Key updating system and method

Abstract

The embodiment of the present specification provides a key update system and method, wherein the key update system includes: a key management unit, at least two applications; the key management unit is configured to generate an update key associated with at least two applications in response to a key update request; the update key is sent to each application respectively, and the key record table is updated to an intermediate key record table according to the key sending result; each application is configured to receive the update key; the local key is updated based on the update key, and the update information is fed back to the key management unit according to the update result; the key management unit is configured to receive the update information, and based on the update information, the intermediate key record table is updated to a target key record table, wherein the target key record table is used to record the key information of each application. Thus, the keys of at least two applications associated with the same update key are updated at the same time. The key of at least two applications is updated with the same key, which improves the security of key update.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular to a key updating system. Background Art

[0002] In actual network applications, for security policy considerations, a validity period is usually set for the key used by the mobile terminal. When the key is close to the validity period, the key will be updated and the old key will be replaced by a new key. In the prior art, when the key of the mobile terminal is updated, each mobile terminal usually updates and maintains its own key. However, when there are many mobile terminals, the key update cannot be performed effectively. Based on this, a key update method is urgently needed to solve this problem. Summary of the invention

[0003] In view of this, an embodiment of the present specification provides a key update system. One or more embodiments of the present specification also relate to a key update method, a key update device, an information interaction system, an information interaction method, an information interaction device, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0004] According to a first aspect of an embodiment of this specification, a key update system is provided, including:

[0005] Key management unit, at least two applications;

[0006] The key management unit is configured to generate an update key associated with at least two applications in response to a key update request; send the update key to each application respectively, and update the key record table to an intermediate key record table according to the key sending result;

[0007] Each application is configured to receive the updated key; update the local key based on the updated key, and feed back the updated information to the key management unit according to the update result;

[0008] The key management unit is configured to receive the update information and update the intermediate key recording table to a target key recording table based on the update information, wherein the target key recording table is used to record the key information of each application.

[0009] Optionally, the key management unit is further configured to store the updated key, wherein the updated key includes key data and a key tag; send the key tag to each application, and update the key record table to an initial key record table according to the tag sending result; when the key update time reaches a preset update threshold, send the key data to each application, and update the initial key record table to an intermediate key record table according to the key sending result.

[0010] Optionally, the key management unit is further configured to send the updated key to the application corresponding to the update failure information; and update the target key record table when the update information fed back by the application corresponding to the update failure information is update success information.

[0011] Optionally, the key management unit is further configured to delete the historical key of the previous key update cycle when it is determined that the key corresponding to each application is successfully updated in the current key update cycle, and record the historical key information corresponding to the historical key in the historical key record table.

[0012] According to a second aspect of an embodiment of this specification, a key updating method is provided, including:

[0013] The key management unit generates an update key associated with at least two applications in response to a key update request; sends the update key to each application respectively, and updates the key record table to an intermediate key record table according to the key sending result;

[0014] Each application receives the updated key; updates the local key based on the updated key, and feeds back the updated information to the key management unit according to the update result;

[0015] The key management unit receives the update information and updates the intermediate key recording table to a target key recording table based on the update information, wherein the target key recording table is used to record key information of each application.

[0016] According to a third aspect of an embodiment of this specification, a key updating device is provided, including:

[0017] The processing module is configured as a key management unit, which generates an update key associated with at least two applications in response to a key update request; sends the update key to each application respectively, and updates the key record table to an intermediate key record table according to the key sending result;

[0018] a sending module configured to receive the updated key for each application; update the local key based on the updated key, and feed back the updated information to the key management unit according to the update result;

[0019] The updating module is configured to receive the updating information from the key management unit and update the intermediate key recording table to a target key recording table based on the updating information, wherein the target key recording table is used to record the key information of each application.

[0020] According to a fourth aspect of the embodiments of this specification, there is provided an information interaction system, including:

[0021] Business server, which hosts the client of the application;

[0022] The client is configured to receive a service request corresponding to the application; encrypt the service data carried in the service request according to the updated key, obtain the encrypted data and send it to the service server;

[0023] The business service end is configured to receive the encrypted data, create a business processing task according to the encrypted data, and execute the business processing task as a response to the business request.

[0024] Optionally, the information interaction system further includes a key management unit;

[0025] The client is further configured to generate a key acquisition request in response to the service request and send the request to the key management unit;

[0026] The key management unit is configured to determine an updated key corresponding to the key acquisition request and send the updated key to the client;

[0027] The client is further configured to receive an updated key sent by the key management unit.

[0028] Optionally, the information interaction system further includes a key management unit;

[0029] The key management unit is further configured to send the updated key to the client;

[0030] The client is configured to receive the updated key, store the updated key, and read the updated key when receiving a service request corresponding to the application.

[0031] Optionally, the client is further configured to encrypt the service data carried in the service request according to the private key included in the update key, obtain the encrypted data carrying the digital signature and send it to the service server;

[0032] The business service end is configured to receive the encrypted data, decrypt the encrypted data according to the public key contained in the local certificate, and if the decryption is successful, execute the business processing task created according to the encrypted data.

[0033] Optionally, the key management unit is further configured to receive a key acquisition request carrying a key tag, and if it is determined that the key tag corresponds to a local key, send the local key to the client.

[0034] Optionally, the information interaction system further includes a key management unit;

[0035] The key management unit is further configured to select a test application from among the at least two applications and send the updated key to the test application;

[0036] The test application is further configured to receive the update key; receive a test service request corresponding to the test application, encrypt the test service data carried by the test service request based on the update key, obtain the test encrypted data and send it to the service server;

[0037] The business service end is configured to receive the test encrypted data, create a test business processing task according to the test encrypted data, and execute the test business processing task as a response to the test business request.

[0038] According to a fifth aspect of the embodiments of this specification, there is provided an information interaction method, including:

[0039] Business server, which hosts the client of the application;

[0040] The client receives a service request corresponding to the application; encrypts the service data carried in the service request according to the updated key, obtains the encrypted data and sends it to the service server;

[0041] The business service end receives the encrypted data, creates a business processing task according to the encrypted data, and executes the business processing task as a response to the business request.

