Key information processing method and apparatus, electronic device and computer readable medium

Abstract

The present disclosure relates to a key information processing method and apparatus, an electronic device and a computer readable medium and the field of computer information processing. The method comprises: determining at least one transform policy; transforming an obtained raw key according to the at least one transform policy to generate key data; abstracting the at least one transform policy to generate policy data; and generating a target key file according to the key data and the policy data. The key information processing method and apparatus, electronic device and computer readable medium that the present disclosure relates to can conduct security encryption of a key to be transmitted in various strengths, thereby raising information security strength of the key during transmission of key information.

Description

KEY INFORMATION PROCESSING METHOD AND APPARATUS, ELECTRONIC DEVICE AND COMPUTER READABLE MEDIUM Technical Field

[0001] The present disclosure relates to the field of computer information processing, specifically to a key information processing method and apparatus, an electronic device and a computer readable medium. Background

[0002] Key is a parameter, which is inputted in an algorithm for converting a plaintext to a ciphertext or converting a ciphertext to a plaintext. Key encryption is an encryption method by which two parties sending and receiving data use the same key or symmetric keys to encrypt and decrypt a plaintext. In general, encryption algorithms are open and a vital point that can assure a plaintext is a key. The key must be confidential, typically is a character string and can be replaced frequently as needed. Therefore, the length of a key is very important. Once a decryption key is found, the password will be cracked. If the key is longer, the space of the key will be larger and it will take a longer time to traverse the space of the key, so the possibility of cracking the key will be smaller.

[0003] In the prior art, a key concealment or protection policy keeps a key confidential by method of data transformation of the key and then transmission. However, in the prior art, the security strength of a key concealment or protection policy is fixed, and the security strength of key concealment cannot be changed with environment. With the passing of time and the improvement of computing power, the concealment of a key may become no longer safe.

[0004] Therefore, a new key information processing method and apparatus, electronic device and computer readable medium are needed.

[0005] The foregoing information disclosed in the section of background art is only intended to deepen understanding on the background of the present disclosure, so it may include information that does not constitute the prior art known to those of ordinary skill in the art. Summary

[0006] For this purpose, the present disclosure provides a key information processing method and apparatus, an electronic device and a computer readable medium, which can conduct security encryption of a key to be transmitted in various strengths, thereby raising information security strength of the key during transmission of key information.

[0007] Other features and advantages of the present disclosure will be evident through the following detailed description, or partially learnt through practice of the present disclosure.

[0008] According to one aspect of the present disclosure, a key information processing method is provided, comprising: determining at least one transform policy; transforming an obtained raw key according to the at least one transform policy to generate key data; abstracting the at least one transform policy to generate policy data; and generating a target key file according to the key data and the policy data.

[0009] In an exemplary embodiment of the present disclosure, the key information processing method further comprises: generating a transform policy group from a plurality of transform policies.

[0010] In an exemplary embodiment of the present disclosure, determining at least one transform policy comprises: generating M transform policies; randomly taking N transform policies from the M transform policies; and transforming the raw key according to the N transform policies for N times to generate key data; where, M >= N >1, M & N are positive integers.

[0011] In an exemplary embodiment of the present disclosure, abstracting the at least one transform policy to generate policy data comprises: transforming the at least one transform policy by Hash function one by one to generate at least one Hash value; abstracting the at least one Hash value and mapping the at least one Hash value to a bit array; and generating the policy data according to the bit array.

[0012] In an exemplary embodiment of the present disclosure, abstracting the at least one Hash value and mapping the at least one Hash value to a bit array comprises: extracting a predetermined number of bit values from each Hash value of the at least one Hash value; generating a bit value set based on the bit values of at least one Hash value; and mapping bit values in the bit value set to the bit array in turn.

[0013] According to one aspect of the present disclosure, a key information processing method is provided, comprising: extracting key data and policy data from a target key file; obtaining at least one transform policy from the policy data; and reversely transforming the key data according to the at least one transform policy to obtain key information.

[0014] In an exemplary embodiment of the present disclosure, obtaining at least one transform policy from the policy data comprises: obtaining at least one transform policy from the transform policy group and the policy data.

[0015] In an exemplary embodiment of the present disclosure, obtaining at least one transform policy from the transform policy group and the policy data comprises: generating a plurality of bit arrays according to the plurality of transform policies in the transform policy group; extracting bit arrays in the policy data; and comparing a plurality of bit arrays in the transform policy group with the bit arrays in the policy data in turn to determine at least one transform policy.

[0016] In an exemplary embodiment of the present disclosure, comparing a plurality of bit arrays in the transform policy group with the bit arrays in the policy data in turn to determine at least one transform policy comprises: comparing the number of bits of each of the plurality of bit arrays in the transform policy group with the number of bits of the bit arrays in the policy data in turn; and determining a transform policy when comparison results are consistent.

[0017] In an exemplary embodiment of the present disclosure, reversely transforming the key data according to the at least one transform policy to obtain key information comprises: randomly arranging the at least one transform policy to generate a plurality of permutations and combinations of transform policies; and reversely transforming the key data according to the plurality of permutations and combinations of transform policies to obtain key information.

[0018] According to one aspect of the present disclosure, a key information processing apparatus is provided, comprising: a policy module, used to determine at least one transform policy; a transform module, used to conduct key transform of key information according to the at least one transform policy to generate key data; an abstracting module, used to abstract the at least one transform policy to generate policy data; and a key module, used to generate a target key file according to the key data and the policy data.

[0019] In an exemplary embodiment of the present disclosure, the key information processing apparatus further comprises: an extracting module, used to extract key data and policy data from a target key file; a transform module, used to obtain at least one transform policy from the policy data; and a reverse transform module, used to reversely transform the key data according to the at least one transform policy to obtain key information.

