GM/T 0107-2021Smart IC card key management system basic technical requirements (English PDF)

5.2.1 Overview

The keys involved in the smart IC card key management system can be divided into smart IC card business keys and system protection keys, according to the key purpose or key source.

Smart IC card business keys are defined by the smart IC card application specification.

6.1 Overview

The smart IC card key management system mainly generates and manages the root key and corresponding certificates of smart IC card services; provides key service functions for other smart IC card related systems, which shall at least include system management, symmetric key management, asymmetric key management, audit management, interface service and other functions.

6.2 System management function

The system management function shall be responsible for user role authority management, operator management, system configuration management, device management functions.

a) Role authority management: It shall include authority resource management and user management; it shall be used to add, delete, modify, check, set permissions and other operations to assign appropriate permissions to the corresponding roles.

b) Operator management: Users with different permissions shall be divided according to roles; different roles shall be assigned to operators. It is used to add, delete, modify, check system operators; assign corresponding roles to operators when creating operators.

c) System configuration management: It shall implement various system configurations for managing the smart IC card key management system, including various basic information and business information configurations.

d) Equipment management: It shall implement encryption machine management of the smart IC card key management system, including the maintenance of encryption machine resource information, reasonable grouping management of encryption machine resources, monitoring and management functions of encryption machines. It shall support the addition, modification, viewing, deletion and other operations of encryption machines to complete the configuration management of encryption machines.

6.3 Symmetric key management function

The symmetric key management function shall support the generation, storage, use, destruction of various symmetric key types, including the security management of keys stored in encryption machines and keys stored in databases; support the management of key attributes and key status of symmetric keys.

a) Generate/inject keys: The function of adding keys shall be implemented. The information of the added symmetric key should include but is not limited to the key name, expiration date, key type, key index, key version number, storage method, etc. If the key is added in ciphertext, the decryption key, decryption algorithm, key value and other related information shall be added.

b) Key diversify: During the use of keys, different levels of diversify will be performed. During the key addition process, the level of diversify to be used and the composition of the diversify factors at different levels shall also be defined.

The key diversify mechanism is shown in 7.1.3.

c) Update key: The added key information shall be queried and modified and saved.

d) Export key: The added key information shall be queried; the related information can be exported and backed up. The exported key can be protected by password envelopes or key transfer cards.

e) Key destruction: The information of symmetric keys shall be queried according to the conditions; symmetric keys that have expired, been leaked, or are no longer used for other reasons shall be deleted.

f) Expired key management: The key validity period shall be modified for keys that have expired or are about to expire.

6.4 Asymmetric key management function

The asymmetric key management function shall support the generation, storage, use, destruction of various asymmetric types of keys, including the security management of keys stored in encryption machines and keys stored in databases; it can support the management of key attributes and key status of asymmetric keys. At the same time, it shall support the management of related certificates and be responsible for the issuance and verification of certificates. It mainly includes but is not limited to the functions of generating certificate requests, importing/exporting certificates, destroying certificates.

a) Generate asymmetric key pairs: The function of generating key pairs can be supported. The parameters of asymmetric key pairs shall be different. When generating key pairs, different parameters shall be used to guide the generation of key pairs.

b) Import asymmetric key pairs: It shall support the import of generated key pairs into the smart IC card key management system for use.

c) Export asymmetric key pairs: It shall support exporting the generated key pairs to the smart IC card key management system, with the private key in encrypted of the event, the operation type, the operation result shall be recorded. The log shall be classified or comprehensively queried by time, operator, operation type, etc. Digital signatures and other methods shall be used to ensure that the log is not tampered with.

6.6 Interface service function

The interface service shall realize the key service function of the key management system to the outside world. The interface service supports multiple forms such as offline files and online network services.

The interface service shall include but is not limited to encryption and decryption, key diversify, key import, key export, smart IC card certificate issuance, card issuer certificate issuance, smart IC card key issuance and other services. The interface transmission protocol shall provide data confidentiality and integrity guarantees.