[0042] According to a sixth aspect of the embodiments of this specification, there is provided an information interaction device, including:

[0043] The encryption module is configured to receive the service request corresponding to the application program at the client; encrypt the service data carried in the service request according to the updated key, obtain the encrypted data and send it to the service server;

[0044] The execution module is configured to receive the encrypted data from the business service end, create a business processing task according to the encrypted data, and execute the business processing task as a response to the business request.

[0045] According to a seventh aspect of an embodiment of this specification, there is provided a computing device, including:

[0046] Memory and processor;

[0047] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above method are implemented.

[0048] According to an eighth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and the instructions implement the steps of the above method when executed by a processor.

[0049] According to a ninth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above method.

[0050] In a key update system provided by an embodiment of the present specification, when performing a key update, a key management unit generates an update key associated with at least two applications in response to a key update request; sends the update key to each application respectively, and updates the key record table to an intermediate key record table according to the key sending result; each application receives the update key; updates the local key based on the update key, and feeds back the update information to the key management unit according to the update result; the key management unit receives the update information, and updates the intermediate key record table to a target key record table based on the update information, wherein the target key record table is used to record the key information of each application. Thus, the keys of at least two applications associated with the same update key are updated simultaneously. The key of at least two applications is updated with the same key, which improves the security of the key update. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a structural diagram of a key update system provided by an embodiment of this specification;

[0052] Figure 2 is a structural diagram of an information interaction system provided by an embodiment of this specification;

[0053] Figure 3 is an interactive schematic diagram of a system provided by an embodiment of this specification;

[0054] Figure 4 is a processing schematic diagram of a system provided by an embodiment of this specification;

[0055] Figure 5 is a flow chart of a key updating method provided by an embodiment of this specification;

[0056] Figure 6 It is a structural diagram of a key updating device provided by an embodiment of this specification;

[0057] Figure 7 is a flow chart of an information interaction method provided by an embodiment of this specification;

[0058] Figure 8 It is a structural diagram of an information interaction device provided by an embodiment of this specification;

[0059] Fig. 9 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0060] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0061] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0062] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0063] First, the terms involved in one or more embodiments of this specification are explained.

[0064] Certificate: This refers to a digital certificate, which is an electronic file that uniquely identifies people and resources on the Internet. Certificates enable secure and confidential communications between two entities.

[0065] Private key: The private key held by the certificate holder

[0066] HTTPS client identity: This refers to the need to verify the identity of the requester when the client accesses a website / service during the HTTPS handshake. Generally, the requester white-labels his client certificate on the server in advance, and then verifies it every time he accesses the server for HTTPS handshake.

[0067] KMI (Key Management Infrastructure) is a unified and centralized key management mechanism suitable for various private networks.

[0068] When connecting to external organizations, there are scenarios where multiple internal systems need to interact with the same external system. Some of the external systems of third-party organizations can only accept one client identity. It is required that the internal system must use the same key (private key + certificate) when accessing the external system. At the same time, because the client identity has a validity period (usually one year), it is also necessary to design a set of key update and key expiration methods to ensure that the key update of the same application of multiple service providers does not affect the normal execution of the business.

[0069] In this specification, a key update system is provided. This specification also involves a key update method, a key update device, an information interaction system, an information interaction method, an information interaction device, a computing device, a computer-readable storage medium and a computer program, which are described in detail one by one in the following embodiments.

[0070] See also Figure 1 , Figure 1 The structure diagram of a key update system provided according to an embodiment of the present specification is shown. The key update system 100 includes a key management unit 110 and at least two application programs 120, wherein:

[0071] The key management unit 110 is configured to generate an update key associated with at least two applications 120 in response to a key update request; send the update key to each application 120 respectively, and update the key record table to an intermediate key record table according to the key sending result;

[0072] Each application 120 is configured to receive the updated key; update the local key based on the updated key, and feed back the updated information to the key management unit 110 according to the update result;

[0073] The key management unit 110 is configured to receive the update information, and update the intermediate key recording table to a target key recording table based on the update information, wherein the target key recording table is used to record the key information of each application 120 .

[0074] Specifically, the key management unit 110 is used to manage key-related data, which includes certificates, private keys, and key labels corresponding to the keys. Certificates are digital certificates, and key labels are also called aliases of keys. Each key has its unique corresponding key label. The application 120 refers to a computer program or computer software, which runs in user mode, can interact with users, and has a visual user interface. A key update request refers to a computer instruction received by the key management unit 110 for requesting the key management unit 110 to update a key. An updated key refers to a new key generated relative to an original key. A key sending result refers to a request sent by the key management unit 110 to the key management unit 110 to update a key. 0 sends the updated key to the application 120, that is, to which applications 120 the updated key is sent; the key record table refers to a table used to record the key information of each application 120, and the intermediate record table refers to the updated key record table obtained after recording the key sending result in the key record table; the local key refers to the key corresponding to the updated key and used before the updated key is received; the update information refers to the information generated by the application 120 for the update status of the updated key, including the update success information and the update failure information; the target key record table refers to the record table obtained after the key management unit 110 updates the intermediate key record table according to the received update information.

[0075] Based on this, after the key management unit 110 receives the key update request, it generates an update key in response to the key update request. The update key is associated with at least two applications 120, that is, at least two applications 120 associated with the update key share the same update key. In this embodiment, at least two applications belong to the same service provider. The key management unit 110 sends the update key to each application 120 respectively, and updates the key record table according to the generated key sending result, and updates the key record table to an intermediate key record table for recording the sending status of the update key, that is, recording which applications 120 the update key is sent to. Each application 120 receives the update key sent by the key management unit 110, and updates the local key stored in the application 120 according to the received update key, and feeds back the update information to the key management unit 110 according to the update result. After receiving the update information fed back by at least two applications 120, the key management unit 110 updates the intermediate key record table based on the update information, and updates the intermediate key record table to a target key record table, which is used to record the key information of each application 120.

[0076] In summary, when updating the local key of an application, the key management unit 110 sends the same updated key to multiple applications, thereby updating the keys of multiple applications at the same time, reducing resource consumption caused by maintaining the keys of multiple applications and simplifying the key update method.

[0077] Furthermore, in this embodiment, the key management unit 110 is further configured to store the updated key, wherein the updated key includes key data and a key tag; send the key tag to each application 120, and update the key record table to the initial key record table according to the tag sending result; when the key update time reaches a preset update threshold, send the key data to each application 120, and update the initial key record table to the intermediate key record table according to the key sending result.

