阅读说明：本技术 增强型cpk的密钥申请与分发方法及装置 (Key application and distribution method and device for enhanced CPK ) 是由 南相浩 于 2020-06-08 设计创作，主要内容包括：本发明实施例提供一种增强型CPK的密钥申请与分发方法及装置,属于网络安全技术领域,解决了现有技术中利用量子计算,就可以通过公开的公钥攻破公钥体制的问题。所述方法包括：客户端向服务中心发送时刻密钥申请消息；接收服务中心发送的第一响应参数；定义第一随机数和第一随机密钥,根据第一响应参数及第一随机数,得到第一随机参数及第二随机参数；利用第二随机参数对密钥参数加密,发送第一随机参数与加密后的密钥参数,密钥参数包括网络时刻、密钥申请标识及第一随机密钥；接收时刻密钥信息,利用第一随机密钥脱密时刻密钥信息得到时刻密钥,时刻密钥与网络时刻、密钥申请标识相关。本发明实施例适用于用户加密、解密、签名以及验证过程。(The embodiment of the invention provides a method and a device for applying and distributing a secret key of an enhanced CPK (Combined public Key), belongs to the technical field of network security, and solves the problem that a public key system can be broken through a public key by utilizing quantum computation in the prior art. The method comprises the following steps: the client sends a time key application message to the service center; receiving a first response parameter sent by a service center; defining a first random number and a first random key, and obtaining a first random parameter and a second random parameter according to the first response parameter and the first random number; encrypting the key parameter by using a second random parameter, and sending the first random parameter and the encrypted key parameter, wherein the key parameter comprises a network moment, a key application identifier and a first random key; and receiving the time key information, and acquiring a time key by using the first random key decryption time key information, wherein the time key is related to the network time and the key application identifier. The embodiment of the invention is suitable for the encryption, decryption, signature and verification processes of the user.)

1. A key application and distribution method of an enhanced Combined Public Key (CPK) is applied to a client, and the method comprises the following steps:

sending a time key application message to a service center;

receiving a first response parameter sent by the service center;

defining a first random number and a first random key, and obtaining a first random parameter and a second random parameter according to the first response parameter and the first random number;

encrypting a key parameter by using the second random parameter, and sending the first random parameter and the encrypted key parameter to the service center, wherein the key parameter comprises a network moment, a key application identifier and a first random key;

and receiving time key information sent by the service center, and decrypting the time key information by using the first random key to obtain a time key, wherein the time key is related to the network time and the key application identifier.

2. The method of claim 1, wherein before sending the time-of-day key application message to the service center, the method further comprises a process of the client registering with the service center:

sending a registration application message to the service center;

receiving a second response parameter sent by the service center;

defining a third random number and a second random key, and obtaining a third random parameter and a fourth random parameter according to the second response parameter and the third random number;

encrypting the client information of the client and the second random key by using the fourth random parameter to obtain a client information ciphertext, and sending the third random parameter and the client information ciphertext to the service center, wherein the client information comprises a real name, an identity card number and application path information of a client, and the application path information comprises a telephone number and a mail address;

and receiving the serial number and the registration certificate which are sent by the service center and encrypted by using the second random key, and decrypting by using the second random key to obtain the serial number and the registration certificate, wherein the registration certificate is a signature of the service center on the key application identifier.

3. The key application and distribution method of the enhanced CPK according to claim 2, wherein when the time key application message is a time private key application message, the key application identifier is an identifier of a time private key application, the key parameters further include a current serial number and a registration certificate of the client, and the time private key application message is sent to the service center through the application path information, so that the service center verifies whether the application path information is consistent with the application path information provided when the client registers with the service center, and when verifying that the application path information is consistent with the application path information provided when the client registers with the service center, the service center is the service center registered by the client, checks the current serial number and verifies the registration certificate, the decrypting the time key information by using the first random key to obtain a time key includes:

and decrypting the time key information by using the first random key to obtain a time private key and an updated serial number, and replacing the current serial number of the client with the updated serial number.

4. The method as claimed in claim 3, wherein when the time key application message is a time signature private key application message, the network time is a signature time.

5. The method as claimed in claim 3, wherein the network time is an encryption time provided by an encryption party when the time key application message is a time privacy key application message.

6. A key application and distribution method of an enhanced Combined Public Key (CPK) is applied to a service center, and the method comprises the following steps:

receiving a time key application message sent by a client;

sending a first response parameter generated by using a defined first response number to the client as a response for receiving the key application message at the moment;

receiving a first random parameter and an encrypted key parameter sent by the client;

obtaining the second random parameter according to the first response number and the first random parameter, and decrypting the encrypted key parameter by using the second random parameter to obtain a network time, a key application identifier and a first random key in the key parameter;

and generating a time key corresponding to the key application identifier by using the network time and the key application identifier, and sending the time key encrypted by using the first random key to the client.

7. The method of claim 6, further comprising the step of registering the client with the service center:

receiving a registration application message sent by the client;

sending a second response parameter generated by using a defined second response number to the client as a response for receiving the registration application message;

receiving a third random parameter and a client information ciphertext sent by the client;

obtaining the fourth random parameter according to the second response number and the third random parameter, and decrypting the client information ciphertext by using the fourth random parameter to obtain client information and a second random key, wherein the client information comprises a real name, an identity card number and application path information of a client, and the application path information comprises a telephone number and a mail address;

and when the authenticity of the client information is verified to be true, defining a serial number and a registration certificate corresponding to the client, and sending the serial number and the registration certificate encrypted by the second random key to the client.

8. The method of claim 7, wherein when the time key application message is a time private key application message, the key parameters further include a current serial number and a registration certificate of the client, and the method further comprises:

determining application path information of a private key at the application time of the client;

verifying whether the application path information is consistent with the application path information provided by the client when the client registers in the service center;

when the application path information is verified to be consistent with the application path information provided when the client registers in the service center, checking whether the current serial number of the client is consistent with the serial number of the client stored in the service center, and verifying whether the registered certificate is a certificate issued by the service center;

when the current serial number of the client is consistent with the serial number of the client stored by the service center and the registration certificate is verified to be the certificate issued by the service center, generating a time private key corresponding to the key application identifier by using the network time and the key application identifier;

and encrypting the time private key and the updated serial number by using the first random key, and sending the time private key and the updated serial number to the client.

