令进行解析后得到预置参数，根据所述预置参数得到功能指令，判断所述功能指令的类型包括：
    所述安全设备对所述预置的FIDO指令进行解析得到所述预置参数，将所述预置参数的数据进行转换得到转换数据，使用预定算法对所述转换数据进行解密后得到解密数据，对所述解密数据执行去除填充数据操作后得到功能指令，根据所述功能指令中的指令标识获得所述功能指令的类型。
  12. 如权利要求1所述的方法，其特征在于，所述根据所述响应数据生成预置的FIDO指令的响应，将所述预置的FIDO指令的响应发送给所述客户端包括：所述安全设备将所述响应数据按照预定的规则进行填充得到填充数据，对所述填充数据进行加密得到密文数据，将所述密文数据作为验证数据参数，根据所述验证数据参数组成预置的FIDO指令的响应返回给所述客户端。
  13. 一种安全设备，其特征在于，所述安全设备包括：
    等待接收模块，用于等待接收客户端发送命令；
    接收模块，用于接收所述客户端发送的指令；
    第一判断触发模块，用于当所述接收模块通过第一接口接收到所述指令时，判断所述接收模块接收到的所述指令是否为预置的线上快速身份验证FIDO指令，还用于当第一判断模块的判断结果为是时，触发解析模块；当第二判断模块的判断结果为否时，触发第一操作模块；所述第一接口为线上快速身份验证人机对话接口设备FIDO HID接口；
    所述第一操作模块，用于被所述第一判断触发模块触发时，执行相应的指令操作；
    所述解析模块，用于对所述预置的FIDO指令进行解析后得到预置参数并根据所述预置参数得到功能指令；
    第二判断触发模块，用于判断所述解析模块得到的所述功能指令的类型，当判断所述功能指令为证书请求生成指令时，触发第二操作模块；当判断所述功能指令为写入证书指令时，触发第三操作模块；
    所述第二操作模块，用于被所述第二判断触发模块触发时，生成密钥对，将所述密钥对存储到存储文件，使用所述密钥对的私钥对所述证书请求生成指令中的用户输入信息和所述密钥对的公钥进行签名，生成签名值，根据所述签名值、所述密钥对的公钥和所述用户输入信息生成证书请求生成指令的响应，根据所述证书请求生成指令的响应生成响应数据，根据所述响应数据生成预置的FIDO指令的响应，将所述预置的FIDO指令的响应发送给所述客户端，触发所述等待接收模块；
    所述第三操作模块，用于将所述写入证书指令中的证书数据写入所述存储文件，根据成功的状态码组成响应数据，根据所述响应数据生成预置的FIDO指令的响应，将所述预置的FIDO指令的响应发送给所述客户端，触发所述等待接收模块。
  14. 一种安全设备，其特征在于，所述设备包括至少一个处理器、存储器及存储在所述存储器上并可被所述至少一个处理器执行的指令，所述至少一个处理器执行所述指令以实现权利要求1所述的方法。
  15. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行如权利要求1所述的方法。
  16. 一种芯片，其特征在于，所述芯片与存储器耦合，用于执行所述存储器中存储的计算机程序，以执行权利要求1所述的方法。
PCT/CN2023/095726 2022-07-21 2023-05-23 一种安全设备的实现方法及安全设备 WO2024016829A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210855758.8A CN114938281B (zh) 2022-07-21 2022-07-21 一种安全设备的实现方法及安全设备
CN202210855758.8 2022-07-21

Publications (1)

Publication Number Publication Date
WO2024016829A1 true WO2024016829A1 (zh) 2024-01-25

Family

ID=82868575

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/095726 WO2024016829A1 (zh) 2022-07-21 2023-05-23 一种安全设备的实现方法及安全设备

Country Status (2)

