Background technology
Along with the high speed development of computer technology, increasing user's custom utilizes the convenient and rich in natural resources of network to finish every work.This has saved the time to a certain extent, has improved work efficiency, promoted the Internet further develop and perfect.But, along with the continuous development of high-tech means, network offer convenience to people and amusement in, also exist great potential safety hazard, for example: the lawless person utilizes network opening to carry out malicious attack, brings very big threat for the computer that inserts the Internet.
Intelligent key apparatus is a kind of small hardware device that has processor and memory, is mainly used in fields such as authentication, software protection.It is connected with computer by the data communication interface of computer, and has the key systematic function, but the safe storage key presets cryptographic algorithm.The intelligent key apparatus computing relevant with key be fully at the device internal operation, and intelligent key apparatus has anti-characteristic of attacking, and fail safe is high.USB Key is a kind of intelligent key apparatus of USB interface, and its built-in single-chip microcomputer or intelligent card chip can be stored user's key or digital certificate.
In the prior art, intelligent key apparatus has been widely used in network safety filed.Because its inside has calculation function, is the computing environment of independence and sealing, therefore can guarantee the fail safe of data processing and storage to a great extent.Yet intelligent key apparatus can't guarantee that but data carry out safety of transmission beyond the exchange channels, and the network malefactor is very easily utilized this weakness of intelligent key apparatus, carries out unlawful activities.Show that mainly present computer is not the computer that isolates, nearly all can get involved the Internet, personal computer becomes an open relatively computer environment, in case user's computer is implanted trojan horse program, when the user uses intelligent cipher key equipment on this computer, network hacker is easy to steal operational order and the operating data that the user sends to intelligent key apparatus by computer, under the situation that the user knows nothing, distort order and data, indiscriminately ad. as one wishes utilize intelligent key apparatus to carry out every illegal operation, cause tremendous economic loss or emotional distress very likely for the validated user of intelligent key apparatus.For example, the user of the Internet bank is when remitting money operation, if intelligent key apparatus be access in one implanted in the computer of trojan horse program, if in time disconnecting with this computer, intelligent key apparatus is not connected, network hacker is easy to utilize trojan horse program to steal remittance information and remittance data that this user sends, and it is illegally distorted, when above-mentioned user carries out the remittance operation, its remittance information no longer is legacy data, in case this user continues to use intelligent key apparatus to signing through the data after distorting and sending, the illegal transaction of network hacker will be gone smoothly, and brings loss difficult to the appraisal for above-mentioned user.
There has been at present a kind of biological identification technology that utilizes to replace merely importing the technology that PIN code is carried out authentication, increased the fail safe of using intelligent key apparatus by the user.But biological characteristic is copied by biotechnology easily, and aspect the user was identified, some utilized biological characteristic to realize that there is certain potential safety hazard in the intelligent key apparatus of identification.
Summary of the invention
To use intelligent key apparatus to have the problem of potential safety hazard in the prior art in order alleviating, to the invention provides a kind of method and system of using intelligent key apparatus safely.Described technical scheme is as follows:
A kind of method of using intelligent key apparatus safely said method comprising the steps of:
Steps A: intelligent key apparatus receives operational order;
Step B: after described intelligent key apparatus is received described operational order, generate identification code, and export described identification code by described intelligent key apparatus;
Step C: described intelligent key apparatus is waited for user's input validation sign indicating number;
Step D: after described intelligent key apparatus is received described confirmation code, verify whether described confirmation code is consistent with described identification code, if consistent, described intelligent key apparatus is carried out described operational order, otherwise returns error message.
Operational order in the described steps A is:
The checking PIN code, generate key to or carry out digital signature.
The described algorithm that carries out digital signature comprises:
RSA Digital Signature Algorithm, DSA Digital Signature Algorithm, elliptic curve or finite automata Digital Signature Algorithm.
The way of output of the described identification code of output among the described step B is specially:
The mode or the voice prompting mode that show.
Identification code among the described step B is one group of random number.
Identification code among the described step B is relevant with operational order, specifically comprises:
Described identification code is the data in the operational order;
Described identification code is by the data in the operational order are carried out generating after the conversion.
Confirmation code among the described step C is that described user imports by main frame.