[0020] According to one aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; and a memory device, for storing one or more programs; when one or more programs are executed by the one or more processors, the one or more processors achieve the foregoing methods.

[0021] According to one aspect of the present disclosure, a computer readable medium is provided, and stores computer programs, which achieve the foregoing methods when being executed by processors.

[0022] The key information processing method and apparatus, electronic device and computer readable medium according to the present disclosure can conduct security encryption of a key to be transmitted in various strengths, thereby raising information security strength of the key during transmission of key information.

[0023] It should be understood that the foregoing general description and subsequent detailed description are only exemplary and cannot limit the present disclosure. Brief Description of the Drawings

[0024] Through detailed description of exemplary embodiments of the present disclosure with reference to accompanying drawings, the foregoing and other objectives, features and advantages of the present disclosure will be evident. The accompanying drawings described below are only some embodiments of the present disclosure. Those skilled in the art can also obtain other accompanying drawings according to these accompanying drawings without creative work.

[0025] FIG. 1 is a system block diagram of a key information processing method and apparatus presented according to an exemplary embodiment.

[0026] FIG. 2 is a flow chart of a key information processing method presented according to an exemplary embodiment.

[0027] FIG. 3 is a schematic diagram of a key information processing method presented according to an exemplary embodiment.

[0028] FIG. 4 is a flow chart of a key information processing method presented according to an exemplary embodiment.

[0029] FIG. 5 is a schematic diagram of a key information processing method presented according to an exemplary embodiment.

[0030] FIG. 6 is a block diagram of a key information processing apparatus presented according to an exemplary embodiment.

[0031] FIG. 7 is a block diagram of a key information processing apparatus presented according to an exemplary embodiment.

[0032] FIG. 8 is a block diagram of an electronic device presented according to an exemplary embodiment.

[0033] FIG. 9 is a schematic diagram of a computer readable memory medium presented according to an exemplary embodiment. Detailed Description

[0034] Now, exemplary embodiments are more comprehensively described with reference to accompanying drawings. However, exemplary embodiments can be implemented in various forms and should not be understood that they are limited to the embodiments set forth herein; on the contrary, provision of these embodiments makes the present disclosure more comprehensive and complete and comprehensively conveys the conception of the exemplary embodiments to those skilled in the art. The same reference signs in the drawings denote the same or similar parts, so the repetitive description on them will be omitted here.

[0035] Further, the described characteristics, structures or features can be combined in one or more embodiments in any appropriate way. In the following description, many details are provided to fully understand the embodiments of the present disclosure. However, those skilled in the art will be aware that the technical solution of the present disclosure can be practiced while omitting one or more of the specific details, or other methods, components, apparatuses and steps can be adopted. Under other circumstances, well-known structures, methods, apparatuses, realizations or operations are not stated or described in detail to avoid blurring various aspects of the present disclosure.

[0036] The block diagrams shown in the accompanying drawings are only functional entities and do not have to correspond to physically independent entities. In other words, these functional entities can be achieved in form of software, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microprocessor devices.

[0037] The flow charts in the accompanying drawings are exemplary description only and do not have to include all content and operations / steps and also do not have to follow the described sequences. For example, some operations / steps can be broken down, too, while some operations / steps can be combined or partially combined, too, so it is likely that the actual sequence is changed according to the actual condition.

[0038] It should be understood that in this document, terms like first, second and third may be used to describe components, but these components should not be restricted by these terms. These terms are intended to differentiate one component from another component. Therefore, a first component described below can be called a second component without departing from the teaching of concepts in the present disclosure. In this document, term "and / or" comprises any of the associated presented items and all combinations of one or more of the items.

[0039] Those skilled in the art can understand that accompanying drawings are only schematic diagrams of exemplary embodiments and the modules or flows in the accompanying drawings may not be necessary for implementation of the present disclosure, so they cannot be used to limit the scope of protection of the present disclosure.

[0040] The inventors of the present application found that all the key concealment solutions in the prior art are to conduct a specific transform of keys and directly store the transformed keys and policies. In the prior art, the security strength of this key concealment or protection policy is fixed and the security strength of key concealment cannot be changed with environment. With the passing of time and the improvement of computing power, the concealment of a key may become no longer safe.

[0041] The prior art has the following defects:

[0042] 1. The existing solutions conduct specific transform of a key only once, rather than multiple rounds of transform of the key to adapt to different security levels.

[0043] 2. The existing solutions directly store or send transform policies and do not conceal relevant policies to assure security of the transform policies.

[0044] On that account, the inventors of the present application put forward the key information processing method of the present application, which transforms a raw key. By controlling rounds of transform and a policy of each round, a user can raise the strength of key concealment with the increase of rounds of transform. Meanwhile, the key information processing method of the present application conceals the transform policy for each round in a policy file containing a great many false transform policies, and increase of entries of the policy file will also raise the concealment strength of the transform policy, thereby raising the strength of key concealment. Further, according to the key information processing method, a corresponding transform policy can be provided to recover a true transform policy from a plurality of policy files. The true transform policy is used to recover the raw key.

[0045] The key information processing method according to the present application can conduct security encryption of a key to be transmitted in various strengths, thereby raising information security strength of the key during transmission of key information.

[0046] Below, the detailed content of the present application will be described:

[0047] FIG. 1 is a system block diagram of a key information processing method and apparatus presented according to an exemplary embodiment.