[0078] Specifically, the key data includes a certificate and a private key; the key tag is also called an alias of the key, and each key has its unique corresponding key tag; the tag sending result refers to the sending status of the key management unit 110 sending the key tag to the application 120, that is, to which applications 120 the key tag is sent; the initial key record table refers to the record table obtained after the key record table is updated according to the tag sending result; the preset update threshold refers to the pre-set key update time threshold, also refers to the key update period, and the preset update threshold can be set to any length of time such as one year or six months, and this embodiment does not impose any limitation on this.

[0079] Based on this, after the key management unit 110 generates an update key associated with at least two applications 120 in response to the key update request, the key management unit 110 stores the update key. The update key includes key data and a key tag. After the update key is generated, the key tag is first sent to each application 120 respectively, and the key record table is updated according to the tag sending result generated by sending the key tag to each application 120, and the key record table is updated to the initial key record table. When the key update time reaches the preset update threshold, the key data is sent to each application 120 respectively, and the initial key record table is updated according to the key sending result generated by sending the key data to each application 120, and the initial key record table is updated to the intermediate key record table.

[0080] For example, when making a payment through a shopping application, it is necessary to initiate a deduction request to the bank associated with the application, and the bank will deduct a certain amount of money. In order to ensure the security of the transaction, it is necessary to use a key to encrypt the deduction data carried in the deduction request before sending it to the bank system. In order to further ensure the security of the key, the key needs to be updated regularly. When the application interacts with the external system, in order to reduce the complexity of the interaction, multiple applications corresponding to the same service party can use the same key (private key + certificate) to interact with the same external system. The key usually has a validity period. Only within the validity period can the application use the key to interact with the external system or organization. Therefore, when the key needs to be updated, the key can be updated through the KMI system, so as to ensure that the normal execution of the business is not affected when the key is updated, and the keys corresponding to multiple applications can be updated at the same time. Before the key update time arrives, the KMI system generates a new key, which includes a certificate and a private key and an alias corresponding to the new key. Among them, the KMI system is the key management unit, the new key is the updated key, the key data includes the certificate and the private key, and the alias of the new key is the key label corresponding to the updated key. After the KMI system generates a new key, it first sends the alias corresponding to the new key to multiple applications that share the same key, such as the quick payment application, shopping application, video application, etc., which are associated with the new key, and records the sending results in the key record table, that is, which applications the new key has been sent to. When the preset key update time threshold is reached, the certificate and private key of the new key are pushed to each application associated with the new key, and the push results are recorded in the key record table. After receiving the new key, the application updates the old key according to the new key and feeds back the key update result to the KMI system, that is, informs the MKI system whether the update is successful. In the case where the update result fed back by the quick payment application and the video application is a successful update, the information of the successful update is recorded in the key record table, and in the corresponding position of the quick payment application and the video application, in the case where the update result fed back by the shopping application is an update failure, the information of this update failure is recorded in the key record table.

[0081] In summary, by sending the key data and the key label at different times, the subsequent application program can obtain the key data from the key management unit based on the key label, thereby improving the flexibility of key update.

[0082] Furthermore, considering that due to the influence of various factors such as the network, the application 120 may fail to receive the updated key, even if the reception fails, it is necessary to send the update information of the failed reception to the key management unit 110, so as to update the intermediate key record table. When the update information received by the key management unit 110 is update failure information, in order to update the key of the application 120 associated with the update key, it is necessary to send the update key again to the application 120 corresponding to the update failure information. In this embodiment, the key management unit 110 is also configured to send the update key to the application 120 corresponding to the update failure information; when the update information fed back by the application 120 corresponding to the update failure information is update success information, the target key record table is updated.

[0083] Specifically, the update failure information refers to the update information generated when the application 120 fails to receive the update key sent by the key management unit 110; the update success information refers to the update information generated when the application 120 successfully receives the update key sent by the key management unit 110.

[0084] Based on this, when the application 120 receives the update key, if it fails to receive it successfully, the update failure information is sent as the update information to the key management unit 110. When the update information received by the key management unit 110 is the update failure information, the application 120 corresponding to the update failure information is determined through the update failure information, and the update key is sent to the application 120 again, until the update success information fed back by the application 120 is received, and the key record table is updated according to the update success information.

[0085] Continuing with the above example, when the KMI system receives feedback from the shopping application that the key update result is an update failure, it means that the shopping application may not have received the new key pushed by the KMI system due to various reasons such as the network. Therefore, when the KMI system receives the update failure information, it needs to push the new key to the shopping application corresponding to the update failure information again, and receive the update result feedback from the shopping application. If the key update result feedback from the shopping application is still an update failure, the new key is pushed again until the KMI system receives feedback from the shopping application that the key update result is an update success. The push is stopped and the update success information feedback from the shopping application is recorded in the position corresponding to the shopping application in the key record table.

[0086] In summary, when the received update information is update failure information, the update information is sent again to the application corresponding to the update failure information, thereby implementing the key update of the application and ensuring that each application associated with the update key completes the key update.

[0087] Furthermore, in the current key update cycle, after each application 120 corresponding to the updated key has completed the key update, considering that the historical key corresponding to the previous key update cycle has expired, the historical key can be deleted. In this embodiment, the key management unit 110 is also configured to delete the historical key of the previous key update cycle when it is determined that the key corresponding to each application 120 has been successfully updated in the current key update cycle, and record the historical key information corresponding to the historical key in the historical key record table.

[0088] Specifically, the key update cycle refers to the pre-set key update time, which can be one year. The key is only valid during the current key update cycle. A new key will be generated in a key update cycle, that is, each key update cycle corresponds to a key; the historical key refers to the key corresponding to the previous key update cycle adjacent to the current key update cycle; the historical key information refers to the relevant information of the historical key, including information such as private key and key label.

[0089] Based on this, in the current key update cycle, the key update status corresponding to each application 120 can be known by traversing the target key record table. When it is determined that the key corresponding to each application 120 is successfully updated, the historical key of the previous key update cycle adjacent to the current key update cycle can be deleted in the application 120 and the key management unit 110, and the historical key information corresponding to the historical key is recorded in the historical key record table maintained by the key management unit 110.

