Key chain updating method, device, electronic device and storage medium
Through the key chain update method, the problems of low key update efficiency and unstable business are solved, the continuity and automated update of the key chain are realized, and the correct decryption of the old key encrypted data and the use of the new key is ensured. .
Patent Information
- Application Number
- CN202210784099.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-07-05
- Publication Date
- 2025-01-03
- Estimated Expiration
- 2042-07-05
AI Technical Summary
The existing key update method is inefficient and prone to human operational errors. It is impossible to ensure that business applications adjust request parameters in a timely manner, resulting in the old key encrypted data being unable to be correctly decrypted by the new key, resulting in business instability and data loss.
Using the key chain update method, by adding the old key identifier of the key to be updated to timestamp, generating a new key and copying the key chain number, the key is automatically updated regularly to ensure the continuity and update time of the key chain. Poke to avoid manual and misoperation.
It improves the efficiency and practicality of key updates, ensures that the old key encrypted data can be correctly decrypted and updated, reduces human errors, and ensures business stability and automation of key management.
Smart Images
Figure CN115348008B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to a key chain updating method, device, electronic equipment and storage medium. Background Art
[0002] The implementation of cryptographic security technology is inseparable from keys. The simplest example is to use keys to encrypt sensitive data to avoid direct exposure of plain text. When we need to use sensitive data, we use the key to decrypt it and obtain the plain text.
[0003] In cryptography, based on the Kerckhoff principle, cryptographic algorithms are usually made public and keys are kept secret. This means that keys must be managed and used securely, otherwise security technology will fail. For security reasons, some security specifications (such as PCI) will instruct people to regularly update the keys used in the system, just like the need to regularly change passwords on some security systems.
[0004] When you update keys regularly, you may encounter some scenarios:
[0005] Key updates are similar to password updates, but the difference is that we can discard old passwords almost immediately, but we cannot discard old keys immediately. This is because each key of a business application may have been used before. For example, if a business application uses an old key to encrypt sensitive data, if we discard the old key, the data encrypted with the old key cannot be decrypted normally, causing the business application to lose sensitive data, resulting in immeasurable consequences.
[0006] In addition, for the convenience of business, business applications will not transmit the entire key value in the business. They are more willing to use unique identifiers such as key identifiers and key serial numbers to replace the keys they need to use. After the key is updated, a new key will be generated. The key identifier and key serial number of the new key are different from the old key. At this time, the business application has to adjust the key identifier and key serial number of the old key to the value of the new key before it can use the new key in the next business.
[0007] Problems will continue to arise: the business application has just used the new key, but the ciphertext data generated by the business before was encrypted with the old key. In order to update the ciphertext data, the business application needs to first use the old key to decrypt the ciphertext to obtain plaintext, and then use the new key to encrypt the plaintext, and finally obtain the new ciphertext data, resulting in low overall work efficiency and poor practicality.
[0008] According to the key security use specifications, such as PCI, in key management, we need to add usage information such as validity period and usage count to the key. This information will be used to ensure the safe use of the key. For example, keys that have expired or have exceeded the usage limit will be prohibited from continued use. In this context, for the security of the business, key updates need to be performed frequently.
[0009] The general operation of key update is to simply generate a new key to replace the old key that needs to be replaced regularly in the business. Because the new key has no connection with the old key, after the update is successful, it is necessary to notify the business application to adjust its request parameters in time, changing from the old key to the new key, so that the business can finally achieve the purpose of using the new key. Otherwise, the deactivation of the old key will lead to business failure. In addition, the data encrypted by the business application using the old key will not be correctly decrypted by the new key after the business application is replaced with the new key.
[0010] In the case of frequent key updates, the existing general key update operation is not only very troublesome, greatly increasing the probability of human error, but also brings business instability: there is no guarantee that the business application will receive the key update notification, nor can it guarantee that the business application can adjust the request parameters in time after receiving the notification. The most fatal thing is that after using the new key, all the data generated by the old key will be invalid, which has low practicality. Summary of the invention
[0011] In view of this, embodiments of the present invention provide a key chain update method, device, electronic device and storage medium with high practicality and efficiency.