9. A key application and distribution device of an enhanced Combined Public Key (CPK), which is applied to a client, and comprises:

a storage module for storing computer executable instructions; and

a control module to execute the computer-executable instructions to perform operations comprising:

sending a time key application message to a service center;

receiving a first response parameter sent by the service center;

defining a first random number and a first random key, and obtaining a first random parameter and a second random parameter according to the first response parameter and the first random number;

encrypting a key parameter by using the second random parameter, and sending the first random parameter and the encrypted key parameter to the service center, wherein the key parameter comprises a network moment, a key application identifier and a first random key;

and receiving time key information sent by the service center, and decrypting the time key information by using the first random key to obtain a time key, wherein the time key is related to the network time and the key application identifier.

10. A key application and distribution device of an enhanced Combined Public Key (CPK) is applied to a service center, and the device comprises:

a storage module for storing computer executable instructions; and

a control module to execute the computer-executable instructions to perform operations comprising:

receiving a time key application message sent by a client;

sending a first response parameter generated by using a defined first response number to the client as a response for receiving the key application message at the moment;

receiving a first random parameter and an encrypted key parameter sent by the client;

obtaining the second random parameter according to the first response number and the first random parameter, and decrypting the encrypted key parameter by using the second random parameter to obtain a network time, a key application identifier and a first random key in the key parameter;

and generating a time key corresponding to the key application identifier by using the network time and the key application identifier, and sending the time key encrypted by using the first random key to the client.

Technical Field

The present invention relates to the field of network security technologies, and in particular, to a method and an apparatus for applying and distributing a key of an enhanced CPK (Combined public key).

Background

At present, the working principle of all public key systems lies in the public key disclosure, and if the public key is not disclosed, the encryption of the secret key and the verification of the signature can not be carried out. However, with the continuous development of quantum computing, in the case of public key disclosure, the public key system will be broken through in a few hours through quantum computing, so as to obtain the private key corresponding to the public key.

Disclosure of Invention

The embodiment of the invention aims to provide a method and a device for applying and distributing a secret key of an enhanced CPK (compact peripheral component Key), which solve the problem that a public key system can be broken through a public key by utilizing quantum computation in the prior art.

In order to achieve the above object, an embodiment of the present invention provides a key application and distribution method for an enhanced CPK, where the method is applied to a client, and the method includes: sending a time key application message to a service center; receiving a first response parameter sent by the service center; defining a first random number and a first random key, and obtaining a first random parameter and a second random parameter according to the first response parameter and the first random number; encrypting a key parameter by using the second random parameter, and sending the first random parameter and the encrypted key parameter to the service center, wherein the key parameter comprises a network moment, a key application identifier and a first random key; and receiving time key information sent by the service center, and decrypting the time key information by using the first random key to obtain a time key, wherein the time key is related to the network time and the key application identifier.

Further, before the sending of the time key application message to the service center, the method further includes a process of registering, by the client, with the service center: sending a registration application message to the service center; receiving a second response parameter sent by the service center; defining a third random number and a second random key, and obtaining a third random parameter and a fourth random parameter according to the second response parameter and the third random number; encrypting the client information of the client and the second random key by using the fourth random parameter to obtain a client information ciphertext, and sending the third random parameter and the client information ciphertext to the service center, wherein the client information comprises a real name, an identity card number and application path information of a client, and the application path information comprises a telephone number and a mail address; and receiving the serial number and the registration certificate which are sent by the service center and encrypted by using the second random key, and decrypting by using the second random key to obtain the serial number and the registration certificate, wherein the registration certificate is a signature of the service center on the key application identifier.

Further, when the time key application message is a time private key application message, the key application identifier is an identifier of the application time private key, the key parameters also include the current serial number and the registration certificate of the client, and the time private key application message is sent to the service center through the application path information, so that the service center verifies whether the application path information is consistent with the application path information provided when the client registers with the service center, and when the application path information is verified to be consistent with the application path information provided when the client registers to the service center, checking the current serial number, and verifying the registration certificate, wherein the service center is a service center registered by the client, and the decrypting the time key information by using the first random key to obtain a time key comprises: and decrypting the time key information by using the first random key to obtain a time private key and an updated serial number, and replacing the current serial number of the client with the updated serial number.

Further, when the time key application message is a time signature private key application message, the network time is signature time.

Further, when the time key application message is a time decryption private key application message, the network time is an encryption time provided by an encryption party.

Further, when the time key application message is a time verification public key application message, the network time is a signature time provided by a signer.

Further, when the time key application message is a time encryption public key application message, the network time is an encryption time.

Correspondingly, the embodiment of the invention also provides a key application and distribution method of the enhanced CPK, the method is applied to the service center, and the method comprises the following steps: receiving a time key application message sent by a client; sending a first response parameter generated by using a defined first response number to the client as a response for receiving the key application message at the moment; receiving a first random parameter and an encrypted key parameter sent by the client; obtaining the second random parameter according to the first response number and the first random parameter, and decrypting the encrypted key parameter by using the second random parameter to obtain a network time, a key application identifier and a first random key in the key parameter; and generating a time key corresponding to the key application identifier by using the network time and the key application identifier, and sending the time key encrypted by using the first random key to the client.

Further, the method also includes a process that the client registers with the service center: receiving a registration application message sent by the client; sending a second response parameter generated by using a defined second response number to the client as a response for receiving the registration application message; receiving a third random parameter and a client information ciphertext sent by the client; obtaining the fourth random parameter according to the second response number and the third random parameter, and decrypting the client information ciphertext by using the fourth random parameter to obtain client information and a second random key, wherein the client information comprises a real name, an identity card number and application path information of a client, and the application path information comprises a telephone number and a mail address; and when the authenticity of the client information is verified to be true, defining a serial number and a registration certificate corresponding to the client, and sending the serial number and the registration certificate encrypted by the second random key to the client.