[0090] Continuing with the above example, if the update results corresponding to the quick payment application, shopping application, and video application recorded in the key record table are all successful, it means that the quick payment application, shopping application, and video application have all completed the key update. At this time, the old key stored in the KMI system can be deleted, and the information of the old key, including the expiration time of the old key and other information, can be recorded in the history record table of the KMI system.

[0091] In summary, in the current key update cycle, when the keys corresponding to each application are successfully updated, the historical keys of the previous key update cycle adjacent to the current key update cycle are deleted, thereby saving storage space of the application and the key management unit.

[0092] See also Figure 2 , Figure 2 2 shows a schematic diagram of the structure of an information interaction system provided according to an embodiment of the present specification. The information interaction system 200 includes a business service end 210 and a client end 220 carrying an application program, wherein:

[0093] The client 220 is configured to receive a service request corresponding to the application; encrypt the service data carried in the service request according to the updated key, obtain the encrypted data and send it to the service server 210;

[0094] The business service end 210 is configured to receive the encrypted data, create a business processing task according to the encrypted data, and execute the business processing task as a response to the business request.

[0095] Specifically, the client 220 carries multiple applications. A business request refers to a computer instruction submitted for a specific business. In this embodiment, a business request can be an operation instruction generated by a user by operating an application to achieve a specific function. Business data refers to the data carried in the business request that needs to be sent to the business server 210. Encrypted data refers to the processing result obtained after encrypting the business data using an updated key. A business processing task refers to a task that needs to be executed corresponding to the business request.

[0096] Based on this, after the client 220 receives the service request corresponding to the hosted application, it reads the service data carried in the service request, encrypts the service data carried in the service request according to the update key corresponding to the application, obtains the encrypted data, and sends the encrypted data to the service server 210. After receiving the encrypted data, the service server 210 creates a service processing task according to the encrypted data and executes the service processing task, thereby realizing the response to the service request.

[0097] In summary, the business data is encrypted according to the updated key to implement the execution of the business processing task, thereby improving the security of data transmission.

[0098] Furthermore, when encrypting business data based on the update key, the business data can be first encrypted based on the private key contained in the update key to obtain encrypted data carrying a digital signature. In this embodiment, the client 220 is further configured to encrypt the business data carried in the business request according to the private key contained in the update key, obtain the encrypted data carrying the digital signature and send it to the business server 210; the business server 210 is configured to receive the encrypted data, decrypt the encrypted data according to the public key contained in the local certificate, and if the decryption is successful, execute the business processing task created according to the encrypted data.

[0099] Specifically, the local certificate refers to the certificate contained in the update key stored by the business server 210, and the certificate includes a public key; the encrypted data refers to the business data carrying a digital signature, that is, the data obtained by adding a digital signature to the business data.

[0100] Based on this, when encrypting the business data based on the update key, the business data is encrypted based on the private key contained in the update key, that is, the intermediate encrypted data is combined with the digital signature to obtain encrypted data carrying the digital signature. The encrypted data is sent to the business service end 210. After the business service end 210 receives the encrypted data carrying the digital signature sent by the client 220, it reads the digital signature carried by the encrypted data, decrypts the encrypted data sent by the client 220 according to the digital signature, and creates a business processing task according to the encrypted data if the decryption is successful.

[0101] For example, after the quick payment application, shopping application, and video application have completed the key update, the quick payment application, shopping application, video application, and other applications carried by the client can use the new key to interact with the business service end, that is, the bank system. The shopping application submits a transaction request carrying transaction data to the bank. Before initiating the request, the transaction data carried in the transaction request is encrypted using the new key. The transaction data includes transaction account A, transaction amount B, and transfer transaction type. The transaction data is encrypted using the private key contained in the new key to obtain the encrypted data, that is, the digital signature is attached to the transaction data to obtain the transaction data carrying the digital signature. The encrypted data is sent to the bank system. After receiving the encrypted data, the bank system decrypts the encrypted data carrying the digital signature according to the local certificate stored in the bank system. If the decryption is successful, the transaction data (transaction account A, transaction amount B, transfer transaction type) is obtained, and a data update task is created according to the transaction data, that is, the amount B is transferred out for account A, and the transaction account A is deducted.

[0102] To summarize, business data is encrypted based on a private key to obtain intermediate encrypted data, and then a digital signature is added to the intermediate encrypted data to ensure the security and accuracy of data transmission.

[0103] Furthermore, when the client 220 needs to interact with the business service end 210, it can request the key management unit to update the key each time the interaction is required, thereby obtaining the updated key, and using the updated key to interact with the business service end 210. In this embodiment, the information interaction system also includes a key management unit; the client 220 is further configured to generate a key acquisition request in response to a business request and send it to the key management unit; the key management unit is configured to determine the updated key corresponding to the key acquisition request, and send the updated key to the client 220; the client 220 is further configured to receive the updated key sent by the key management unit.

[0104] Specifically, the key acquisition request refers to a computer instruction for requesting the key management unit to update the key, thereby obtaining the updated key sent by the key management unit, so as to facilitate subsequent interaction with the business service end 210 based on the updated key.

[0105] Based on this, after the client 220 receives the service request corresponding to the hosted application, it creates a key acquisition request based on the service request and sends the key acquisition request to the key management unit. After receiving the key acquisition request, the key management unit determines the updated key corresponding to the key acquisition request based on the key acquisition request and sends the updated key to the client 220. After receiving the updated key, the client 220 stores the updated key so that the client 220 can subsequently interact with the service server 210 based on the updated key.

[0106] To sum up, whenever the client receives a business request, it creates a key acquisition request based on the business request and sends it to the key management unit, thereby obtaining the updated key stored in the key management unit, ensuring the accuracy of the updated key corresponding to the client and improving the success rate of information interaction between the client and the business server.

[0107] Furthermore, when the key update is not completed and the client 220 needs to interact with the business service end 210, the local key can continue to be used. In this embodiment, the key management unit is also configured to receive a key acquisition request carrying a key tag, and when it is determined that the key tag corresponds to the local key, the local key is sent to the client 220.

[0108] Specifically, during the process of the client 220 updating the key, the client 220 will continue to use the key before the update to interact with the business server 210. The local key refers to the key in use corresponding to the currently updated key.

[0109] Based on this, during the key update process, when the client 220 has not completed the key update, when the client needs to interact with the business service end 210, a key acquisition request carrying a key tag is sent to the key management unit. After the key management unit receives the key acquisition request carrying the key tag from the client, if it is determined that the key tag is a local key tag, it determines the local key corresponding to the key tag and sends the local key to the client.