[0048] As shown in FIG. 1, a system architecture 100 may comprise terminal devices 101, 102 & 103, a network 104 and terminal devices 105, 106 and 107. The network 104 is used to provide a medium of communication links between the terminal devices 101, 102 & 103 and the terminal devices 105, 106 & 107. The network 104 may include various connection types, such as wired, wireless communication links or optical cables.

[0049] Users may use the terminal devices 101, 102 & 103 to interact with the terminal devices 105, 106 & 107 via the network 104 to receive or send messages. On the terminal devices 101, 102 & 103 and the terminal devices 105, 106 & 107, various kinds of communication client applications can be installed, such as shopping applications web browsing applications, search applications, instant messaging tools, mailbox clients and social platform software.

[0050] The terminal devices 101, 102 & 103 and the terminal devices 105, 106 & 107 can be various electronic devices that have display screens and support web browsing, including but not limited to smart phones, tablet computers, laptop computers and desktop computers.

[0051] The terminal devices 101, 102 & 103 can for example encrypt a target message to be sent by means of a key, and then send the target message to the terminal devices 105, 106 & 107. The terminal devices 105, 106 & 107 can for example decrypt the received messages according to the key to extract the target message.

[0052] The terminal devices 101, 102 & 103 can for example determine at least one transform policy; the terminal devices 101, 102 & 103 can for example transform an obtained raw key according to the at least one transform policy to generate key data; the terminal devices 101, 102 & 103 can for example abstract the at least one transform policy to generate policy data; the terminal devices 101, 102 & 103 can for example generate a target key file according to the key data and the policy data.

[0053] The terminal devices 101, 102 & 103 can for example encrypt target messages by keys and then send the target messages and target key files to the terminal devices 105, 106 & 107 so that the terminal devices 105, 106 & 107 decrypt and restore target messages.

[0054] The terminal devices 105, 106 & 107 can for example extract key data and policy data from a target key file; the terminal devices 105, 106 & 107 can for example obtain at least one transform policy from the policy data; the terminal devices 105, 106 & 107 can for example reversely transform the key data according to the at least one transform policy to obtain key information.

[0055] The terminal devices 105, 106 & 107 also can for example receive encrypted target messages sent from the terminal devices 101, 102 & 103, and the terminal devices 105, 106 & 107 also can for example decrypt received target information according to key information to restore the target messages.

[0056] It needs to be explained that the key information processing method provided in embodiments of the present disclosure can be executed by the terminal devices 101, 102 & 103 and the terminal devices 105, 106 & 107. Accordingly, the key information processing apparatus can be arranged in the terminal devices 101, 102 & 103 and the terminal devices 105, 106 & 107.

[0057] FIG. 2 is a flow chart of a key information processing method presented according to an exemplary embodiment. The key information processing method 20 at least comprises step S202 to step S208.

[0058] As shown in FIG. 2, at S202, determining at least one transform policy. The key information processing method can for example encrypt a target message to be sent according to key information in a terminal device A, and then determine at least one transform policy for encrypting the key information.

[0059] In an embodiment, a transform policy group can be generated from a plurality of transform policies, and a transform policy is extracted from the transform policy group. By using a plurality of different transform rules, a great many key transform policies are generated, thereby generating a plurality of transform policies.

[0060] In an embodiment, determining at least one transform policy comprises: determining the number M of target policy files; and randomly extracting M transform policies from the transform policy group; where M is a positive integer. For example, a plurality of transform policies in the transform policy group are numbered in turn, the number M of target policy files is determined when transform policies are to be extracted, then M random numbers are generated through a random number generator and then the M random numbers are corresponded to the reference numbers of the transform policies to determine M transform policies.

[0061] In an embodiment, the number of transform policies that need to be used can be determined according to the requirements of business security. Supposing the number is N and M policies are randomly screened from a plurality of policy files, these M policies are key transform policies to be used in the future.

[0062] In an embodiment, for example, the number M of target policy files can be determined according to an encryption level of target messages. For example, the target messages are defined at different secret levels in advance: confidential, top secret, secret and so on and a different number of policy files of keys are set for different secret levels. For example, for a target message at a high secret level of top secret, the number of policy files for encrypting a key of the target message can be for example 10. For another example, for a target message at a low secret level of secret, the number of policy files for encrypting a key of the target message can be for example 2.

[0063] In an embodiment, number M of target policy files can also be determined according to the transmission channel of a target message. For example, when a message is transmitted in LAN, a smaller number of target policy files are determined; when a target message is uploaded on the Internet, a larger number of target policy files are determined. In embodiments of the present application, alternatively, other judgment rules can be used to set different numbers M of target policy files. The present application does not use the number here as a limit.

[0064] At S204, transforming an obtained raw key according to the at least one transform policy to generate key data. M transform policies can be used to transform a key to obtain a transformed key. For example, M transform policies are generated; N transform policies are randomly taken from the M transform policies; and the raw key is transformed according to the N transform policies for N times to generate key data; where, <semantics>M≥N≥1<annotation encoding="application / x-tex">M \ge N \ge 1< / annotation>< / semantics>, M & N are positive integers.

[0065] In an embodiment, a rule for key transform can be customized according to different requirements. For example, a relatively simple transform method is to exchange two values in a key array, and conduct key transform of key information according to the at least one transform policy. For example, a plurality of values in a key array is exchanged in turn according to different transform rules (numbers are exchanged for multiple times for each rule), and a plurality of transform policies are equivalent to multiple rounds and multiple times of numerical exchange.