Further, when the time key application message is a time private key application message, the key parameters further include a current serial number and a registration certificate of the client, and the method further includes: determining application path information of a private key at the application time of the client; verifying whether the application path information is consistent with the application path information provided by the client when the client registers in the service center; when the application path information is verified to be consistent with the application path information provided when the client registers in the service center, checking whether the current serial number of the client is consistent with the serial number of the client stored in the service center, and verifying whether the registered certificate is a certificate issued by the service center; when the current serial number of the client is consistent with the serial number of the client stored by the service center and the registration certificate is verified to be the certificate issued by the service center, generating a time private key corresponding to the key application identifier by using the network time and the key application identifier; and encrypting the time private key and the updated serial number by using the first random key, and sending the time private key and the updated serial number to the client.

Correspondingly, the embodiment of the invention also provides a device for applying and distributing the key of the enhanced CPK, which is applied to the client and comprises: a storage module for storing computer executable instructions; and a control module to execute the computer-executable instructions to perform operations comprising: sending a time key application message to a service center; receiving a first response parameter sent by the service center; defining a first random number and a first random key, and obtaining a first random parameter and a second random parameter according to the first response parameter and the first random number; encrypting a key parameter by using the second random parameter, and sending the first random parameter and the encrypted key parameter to the service center, wherein the key parameter comprises a network moment, a key application identifier and a first random key; and receiving time key information sent by the service center, and decrypting the time key information by using the first random key to obtain a time key, wherein the time key is related to the network time and the key application identifier.

Further, before the sending of the time key application message to the service center, the control module is further configured to execute the computer-executable instructions to perform a process of registering the client with the service center: sending a registration application message to the service center; receiving a second response parameter sent by the service center; defining a third random number and a second random key, and obtaining a third random parameter and a fourth random parameter according to the second response parameter and the third random number; encrypting the client information of the client and the second random key by using the fourth random parameter to obtain a client information ciphertext, and sending the third random parameter and the client information ciphertext to the service center, wherein the client information comprises a real name, an identity card number and application path information of a client, and the application path information comprises a telephone number and a mail address; and receiving the serial number and the registration certificate which are sent by the service center and encrypted by using the second random key, and decrypting by using the second random key to obtain the serial number and the registration certificate, wherein the registration certificate is a signature of the service center on the key application identifier.

Further, when the time key application message is a time private key application message, the key application identifier is an identifier of the application time private key, the key parameters also include the current serial number and the registration certificate of the client, and the time private key application message is sent to the service center through the application path information, so that the service center verifies whether the application path information is consistent with the application path information provided when the client registers with the service center, and when the application path information is verified to be consistent with the application path information provided when the client registers to the service center, checking the current serial number, and verifying the registration certificate, wherein the service center is a service center registered by the client, and the decrypting the time key information by using the first random key to obtain a time key comprises: and decrypting the time key information by using the first random key to obtain a time private key and an updated serial number, and replacing the current serial number of the client with the updated serial number.

Further, when the time key application message is a time signature private key application message, the network time is signature time.

Further, when the time key application message is a time decryption private key application message, the network time is an encryption time provided by an encryption party.

Further, when the time key application message is a time verification public key application message, the network time is a signature time provided by a signer.

Further, when the time key application message is a time encryption public key application message, the network time is an encryption time.

Correspondingly, the embodiment of the invention also provides a device for applying and distributing the key of the enhanced CPK, which is applied to the service center and comprises: a storage module for storing computer executable instructions; and a control module to execute the computer-executable instructions to perform operations comprising: receiving a time key application message sent by a client; sending a first response parameter generated by using a defined first response number to the client as a response for receiving the key application message at the moment; receiving a first random parameter and an encrypted key parameter sent by the client; obtaining the second random parameter according to the first response number and the first random parameter, and decrypting the encrypted key parameter by using the second random parameter to obtain a network time, a key application identifier and a first random key in the key parameter; and generating a time key corresponding to the key application identifier by using the network time and the key application identifier, and sending the time key encrypted by using the first random key to the client.

Further, the control module executes the computer-executable instructions to perform the process of the client registering with the service center: receiving a registration application message sent by the client; sending a second response parameter generated by using a defined second response number to the client as a response for receiving the registration application message; receiving a third random parameter and a client information ciphertext sent by the client; obtaining the fourth random parameter according to the second response number and the third random parameter, and decrypting the client information ciphertext by using the fourth random parameter to obtain client information and a second random key, wherein the client information comprises a real name, an identity card number and application path information of a client, and the application path information comprises a telephone number and a mail address; and when the authenticity of the client information is verified to be true, defining a serial number and a registration certificate corresponding to the client, and sending the serial number and the registration certificate encrypted by the second random key to the client.

Further, when the time key application message is a time private key application message, the key parameters further include a current serial number and a registration certificate of the client, and the control module further executes the computer-executable instructions to perform the following operations: determining application path information of a private key at the application time of the client; verifying whether the application path information is consistent with the application path information provided by the client when the client registers in the service center; when the application path information is verified to be consistent with the application path information provided when the client registers in the service center, checking whether the current serial number of the client is consistent with the serial number of the client stored in the service center, and verifying whether the registered certificate is a certificate issued by the service center; when the current serial number of the client is consistent with the serial number of the client stored by the service center and the registration certificate is verified to be the certificate issued by the service center, generating a time private key corresponding to the key application identifier by using the network time and the key application identifier; and encrypting the time private key and the updated serial number by using the first random key, and sending the time private key and the updated serial number to the client.

Through the technical scheme, when the user needs to use the key, the user applies for the key from the service center, and the key is invalidated after the applied key is used. The embodiment of the invention solves the problem that a public key system can be broken through a public key by utilizing quantum computation in the prior art, and the embodiment of the invention adopts a disposable secret key system, namely a public key or a private key, which is used for application once and then is discarded, so that even if the secret key is broken by the quantum computation, the broken secret key is discarded, and the breaking is meaningless.

Additional features and advantages of embodiments of the invention will be set forth in the detailed description which follows.