[0110] Continuing with the above example, after the shopping application completes the key update, it can interact with the banking system based on the new key. The shopping application actively sends a key acquisition request to the MKI system to obtain a new key. When the MKI system receives the key acquisition request, it sends the new key (new certificate and private key) to the shopping application. The shopping application encrypts the transaction data: transaction account A, transaction amount B, and transfer transaction type based on the received new key, and sends the encrypted data to the banking system.

[0111] To sum up, during the key update process, when the client needs to interact with the business server, it obtains the local key through the key acquisition request carrying the key tag, thereby completing the interaction with the business server and avoiding the situation where the client cannot interact with the business server due to the key update.

[0112] Furthermore, considering that each time the client 220 interacts with the business service end 210, it needs to send a key acquisition request to the key management unit, which will cause a waste of resources, after the key is updated, the client 220 can store the updated key sent by the key management unit, so that the next time it interacts with the business service end 210, it can read the updated key. In this embodiment, the information interaction system also includes a key management unit; the key management unit is further configured to send the updated key to the client 220; the client 220 is configured to receive the updated key and store the updated key; and when a business request corresponding to the application is received, the updated key is read.

[0113] Based on this, after the key management unit sends the updated key to the client 220, the client 220 receives the updated key and stores it. When the client 220 needs to interact with the business service end 210, it can read the stored updated key, thereby encrypting data according to the updated key.

[0114] Continuing with the above example, considering that each time the shopping application needs to interact with the banking system, it needs to send a key acquisition request to the KMI system, which will consume a lot of resources and require a long waiting time, therefore, when the shopping application completes the key update and needs to use the new key to interact with the banking system, it can send a key acquisition request to the KMI system. When the KMI system receives the key acquisition request from the shopping application, it sends the new key corresponding to the key acquisition request to the shopping application. The shopping application receives and stores the new key, and interacts with the banking system based on the received new key. When the shopping application needs to interact with the banking system again, it can read the previously stored new key to interact with the banking system, thereby avoiding waste of resources and saving time.

[0115] To sum up, after receiving the updated key, the client stores the updated key so that the client can directly read the updated key when it needs to interact with the business server, avoiding the client requesting the key management unit to update the key again, reducing resource consumption and shortening data encryption time.

[0116] Furthermore, before pushing the updated key to multiple applications, a test needs to be performed first. In this embodiment, the information interaction system further includes a key management unit;

[0117] The key management unit is further configured to select a test application from the at least two applications and send the updated key to the test application; the test application is further configured to receive the updated key; receive a test service request corresponding to the test application, encrypt the test service data carried by the test service request based on the updated key, obtain the test encrypted data and send it to the service server 210; the service server 210 is configured to receive the test encrypted data, create a test service processing task according to the test encrypted data, and execute the test service processing task as a response to the test service request.

[0118] Specifically, the test application refers to an application selected from the applications hosted by the client 220, which is used to test whether the updated key can be used normally and whether the test application can successfully implement the key update; the test business request refers to the computer instruction issued by the test application; the test business data refers to the test data carried in the test business request that needs to be sent to the business service end 210; the test encryption data refers to the encrypted data obtained after encrypting the test business data; the test business processing task refers to the task that needs to be executed corresponding to the test business request.

[0119] Based on this, before pushing the update key to all applications associated with the update key, an update key test is performed, a test application is selected from at least two applications carried by the client 220, and the update key is sent to the test application. The test application receives the update key, and after receiving the test service request, reads the test service data carried in the test service request, encrypts the test service data carried in the test service request according to the update key corresponding to the test application, obtains the test encrypted data, and sends the test encrypted data to the service server 210. After receiving the test encrypted data, the service server 210 creates a test service processing task according to the test encrypted data and executes the test service processing task, thereby responding to the test service request.

[0120] Continuing with the above example, before sending the new key to the quick payment application, shopping application, video application and other applications corresponding to the new key, it is also necessary to perform a grayscale test on the new key, that is, to test whether the new key is available. First, select a video application as a test application from multiple applications, and send the new key from the KMI system to the video application. After the video application receives the new key, when it receives a test service request for testing the new key, it encrypts the test data carried in the test service request based on the new key and sends it to the business server. The business server creates and executes the test service based on the encrypted test data, thereby realizing grayscale testing.

[0121] To summarize, before pushing the update key to all applications associated with the update key, the update key is tested first. If the test passes, the update key is pushed to all applications associated with the update key, thereby avoiding waste of resources caused by pushing unusable update keys.

[0122] Figure 3 A schematic diagram of an interaction between key update and information interaction provided by an embodiment of the present application is shown, wherein the client 310 carrying at least two applications, a key management unit 320 and a business service end 330 are included, and specifically the following steps are included:

[0123] Step S302: Enter the new certificate, private key and key label into the key management unit.

[0124] like Figure 4 As shown in the processing diagram, the key management unit manages multiple certificates and private keys, each of which has its corresponding application. The service party to which application 1 and application 2 corresponding to the new certificate and private key 1 belong is the same, so the new certificate and private key 1 are shared. Since certificates and private keys have a validity period, which is generally 1 year, when the validity period is about to expire, the key management unit will generate a new certificate and private key, or receive and store a new certificate and private key, which will be pushed to the application associated with the new certificate and private key to achieve grayscale replacement, and replace the original certificate and private key in use with the new certificate and private key. When the application needs to interact with the business service end, if the grayscale replacement is completed, the new certificate and private key are used for information interaction, and if it is not completed, the original certificate and private key are used for information interaction. When the certificate and private key need to be updated, the key management unit generates a new certificate and private key 1, or manually enters the new certificate and private key 1 in the key management unit, and stores the new certificate and private key 1 in the key management unit.

[0125] Step S304: Select a verification application from at least two applications, and push the new certificate, private key, and key tag to the verification application of the client.

[0126] Select Application 1 as the verification application, i.e., the grayscale verification machine, and send the new certificate and private key 1 to Service 1 in Application 1 to implement grayscale push.

[0127] Step S306: Push the new certificate to the business server.

[0128] When the new certificate and private key 1 are sent to the application 1, the new certificate is sent to the business server for verifying the identity of the application 1 when the application 1 interacts with the business server.

