GB/T 25056-2018Information security technology—Specifications of cryptograph and related security technology for certificate authentication system (English PDF)

3.1 CA certificate

A certificate issued by one CA to another CA, a CA can also issue a certificate for itself, which is a self-signed certificate.

3.2 Certificate authentication system

A system for managing the life cycle of digital certificates such as the issuance, issuance, update, and revocation of digital certificates.

3.3 Certificate policy

A specified set of rules that indicates the appropriateness of the certificate for a particular group and/or specific application class with general security requirements Use sex.

Note: A specific certificate policy can indicate the suitability of a type of certificate for the authentication of electronic data processing of commodity transactions at a certain price range. Use sex.

3.4 Certificate revocation list

A list of revoked certificates issued and issued by a Certificate Authority (CA).

3.5 Certificate authority

An entity that performs full lifecycle management of digital certificates, also known as an electronic certification service.

3.6 CA logout list

Marks a list of CA's public key certificates that have been logged out, indicating that they have been invalidated.

3.7 Certificate revocation list distribution point; CDP

A directory entry or other certificate revocation list distribution source, a certificate revocation list issued through a certificate revocation list distribution point, It can include a logout entry for a subset of all certificates issued by one CA, or a logout entry for all certificates.

3.8 Certificate serial number

An integer used to uniquely identify a digital certificate in a certificate issued by a certificate authority.

3.9 Digital certificate; public key certificate

Signed by a certificate authority (CA) containing public key owner information, public key, issuer information, expiration date, and extension letter A data structure of interest. According to the category, it can be divided into personal certificate, agency certificate and equipment certificate, which can be divided into signature certificate and encryption according to the purpose. certificate.

3.10 Private key

A non-public key that can only be used by the owner in an asymmetric cryptographic algorithm.

3.11 Public key

A key that can be exposed in an asymmetric cryptographic algorithm.

3.12 Registration authority

An entity that accepts applications for the application, renewal, recovery, and cancellation of digital certificates.

3.13 Security policy

A set of rules issued by a certificate authority to constrain the use of security services and the way they are used and provided.

3.14 SM2 algorithm

Algorithm defined by GB/T 32918 (all parts).

3.15 SM3 cryptographic hash algorithm

Algorithm defined by GB/T 32905.

3.16 Trust

It is generally said that one entity trusts another entity to indicate that the latter entity will perform related activities in full compliance with the provisions of the first entity.

In this standard, trust is used to describe the relationship between an authenticating entity and a certificate authority.

5.1 Overview

The certificate authentication system is a security system that manages the entire process of digital certificates in the life cycle. Certificate certification system should use double certificate Books (certificates for digital signatures and certificates for data encryption) mechanisms and the construction of dual-center (Certificate Authority and Key Management Center).

The certificate authentication system can be logically divided into a core layer, a management layer, and a service layer. The core layer is generated by a key management center and a certificate/CRL. It is composed of the issuance system and the certificate/CRL storage and distribution system; the management layer is composed of the certificate management system and the security management system; The book registration management system (including the remote user registration management system) and the certificate status inquiry system are composed. The logical structure of the certificate authentication system should be As shown in Figure 1.

5.2 Functional Description

5.2.1 Overview

The certificate authentication system provides full-process management of digital certificates in the lifecycle, including user registration management, certificates/ Certificate revocation list generation and issuance, certificate/certificate revocation list storage and distribution, certificate status query, certificate management, and security management And so on.

5.2.2 User Registration Management System

5.2.2.1 Overview

The user registration management system is responsible for the user's certificate application, identity review and certificate download, which can be divided into local registration management system and remote injection. Book management system.

5.2.2.2 Certificate application

Certificate applications can be either online or offline.

a) Online mode. Users log in to the user registration management system to apply for a certificate through the Internet;

b) Offline mode. The user applies for a certificate to the designated registration authority.

5.2.2.3 Identity review

The auditor conducts an identity review of the certificate applicant through the user registration management system.

5.2.2.4 Certificate download

Certificate downloads can be either online or offline.

a) Online mode. Users log in to the user registration management system to download certificates through the Internet;

b) Offline mode. The user downloads the certificate to the designated registration authority.

5.2.3 Certificate/Certificate Revocation List Generation and Issuance System

5.2.3.1 Features

The certificate/certificate revocation list generation and issuance system is responsible for generating, issuing digital certificates and certificate revocation lists.

5.2.3.2 Type of certificate

According to the subject object, the certificate is divided into three types. personnel certificate, device certificate and agency certificate.

According to the function, the certificate is divided into two types. encryption certificate and signature certificate.

5.2.3.3 Certificate mechanism

The certificate authentication system uses a dual certificate mechanism. Each user has two digital certificates, one for digital signatures and one for data encryption. A key pair for digital signature can be generated by a user using a certificate carrier having a cryptographic operation function; a secret for data encryption The key pair is generated by the Key Management Center and is responsible for security management. The signed certificate and the encrypted certificate are stored in the user's certificate carrier.

5.2.3.4 Certificate Generation/Issuance

The user's digital certificate is issued by the CA of the system, and the digital certificate of the root CA is issued by the root CA itself, and the digital certificate of the lower level CA is issued. Issued by a superior CA.

5.2.3.5 Certificate Revocation List

The certificate revocation list is the information of the termination certificate used by the CA within the validity period of the certificate, and is divided into the user certificate revocation list. (CRL) and CA Certificate Revocation List (ARL). During the use of the certificate, the application system obtains the CRL/ARL by checking The status of the certificate.