[0012] An aspect of an embodiment of the present invention provides a key chain update method, comprising:
[0013] Update the old key identifier of the key to be updated and add timestamp information;
[0014] Generate a new key according to the key to be updated, wherein the key identifier of the new key is consistent with the key identifier of the key to be updated;
[0015] Obtain the key chain number attribute of the key to be updated;
[0016] When the key chain number attribute already has a value, copy the key chain number in the key to be updated to the key chain number of the new key, and assign the current timestamp to the update time attribute of the key to be updated, so as to complete the key chain update;
[0017] When the key chain number attribute has no value, a random number is generated as the key chain number of the key to be updated and the new key, and the current timestamp is assigned to the update time attribute of the key to be updated to complete the key chain update.
[0018] Optionally, the method further comprises the step of constructing a new key attribute structure.
[0019] The key attributes include, but are not limited to, key serial number, key identifier, update time, key chain number, expiration time, and number of uses;
[0020] The key serial number, the key identifier and the key chain number are all globally unique attributes;
[0021] The update time attribute is used to record the timestamp when the key is updated. When the update time attribute has a value, it means that the corresponding key has been updated. When the update time attribute has no value, it means that the corresponding key has not been updated.
[0022] The attribute of the key chain number is used to indicate whether the corresponding key is a key on a key chain, and the specific value of the attribute is used to identify the key chain to which the key belongs.
[0023] Optionally, the method further comprises the step of regularly and automatically performing chain updates:
[0024] Configure a scheduled scan time, and when the scheduled scan time is reached, filter out keys that meet the key update conditions according to the key's expiration time attribute or the use count limit attribute;
[0025] The filtered keys are chain updated to complete regular and automatic chain updates.
[0026] Optionally, the method further comprises:
[0027] After completing the chain update of the key to be updated, construct the encrypted response data structure;
[0028] A decryption operation is performed according to the encrypted response data structure to obtain plain text.
[0029] Optionally, the encryption response data structure includes a structure version number, a key sequence number, an IV value, and an original encryption result;
[0030] Wherein, the structure version number is used to represent the version number of the encrypted response data structure;
[0031] The key sequence number is used to represent the attribute value of the key sequence number in the key attribute.
[0032] Optionally, performing a decryption operation according to the encrypted response data structure to obtain a plain text includes:
[0033] Obtain each data in the encrypted response data structure, parse to obtain the structure version number, and then determine the data structure of the incoming data;
[0034] Parse the key serial number from the incoming data, and find the corresponding target key according to the key serial number;
[0035] Obtain the IV value of the target key and the original encryption result, perform decryption operation, and obtain plain text.
[0036] Optionally, the method further comprises:
[0037] After decrypting and obtaining the plaintext, check the key chain number and update time of the target key. If both the key chain number and the update time have values, it indicates that the current key has been updated. Then find the latest key through the key chain, re-encrypt the decryption result and respond to the business application, and update the saved encrypted data in the business application.
[0038] Another aspect of the embodiment of the present invention further provides a key chain updating device, comprising:
[0039] The first module is used to update the old key identifier of the key to be updated and add timestamp information;
[0040] A second module is used to generate a new key according to the key to be updated, wherein the key identifier of the new key is consistent with the key identifier of the key to be updated;
[0041] The third module is used to obtain the key chain number attribute of the key to be updated;
[0042] The fourth module is used for, when the key chain number attribute has a value, copying the key chain number in the key to be updated to the key chain number of the new key, and assigning the current timestamp to the update time attribute of the key to be updated, so as to complete the key chain update;
[0043] The fifth module is used to generate a random number as the key chain number of the key to be updated and the new key when the key chain number attribute has no value, and assign the current timestamp to the update time attribute of the key to be updated to complete the key chain update.
[0044] Another aspect of an embodiment of the present invention further provides an electronic device, including a processor and a memory;
[0045] The memory is used to store programs;
[0046] The processor executes the program to implement the method described above.
[0047] Another aspect of the embodiments of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the method described above.
[0048] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.
