Cryptographic key management based on identity information

Patent metadata

Field	Value
Publication number	US-11258591-B2
Application number	US-202117348413-A
Country	US
Kind code	B2
Filing date	Jun 15, 2021
Priority date	Mar 29, 2019
Publication date	Feb 22, 2022
Grant date	Feb 22, 2022

Abstract

Disclosed herein are methods, systems, and apparatus, including computer programs encoded on computer storage media, for managing cryptographic keys based on user identity information. One of the methods includes receiving a request to store identity information and a user key pair to a memory on a chip, the request being digitally signed with a digital signature, the identity information uniquely identifying the user, and the user key pair being assigned to the user; determining that the digital signature is authentic based on a public key pre-stored in the memory; encrypting the identity information and the user key pair; and storing the identity information and the user key pair to the memory.

First claim

What is claimed is:

1. A computer-implemented method comprising
receiving, by an identity cryptographic chip (ICC), a request to input a public authorization key;
in response to receiving the request to input the public authorization key, resetting, by the ICC, the ICC;
after resetting the ICC, receiving, by the ICC, the public authorization key;
in response to receiving the public authorization key, determining, by the ICC, memory of the ICC is not a type of one-time programmable (OTP) memory;
in response to determining the memory of the ICC is not the type of OTP memory, erasing, by the ICC, the memory of the ICC;
encrypting, by the ICC, the public authorization key as an encrypted public authorization key; and
inputting, by the ICC, the encrypted public authorization key to the memory of the ICC.

2. The computer-implemented method of claim 1 , wherein resetting the ICC comprises:
reconfiguring settings of a logic computing component of the ICC to default.

3. The computer-implemented method of claim 1 , wherein resetting the ICC comprises:
erasing identity information and cryptographic key pairs previously stored in the ICC.

4. The computer-implemented method of claim 1 , comprising:
pre-storing the public authorization key and a private authorization key, wherein the public authorization key and the private authorization key are an asymmetric-key pair assigned to a master user of the ICC.

5. The computer-implemented method of claim 1 , comprising:
storing identity authentication code executable to authenticate a user based on identity information.

6. The computer-implemented method of claim 1 , comprising:
storing first cryptographic operation code executable to add a digital signature corresponding to a second request based on a private authorization key corresponding to the public authorization key; and
storing second cryptographic operation code executable to perform file encryption or file decryption based on a user key pair assigned to a user.

7. The computer-implemented method of claim 1 , comprising:
receiving a second request to store, to the memory on the ICC, identity information and a user key pair, wherein the request is digitally signed with a digital signature, wherein the identity information uniquely identifies a user, and wherein the user key pair is assigned to the user;
determining that the digital signature is authentic based on the public authorization key;
encrypting the identity information and the user key pair; and
storing the identity information and the user key pair to the memory.

8. The computer-implemented method of claim 7 , wherein the identity information is biometric information.

9. The computer-implemented method of claim 1 , wherein the memory is a programmable read-only memory (PROM), an electrically erasable PROM or a flash memory.

10. A non-transitory, computer-readable storage medium storing one or more instructions executable by a computer system to perform operations comprising:
receiving, by an identity cryptographic chip (ICC), a request to input a public authorization key;
in response to receiving the request to input the public authorization key, resetting, by the ICC, the ICC;
after resetting the ICC, receiving, by the ICC, the public authorization key;
in response to receiving the public authorization key, determining, by the ICC, memory of the ICC is not a type of one-time programmable (OTP) memory;
in response to determining the memory of the ICC is not the type of OTP memory, erasing, by the ICC, the memory of the ICC;
encrypting, by the ICC, the public authorization key as an encrypted public authorization key; and
inputting, by the ICC, the encrypted public authorization key to the memory of the ICC.

11. The non-transitory, computer-readable storage medium of claim 10 , wherein resetting the ICC comprises:
reconfiguring settings of a logic computing component of the ICC to default.

12. The non-transitory, computer-readable storage medium of claim 10 , wherein resetting the ICC comprises:
erasing identity information and cryptographic key pairs previously stored in the ICC.

13. The non-transitory, computer-readable storage medium of claim 10 , comprising:
pre-storing the public authorization key and a private authorization key, wherein the public authorization key and the private authorization key are an asymmetric-key pair assigned to a master user of the ICC.

14. The non-transitory, computer-readable storage medium of claim 10 , comprising:
storing identity authentication code executable to authenticate a user based on identity information.

15. The non-transitory, computer-readable storage medium of claim 10 , comprising:
storing first cryptographic operation code executable to add a digital signature corresponding to a second request based on a private authorization key corresponding to the public authorization key; and
storing second cryptographic operation code executable to perform file encryption or file decryption based on a user key pair assigned to a user.

16. The non-transitory, computer-readable storage medium of claim 10 , comprising:
receiving a second request to store, to the memory on the ICC, identity information and a user key pair, wherein the request is digitally signed with a digital signature, wherein the identity information uniquely identifies a user, and wherein the user key pair is assigned to the user;
determining that the digital signature is authentic based on the public authorization key;
encrypting the identity information and the user key pair; and
storing the identity information and the user key pair to the memory.

17. The non-transitory, computer-readable storage medium of claim 16 , wherein the identity information is biometric information.

18. The non-transitory, computer-readable storage medium of claim 10 , wherein the memory is a programmable read-only memory (PROM), an electrically erasable PROM or a flash memory.

19. A computer-implemented system, comprising:
one or more computing devices; and
one or more computer memory devices interoperably coupled with the one or more computing devices and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computing devices, perform one or more operations comprising:
receiving, by an identity cryptographic chip (ICC), a request to input a public authorization key;
in response to receiving the request to input the public authorization key, resetting, by the ICC, the ICC;
after resetting the ICC, receiving, by the ICC, the public authorization key;
in response to receiving the public authorization key, determining, by the ICC, memory of the ICC is not a type of one-time programmable (OTP) memory;
in response to determining the memory of the ICC is not the type of OTP memory, erasing, by the ICC, the memory of the ICC;
encrypting, by the ICC, the public authorization key as an encrypted public authorization key; and
inputting, by the ICC, the encrypted public authorization key to the memory of the ICC.

20. The computer-implemented system of claim 19 , wherein resetting the ICC comprises:
reconfiguring settings of a logic computing component of the ICC to default.

Assignees

• Advanced New Technologies Co Ltd

Inventors

• Feng Zhiyuan
• Li Yanpeng
• Cheng Long

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L9/3213 Primary

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title