Drawings

The accompanying drawings, which are included to provide a further understanding of the embodiments of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the embodiments of the invention without limiting the embodiments of the invention. In the drawings:

fig. 1 is a schematic structural diagram of a wind grid key management system according to an embodiment of the present invention;

fig. 2 is a schematic flowchart of a key application and distribution method of an enhanced CPK according to an embodiment of the present invention;

FIG. 3 is a flowchart illustrating a process of registering a client with a service center according to an embodiment of the present invention;

fig. 4 is a schematic flowchart of another key application and distribution method for an enhanced CPK according to an embodiment of the present invention;

FIG. 5 is a flowchart illustrating a process of a service center processing a client registration process according to an embodiment of the present invention;

FIG. 6 is a flow chart of an application process of an encrypted public key and a decrypted private key provided by an embodiment of the present invention;

fig. 7 is a flowchart illustrating a process of applying for a private key signature and a public key verification according to an embodiment of the present invention.

Detailed Description

The following detailed description of embodiments of the invention refers to the accompanying drawings. It should be understood that the detailed description and specific examples, while indicating embodiments of the invention, are given by way of illustration and explanation only, not limitation.

The key application and distribution method of the enhanced CPK in the embodiment of the invention is carried out on a wind network key management system, and the wind network key management system is a special network for CPK key management, which is called a wind network for short. The wind network is a virtual network constructed on the basis of identification authentication, forms virtual links between any identifications and provides authenticity proof of the identifications. As shown in fig. 1, the wind network key management system includes a client, a service center, a management center, and a key justice authority. The management center is responsible for defining and updating the system key, the service center is responsible for managing the key application and distribution of each client, the client selects one service center to register and becomes a client of the service center, and the client can only apply for the private key from the registered service center. The key justice authority is used for handling key disputes, for example, when a user copies the keys of other users and the copying is successful, the copy user becomes a legal user, and the legal user becomes an illegal user, then the legal user can reflect to the key justice authority, the legality of the legal user is recovered, and the copy user becomes the illegal user.

In the embodiment of the present invention, the keys are all disposable keys, i.e., they are invalidated once, so that each time the key is used, the key needs to be applied, and the following embodiment will describe the key application and distribution process in detail.

Fig. 2 is a schematic flowchart of a key application and distribution method of an enhanced CPK according to an embodiment of the present invention. As shown in fig. 2, the method is applied to a client, and includes the following steps:

step 201, sending a time key application message to a service center.

The time key application message may include a time private key application message and a time public key application message. The time private key application message comprises a time signature private key application message and a time decryption private key application message. The time public key application message comprises a time verification public key application message and a time encryption public key application message. The time key application message is only a simple application message, and no special information is contained in the message.

Step 202, receiving a first response parameter sent by the service center;

step 203, defining a first random number and a first random key, and obtaining a first random parameter and a second random parameter according to the first response parameter and the first random number.

The client defines a first random number R2 and a first random key ran1, and obtains a first random parameter R2, for example, R2 × G — R2, by using the first random number R2 and a generator G of the elliptic curve.

Further, a second random parameter R3, for example, R2 × R1 — R3, is obtained from the first response parameter R1 and the first random number R2.

And 204, encrypting the key parameter by using the second random parameter, and sending the first random parameter and the encrypted key parameter to the service center, wherein the key parameter comprises a network time, a key application identifier and a first random key.

The key parameter data1 is { network time, key application identifier, first random key }, where the key application identifier is an identifier corresponding to the time key. Then, the key parameter data1 is symmetrically encrypted by using the second random parameter R3 to obtain an encrypted key parameter code1, such as E_R3(data1) ═ code1, and transmits the first random parameter and the encrypted key parameter to the service center, for example, msg1 ═ { R2, code1} to the service center. Wherein, the function E is a symmetric encryption function.

Step 205, receiving the time key information sent by the service center, and decrypting the time key information by using the first random key to obtain a time key, where the time key is related to the network time and the key application identifier.

Wherein, the time key information sent by the service center is the utilization stationThe first random key is encrypted, so that the client, after receiving the time key information code2, performs decryption using the first random key to obtain a time key, e.g., D_ran1(code2) ═ data2, where data2 includes the time of day key and D is the symmetric cipher function. The time key is related to the network time and the key application identifier, for example, the time key generated by the service center according to the network time and the real-time key application identifier.

In addition, for the time private key corresponding to the client, only the service center registered by the client is qualified to generate, and the client can only apply for the registered service center when the client applies for the time private key, so that the client needs to register with the service center before the client applies for the time private key from the service center.

Therefore, the following describes a process of registering a client with a service center, and before the client sends a time key application message to the service center, as shown in fig. 3, the method further includes the following steps:

step 301, sending a registration application message to the service center;

step 302, receiving a second response parameter sent by the service center;

step 303, defining a third random number and a second random key, and obtaining a third random parameter and a fourth random parameter according to the second response parameter and the third random number.

The client defines a third random number R5 and a second random key ran2, and obtains a third random parameter R5, for example, R5 × G — R5, by using the third random number R5 and a generator G of the elliptic curve.

Further, a fourth random parameter R6, for example, R5 × R4 — R6, is obtained from the second response parameter R4 and the third random number R5.

And 304, encrypting the client information of the client and the second random key by using the fourth random parameter to obtain a client information ciphertext, and sending the third random parameter and the client information ciphertext to the service center, wherein the client information comprises a real name, an identity card number and application path information of the client, and the application path information comprises a telephone number and a mail address.

Wherein the customer information data3 is { real name, identification number, telephone number, mail address }. Then, the client information data3 and the second random key ran2 are symmetrically encrypted by using the fourth random parameter to obtain an encrypted client information cipher text code3, such as E_R6(data3, ran2) ═ code3, and transmits the third random parameter and the client information ciphertext to the service center, i.e., msg2 ═ { R5, code3} to the service center. Wherein, the function E is a symmetric encryption function.

Step 305, receiving the serial number and the registration certificate which are sent by the service center and encrypted by using the second random key, and decrypting by using the second random key to obtain the serial number and the registration certificate, wherein the registration certificate is a signature of the service center on the key application identifier.