The present invention provides a kind of system that uses intelligent key apparatus safely simultaneously, comprises main frame and intelligent key apparatus, and described main frame comprises:
MIM message input module, the confirmation code that be used to point out the input validation sign indicating number, receives user's input;
Host interface module is used for main frame is connected with described intelligent key apparatus, realizes data communication;
Described intelligent key apparatus comprises:
The identification code generation module is used to generate identification code;
The identification code output module is used to export the identification code that described identification code generation module generates;
Match comparison module is used to verify whether the confirmation code of input is consistent with the identification code that described identification code generation module generates, if consistent, then allows the command execution module operation command, otherwise, return error message;
Command execution module is used for operation command;
Control module is used for sending order to described identification code generation module, described identification code output module, described match comparison module and described command execution module, and the work of coordinating each intermodule;
Interface module is used for described control module is connected with main frame, realizes data communication.
Described identification code output module specifically comprises:
Display unit is used for exporting described identification code in the mode that shows;
And/or phonation unit, be used for exporting described identification code with voice prompting mode.
Described interface module comprises usb interface module, eSATA interface module, SDIO interface module, pcmcia interface module.
The beneficial effect that technical scheme of the present invention is brought is:
The identification code that intelligent key apparatus among the present invention generates only sends to the identification code output module, the channel that obtains identification code has only by the identification code output module on the intelligent key apparatus and could realize, the identification code that intelligent key apparatus generates does not send to host side, so, even the main frame that links to each other with intelligent key apparatus is implanted trojan horse program, because trojan horse program can't be predicted identification code, therefore malefactor can't be stolen it, thereby can not utilize intelligent key apparatus to carry out any operation.
Though malefactor can be stolen identification code by main frame the user in intelligent key apparatus is imported the process of identification code (confirmation code), because identification code can only be used once, promptly each identification code that generates can only be effective to the once-through operation order, the user can not utilize same identification code order intelligent key apparatus to finish the multi-pass operation task, in fact the malefactor identification code of stealing is cancelled, do not have in all senses, finally contained the illegal act of malefactor.
The present invention has improved the user to a great extent in the validity of using intelligent key apparatus process safe and operational order.
Embodiment
The invention will be further described below in conjunction with the drawings and specific embodiments, but the present invention is not limited to following examples.
Embodiment 1
Present embodiment uses intelligent key apparatus that data are carried out digital signature with the user to be example, the user is when using intelligent key apparatus that data are carried out digital signature, intelligent key apparatus produces identification code at random, and require the user correctly to import this identification code to confirm the validity of its legal identity and operational order, in the present embodiment, intelligent key apparatus is USB Key, and identification code is a string random number.
Referring to Fig. 1, a kind of method of using intelligent key apparatus safely is provided, concrete steps are as follows:
After step 101:USB Key and main frame connected, the prompting user imported PIN code;
Step 102: the user imports PIN code and carries out authentication;
Whether the PIN code of step 103:USB Key internal verification user input is correct, if correct, then execution in step 104, otherwise execution in step 109;
Step 104: the user by authentication after, send one group of data to USB Key, and require USB Key that these data are carried out digital signature;
Step 105:USB Key is inner to generate a string identification code, and is shown to the user by display unit, and this display unit can be a LCD Panel;
Step 106: the user is according to prompting, the input validation sign indicating number, and the confirmation code that at this moment requires the user to import is the identification code that display unit shows;
Whether the confirmation code of step 107:USB Key internal verification user input is consistent with the identification code of generation in the step 105, in the present embodiment, the confirmation code process of checking user's input is that USB Key inside compares the identification code of its generation and the confirmation code of user's input, judge whether the two is consistent, if it is consistent, then execution in step 108, otherwise execution in step 109;
Step 108:USB Key combine digital signature operation.
Digital signature is some data that are attached on the initial data, or by Digital Signature Algorithm initial data is carried out cryptographic transformation.Digital signature is the recipient in order to the source of confirming initial data and the integrality and the protected data of initial data, prevents that other people (for example recipient) forges.Can obtain digital signature based on public-key cryptosystem and private key cryptographic system, mainly be based on the digital signature of public-key cryptosystem at present, different digital signature is closely related with concrete applied environment.
Digital Signature Algorithm comprises: RSA Digital Signature Algorithm, DSA Digital Signature Algorithm, and elliptic curve or finite automata Digital Signature Algorithm, in the present embodiment, the Digital Signature Algorithm of selecting for use is a RSA Algorithm.