[0066] In an embodiment, for example, after a transform policy: 161520100414102003052411 is hashed, the following Hash array is generated:

[0067] <semantics>0=−534694747<annotation encoding="application / x-tex">0 = -534694747< / annotation>< / semantics>;

[0068] <semantics>1=1985910054;<annotation encoding="application / x-tex">1 = 1985910054;< / annotation>< / semantics>

[0069] <semantics>2=−488763339<annotation encoding="application / x-tex">2 = -488763339< / annotation>< / semantics>;

[0070] <semantics>3=1331411845<annotation encoding="application / x-tex">3 = 1331411845< / annotation>< / semantics>;

[0071] <semantics>4=−137102220;<annotation encoding="application / x-tex">4 = -137102220;< / annotation>< / semantics>

[0072] <semantics>5=−81949194<annotation encoding="application / x-tex">5 = -81949194< / annotation>< / semantics>;

[0073] <semantics>6=1794769274<annotation encoding="application / x-tex">6 = 1794769274< / annotation>< / semantics>;

[0074] <semantics>7=966099589;<annotation encoding="application / x-tex">7 = 966099589;< / annotation>< / semantics>

[0075] <semantics>8=907334699<annotation encoding="application / x-tex">8 = 907334699< / annotation>< / semantics>;

[0076] <semantics>9=816196382<annotation encoding="application / x-tex">9 = 816196382< / annotation>< / semantics>;

[0077] An absolute value in the Hash array is used to divide length of the bit array (for example, the length of the bit array in this transform test is: bitSetSize = 7357745) to obtain a remainder. Example code: Math.abs (hash%bitSetSize). A remainder array obtained is:

[0078] 4937107;

[0079] 6676649;

[0080] 3152169;

[0081] 7017745;

[0082] 4662810;

[0083] 1013999;

[0084] 6837239;

[0085] 2234994;

[0086] 2332064;

[0087] 6844432;

[0088] In the bit array, the bit corresponding to the foregoing number of bits is set to be 1, CA thereby achieving concealment of the transform policies.

[0089] At S206, abstracting the at least one transform policy to generate policy data.

[0090] In an embodiment, abstracting the at least one transform policy to generate policy data comprises: transforming the at least one transform policy by Hash function one by one to generate at least one Hash value; abstracting the at least one Hash value and mapping the at least one Hash value to a bit array; and generating the policy data according to the bit array.

[0091] In an embodiment, abstracting the at least one Hash value and mapping the at least one Hash value to a bit array comprises: extracting a predetermined number of bit values from each Hash value of the at least one Hash value; generating a bit value set based on the bit values of at least one Hash value; and mapping bit values in the bit value set to the bit array in turn.

[0092] At S208, generating a target key file according to the key data and the policy data. For example, transformed key data and policy data are merged to one file to generate a target key file to facilitate storage and transmission.

[0093] The key information processing method according to the present disclosure encrypts a key to be transmitted according to a different number of key transform policies and can conduct security encryption of the key to be transmitted in various strengths, thereby raising information security strength of the key during transmission of key information.

[0094] It should be clearly understood that the present disclosure describes how to form and use specific examples, but the principles of the present disclosure are not limited to any detail of these examples. On the contrary, based on teaching of the content disclosed by the present disclosure, these disciplines can be applied in many other embodiments.

[0095] FIG. 3 is a schematic diagram of a key information processing method presented according to another exemplary embodiment. FIG. 3 exemplarily describes concrete content of "abstracting the at least one transform policy to generate policy data" at step S206 of the key information processing method 20 shown in FIG. 2.

[0096] A key is transformed according to M screened policies, the true policies are abstracted, to a bit array for example, and the array and the transformed key are merged to a file. The concrete steps are as follows:

[0097] a) M transform policies are used to transform a key to obtain a transformed key. For example, M is 2. That means a key is transformed according to two transform policies (for example, transform policy A and transform policy B).

[0098] b) The M transform policies are transformed by Hash function one by one, and then obtained Hash values are abstracted to a bit array. Here, the Hash algorithm is to map a binary value at any length to a smaller binary value at a fixed length. This smaller binary value is called a Hash value. Hash value is a sole and extremely compact value expression form of a segment of data. If a paragraph of plaintext is hashed and only one letter of this paragraph is changed, the subsequent Hashing will generate a different value. In calculation, it is impossible to find two different inputs, which are hashed into the same value.

[0099] After a transform policy A is transformed by Hash function, the Hash value is: E8C636D0C048637;

[0100] After a transform policy B is transformed by Hash function, the Hash value is: 8BF61E6A3000D0F;

[0101] The Hash value of the transform policy A is converted into a binary form containing 01 only, and then is mapped to a bit array;

[0102] The Hash value of the transform policy A is converted into a binary form containing 01 only, and then the Hash value of the transform policy B is mapped to a bit array;

[0103] It is noteworthy that when the transform policy A and the transform policy B are mapped to the same bit array, numbers of bits may be overlapped. It does not affect the decryption processing of subsequent files.

[0104] c) The transformed key and the bit array are merged to one file and then transmitted.

[0105] The key information processing method according to the present disclosure generate a plurality of different transform policies according to the requirements for security strength of information to be transmitted. Each transform policy performs one round (or one time) of transform of the key to adapt to different requirements for security strength.

[0106] The key information processing method according to the present disclosure freely pick out a specific number of transform policies from a great many random transform policies. Further, during storage, the receiver will store all the transform policies rather than only store true transform policies, thereby achieving concealment of the true key transform policies. By changing entries of transform policies in the policy file, different requirements for security strength can be adapted to.

[0107] The key information processing method according to the present disclosure hashes true key transform policies and abstract the true key transform policies to a bit array to prevent the true transform policies from being restored and being merged with the transformed key to a file to achieve restoration of the true key transform policies.