[0129] Step S308: The key management unit receives the update information fed back by the client.

[0130] After receiving the new certificate and private key 1 and completing the replacement, application 1 feeds back information about the successful update to the key management unit. If application 1 has not completed the replacement of the new certificate and private key 1, it feeds back information about the failed update to the key management unit, and the key management unit pushes the new certificate and private key 1 to application 1 again.

[0131] Step S310: The key management unit receives update information fed back by the business service end.

[0132] Correspondingly, after receiving the new certificate, the service server feeds back information of successful reception to the key management unit. If the service server fails to receive the new certificate, information of update failure is fed back to the key management unit.

[0133] Step S312: Complete verification of the new certificate and private key in the client's verification application.

[0134] The new certificate and private key 1 are verified through application 1. After receiving the transfer task, application 1 obtains the transfer data such as the transferee account number, transferor account number, transfer amount, etc. carried in the transfer task, encrypts the transfer data with the received private key, generates encrypted data and sends it to the business server. After receiving the encrypted data, the business server verifies the encrypted data based on the new certificate.

[0135] Step S314: After the verification is passed, the key management unit pushes the new certificate and private key to all applications hosted by the client.

[0136] If the verification is successful, the key management unit may send the new certificate and private key 1 to all applications associated with the new certificate and private key 1 , that is, application 2 .

[0137] Step S316: the client sends a key acquisition request carrying the key tag to the key management unit according to the key tag.

[0138] When service 1 in application 1 needs to interact with the business service end, service 1 in the application submits a key acquisition request carrying a key label to the key management unit to obtain a new certificate and private key 1 corresponding to the key label from the key management unit.

[0139] Step S318: Send the certificate and private key to the client according to the key tag.

[0140] When the key tag received by the key management unit corresponds to the old certificate and private key, the old certificate and private key are sent to the application; when the key tag received by the key management unit corresponds to the new certificate and private key, the new certificate and private key are sent to the client.

[0141] Step S320: Add a digital signature to the business data according to the private key.

[0142] When the received certificate and private key are new ones, the new private key is used to add a digital signature to the business data to obtain encrypted data; when the received certificate and private key are old ones, the old private key is used to add a digital signature to the business data to obtain encrypted data, wherein the encrypted data is business data carrying a digital signature.

[0143] Step S322: Send the encrypted data to the business service end for verification.

[0144] In summary, a new certificate and private key are generated by the key management unit, and the new certificate and private key are actively pushed to at least two applications associated with the new certificate and private key, thereby implementing key updates for the applications, and managing key updates for multiple applications simultaneously.

[0145] Corresponding to the above system embodiment, this specification also provides a key updating method. Figure 5 A flowchart of a key update method provided by an embodiment of this specification is shown, which specifically includes the following steps:

[0146] Step S502: the key management unit generates an update key associated with at least two applications in response to the key update request; sends the update key to each application respectively, and updates the key record table to an intermediate key record table according to the key sending result.

[0147] Step S504: Each application receives the updated key; updates the local key based on the updated key, and feeds back the update information to the key management unit according to the update result.

[0148] Step S506: the key management unit receives the update information, and updates the intermediate key recording table to a target key recording table based on the update information, wherein the target key recording table is used to record the key information of each application.

[0149] Optionally, the key management unit stores the updated key, wherein the updated key includes key data and a key tag; sends the key tag to each application, and updates the key record table to an initial key record table according to the tag sending result; when the key update time reaches a preset update threshold, sends the key data to each application, and updates the initial key record table to an intermediate key record table according to the key sending result.

[0150] Optionally, the key management unit sends the updated key to an application corresponding to the update failure information; and when the update information fed back by the application corresponding to the update failure information is update success information, the target key record table is updated.

[0151] Optionally, when the key management unit determines that the key corresponding to each application is successfully updated in the current key update cycle, the key management unit deletes the historical key of the previous key update cycle and records the historical key information corresponding to the historical key in the historical key record table.

[0152] In summary, in a key update method provided by an embodiment of the present specification, when performing a key update, the key management unit generates an update key associated with at least two applications in response to a key update request; sends the update key to each application respectively, and updates the key record table to an intermediate key record table according to the key sending result; each application receives the update key; updates the local key based on the update key, and feeds back the update information to the key management unit according to the update result; the key management unit receives the update information, and updates the intermediate key record table to a target key record table based on the update information, wherein the target key record table is used to record the key information of each application. Thus, the keys of at least two applications associated with the same update key are updated simultaneously. The key of at least two applications is updated with the same key, which improves the security of the key update.

[0153] The above is an illustrative solution of the key update method of this embodiment. It should be noted that the technical solution of the key update method and the technical solution of the key update system described above are of the same concept, and the details not described in detail in the technical solution of the key update method can be found in the description of the technical solution of the key update system described above.

[0154] Corresponding to the above method embodiments, this specification also provides 6 device embodiments, Figure 6 FIG. 1 shows a schematic diagram of the structure of a key updating device provided by an embodiment of the present specification. Figure 6 As shown, the device comprises:

[0155] The processing module 602 is configured as a key management unit to generate an update key associated with at least two applications in response to a key update request; send the update key to each application respectively, and update the key record table to an intermediate key record table according to the key sending result.

[0156] The sending module 604 is configured to receive the updated key for each application; update the local key based on the updated key, and feed back the updated information to the key management unit according to the updated result.

[0157] The updating module 606 is configured so that the key management unit receives the updating information and updates the intermediate key recording table to a target key recording table based on the updating information, wherein the target key recording table is used to record the key information of each application.

[0158] In an optional embodiment, the processing module 602 is further configured to:

[0159] The updated key is stored, wherein the updated key includes key data and a key tag; the key tag is sent to each application, and the key record table is updated to an initial key record table according to the tag sending result; when the key update time reaches a preset update threshold, the key data is sent to each application, and the initial key record table is updated to an intermediate key record table according to the key sending result.

[0160] In an optional embodiment, the processing module 602 is further configured to:

[0161] The updated key is sent to the application corresponding to the update failure information; when the update information fed back by the application corresponding to the update failure information is update success information, the target key record table is updated.

[0162] In an optional embodiment, the updating module 606 is further configured to:

[0163] When it is determined in the current key update cycle that the key corresponding to each application is updated successfully, the historical key of the previous key update cycle is deleted, and the historical key information corresponding to the historical key is recorded in the historical key record table.

