The smart password key is a terminal password device that realizes password calculation and key management functions. It uses a USB interface and is widely used in the industry.
The names used are USBKey, UKey, U-Shield, etc.
Relevant specifications of smart cryptographic keys in national secret standards
01 | GMT 0016-2012 Smart password key password application interface specification
This standard specifies the smart cryptographic key application interface based on the PKI cryptographic system, and describes the functions, data types, parameter definitions and equipment security requirements of the cryptographic application interface. SKF interface for short, is a C language application development interface.
Equipment manufacturers will basically provide supporting SKF interface development kits for their products. When the developer of the information system has this type of interface integration capability, the cryptographic application can be completed through the standard SKF. However, SKF is a low-level application development interface. For information system developers, completing some high-level cryptographic application functions requires a large amount of development work. At this time, the language-independent secondary development interface (such as restful API) to complete the password application.
The position of the SKF interface in the PKI cryptographic system is similar to that of the SDF interface, and both can be regarded as cryptographic device application interfaces to support upper-layer applications to complete services.
02 | GMT 0017-2012 Data Format Specification for Smart Password Key Password Application Interface
On the basis of 0016, this standard further stipulates the data access interface, and provides specific descriptions in terms of data type, data format, parameter description and definition, security, etc., for equipment manufacturers to refer to for product development.
As a supplement to the SKF interface, the position of the data format specification in the application hierarchy is as follows:
03 | GMT 0027-2014 Technical Specifications for Smart Password Keys
This standard stipulates the functional requirements, hardware requirements, software requirements, performance requirements, safety requirements, environmental adaptability requirements and reliability requirements of smart cryptographic keys, and is used as a reference for the development, testing and testing of related products.
04 | GMT 0063-2018 Smart password key password application interface detection specification
This standard stipulates the detection environment, content and method of the application interface of the smart password key. Manufacturers can reversely guide product development and use based on this.
A typical smart password key application scenario
One of the most typical application scenarios of smart password keys is identity authentication. The identity authentication service provides a way to verify the authenticity of an entity. The figure below is an authentication process for digital certificate login using UKey.
Typical interface selection reference for smart password keys
1. First of all, at the hardware driver level, you can choose:
- The interface of USB MS protocol supports mainstream windows and linux systems.
- HID man-machine interface, supports mainstream windows, linux, Mac OS systems.
- CCID interface, the device can be connected to the host or other embedded hosts through the USB interface to perform data communication that checks the CCID standard.
2.USB MS interface and HID interface are widely used
Although it is driver-free for the operating system, the internal protocol processing of different manufacturers is different, and the software interface must rely on the SKF interface library of a specific manufacturer.
Therefore, at the software interface level, in order to facilitate the information system to complete high-level cryptographic applications more conveniently, manufacturers can provide richer application integration interfaces in addition to SKF interfaces. For example, Andang UKey provides a convenient integrated Restful style API interface on the basis of national secret authentication and national secret interface. The information system calls the cryptographic application through the Andang middleware, which can greatly reduce the development workload and integration difficulty. For identity authentication applications, it can also be combined with Andang ASP identity authentication platform to complete more user management, authority control, and log management functions.