Step 109: mistake will be pointed out by system, and refusal is carried out next step operation.
Embodiment 2
Referring to Fig. 2, present embodiment provides a kind of system that uses intelligent key apparatus safely, comprises main frame and intelligent key apparatus, and wherein, main frame comprises:
MIM message input module, the confirmation code that be used to point out the input validation sign indicating number, receives user's input; Generally be prompted to and want the user that uses intelligent key apparatus to operate.
Host interface module is used for main frame is connected with described intelligent key apparatus, realizes data communication;
Intelligent key apparatus comprises:
The identification code generation module is used to generate identification code;
The identification code output module is used to export the identification code that the identification code generation module generates;
Match comparison module is used to verify whether the confirmation code of input is consistent with the identification code that the identification code generation module generates, if consistent, then allows the command execution module operation command, otherwise, the refusal operation;
Command execution module is used for operation command;
Control module is used for sending order to identification code generation module, identification code output module, match comparison module and command execution module, and the work of coordinating each intermodule;
Interface module is used for control module is connected with main frame, realizes data communication.
The intelligent key apparatus of present embodiment is USB Key.
Wherein, the identification code output module specifically comprises:
Display unit is used to the identification code that shows that the identification code generation module generates;
And/or phonation unit, be used for identification code with the form output identification code generation module generation of sound.
In the present embodiment, this system also comprises: data memory module is used for the storing initial key to, root ca certificate, initial password and user's private information.
Above-mentioned host interface module and interface module include line interface module and radio interface module.Specifically have: usb interface module, eSATA (External Serial ATA, external serial advanced technology attachment) interface module, SDIO (input and output of SD card) interface module, PCMCIA (Personal Computer MemoryCard International Association) interface module.
Pcmcia interface also is pc card slot, is the standard facility of notebook computer, belongs to industrial standard (PCMCIA standard), and also extensive use on many medium-sized digital equipments and industrial control equipment is most commonly used to notebook computer.
The wireline interface module comprises usb interface module, serial interface module and parallel interface module.
Serial interface module is SPI (Serial Peripheral Interface, a Serial Peripheral Interface (SPI)) module, is a kind of synchronous serial Peripheral Interface, and it can make control module and various ancillary equipment communicate with exchange message with serial mode.
In the present embodiment, host interface module and interface module all adopt usb interface module.
In the present embodiment, identification code generation module, match comparison module, command execution module, data memory module, control module, interface module are integrated in the process chip, and the SPI interface module is responsible for display unit and process chip are set up being connected physically.
Embodiment 3
In the present embodiment, the identification code that USB Key produces is exported with speech form, replaces the form output of identification code to show among the embodiment 1, and concrete steps are as follows:
Step 301:USB Key and main frame connect, and the prompting user imports PIN code;
Step 302: the user imports PIN code and carries out authentication;
Whether the PIN code of step 303:USB Key internal verification user input is correct, if correct, then execution in step 304, otherwise execution in step 309;
Step 304: the user sends one group of data by authentication to USB Key, and requires USB Key that these data are carried out digital signature;
Step 305:USB Key is inner to generate a string identification code, and exports to the user with the form of voice;
Step 306: the user points out according to main frame, the input validation sign indicating number; At this moment the confirmation code that requires the user to import is the identification code that display unit shows;
Whether the confirmation code of step 307:USB Key internal verification user input is consistent with the identification code of generation in the step 305, in the present embodiment, the process of the confirmation code of checking user input is that USB Key inside compares the identification code of its generation and the identification code of user's input, judgement is whether the two is consistent, if it is consistent, then execution in step 308, otherwise execution in step 309;
Step 308: the identification code of user's input is consistent with the inner identification code that produces of USB Key, USB Key combine digital signature operation;
Step 309: mistake will be pointed out by system, and refusal is carried out next step operation.
More than a kind of method and system of using intelligent key apparatus safely provided by the present invention are introduced, adopt instantiation that principle and execution mode are set forth among the present invention, the explanation of above embodiment just is used for helping to understand method of the present invention and core concept thereof; Simultaneously, for one of ordinary skill in the art, according to thought of the present invention, common variation of carrying out in embodiment and range of application and replacement all should be included in protection scope of the present invention.