[0164] In summary, in a key updating device provided by an embodiment of the present specification, when performing a key update, the key management unit generates an update key associated with at least two applications in response to a key update request; sends the update key to each application respectively, and updates the key record table to an intermediate key record table according to the key sending result; each application receives the update key; updates the local key based on the update key, and feeds back the update information to the key management unit according to the update result; the key management unit receives the update information, and updates the intermediate key record table to a target key record table based on the update information, wherein the target key record table is used to record the key information of each application. Thus, the keys of at least two applications associated with the same update key are updated simultaneously. The key of at least two applications is updated with the same key, which improves the security of the key update.

[0165] The above is a schematic scheme of a key updating device of this embodiment. It should be noted that the technical scheme of the key updating device and the technical scheme of the key updating method described above are of the same concept, and the details not described in detail in the technical scheme of the key updating device can be found in the description of the technical scheme of the key updating method described above.

[0166] Corresponding to the above system embodiment, this specification also provides an information interaction method, Figure 7 A flowchart of an information interaction method provided by an embodiment of this specification is shown, which specifically includes the following steps:

[0167] Step S702: The client carrying the application receives a service request corresponding to the application; encrypts the service data carried in the service request according to the updated key, obtains the encrypted data and sends it to the service server.

[0168] Step S704: The business service end receives the encrypted data, creates a business processing task according to the encrypted data, and executes the business processing task as a response to the business request.

[0169] Optionally, the information interaction system also includes a key management unit; the client generates a key acquisition request in response to a service request and sends it to the key management unit; the key management unit determines an updated key corresponding to the key acquisition request and sends the updated key to the client; the client receives the updated key sent by the key management unit.

[0170] Optionally, the information interaction system further includes a key management unit; the key management unit sends the updated key to the client; the client receives the updated key and stores the updated key; and reads the updated key upon receiving a service request corresponding to the application.

[0171] Optionally, the client encrypts the business data carried in the business request according to the private key contained in the updated key, obtains the encrypted data carrying the digital signature and sends it to the business server; the business server receives the encrypted data, decrypts the encrypted data according to the public key contained in the local certificate, and if the decryption is successful, executes the business processing task created based on the encrypted data.

[0172] Optionally, the key management unit receives a key acquisition request carrying a key tag, and when determining that the key tag corresponds to a local key, sends the local key to the client.

[0173] Optionally, the information interaction system also includes a key management unit; the key management unit selects a test application from the at least two applications, and sends the updated key to the test application; the test application receives the updated key; receives a test business request corresponding to the test application, encrypts the test business data carried by the test business request based on the updated key, obtains the test encrypted data and sends it to the business service end; the business service end receives the test encrypted data, creates a test business processing task according to the test encrypted data, and executes the test business processing task as a response to the test business request.

[0174] In summary, an information interaction method provided by an embodiment of the present specification receives a service request corresponding to an application program through a client; encrypts the service data carried in the service request according to an updated key, obtains the encrypted data and sends it to a service server; the service server receives the encrypted data, creates a service processing task according to the encrypted data, and executes the service processing task as a response to the service request. The service data is encrypted according to the updated key to implement the execution of the service processing task, thereby improving the security of data transmission.

[0175] The above is a schematic scheme of the information interaction method of this embodiment. It should be noted that the technical scheme of the information interaction method and the technical scheme of the above information interaction system belong to the same concept, and the details not described in detail in the technical scheme of the information interaction method can be referred to the description of the technical scheme of the above information interaction system.

[0176] Corresponding to the above method embodiments, this specification also provides 8 device embodiments. Figure 8 FIG. 1 shows a schematic diagram of the structure of an information interaction device provided by an embodiment of this specification. Figure 8 As shown, the device comprises:

[0177] The encryption module 802 is configured to receive the service request corresponding to the application program at the client; encrypt the service data carried in the service request according to the updated key, obtain the encrypted data and send it to the service server.

[0178] The execution module 804 is configured to receive the encrypted data at the business service end, create a business processing task according to the encrypted data, and execute the business processing task as a response to the business request.

[0179] In an optional embodiment, the encryption module 802 is further configured to:

[0180] The information interaction system also includes a key management unit; the client generates a key acquisition request in response to a service request and sends it to the key management unit; the key management unit determines an updated key corresponding to the key acquisition request and sends the updated key to the client; the client receives the updated key sent by the key management unit.

[0181] In an optional embodiment, the encryption module 802 is further configured to:

[0182] The information interaction system also includes a key management unit; the key management unit sends the updated key to the client; the client receives the updated key and stores the updated key; and reads the updated key when receiving a service request corresponding to the application.

[0183] In an optional embodiment, the execution module 804 is further configured to:

[0184] The client encrypts the business data carried in the business request according to the private key contained in the update key, obtains the encrypted data carrying the digital signature and sends it to the business server; the business server receives the encrypted data, decrypts the encrypted data according to the public key contained in the local certificate, and if the decryption is successful, executes the business processing task created according to the encrypted data.

[0185] In an optional embodiment, the execution module 804 is further configured to:

[0186] The key management unit receives a key acquisition request carrying a key tag, and when determining that the key tag corresponds to a local key, sends the local key to the client.

[0187] In an optional embodiment, the execution module 804 is further configured to:

[0188] The information interaction system also includes a key management unit; the key management unit selects a test application from the at least two applications and sends the updated key to the test application; the test application receives the updated key; receives a test service request corresponding to the test application, encrypts the test service data carried by the test service request based on the updated key, obtains the test encrypted data and sends it to the service server; the service server receives the test encrypted data, creates a test service processing task according to the test encrypted data, and executes the test service processing task as a response to the test service request.

[0189] In summary, an information interaction method provided by an embodiment of the present specification receives a service request corresponding to an application program through a client; encrypts the service data carried in the service request according to an updated key, obtains the encrypted data and sends it to a service server; the service server receives the encrypted data, creates a service processing task according to the encrypted data, and executes the service processing task as a response to the service request. The service data is encrypted according to the updated key to implement the execution of the service processing task, thereby improving the security of data transmission.