[0049] The embodiment of the present invention updates the old key identifier of the key to be updated and adds timestamp information; generates a new key according to the key to be updated, and the key identifier of the new key is consistent with the key identifier of the key to be updated; obtains the key chain number attribute of the key to be updated; when the key chain number attribute has a value, copies the key chain number in the key to be updated to the key chain number of the new key, and assigns the current timestamp to the update time attribute of the key to be updated, completing the key chain update; when the key chain number attribute has no value, generates a random number as the key chain number of the key to be updated and the new key, and assigns the current timestamp to the update time attribute of the key to be updated, completing the key chain update. The present invention has high practicality and high efficiency. BRIEF DESCRIPTION OF THE DRAWINGS
[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0051] Figure 1 A schematic diagram of key attributes provided by an embodiment of the present invention;
[0052] Figure 2 A flowchart of a key chain update method provided by an embodiment of the present invention;
[0053] Figure 3 An example diagram of chain update provided by an embodiment of the present invention;
[0054] Figure 4 A schematic diagram of a key chain provided by an embodiment of the present invention;
[0055] Figure 5 A schematic diagram of the encrypted response data structure provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0056] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0057] In view of the problems existing in the prior art, an embodiment of the present invention provides a key chain update method, comprising:
[0058] Update the old key identifier of the key to be updated and add timestamp information;
[0059] Generate a new key according to the key to be updated, wherein the key identifier of the new key is consistent with the key identifier of the key to be updated;
[0060] Obtain the key chain number attribute of the key to be updated;
[0061] When the key chain number attribute already has a value, copy the key chain number in the key to be updated to the key chain number of the new key, and assign the current timestamp to the update time attribute of the key to be updated, so as to complete the key chain update;
[0062] When the key chain number attribute has no value, a random number is generated as the key chain number of the key to be updated and the new key, and the current timestamp is assigned to the update time attribute of the key to be updated to complete the key chain update.
[0063] Optionally, the method further comprises the step of constructing a new key attribute structure.
[0064] The key attributes include, but are not limited to, key serial number, key identifier, update time, key chain number, expiration time, and number of uses;
[0065] The key serial number, the key identifier and the key chain number are all globally unique attributes;
[0066] The update time attribute is used to record the timestamp when the key is updated. When the update time attribute has a value, it means that the corresponding key has been updated. When the update time attribute has no value, it means that the corresponding key has not been updated.
[0067] The attribute of the key chain number is used to indicate whether the corresponding key is a key on a key chain, and the specific value of the attribute is used to identify the key chain to which the key belongs.
[0068] Optionally, the method further comprises the step of regularly and automatically performing chain updates:
[0069] Configure a scheduled scan time, and when the scheduled scan time is reached, filter out keys that meet the key update conditions according to the key's expiration time attribute or the use count limit attribute;
[0070] The filtered keys are chain updated to complete regular and automatic chain updates.
[0071] Optionally, the method further comprises:
[0072] After completing the chain update of the key to be updated, construct the encrypted response data structure;
[0073] A decryption operation is performed according to the encrypted response data structure to obtain plain text.
[0074] Optionally, the encryption response data structure includes a structure version number, a key sequence number, an IV value, and an original encryption result;
[0075] Wherein, the structure version number is used to represent the version number of the encrypted response data structure;
[0076] The key sequence number is used to represent the attribute value of the key sequence number in the key attribute.
[0077] Optionally, performing a decryption operation according to the encrypted response data structure to obtain a plain text includes:
[0078] Obtain each data in the encrypted response data structure, parse to obtain the structure version number, and then determine the data structure of the incoming data;
[0079] Parse the key serial number from the incoming data, and find the corresponding target key according to the key serial number;
[0080] Obtain the IV value of the target key and the original encryption result, perform decryption operation, and obtain plain text.
[0081] Optionally, the method further comprises:
[0082] After decrypting and obtaining the plaintext, check the key chain number and update time of the target key. If both the key chain number and the update time have values, it indicates that the current key has been updated. Then find the latest key through the key chain, re-encrypt the decryption result and respond to the business application, and update the saved encrypted data in the business application.
[0083] Another aspect of the embodiment of the present invention further provides a key chain updating device, comprising:
[0084] The first module is used to update the old key identifier of the key to be updated and add timestamp information;
[0085] A second module is used to generate a new key according to the key to be updated, wherein the key identifier of the new key is consistent with the key identifier of the key to be updated;
[0086] The third module is used to obtain the key chain number attribute of the key to be updated;
[0087] The fourth module is used for, when the key chain number attribute has a value, copying the key chain number in the key to be updated to the key chain number of the new key, and assigning the current timestamp to the update time attribute of the key to be updated, so as to complete the key chain update;
[0088] The fifth module is used to generate a random number as the key chain number of the key to be updated and the new key when the key chain number attribute has no value, and assign the current timestamp to the update time attribute of the key to be updated to complete the key chain update.