E.g. the encrypted serial number and the registration certificate are code4, the decryption is performed using said second random key to obtain the serial number and the registration certificate, e.g. D_ran2(code4) ═ data4, where the data4 includes a serial number and a registration certificate, and the serial number sent by the service center to the client is synchronized with the serial number of the service center, and is kept secret and prevented from being copied by a third party. And after the client obtains the serial number, the serial number is stored so as to be convenient for the service center to check. The registration certificate is a CPK signature which is carried out by the service center by using a private key of the service center, so that the service center can check whether the registration certificate is the certificate issued by the service center, and if so, the registration certificate indicates that the client belongs to the client governed by the service center.

After the client registers to the service center, when the client applies for a time private key to the service center, the client applies for the application path information provided during registration, for example, when the time private key application message is a time private key application message, the key application identifier is an identifier of the time private key, the key parameters further include a current running number and a registration certificate of the client, and the time private key application message is sent to the service center through the application path information, so that the service center verifies whether the application path information is consistent with the application path information provided when the client registers to the service center, and checks the current running number when verifying that the application path information is consistent with the application path information provided when the client registers to the service center, and verifying the registration certificate, wherein the service center is a service center registered by the client, and in step 205, the time key information can be decrypted by using the first random key to obtain a time private key and an updated serial number, and the current serial number of the client is replaced by the updated serial number, so that the updated serial number in the client is ensured to be synchronous with the service center. In addition, when the time key application message is a time signature private key application message, the network time is signature time. In addition, when the time key application message is a time decryption private key application message, the network time is an encryption time provided by an encryption party.

When the customer applies for the private key at the moment of the telephone number, the service center needs to check whether the telephone number of the application route information is consistent with the telephone number during registration, and if so, the service center checks the serial number and the registration certificate. Similarly, when the client applies for the private key at the time of the email address, the service center first checks whether the email address of the application route information is consistent with the email address at the time of registration, and if so, checks the serial number and the registration certificate. When a client applies for a private key of a real name at the moment, two situations exist, one is applying through a telephone number, the other is applying through a mail address, and no matter which application mode is adopted, a service center is required to verify whether application path information (the telephone number or the mail address) is consistent with application path information (the telephone number or the mail address) during registration, and when the application path information (the telephone number or the mail address) is consistent with the application path information during registration, a serial number and a registration certificate are checked.

In addition, when the time key application message is a time verification public key application message, the network time is the signature time provided by the signer. And when the moment key application message is a moment encryption public key application message, the network moment is an encryption moment.

Correspondingly, fig. 4 is a schematic flowchart of a key application and distribution method of an enhanced CPK according to an embodiment of the present invention. As shown in fig. 4, the method is applied to a service center, and the method includes the following steps:

step 401, receiving a time key application message sent by a client;

step 402, as a response to receiving the time key application message, sending a first response parameter generated by using a defined first response number to the client.

The first response number is randomly defined by the service center, for example, the first response number is R1, the first response parameter is R1, and R1 is obtained from the generator G of the elliptic curve and the first response number R1, that is, R1 × G — R1.

Step 403, receiving a first random parameter and an encrypted key parameter sent by the client;

step 404, obtaining the second random parameter according to the first response number and the first random parameter, and decrypting the encrypted key parameter by using the second random parameter to obtain the network time, the key application identifier and the first random key in the key parameter.

For example, the first random parameter and the encrypted key parameter sent by the client are msg1 ═ { R2, code1 }. The second random parameter R3, i.e., R1 × R2 — R3, is obtained from the first response number R1 and the first random parameter R2. Then, the encrypted key parameter data1, e.g. D, is decrypted using the second random parameter_R3(code1) ═ data 1. Wherein D is a symmetric decryption function.

Step 405, generating a time key corresponding to the key application identifier by using the network time and the key application identifier, and sending the time key encrypted by using the first random key to the client.

And the service center takes out the network time and generates a time key corresponding to the key application identifier. And then, encrypting the time key by using the first random key, and sending the time key to the client.

In addition, when the client registers with the service center, the registration process is as shown in fig. 5, and includes the following steps:

step 501, receiving a registration application message sent by the client;

step 502, as a response to receive the registration application message, sending a second response parameter generated by using a defined second response number to the client.

The second response number is randomly defined by the service center, for example, the second response number is R4, the second response parameter is R4, and R4 is obtained from the generator G of the elliptic curve and the second response number R4, that is, R4 × G — R4.

Step 503, receiving a third random parameter and a client information ciphertext sent by the client;

and 504, obtaining the fourth random parameter according to the second response number and the third random parameter, and decrypting the client information ciphertext by using the fourth random parameter to obtain client information and a second random key, wherein the client information comprises a real name, an identification number and application path information of the client, and the application path information comprises a telephone number and a mail address.

For example, the fourth random parameter R6, for example, R5 × R4 — R6, is obtained according to the second response number R4 and the third random parameter R5.

Then, the client information ciphertext code3 is decrypted by using the fourth random parameter R6 to obtain the client information data3 and a second random key ran2, e.g., D_R6(code3) ═ data3, ran 2. Wherein D is a symmetric decryption function.

And 505, when the authenticity of the client information is verified to be true, defining a serial number and a registration certificate corresponding to the client, and sending the serial number and the registration certificate encrypted by using the second random key to the client.

Wherein the customer information data3 is { real name, identification number, telephone number, mail address }. And the service center verifies the authenticity of the client information, including verifying whether the real name of the client corresponds to the identity card number, and if the real name of the client corresponds to the identity card number, the service center indicates that the authenticity of the client information is true.