[0108] FIG. 4 is a flow chart of a key information processing method presented according to another exemplary embodiment. The flow shown in FIG. 4 is detailed description of the target message decryption step in the key information processing method 20 shown in FIG. 2.

[0109] As shown in FIG. 4, at S402, extracting key data and policy data from a target key file. For example, a target key file and a target message are received at a terminal device B, and the terminal device B extracts key data and policy data from the target key file.

[0110] At S404, obtaining at least one transform policy from the policy data, which comprises: obtaining at least one transform policy from the transform policy group and the policy data.

[0111] In an embodiment, obtaining at least one transform policy from the transform policy group and the policy data comprises: generating a plurality of bit arrays according to the plurality of transform policies in the transform policy group; extracting bit arrays in the policy data; and comparing a plurality of bit arrays in the transform policy group with the bit arrays in the policy data in turn to determine at least one transform policy.

[0112] In an embodiment, comparing a plurality of bit arrays in the transform policy group with the bit arrays in the policy data in turn to determine at least one transform policy comprises: comparing the number of bits of each of the plurality of bit arrays in the transform policy group with the number of bits of the bit arrays in the policy data in turn; and determining a transform policy when comparison results are consistent.

[0113] At S406, reversely transforming the key data according to the at least one transform policy to obtain key information. For example, randomly arranging the at least one transform policy to generate a plurality of permutations and combinations of transform policies; and reversely transforming the key data according to the plurality of permutations and combinations of transform policies to obtain key information.

[0114] The key information processing method according to the present disclosure encrypts a key to be transmitted according to a different number of key transform policies and can conduct security encryption of the key to be transmitted in various strengths, thereby raising information security strength of the key during transmission of key information. During decryption of a key file, a method of decryption by obtaining transform policies from the 4 transform policy group and the policy data can effectively guarantee information security of the key.

[0115] FIG. 5 is a schematic diagram of a key information processing method presented according to another exemplary embodiment. FIG. 5 exemplarily describes the concrete content of "obtaining at least one transform policy from the policy data" at Step S404 of the key information processing method 40 shown in FIG. 4.

[0116] a) A transformed key and a bit array are recovered from the transformed key and bit array files.

[0117] b) A policy file containing true transform policies and the bit array in a) are used to obtain M true transform policies.

[0118] For example, a transform policy group contains 10 transform policies, which are transform policies A, B, C, D, E, F, G, H and I;

[0119] The foregoing transform policies are transformed by Hash function respectively to generate a plurality of Hash values A, B, C, D, E, F, G, H & I; the Hash values A, B, C, D, E, F, G, H, I corresponding to the transform policies A, B, C, D, E, F, G, H and I are converted to a binary form containing 01 only and mapped to a bit array respectively to generate a bit array set.

[0120] Every bit array in the bit array set is compared with bit arrays in policy data respectively to determine transform policies. In the process of comparison, if every bit value (the number of bits is 1) in a bit array A corresponding to the transform policy A is consistent with the value in a corresponding position in policy data, it is determined that transform policy A is one of original transform policies.

[0121] After a transform policy is determined, other transform policies are compared until all the files have been compared to determine M transform policies to be processed.

[0122] c) The transformed key in a) and M transform policies in b) are used for reverse transform to restore a true key.

[0123] The key information processing method according to the present disclosure can abstract and conceal true transform policies and recover the true transform policy according to a policy file.

[0124] By concealing true transform policies in a great many false transform policies, the key information processing method according to the present disclosure can achieve concealment of transform policies to adapt to various strengths of security requirements.

[0125] Those skilled in the art can understand that all or some of steps implementing the foregoing embodiment are implemented as a computer program executed by CPU. When the computer program is executed by CPU, the computer program executes the foregoing functions limited by the foregoing method provided by the present disclosure. The program can be stored in a computer readable memory medium, which can be a read only memory or a magnetic disk or a compact disk, etc.

[0126] Further, it should be noted that the foregoing accompanying drawing is only an exemplary description of processing included in the method provided in an exemplary embodiment of the present disclosure, and not intended to set any limitation. It can be easily understood that the processing shown in the foregoing accompanying drawing does not indicate or limit a time sequence of the processing. Further, it can also be easily understood that the processing can be executed in a plurality of modules synchronously or asynchronously.

[0127] Below is an apparatus embodiment of the present disclosure, which can be used to implement method embodiments of the present disclosure. For details not disclosed in the apparatus embodiment of the present disclosure, please refer to the method embodiments of the present disclosure.

[0128] FIG. 6 is a block diagram of a key information processing apparatus presented according to an exemplary embodiment. The key information processing apparatus 60 comprises: a policy module 602, a transform module 604, an abstracting module 606 and a key module 608. The key information processing apparatus 60 can be located at a terminal where information is to be sent.

[0129] The policy module 602 is used to determine at least one transform policy; and can generate a transform policy group from a plurality of transform policies, and extract transform policies in the transform policy group. By using a plurality of different transform rules, a great many key transform policies are generated, thereby generating a plurality of transform policies.

[0130] The transform module 604 is used to conduct key transform of key information according to the at least one transform policy to generate key data; N transform policies can be used to transform a key to obtain a transformed key.

[0131] The abstracting module 606 is used to abstract the at least one transform policy to generate policy data; and can for example transform the at least one transform policy by Hash function one by one to generate at least one Hash value; abstract the at least one Hash value and map the at least one Hash value to a bit array; and generate the policy data according to the bit array.

[0132] The key module 608 is used to generate a target key file according to the key data and the policy data. For example, transformed key data and policy data are merged to a file to generate a target key file to facilitate storage and transmission.