[0089] Another aspect of an embodiment of the present invention further provides an electronic device, including a processor and a memory;
[0090] The memory is used to store programs;
[0091] The processor executes the program to implement the method described above.
[0092] Another aspect of the embodiments of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the method described above.
[0093] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.
[0094] The specific implementation process of the present invention is described in detail below in conjunction with the accompanying drawings:
[0095] First, to support chained key updates, construct key attributes such as Figure 1 As shown, Figure 1 Among the key attributes shown:
[0096] 1. The key should have the following attributes: key serial number, key identifier, update time, key chain number, and other attributes such as expiration time, number of times used, etc. Among them, the key serial number, key identifier, and key chain number are all globally unique. Business applications specify the key to be used through the key identifier.
[0097] 2. The "Update Time" attribute is used to record the timestamp when the key is updated. When this attribute has a value, it means that the key has been updated and is not the latest key; when it has no value, it means that the key has not been updated.
[0098] 3. The "key chain number" attribute is used to indicate whether the key is a key on a key chain (yes - non-null value, no - null value), and the specific value of the attribute is used to identify which key chain the key belongs to.
[0099] The key chain update steps of the embodiment of the present invention are as follows: Figure 2 As shown, the specific steps include:
[0100] 1. Change the key identifier of the key to be updated (old key) to the format of "key name: timestamp". For example, if the original key identifier is test-key, change it to test-key:1651845705040.
[0101] 2. Generate a new key using the basic algorithm attributes of the old key, and set the key identifier of the new key to the original key identifier of the old key. Using the above example, the new key identifier is test-key.
[0102] 3. If the "key chain number" attribute of the old key already has a value, it means that the old key is already a key on the key chain and the new key also belongs to the key chain, so its value is assigned to the key chain number of the new key. Otherwise, it means that the old key is not a key on the key chain and does not belong to any key chain, then it will form a key chain with the new key, so a random number (UUID) needs to be generated as the key chain number of the old and new keys (and as the value of the key chain number of the old and new keys).
[0103] 4. Update the current time to the "update time" attribute of the old key.
[0104] According to the above chain update process, we can get Figure 3 The chain update example diagram shown:
[0105] 1. Assume that the original key has attribute value:
[0106] a) Key number: 1
[0107] b)Key identifier: test-key
[0108] c) Update time: null value
[0109] d)Keychain ID: null value
[0110] 2. After the original key is chained and updated, the attribute value of the original key becomes:
[0111] a) Key number: 1
[0112] b)Key identifier: test-key:1651845705040
[0113] c) Update time: 1651845705040
[0114] d)Keychain ID: f577b64f94ea
[0115] 3. After the original key is chained and updated, the attribute value of the new key is:
[0116] a) Key number: 2
[0117] b)Key identifier: test-key
[0118] c) Update time: null value
[0119] d)Keychain ID: f577b64f94ea
[0120] 4. According to the above example, when the key is chained and updated, the old and new keys will be in a key chain, and the key chain will continue to grow with the chain update. However, the key identifier of the latest key will not change after the chain update, so the business can keep the original key identifier (to indicate the key to be used) and use the latest key without doing anything.
[0121] 5. After the chain update, the "update time" of the latest key is a null value. This embodiment can also use this point to quickly locate the latest key on the key chain.
[0122] Continuing with the above example and continuing the chain update, we can get Figure 4 The key chain diagram is shown.
[0123] Specifically, the embodiment of the present invention can perform regular and automatic chain update, including the following steps:
[0124] 1. Set up a scheduled task in the system: scan the key once every 24 hours, and filter out the keys that meet the key update conditions based on the key's expiration time, usage limit and other attributes, such as "keys that will expire within 24 hours or have reached the maximum number of uses".
[0125] 2. Chain update of the selected keys can achieve regular and automatic characteristics.
[0126] After the old key is chained and updated, the business will automatically use the new key, but the system can still decrypt the data encrypted by the old key. This function requires the support of a specific encryption response data structure. Figure 5 A schematic diagram of a specific encrypted response data structure.