When the customer information is verified as authentic, the customer information may be registered for subsequent use. The service center can randomly define the serial number, and carry out CPK signature on the real name in the client information by using a signature private key of the service center, so as to obtain a registration certificate. The serial number and registration certificate are then encrypted using the second random key, e.g., data4 ═ serial number, registration certificate, by E_ran2(data4)＝code4。

In addition, when the time key application message is a time private key application message, the key parameters also include the current serial number and the registration certificate of the client, the service center firstly determines the application path information of the client for the time private key, wherein the application route information comprises a telephone number and a mail address, whether the telephone number or the mail address is used by the private key at the time of the user application is determined, then verifying whether the application path information is consistent with the application path information provided when the client registers to the service center, for example, when the user applies for the private key using the telephone number at the time of application, it is verified whether the used telephone number is identical to the telephone number provided at the time of registration, or when the user applies the private key to use the mail address at the moment, whether the used mail address is consistent with the mail address provided during registration is verified. When the application path information is verified to be consistent with the application path information provided when the client registers to the service center, namely when the used telephone number is verified to be consistent with the telephone number provided when the client registers, or the used mail address is consistent with the mail address provided when the client registers, whether the current serial number of the client is consistent with the serial number of the client stored by the service center is checked, and whether the registered certificate is the certificate issued by the service center is verified. For verification of the registration certificate, thenVerifying whether the signature of the registration certificate is the signature performed by the service center, and if so, indicating that the registration certificate is the certificate issued by the service center. And when the current serial number of the client is consistent with the serial number of the client stored by the service center and the registered certificate is verified to be the certificate issued by the service center, taking out the network time in the key parameter, generating a time private key corresponding to the key application identifier by using the network time and the key application identifier, and updating the serial number of the client to obtain an updated serial number. Then, in step 405, the time private key and the updated serial number are encrypted by using the first random key, and are sent to the client. For example, data5 ═ updated serial number, time private key } is encrypted using the first random key ran1, E_ran1(data5) code5, and transmits code5 to the client.

The key application identifier may be a real name of the user, or may also be a phone number or an email address of the user, which is not limited in the embodiment of the present invention.

In addition, for facilitating understanding of the embodiment of the present invention, the following takes a client a, a client B, a service center 1, and a service center 2 as an example, where the client a is a registered user of the service center 1, and the client B is a registered user of the service center 2. Before applying for a secret key and a signature key, the client a and the client B need to register with the service center 1 and the service center 2, respectively. The application of the public key is not limited by the service center, and the public key can be applied to any service center.

The following description will be made by taking a registration procedure between the client a and the service center 1 as an example.

First, a client A sends a registration application message to a service center 1, and the service center 1 sends a response number r defined by a definition to the client A as a response to receiving the registration application message_AGenerated response parameter R_A. Wherein r is_A*G＝R_AAnd G is a generator of the elliptic curve.

Then, the client a defines a random number M1 and a random key ran1, and obtains a random parameter M1, for example, M1 × G — M1, according to the random number M1 and the generator G of the elliptic curve. According to a response parameter R_AWith a random number M1, a random parameter M2 is obtained, e.g. M1R_AM2. The client information info of the client A and the random key ran1 are encrypted by using a random parameter M2 to obtain a client information ciphertext cip, such as E_M2(info, ran1) ═ cip, and sends a random parameter M1 to the service center together with the client information ciphertext cip.

Then, the service center 1 receives the random parameter M1 and the client information ciphertext cip sent by the client a. According to the response number r_AWith a random parameter M1, a random parameter M2 is obtained, e.g. r_AM1 ═ M2. Then, the client information ciphertext cip is decrypted using a random parameter M2 to obtain the client information info and a random key ran1, e.g., D_M2(cip) ═ info (ran 1). Client information info ═ real name, identification card number, telephone number, mail address. The service center 1 checks whether the real name in the client information corresponds to the identification number, and if the real name in the client information corresponds to the identification number, the authenticity of the client information is true. When the customer information is verified as genuine, the service center 1 may register the customer information for subsequent use. The service center 1 can randomly define the serial number, and perform CPK signature on the real name in the customer information by using the signature private key of the service center 1, thereby obtaining the registration certificate. The serial number and registration certificate are then encrypted using random key ran1, e.g., data ═ serial number, registration certificate, by E_ran1(data)＝code。

Thereafter, the client a receives the encrypted serial number and the registration certificate sent by the service center 1, and decrypts the serial number and the registration certificate using the random key ran1, for example, D_ran1(code) ═ data. And the client A stores the serial number and the registration certificate.

For the registration process of the client B to the service center 2, reference may be made to the registration process of the client a to the service center 1, which is not described herein again. First, the application of the encrypted public key and the decrypted private key is described below, in which a user Alice of a client a sends encrypted data to a user Bob of a client B, as shown in fig. 6, the method includes the following steps:

step 601, the user Alice of the client A sends a moment encryption public key application message to the registration service center 1;

step 602, the service center 1 defines a first random number M1, calculates M1 × G — M1, and sends M1 to Alice as a response;

in step 603, Alice defines a second random number M2, calculates a second random parameter M2 × G — M2, calculates a third random parameter M2 × M1 — M3, and defines a random key ran 1. Then, the encryption time, the identifier Bob corresponding to the time encryption public key, and the random key ran1 are encrypted by using the third random parameter, that is, the data1 ═ { time, Bob, ran1} is encrypted: e_M3(data1) ═ code1, which transmits msg1 ═ M2, code1} to service center 1.

In step 604, the service center 1 receives msg1 ═ { M2, code1}, and calculates a third random parameter M2 ═ M1 ═ M3, and decrypts the data code 1: d_M3(code1) ═ data 1. The service center 1 takes the encrypted TIME and the identification Bob out of the data1, generates a TIME encryption public key TIME-Bob of Bob, and encrypts the TIME encryption public key with a random key ran 1: e_ran1(TIME-BOB) code2 and sends code2 to Alice.

In step 605, after Alice receives code2, it decrypts with a random key: d_ran1(code2)＝TIME-BOB。

Then, Alice defines a random number k, calculates k × G ═ x, y, (x + y)²mod 2⁶⁴＝key，E_key(data3) ═ code3, resulting in encrypted data code3, and encrypts the key with the TIME-of-day encryption public key, key TIME-BOB β, and transmits msg2 ═ code3, TIME, β to user BOB.

In step 606, Bob receives msg2 ═ code3, time, β } sent by Alice, and Bob needs to apply for the time privacy key from the service center 2, that is, send a time privacy key application message to the service center 2. Bob can send the time privacy key application message to the service center 2 through the phone number of Bob.