[0133] The key information processing apparatus according to the present disclosure encrypts a key to be transmitted according to a different number of key transform policies and can conduct security encryption of the key to be transmitted in various strengths, thereby raising information security strength of the key during transmission of key information.

[0134] FIG. 7 is a block diagram of a key information processing apparatus presented according to another exemplary embodiment. The key information processing apparatus 70 comprises: an extracting module 702, a transform module 704 and a reverse transform module 706.

[0135] The extracting module 702 is used to extract key data and policy data from a target key file; and can for example receive a target key file and a target message at a terminal device B. The terminal device B extracts key data and policy data from the target key file.

[0136] The transform module 704 is for obtaining at least one transform policy from the policy data, comprising: obtaining at least one transform policy from the transform policy group and the policy data. And

[0137] The reverse transform module 706 is used to reversely transform the key data according to the at least one transform policy to obtain key information and can for example, randomly arrange the at least one transform policy to generate a plurality of permutations and combinations of transform policies; and reversely transform the key data according to the plurality of permutations and combinations of transform policies to obtain key information.

[0138] In the key information processing apparatus according to the present disclosure, during decryption of a key file, a method of decryption by obtaining transform policies from the transform policy group and the policy data can effectively guarantee information security of the key.

[0139] FIG. 8 is a block diagram of an electronic device presented according to an exemplary embodiment. <semantics>⌈0140⌉<annotation encoding="application / x-tex">\lceil 0140 \rceil< / annotation>< / semantics> Below with reference to FIG. 8, an electronic device 200 according to this embodiment of the present disclosure is described. The electronic device 200 shown in FIG. 8 is only an example and should not cause any limitation to the functions and use scopes of embodiments of the present disclosure.

[0141] As shown in FIG. 8, the electronic device 200 is shown in form of a general purpose computing device. Components of the electronic device 200 may include without limitation: at least one processing unit 210, at least one memory unit 220, a bus 230 connecting different system components (including a memory unit 220 and a processing unit 210) and a display unit 240.

[0142] The memory unit stores program codes. The program codes can be executed by the processing unit 210 so that the processing unit 210 executes steps described in the foregoing processing method of the Description according to exemplary embodiments of the present disclosure. For example, the processing unit 210 can execute steps shown in FIG. 2 and FIG. 4.

[0143] The memory unit 220 may comprise a readable medium in form of volatile memory unit, such as random access memory unit (RAM) 2201 and / or cache memory unit 2202, and may further comprise a read only memory unit (ROM) 2203.

[0144] The memory unit 220 may further comprise a program / utility tool 2204 comprising a group of (at least one) program modules 2205. Such program modules 2205 include without limitation: an operating system, one or more application programs, other program modules and program data. Each of these examples or a combination of these examples may include achievement of a network environment.

[0145] The bus 230 may stand for one or more of a few types of bus structures, including a memory unit bus or a memory unit controller, a peripheral bus, an accelerated graphic port and a processing unit or may be a local bus using any of a plurality of bus structures.

[0146] The electronic device 200 can also communicate with one or more peripheral units 300 (e.g., keyboard, pointing device and Bluetooth device) and also can communicate with one or more devices that enable a user to interact with the electronic device 200, and / or communicate with any device (e.g., router and modem) that enables the electronic device 200 to communicate with one or more other computing devices. This communication can be conducted via an input / output (I / O) interface 250. Further, the electronic device 200 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) via a network adapter 260. The network adapter 260 can communicate with other modules of the electronic device 200 via the bus 230. It should be understood that although not shown in the diagram, other hardware and / or software moulds, including but not limited to: microcodes, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drivers and data backup storage systems, can be used in combination with the electronic device 200.

[0147] From description of the foregoing embodiments, those skilled in the art can easily understand that the exemplary embodiments described here can be achieved by means of software or by means of software combined with necessary hardware. Therefore, a technical solution according to an implementation manner of the present disclosure can be embodied in form of a software product. The software product can be stored in a non-volatile memory medium (it can be a CD-ROM, a USB disk, or a mobile hard disk, or others) or in a network and comprises a number of instructions so that a computing device (it can be a personal computer, a server, a network device, or others) implements the foregoing method according to an implementation manner of the present disclosure.

[0148] FIG. 9 is a schematic diagram of a computer readable memory medium presented according to an exemplary embodiment.

[0149] FIG. 9 describes a program product 400 that is used to implement the foregoing method according to an implementation manner of the present disclosure. The program product 400 can adopt a portable compact disk read only memory (CD-ROM) and include program codes, and can run on a terminal device, such as personal computer. However, the program product of the present disclosure is not limited to the above. In this document, a readable memory medium can be any tangible medium containing or storing programs. The programs can be used by an instruction execution system, an apparatus or device or used in combination with an instruction execution system, an apparatus or device.

[0150] The program product may adopt any combination of one or more readable media. A readable medium can be a readable signal medium or readable memory medium. The readable memory medium for example can be - without limitation - an electric, magnetic, optical, electromagnetic, infrared or semiconductor system, apparatus or device, or any combination thereof. More concrete examples of the readable memory media (an non-exhaustive list) include: electric connection with one or more conductors, portable disk, hard disk, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical memory module, magnetic memory module or any appropriate combination thereof.

[0151] Computer readable signal media may include data signals transmitted in base band or as part of carriers, and carry readable program codes. Such transmitted data signals can adopt various forms, including but not limited to: electromagnetic signals, optical signals or any appropriate combination thereof. The readable memory media may further be any readable media except readable memory media. Such readable media can send, transmit or transfer programs used by an instruction execution system, apparatus or device or used in combination with an instruction execution system, apparatus or device. The program codes contained on a readable memory medium can be transferred by any appropriate medium, including but not limited to: wireless, wired, optical cable and RF, or any appropriate combination thereof.