[0190] The above is a schematic scheme of an information interaction device of this embodiment. It should be noted that the technical scheme of the information interaction device and the technical scheme of the above information interaction method belong to the same concept, and the details not described in detail in the technical scheme of the information interaction device can be referred to the description of the technical scheme of the above information interaction method.

[0191] Fig. 9 The block diagram of a computing device 900 according to an embodiment of the present specification is shown. The components of the computing device 900 include but are not limited to a memory 910 and a processor 920. The processor 920 is connected to the memory 910 via a bus 930, and a database 950 is used to store data.

[0192] The computing device 900 also includes an access device 940 that enables the computing device 900 to communicate via one or more networks 960. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 940 may include one or more of any type of network interface (e.g., a network interface card (NIC)) that is wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a World Wide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0193] In one embodiment of the present specification, the above components of the computing device 900 and Fig. 9 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Fig. 9 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0194] The computing device 900 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. The computing device 900 may also be a mobile or stationary server.

[0195] The processor 920 is used to execute the following computer executable instructions, which implement the steps of the above method when executed by the processor.

[0196] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above method belong to the same concept, and the details not described in detail in the technical scheme of the computing device can be referred to the description of the technical scheme of the above method.

[0197] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which can implement the steps of the above method when executed by a processor.

[0198] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the above method belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be referred to the description of the technical scheme of the above method.

[0199] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above method.

[0200] The above is an illustrative solution of a computer program of this embodiment. It should be noted that the technical solution of the computer program and the technical solution of the above method belong to the same concept, and the details not described in detail in the technical solution of the computer program can be referred to the description of the technical solution of the above method.

[0201] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0202] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0203] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0204] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0205] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A key updating system, comprising: Key management unit, at least two applications; The key management unit is configured to generate an update key associated with at least two applications in response to a key update request; Performing a grayscale test on the updated key, and sending the updated key obtained after the grayscale test to each application respectively, and updating the key record table to an intermediate key record table according to the key sending result, wherein the grayscale test of the updated key is completed based on a test application, and the test application is an application selected from the at least two applications; Each application is configured to receive the updated key; update the local key based on the updated key, and feed back the updated information to the key management unit according to the update result; The key management unit is configured to receive the update information and update the intermediate key recording table to a target key recording table based on the update information, wherein the target key recording table is used to record the key information of each application.

2. The key update system according to claim 1, wherein the key management unit is further configured to store the updated key, wherein: The updated key includes key data and a key tag; the key tag is sent to each application, and the key record table is updated to an initial key record table according to the tag sending result; when the key update time reaches a preset update threshold, the key data is sent to each application, and the initial key record table is updated to an intermediate key record table according to the key sending result.

3. According to the key update system of claim 1, the key management unit is also configured to send the updated key to the application corresponding to the update failure information; when the update information fed back by the application corresponding to the update failure information is update success information, the target key record table is updated.

4. According to the key update system according to any one of claims 1-3, the key management unit is also configured to delete the historical key of the previous key update cycle when it is determined that the key corresponding to each application is successfully updated in the current key update cycle, and record the historical key information corresponding to the historical key in the historical key record table.

5. An information interaction system, comprising: Business server, which hosts the client of the application; The client is configured to receive a service request corresponding to the application; Encrypting the service data carried in the service request according to the update key in the system according to any one of claims 1 to 4, obtaining the encrypted data and sending it to the service server, wherein the update key is an update key obtained after grayscale testing, and the grayscale testing of the update key is completed based on a test application, and the test application is an application selected from the at least two applications; The business service end is configured to receive the encrypted data, create a business processing task according to the encrypted data, and execute the business processing task as a response to the business request.

6. The information interaction system according to claim 5, further comprising a key management unit; The client is further configured to generate a key acquisition request in response to the service request and send the request to the key management unit; The key management unit is configured to determine an updated key corresponding to the key acquisition request and send the updated key to the client; The client is further configured to receive an updated key sent by the key management unit.

7. The information interaction system according to claim 5, further comprising a key management unit; The key management unit is further configured to send the updated key to the client; The client is configured to receive the updated key and store the updated key; When a service request corresponding to the application is received, the update key is read.

8. The information interaction system according to claim 5, wherein the client is further configured to encrypt the business data carried in the business request according to the private key contained in the update key, obtain the encrypted data carrying the digital signature and send it to the business service end; The business service end is configured to receive the encrypted data, decrypt the encrypted data according to the public key contained in the local certificate, and if the decryption is successful, execute the business processing task created according to the encrypted data.

9. The information interaction system according to claim 6, wherein the key management unit is further configured to receive a key acquisition request carrying a key tag, and when it is determined that the key tag corresponds to a local key, send the local key to the client.

10. The information interaction system according to claim 5, further comprising a key management unit; The key management unit is further configured to select a test application from among the at least two applications and send the updated key to the test application; The test application is further configured to receive the update key; Receiving a test service request corresponding to the test application, encrypting the test service data carried in the test service request based on the update key, obtaining the test encrypted data and sending it to the service server; The business service end is configured to receive the test encrypted data, create a test business processing task according to the test encrypted data, and execute the test business processing task as a response to the test business request.

11. A key updating method, comprising: Key management unit, at least two applications; The key management unit generates an update key associated with at least two applications in response to the key update request; Performing a grayscale test on the updated key, and sending the updated key obtained after the grayscale test to each application respectively, and updating the key record table to an intermediate key record table according to the key sending result, wherein the grayscale test of the updated key is completed based on a test application, and the test application is an application selected from the at least two applications; Each application receives the updated key; updates the local key based on the updated key, and feeds back the updated information to the key management unit according to the update result; The key management unit receives the update information and updates the intermediate key recording table to a target key recording table based on the update information, wherein the target key recording table is used to record key information of each application.

12. An information interaction method, comprising: Business server, which hosts the client of the application; The client receives a service request corresponding to the application; Encrypting the service data carried in the service request according to the update key in the system according to any one of claims 1 to 4, obtaining the encrypted data and sending it to the service server; The business service end receives the encrypted data, creates a business processing task based on the encrypted data, and executes the business processing task as a response to the business request, wherein the updated key is an updated key obtained after grayscale testing, and the grayscale testing of the updated key is completed based on a test application, and the test application is an application selected from the at least two applications.

13. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the method according to claim 11 or 12 are implemented.

14. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions implement the steps of the method according to claim 11 or 12 when executed by a processor.

Images