In step 607, the service center 2, after receiving the time-based secret key application message, defines a random number M4, calculates M4 × G — M4, and sends M4 to Bob as a response.

Step 608, Bob receives M4, defines random number M5 and random key ran2, calculates M5 × G — M5, M5 × M4 — M6, extracts encryption time from msg2 sent by Alice, encrypts data4 { (time, Bob, current serial number, registration certificate, ran2} with M6: e_M6(data4) ═ code4, and transmits msg3 ═ { M5, code4} to service center 2. Likewise, msg3 is also sent to service center 2 via its phone number.

In step 609, the service center 2 first verifies the identity of the user Bob, then calculates M5 × M4 — M6, and decrypts the data code 4: d_M6(code4) ═ data4, the encryption time, the identity Bob, the current water number of the user Bob, its registration certificate, and the random key ran2 are obtained.

The service center 2 first determines the way the user Bob sends the message, i.e. obtains the phone number of the message he sent, it is then verified whether the telephone number corresponds to the telephone number provided by the user Bob when registering with the service centre 2, when verifying that the telephone number of the transmitted message is identical to the telephone number provided at the time of registration thereof, checking whether the current serial number is identical to the serial number of the user Bob stored in the service center 2, and verifying whether the registration certificate of Bob is the certificate issued by the service center 2, when the serial numbers are consistent and the certificate is the certificate issued by the service center 2, the encryption time is extracted, and generates the time-decryption private key time-Bob of Bob, updates the serial number of Bob, and the updated serial number and the time decryption private key are encrypted together and sent to the user Bob, namely data5 is { the updated serial number, time-Bob }, E._ran2(data5) ═ code5, code5 is transmitted to the user Bob.

In step 610, after receiving code5, Bob decrypts it by using ran 2: d_ran2(code5) ═ data5, get the serial number after updating and take off the secret private key at moment, Bob replaces the current serial number with the serial number after updating, guarantee to be synchronous with the serial number of service center 2, and take off the secret with the secret private key at moment: timed-bob^-1*β＝key，D_key(code3) ═ data3, and therefore, data transmitted by Alice to Bob was obtainedAnd (4) data.

The following will describe the application of the signature private key and the verification public key, and the user Alice of the client a sends signature data to the user Bob of the client B, including the following steps:

in step 701, the user Alice of the client a sends a time signature private key application message to the registration service center 1. Wherein, the user Alice can send the time signature private key application message to the service center 1 through the mail address.

Step 702, the service center 1 defines a random number P1, calculates P1 × G — P1, and sends P1 to Alice as a response;

at step 703, Alice defines a random number P2, calculates P2 × G — P2, and P2 × P1 — P3, defines a random key ran 3. Then, the signature time, the identification Alice, the current serial number, the registration certificate and the random key ran3 are encrypted by using P3, that is, the data1 is { time, Alice, the current serial number, the registration certificate, ran3} is encrypted, E_P3(data1) ═ code1, and then msg1 ═ { P2, code1} is transmitted to service center 1. Similarly, user Alice sends msg1 to service center 1 via his email address.

Step 704, the service center 1 receives msg1 ═ { P2, code1}, first verifies the identity of the user Alice, then calculates P2 × P1 ═ P3, decrypts the data code 1: d_P3(code1) ═ data1, the signature time, the current serial number identifying Alice, the user Alice, its registration certificate, and the random key ran3 were obtained.

The method comprises the steps that a service center 1 firstly determines application path information of a user Alice, namely determines whether a path of the user Alice for sending a message is a telephone number or a mail address, verifies whether the mail address is consistent with a mail address provided when the user Alice registers to the service center 1 after the mail address is determined, checks whether a current serial number is consistent with a serial number of the user Alice stored in the service center 1 and a registration certificate of the Alice is a certificate issued by the service center 1 when the mail address for sending the message is verified to be consistent with the mail address provided when the mail address for sending the message is registered to the service center 1, extracts a signature time and generates a time signature of the Alice when the serial number is consistent and the registration certificate is the certificate issued by the service center 1The private key time-Alice updates the serial number of the Alice, encrypts the updated serial number and the time signature private key together and sends the encrypted serial number and the time signature private key to the user Alice, namely data2 ═ updated serial number, time-Alice }, E_ran3(data2) ═ code2, and code2 is transmitted to the user Alice.

Step 705, after receiving code2, the user Alice decrypts by using ran 3: d_ran3And (code2) ═ data2, the updated serial number and the time signature private key are obtained, and Alice replaces the current serial number with the updated serial number to ensure the synchronization with the serial number of the service center 1. Then signing the data h, defining a random number k by Alice, and calculating a verification code c and a signature code s: k G ═ G (x1, y 1); c ═ x₁+y₁)²mod 2⁴⁰，s＝k^-1(h + c time-alice) mod n, the signature being functionally labeled SIG_time-alice(h) (s, c). And the user Alice sends the signature data and the signature time to the user Bob.

In step 706, after receiving the signature data and the signature time, the user Bob automatically sends a time verification public key application message to the service center 2.

In step 707, the service center 2 defines a random number P4, calculates P4 × G — P4, and sends P4 to Bob as a response.

At step 708, Bob defines a random number P5, calculates P5G-P5, P5P 4P 6, and defines a random key ran 4. Then, the signature time, the identification Alice corresponding to the time verification public key, and the random key ran4 are encrypted by using P6, that is, the data3 is { time, Alice, ran4} is encrypted: e_P6(data3) ═ code3, which transmits msg2 ═ P5, code3} to service center 2.

In step 709, the service center 2 receives msg2 ═ { P5, code3}, and calculates P4 ═ P5 ═ P6, decrypts the data code 3: d_P6(code3) ═ data 3. The service center 2 takes out the signature TIME and the identification Alice from the data3, generates a TIME verification public key TIME-Alice of Alice, and encrypts the TIME verification public key with a random key ran 4: e_ran4(TIME-Alice) code4, and transmits code4 to Bob.

