Patent ID: 7386131

Claim:
A digital certificate issuing system with intrusion tolerance ability, comprising an offline secret key distributor, at least one online task distributor, k online secret share calculators and m online secret share combiners, wherein the offline secret key distributor is configured for splitting a private key into multiple first sub-secret-keys d ji and multiple second sub-secret-keys, sending the first sub-secret-keys d ji to the k online secret share calculators; sending the second sub-secret-keys and equation combination representations corresponding to the second sub-secret-keys to the m online secret share combiners; and the private key is constructed by one second sub-secret-key and t first sub-secret-keys d ji , each equation combination representation comprises t items of j and i, j is sequence number of the secret share calculator and i is number of the first sub-secret-key in the j th secret share calculator, and each of j in one equation combination representation is different; the at least one online task distributor is configured for sending out a certificate to be signed through a first broadcast channel; the k online secret share calculators are configured for checking correctness of the certificate to be signed, calculating at least t first calculation results according to first sub-secret-keys stored and the certificate to be signed, and sending out the at least t first calculation results, at least t items of j and i corresponding to the at least t first calculation results respectively through a second broadcast channel; and the m online secret share combiners are configured for matching t items of j and i received through the second broadcast channel with the equation combination representations stored, and determining a matched online secret combiner storing the matched equation combination representation including t items of j and i; the matched online secret share combiner is configured for checking the correctness of the certificate to be signed, calculating a second calculation result according to the certificate to be signed and the second sub-secret-key corresponding to the matched equation combination representation, calculating a digital signature according to the t first calculation results corresponding to the t items of i and j in the matched equation combination representation and the second calculation result, generating a digital certificate according to the digital signature and contents of the certificate to be signed; j, i, k, t and m are positive integers, and t is less than k.