[0152] Program codes that are used to execute operation of the present disclosure can be compiled using any combination of one or more programming languages. The programming languages include object-oriented programming languages – such as Java and C++, and further include conventional procedural programming languages – such as "C" language or similar programming languages. The program codes can be fully executed on a user's computing device or partially executed on user equipment, or executed as an independent software package, or partially executed on a user's computing device or partially executed on a remote computing device, or fully executed on a remote computing device or a server. When a remote computing device is involved, the remote computing device can be connected to a user's computing device via any type of network, including local area network (LAN) or wide area network (WAN), or can be connected to an external computing device (e.g., connected via the Internet by an Internet service provider).

[0153] The forgoing computer readable media carry one or more programs. When the foregoing one or more programs are executed by one of such devices, the computer readable medium can achieve the following functions: determining at least one transform policy; conducting key transform of key information according to the at least one transform policy to generate key data; abstracting the at least one transform policy to generate policy data; and generating a target key file according to the key data and the policy data.

[0154] Those skilled in the art can understand that the foregoing modules can be distributed in an apparatus according to description of the embodiment, or different from the description, can be distributed in one or more apparatuses of this embodiment. The modules in the foregoing embodiment can be merged into one module, or further split into a plurality of sub-modules.

[0155] From description of the foregoing embodiments, those skilled in the art can easily understand that the exemplary embodiments described here can be achieved by means of software or by means of software combined with necessary hardware. Therefore, a technical solution according to an implementation manner of the present disclosure can be embodied in form of a software product. The software product can be stored in a non-volatile memory medium (it can be a CD-ROM, a USB disk, or a mobile hard disk, or others) or in a network and comprises a number of instructions so that a computing device (it can be a personal computer, a server, a network device, or others) implements the foregoing method according to an implementation manner of the present disclosure.

[0156] Exemplary embodiment of the present disclosure are presented and described above. It should be understood that the present disclosure is not limited to the detailed structures, setting modes or implementation methods described here; on the contrary, the present disclosure intends to cover all modifications and equivalent settings included in the spirit and scope of the claims.