In step 710, after receiving code4, Bob decrypts it with random key ran 4: d_ran4(code4)＝TIME-Alice。

Then, Bob verifies Alice's signature:

and (c) Alice verification: s^-1*h*G+s^-1*c*TIME-Alice＝(x₁,y₁)；c'＝(x₁+y₁)²mod 2⁴⁰

Verification is functionally labeled VER_TIME-Alice(h,s)＝c’。

After the key applied by the client to the service center is used, the key, whether a public key or a private key, is used once and then is invalidated. When the data needs to be encrypted and decrypted, or signed and verified next time, the public key or the private key is applied, so that the application is guaranteed to be used once and is invalidated after being used.

The embodiment of the invention solves the problem that a public key system can be broken through a public key by utilizing quantum computation in the prior art, and the embodiment of the invention adopts a disposable key system, namely a public key or a private key, which is applied for use once and then is discarded, so that even if the quantum computation is used for breaking the key, the broken key is already discarded, and the breaking is meaningless.

Correspondingly, the embodiment of the invention also provides a device for applying and distributing the key of the enhanced CPK, which is applied to the client and comprises: a storage module for storing computer executable instructions; and a control module to execute the computer-executable instructions to perform operations comprising: sending a time key application message to a service center; receiving a first response parameter sent by the service center; defining a first random number and a first random key, and obtaining a first random parameter and a second random parameter according to the first response parameter and the first random number; encrypting a key parameter by using the second random parameter, and sending the first random parameter and the encrypted key parameter to the service center, wherein the key parameter comprises a network moment, a key application identifier and a first random key; and receiving time key information sent by the service center, and decrypting the time key information by using the first random key to obtain a time key, wherein the time key is related to the network time and the key application identifier.

Further, before the sending of the time key application message to the service center, the control module is further configured to execute the computer-executable instructions to perform a process of registering the client with the service center: sending a registration application message to the service center; receiving a second response parameter sent by the service center; defining a third random number and a second random key, and obtaining a third random parameter and a fourth random parameter according to the second response parameter and the third random number; encrypting the client information of the client and the second random key by using the fourth random parameter to obtain a client information ciphertext, and sending the third random parameter and the client information ciphertext to the service center, wherein the client information comprises a real name, an identity card number and application path information of a client, and the application path information comprises a telephone number and a mail address; and receiving the serial number and the registration certificate which are sent by the service center and encrypted by using the second random key, and decrypting by using the second random key to obtain the serial number and the registration certificate, wherein the registration certificate is a signature of the service center on the key application identifier.

Further, when the time key application message is a time private key application message, the key application identifier is an identifier of the application time private key, the key parameters also include the current serial number and the registration certificate of the client, and the time private key application message is sent to the service center through the application path information, so that the service center verifies whether the application path information is consistent with the application path information provided when the client registers with the service center, and when the application path information is verified to be consistent with the application path information provided when the client registers to the service center, checking the current serial number, and verifying the registration certificate, wherein the service center is a service center registered by the client, and the decrypting the time key information by using the first random key to obtain a time key comprises:

and decrypting the time key information by using the first random key to obtain a time private key and an updated serial number, and replacing the current serial number of the client with the updated serial number.

Further, when the time key application message is a time signature private key application message, the network time is signature time.

Further, when the time key application message is a time decryption private key application message, the network time is an encryption time provided by an encryption party.

Further, when the time key application message is a time verification public key application message, the network time is a signature time provided by a signer.

Further, when the time key application message is a time encryption public key application message, the network time is an encryption time.

Specific implementation details and effects of the embodiment of the present invention can refer to the implementation process of the aforementioned key application and distribution method applied to the enhanced CPK of the client, and are not described herein again.

Correspondingly, the embodiment of the invention also provides a device for applying and distributing the key of the enhanced CPK, which is applied to the service center and comprises: a storage module for storing computer executable instructions; and a control module to execute the computer-executable instructions to perform operations comprising: receiving a time key application message sent by a client; sending a first response parameter generated by using a defined first response number to the client as a response for receiving the key application message at the moment; receiving a first random parameter and an encrypted key parameter sent by the client; obtaining the second random parameter according to the first response number and the first random parameter, and decrypting the encrypted key parameter by using the second random parameter to obtain a network time, a key application identifier and a first random key in the key parameter; and generating a time key corresponding to the key application identifier by using the network time and the key application identifier, and sending the time key encrypted by using the first random key to the client.

Further, the control module executes the computer-executable instructions to perform the process of the client registering with the service center: receiving a registration application message sent by the client; sending a second response parameter generated by using a defined second response number to the client as a response for receiving the registration application message; receiving a third random parameter and a client information ciphertext sent by the client; obtaining the fourth random parameter according to the second response number and the third random parameter, and decrypting the client information ciphertext by using the fourth random parameter to obtain client information and a second random key, wherein the client information comprises a real name, an identity card number and application path information of a client, and the application path information comprises a telephone number and a mail address; and when the authenticity of the client information is verified to be true, defining a serial number and a registration certificate corresponding to the client, and sending the serial number and the registration certificate encrypted by the second random key to the client.

Further, when the time key application message is a time private key application message, the key parameters further include a current serial number and a registration certificate of the client, and the control module further executes the computer-executable instructions to perform the following operations: determining application path information of a private key at the application time of the client; verifying whether the application path information is consistent with the application path information provided by the client when the client registers in the service center; when the application path information is verified to be consistent with the application path information provided when the client registers in the service center, checking whether the current serial number of the client is consistent with the serial number of the client stored in the service center, and verifying whether the registered certificate is a certificate issued by the service center; when the current serial number of the client is consistent with the serial number of the client stored by the service center and the registration certificate is verified to be the certificate issued by the service center, generating a time private key corresponding to the key application identifier by using the network time and the key application identifier; and encrypting the time private key and the updated serial number by using the first random key, and sending the time private key and the updated serial number to the client.

Specific implementation details and effects of the embodiment of the present invention can refer to the implementation process of the aforementioned key application and distribution method applied to the enhanced CPK of the service center, and are not described herein again.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus, and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). The memory is an example of a computer-readable medium.

Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in the process, method, article, or apparatus that comprises the element.

The above are merely examples of the present application and are not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.