5.2.4 Certificate/Certificate Revocation List Storage and Distribution System

The certificate/certificate revocation list storage and distribution system is responsible for the storage and distribution of digital certificates, certificate revocation lists.

According to the application environment, the certificate/certificate revocation list storage and publishing system should adopt the database or directory service mode to implement the number. The function of storing, backing up and restoring the word certificate/certificate revocation list and providing query service.

Using the directory service method, the master and slave directory server structure should be adopted to ensure the security of the home directory server, while the slave directory server It can be set up in a distributed manner to increase the efficiency of the system. Users can only access the slave directory server.

5.2.5 Certificate Status Query System

The certificate status query system shall provide certificate status query services for users and application systems, including.

a) CRL query. the user or application system uses the CRL address identified in the digital certificate to download the CRL and verify the validity of the certificate;

b) Online certificate status inquiry. the user or application system can query the certificate online in real time according to the method specified in RFC6960. status.

In practical applications, one or both of the above two query methods may be adopted according to specific situations.

5.2.6 Certificate Management System

The certificate management system implements the application, review, generation, issuance, storage, and release of the certificate/certificate revocation list in the certificate authentication system. Management and control system for functions such as logout and archiving.

5.2.7 Security Management System

The security management system mainly includes a security audit system and a security protection system.

The security audit system provides event-level auditing to track, count, and record records, behaviors, personnel, and time related to system security. analysis.

The security system provides network security features such as access control, intrusion detection (intrusion prevention), vulnerability scanning, and virus prevention.

5.3 System Design

5.3.1 Overview

The design of the certificate certification system includes the overall design of the system and the design of each subsystem. This standard provides the design principles of the certificate certification system. And the implementation of each subsystem, in the specific implementation process, should be based on the selected development platform and development environment for detailed design.

5.3.2 General design principles

The overall design principles of the certificate certification system are as follows.

a) The certificate certification system follows the principles of standardized and modular design;

b) The certificate authentication system sets relatively independent functional modules, and realizes various functions through secure connections between the modules;

c) that the communication between the modules uses a secure communication protocol based on an identity authentication mechanism;

d) The cryptographic operations used by each module must be completed in the cryptographic device;

e) The audit log files generated by each module are transmitted and stored in a unified format;

f) User registration management system, certificate/certificate revocation list generation and issuance system and key management center can set independent numbers Database

g) Each module of the certificate authentication system shall be provided with effective system management functions;

h) The system should have access control functions;

i) The system should fully consider the security of the system while implementing the certificate management function.

5.3.3 User Registration Management System Design

5.3.3.1 User Registration Management System Functions

The user registration management system is responsible for the application, audit and certificate creation of the user certificate/certificate revocation list. Its main functions are as follows.

a) User information entry. Enter the user's application information, the user application information includes the information required to issue the certificate, and also includes Information for verifying the identity of the user, which is stored in the database of the user registration management system. User registration management system It should be possible to batch receive user information generated from an external system and stored in an electronic document.

b) Review of user information. extract the user's application information, review the user's true identity, and, when the approval is passed, issue the certificate. The required information is submitted to the issuance system.

c) User certificate download. The user registration management system provides the certificate download function. When the issuing system issues a certificate for the user, the user notes. The book management system can download the user certificate and write the user certificate into the specified user certificate carrier and distribute it to the user.

d) Security audit. responsible for querying, counting and reporting the operation logs of the administrators and operators of the user registration management system Table printing, etc.

e) Security management. secure access control to the login of the user registration management system, and manage the user information database and Backup.

f) Multi-level audit. The user registration management system can adopt the hierarchical deployment mode as needed, and the certificates of different types and levels can be Audited by different levels of user registration management systems. User registration management system should be able to support multi-level registration as needed Management system establishment and multi-level audit mode.

The user registration management system should have the ability to process in parallel.

5.3.3.2 User Registration Management System Structure

The user registration management system has two methods. local registration management and remote registration management, which are respectively registered management, database, information entry, Part of the composition review, certificate production, security management and security audit. Its structure is shown in Figure 2.

5.3.4 Certificate/Certificate Revocation List Generation and Issuance System Design

5.3.4.1 Certificate/Certificate Revocation List Generation and Issuance System Functions

The certificate/certificate revocation list generation and issuance system is the core of the certificate authentication system, and not only provides the issuance certificate for the entire certificate authentication system. The book/certificate revocation list service also undertakes the main security management work in the entire certificate authentication system. Its main functions are as follows.

a) Certificate generation and issuance. reading and checking user information from the database, applying to the key management center according to the type of certificate to be issued Encrypt the key pair, generate the user's signature certificate and encryption certificate, and publish the signed certificate to the directory server and data. In the library. Depending on the configuration and management policy of the system, different types or uses of certificates can use different signature keys.

b) Certificate update. The system should provide the update function of CA certificate and user certificate.

c) Certificate revocation list generation and issuance. receiving the cancellation information, verifying the signature in the cancellation information, and then issuing a certificate revocation list, The signed-out logout list is published to the database or directory server. Signing the certificate revocation list can be signed and signed The certificate's signature key is the same or different.

d) Security audit. responsible for the operation log of the manager/operator of the certificate/certificate revocation list generation and issuance system Query, statistics, and report printing.

e) Security management. secure access control for certificate/certificate revocation list generation and login system login, and withdrawal of certificate/certificate Sales list database for management and backup; set up administrators, operators, and apply for and download digital certificates for these people; configuration Different password devices; configure different certificate templates. […]