Claims

<pat:ClaimStatement>Claims:< / pat:ClaimStatement> <pat:Claims com:id="claims"> <pat:Claim com:id="CLM-00001"> <pat:ClaimNumber>1< / pat:ClaimNumber> <pat:ClaimText>1. An apparatus for processing key information, wherein the apparatus comprises: a policy module configured to determine at least one transform policy; a transform module configured to transform an obtained raw key according to the at least one transform policy to generate key data; an abstracting module configured to abstract the at least one transform policy to generate policy data; and a key module configured to generate a target key file according to the key data and the policy data, wherein the policy data includes M transform policies; wherein the transform module further includes: a policy generating unit configured to generate M transform policies; and a key generating unit configured to: randomly taking the N transform policies to be used from the M transform policies; and transform the raw key according to the N transform policies to be used for N times to generate the key data; where, <semantics>M≥N≥1<annotation encoding="application / x-tex">M \ge N \ge 1< / annotation>< / semantics>, M & N are positive integers. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00002"> <pat:ClaimNumber>2< / pat:ClaimNumber> <pat:ClaimText>2. The apparatus of claim 1, wherein the abstracting module is further configured to: transform the at least one transform policy by Hash function to generate at least one Hash value; abstract the at least one Hash value and map the at least one Hash value to a bit array; and generate the policy data according to the bit array. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00003"> <pat:ClaimNumber>3< / pat:ClaimNumber> <pat:ClaimText>3. The apparatus of any one of claims 1 to 2, wherein the abstracting module is further configured to: extract a predetermined number of bit values from each Hash value of the at least one Hash value; generate a bit value set based on the bit values of at least one Hash value; and map bit values in the bit value set to the bit array in turn. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00004"> <pat:ClaimNumber>4< / pat:ClaimNumber> <pat:ClaimText>4. The apparatus of any one of claims 1 to 3, wherein the key module is further configured to merge transformed key data and the policy data to a file to generate the target key file to facilitate storage and transmission. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00005"> <pat:ClaimNumber>5< / pat:ClaimNumber> <pat:ClaimText>5. The apparatus of any one of claims 1 to 4, wherein the apparatus is located at a terminal where information is to be sent. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00006"> <pat:ClaimNumber>6< / pat:ClaimNumber> <pat:ClaimText>6. An electronic device for processing key information wherein the electronic device includes: a memory storing data; and a processor configured to: determine at least one transform policy; transform an obtained raw key according to the at least one transform policy to generate key data; abstract the at least one transform policy to generate policy data; and generate a target key file according to the key data and the policy data, wherein the policy data includes M transform policies; wherein the processor further configured to: generating M transform policies; and randomly taking N transform policies to be used from the M transform policies; and transforming the raw key according to the N transform policies to be used for N times to generate the key data; where, <semantics>M≥N≥1<annotation encoding="application / x-tex">M \ge N \ge 1< / annotation>< / semantics>, M & N are positive integers. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00007"> <pat:ClaimNumber>7< / pat:ClaimNumber> <pat:ClaimText>7. The electronic device of claim 6, wherein the processor is further configured to transform the at least one transform policy by Hash function to generate at least one Hash value. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00008"> <pat:ClaimNumber>8< / pat:ClaimNumber> <pat:ClaimText>8. The electronic device of any one of claims 6 to 7, wherein the processor is further configured to abstract the at least one Hash value and mapping the at least one Hash value to a bit array. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00009"> <pat:ClaimNumber>9< / pat:ClaimNumber> <pat:ClaimText>9. The electronic device of any one of claims 6 to 8, wherein the processor is further configured to generate the policy data according to a bit array. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00010"> <pat:ClaimNumber>10< / pat:ClaimNumber> <pat:ClaimText>10. The electronic device of any one of claims 6 to 9, wherein the processor is further configured to extract a predetermined number of bit values from each Hash value of the at least one Hash value. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00011"> <pat:ClaimNumber>11< / pat:ClaimNumber> <pat:ClaimText>11. The electronic device of any one of claims 6 to 10, wherein the processor is further configured to generating a bit value set based on the bit values of at least one Hash value. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00012"> <pat:ClaimNumber>12< / pat:ClaimNumber> <pat:ClaimText>12. The electronic device of any one of claims 6 to 11, wherein the processor is further configured to map bit values in the bit value set to the bit array in turn. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00013"> <pat:ClaimNumber>13< / pat:ClaimNumber> <pat:ClaimText>13. The electronic device of any one of claims 6 to 12, wherein the processor is further configured to merge transformed key data and the policy data to a file to generate the target key file to facilitate storage and transmission. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00014"> <pat:ClaimNumber>14< / pat:ClaimNumber> <pat:ClaimText>14. A computer-readable storage medium having recorded thereon instructions for execution by an apparatus for processing key information, wherein the computer-readable storage medium includes the instructions for: determining at least one transform policy; transforming an obtained raw key according to the at least one transform policy to generate key data; abstracting the at least one transform policy to generate policy data; and generating a target key file according to the key data and the policy data, wherein the policy data includes M transform policies; wherein the key data is generated by the instructions for: generating M transform policies; and randomly taking N transform policies to be used from the M transform policies; and transforming the raw key according to the N transform policies to be used for N times to generate the key data; where, <semantics>M≥N≥1<annotation encoding="application / x-tex">M \ge N \ge 1< / annotation>< / semantics>, M & N are positive integers. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00015"> <pat:ClaimNumber>15< / pat:ClaimNumber> <pat:ClaimText>15. The computer-readable storage medium of claim 14, where the computer-readable storage medium further includes the instructions for transforming the at least one transform policy by Hash function to generate at least one Hash value. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00016"> <pat:ClaimNumber>16< / pat:ClaimNumber> <pat:ClaimText>16. The computer-readable storage medium of any one of claims 14 to 15, where the computer- readable storage medium further includes the instructions for abstracting the at least one Hash value and mapping the at least one Hash value to a bit array. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00017"> <pat:ClaimNumber>17< / pat:ClaimNumber> <pat:ClaimText>17. The computer-readable storage medium of any one of claims 14 to 16, where the computer- readable storage medium further includes the instructions for generating the policy data according to a bit array. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00018"> <pat:ClaimNumber>18< / pat:ClaimNumber> <pat:ClaimText>18. The computer-readable storage medium of any one of claims 14 to 17, where the computer- readable storage medium further includes the instructions for extracting a predetermined number of bit values from each Hash value of the at least one Hash value. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00019"> <pat:ClaimNumber>19< / pat:ClaimNumber> <pat:ClaimText>19. The computer-readable storage medium of any one of claims 14 to 18, where the computer- readable storage medium further includes the instructions for generating a bit value set based on the bit values of at least one Hash value. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00020"> <pat:ClaimNumber>20< / pat:ClaimNumber> <pat:ClaimText>20. The computer-readable storage medium of any one of claims 14 to 19, where the computer- readable storage medium further includes the instructions for mapping bit values in the bit value set to the bit array in turn. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00021"> <pat:ClaimNumber>21< / pat:ClaimNumber> <pat:ClaimText>21. The computer-readable storage medium of any one of claims 14 to 20, where the computer- readable storage medium further includes the instructions for merging transformed key data and the policy data to a file to generate the target key file to facilitate storage and transmission. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00022"> <pat:ClaimNumber>22< / pat:ClaimNumber> <pat:ClaimText>22. A method for processing key information, wherein the method includes: determining at least one transform policy; transforming an obtained raw key according to the at least one transform policy to generate key data; abstracting the at least one transform policy to generate policy data; and generating a target key file according to the key data and the policy data, wherein the policy data includes M transform policies; wherein the key data is generated by the method for: generating M transform policies; and randomly taking N transform policies to be used from the M transform policies; and transforming the raw key according to the N transform policies to be used for N times to generate the key data; where, <semantics>M≥N≥1<annotation encoding="application / x-tex">M \ge N \ge 1< / annotation>< / semantics>, M & N are positive integers. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00023"> <pat:ClaimNumber>23< / pat:ClaimNumber> <pat:ClaimText>23. The method of claim 22, wherein the method further includes: transforming the at least one transform policy by Hash function to generate at least one Hash value; abstracting the at least one Hash value and mapping the at least one Hash value to a bit array; and generating the policy data according to the bit array. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00024"> <pat:ClaimNumber>24< / pat:ClaimNumber> <pat:ClaimText>24. The method of claim 23, wherein the method further includes: extracting a predetermined number of bit values from each Hash value of the at least one Hash value; generating a bit value set based on the bit values of at least one Hash value; and mapping bit values in the bit value set to the bit array in turn. < / pat:ClaimText> < / pat:Claim> <pat:Claim com:id="CLM-00025"> <pat:ClaimNumber>25< / pat:ClaimNumber> <pat:ClaimText>25. The method of any one of claims 22 to 24, wherein the method further includes merging transformed key data and the policy data to a file to generate the target key file to facilitate storage and transmission. < / pat:ClaimText> < / pat:Claim> < / pat:Claims>