Country Link
CN (1) CN114938281B (zh)
WO (1) WO2024016829A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114938281B (zh) * 2022-07-21 2022-11-04 飞天诚信科技股份有限公司 一种安全设备的实现方法及安全设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108234509A (zh) * 2018-01-16 2018-06-29 国民认证科技（北京）有限公司 基于tee和pki证书的fido认证器、认证***及方法
KR20180119178A (ko) * 2017-04-24 2018-11-02 라온시큐어(주) 인증체인 기반 fido 및 인증서 등록 방법 및 장치
CN112953970A (zh) * 2021-04-01 2021-06-11 国民认证科技（北京）有限公司 一种身份认证方法及身份认证***
CN114938281A (zh) * 2022-07-21 2022-08-23 飞天诚信科技股份有限公司 一种安全设备的实现方法及安全设备

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110889698B (zh) * 2018-09-07 2023-07-07 深圳市文鼎创数据科技有限公司 一种命令处理方法、电子设备及存储介质
CN109474437B (zh) * 2018-12-19 2021-06-15 中金金融认证中心有限公司 一种基于生物识别信息来应用数字证书的方法
CN111726365B (zh) * 2020-06-29 2024-07-16 深圳前海微众银行股份有限公司 一种在线身份认证的方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20180119178A (ko) * 2017-04-24 2018-11-02 라온시큐어(주) 인증체인 기반 fido 및 인증서 등록 방법 및 장치
CN108234509A (zh) * 2018-01-16 2018-06-29 国民认证科技（北京）有限公司 基于tee和pki证书的fido认证器、认证***及方法
CN112953970A (zh) * 2021-04-01 2021-06-11 国民认证科技（北京）有限公司 一种身份认证方法及身份认证***
CN114938281A (zh) * 2022-07-21 2022-08-23 飞天诚信科技股份有限公司 一种安全设备的实现方法及安全设备

Also Published As

Publication number Publication date
CN114938281A (zh) 2022-08-23
CN114938281B (zh) 2022-11-04

Similar Documents

Publication Publication Date Title
US20200363994A1 (en) Distributed storage method and apparatus, computer device, and storage medium
CN109150499B (zh) 动态加密数据的方法、装置、计算机设备和存储介质
CN110099064B (zh) 一种基于物联网的文件处理方法、装置、设备和存储介质
US7904952B2 (en) System and method for access control
US11205014B2 (en) Method and server for authenticating and verifying file
TW201447759A (zh) 用於管理及診斷配備有統一可延伸韌體介面（ｕｅｆｉ）相容韌體的計算裝置之系統與方法
TW202036347A (zh) 資料儲存、驗證方法及裝置
WO2024016829A1 (zh) 一种安全设备的实现方法及安全设备
JP2001027964A (ja) データの保存方法およびシステム並びにデータ保存処理用記録媒体
CN111541542B (zh) 请求的发送和验证方法、装置及设备
CN111641630B (zh) 一种加密传输方法、装置、电子设备和存储介质
US20060218406A1 (en) Computer system, storage device, computer software, and storage administrator authentication method
CN115001766B (zh) 一种高效的多节点批量远程证明方法
WO2018166163A1 (zh) Pos终端控制方法、pos终端、服务器及存储介质
CN113225351B (zh) 一种请求处理方法、装置、存储介质及电子设备
US11368291B2 (en) Mutually authenticated adaptive management interfaces for interaction with sensitive infrastructure
JP2020510924A (ja) 初期オペレーティングシステム・セットアップ・オプションのリモート管理
CN109831435A (zh) 一种数据库操作方法、***及代理服务器和存储介质
CN111200593A (zh) 应用登录方法、装置和电子设备
CN115129332A (zh) 固件烧录方法、计算机设备及可读存储介质
CN112148314A (zh) 一种嵌入式***的镜像验证方法、装置、设备及存储介质
JP2021090151A (ja) ストレージシステムおよびストレージシステムのデータ保護方法
JP4998314B2 (ja) 通信制御方法および通信制御プログラム
WO2023160299A1 (zh) 一种设备物理身份认证方法、***、装置及第一平台
JP2007329731A (ja) 証明書更新方法、システム及びプログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23841898

Country of ref document: EP

Kind code of ref document: A1