The specific interface parameters and interface protocols can follow the requirements of the corresponding smart IC card application specifications; this document does not make specific provisions.

7.1.1 Overview

The smart IC card key management system mainly manages the life cycle of the smart IC card business root key, including key generation, key diversify, key issuance, key transmission, key storage, key backup, key archiving, key destruction, etc. A complete key security mechanism shall be in place during the lifecycle management process.

7.1.2 Key generation

The root key of the smart IC card business shall be randomly generated in the password module. The security requirements of the password module are as shown in 8.2; or imported from an external system through a secure medium. The secure medium can be a smart IC card or a smart password key. The specific format is not required, but the integrity and confidentiality of the key import must be guaranteed.

7.1.3 Key diversify

The root key of the smart IC card business shall be diversified to generate smart IC card-level subkeys or subordinate institution subkeys. The diversify method shall support one-level diversify and multi-level diversify. The selection of diversify factors

7.2.1 Overview

The smart IC card key management system shall also manage the public and private key pairs of the card issuer and the public and private key pairs of the smart IC card throughout the life cycle, including key generation, key distribution, key storage, key backup, key archiving, key destruction.

7.2.2 Key generation

The public and private key pairs of the card issuer and the public and private keys of the smart IC card are generated in the cryptographic module. The smart IC card key management system shall support the pre-generation of the public and private key pairs of the smart IC card. The security requirements of the cryptographic module are as shown in 8.2.

7.2.3 Key distribution

The private key of the card issuer is only stored in the smart IC card key management system and does not need to be distributed. The private key of the smart IC card shall be distributed to the data preparation system and the smart IC card issuance system.

The distribution process shall be encrypted with the system transmission protection key before distribution. The public key certificate of the card issuer and the public key certificate of the smart IC card can be directly distributed to the data preparation system and the smart IC card issuance system.

When the smart IC card key management system of the card issuer imports the certificate of the card issuer, its validity shall be verified, including the validity period and the digital signature. When importing the root certificate, the trustworthiness of the root certificate issuing authority and the validity of the root certificate shall be verified, including verification of the certificate validity period, verification of the digital signature, etc.

7.2.4 Key storage

The public and private keys of the card issuer are stored in the cryptographic module.

The security requirements of the cryptographic module are shown in 8.2. The pre-generated public and private keys of the smart IC card are encrypted using the system storage protection key and stored in the system database in ciphertext form.

7.2.5 Key backup

The private key of the card issuer shall be backed up using the key backup mechanism of the cryptographic module itself.

The cryptographic application requirements of the smart IC card key management system shall comply with GB/T 39786 as a whole.

8.2.2 Cryptographic algorithms

The cryptographic algorithm requirements include: The cryptographic algorithms used in smart IC card applications shall adopt the cryptographic algorithms approved by the national cryptographic management authority. The specific cryptographic algorithms include but are not limited to the following cryptographic algorithms:

- The signature algorithm shall use SM2 and comply with GB/T 32918; SM9 shall be used and comply with GM/T 0044;

- The hash algorithm shall use the SM3 algorithm and comply with GB/T 32905;

- The data encryption and decryption shall use the SM4 block cipher algorithm and comply with GB/T 32907.

8.2.3 Cryptographic module

The cryptographic module includes the following requirements.

a) Overall requirements;

The cryptographic module used in the system shall be a cryptographic module that has been tested and certified in accordance with the law and certified by a commercial cryptographic certification body; ensure that the private key and symmetric key do not appear in plain text outside the cryptographic module during use.

b) Cryptographic function requirements:

1) Generate random numbers: Generate a random sequence of specified length;

the generated random numbers shall comply with the requirements of GB/T 32915;

2) Key generation: Generate a key of specified algorithm type and length;

generate subkeys in a dispersed manner;

3) Asymmetric cryptographic operations: Encryption, decryption, signing, signature verification, key negotiation;

4) Symmetric cryptographic operations: Data encryption and decryption;

5) Cryptographic hash operations: Cryptographic hash generation and verification;

6) Message authentication code operations: Message authentication code generation and verification;