[0127] 1. The encryption response structure consists of 4 parts: structure version number, key sequence number, IV, and original encryption result;
[0128] a) Structure version number: used to identify the version number of a specific structure. Considering the data structure of other cryptographic operations or the upgrade of the structure in the future, this attribute is defined to indicate that a structure version number corresponds to a fixed data structure, thereby achieving good scalability and avoiding confusion during parsing.
[0129] b) Key Serial Number: The value of the "Key Serial Number" attribute in the key attribute. The "Key Serial Number" attribute can be used to locate the key in the system. It is unique and cannot be changed, and will not change with chain updates.
[0130] c) IV: When performing encryption operations, in some encryption modes (such as CBC, etc.), in addition to the key and plaintext data, other parameters may be required, such as the IV value. This part is used to store such parameters, because such parameters are also needed during decryption.
[0131] d) Original encryption result: This part stores the result of the original encryption operation.
[0132] 2. When decrypting, the encrypted response data needs to be passed in. The system will parse out the structure version number and thus understand the data structure of the passed in data.
[0133] 3. Parse the key serial number from the incoming data and find the corresponding key based on the key serial number. This key is the key used for encryption.
[0134] 4. Use the queried key, IV and original encryption result to perform decryption operation to obtain plaintext.
[0135] 5. After decrypting the plaintext, check the key chain number and update time of the key obtained. If both the key chain number and update time have values, it means that the current key has been updated. Then you can find the latest key through the key chain, and according to the decryption result, re-encrypt and respond to the business application, so that the business application can update the encrypted data it saves.
[0136] A simplified embodiment is described below:
[0137] 1. The business application adds a symmetric key and sets it to allow automatic chain updates;
[0138] 2. The system regularly scans the keys in the database, selects the keys that have expired within 24 hours (including those that have already expired) or have exceeded the maximum number of uses, and automatically updates them;
[0139] 3. Business applications do not need to adjust their request parameters, and when business applications pass in data encrypted with the old key, they can still decrypt normally and return the latest encrypted data.
[0140] In summary, compared with the prior art, the present invention has the following advantages:
[0141] 1. If a business application uses an old key to encrypt sensitive data and then discards the old key, the data encrypted by the old key cannot be decrypted normally, resulting in the loss of sensitive data in the business application, causing immeasurable consequences. The present invention can link the old key and the new key together for management, making it easier to view and manage.
[0142] 2. Key update operations can be performed automatically and regularly, without the need for system administrators to perform a large number of manual operations. Automatic updates avoid omissions and misoperations that may occur during manual operations, and ensure the stability of the key management system.
[0143] 3. For the convenience of business, business applications will not transmit the entire key value in the business. They are more willing to use unique identifiers such as key identifiers and key serial numbers to refer to the keys they need to use. After the key is updated, a new key will be generated. The key identifier and key serial number of the new key are different from the old key. At this time, the business application has to adjust the key identifier and key serial number used in its business to the value of the new key before it can use the new key in the next business. With the method of the present invention, after the key is updated, the business application does not need to update the key identifier used in the business, and the original parameters can continue to remain unchanged.
[0144] 4. In the original case, the business application has just used the new key, but the ciphertext data on hand is still encrypted with the old key. In order to update the ciphertext data on hand, the business application needs to first use the old key to decrypt the ciphertext to obtain the plaintext, and then use the new key to encrypt the plaintext to replace the ciphertext data on hand. However, through the method of the present invention, after the key is updated, the data encrypted by the old key can still be correctly decrypted and the plaintext data is returned. Moreover, the system can determine whether the incoming data is generated by the old key. If so, it will find the latest key, encrypt the plaintext data again and respond to the business application.
[0145] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.
[0146] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features described may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in separate physical devices or software modules. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions, and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.
[0147] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.
[0148] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.
[0149] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.
[0150] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.
[0151] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.
[0152] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.
[0153] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the described embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.
Claims
1. A key chain update method, characterized in that: include: Update the old key identifier of the key to be updated and add timestamp information; Generate a new key according to the key to be updated, wherein the key identifier of the new key is consistent with the key identifier of the key to be updated; Obtain the key chain number attribute of the key to be updated; When the key chain number attribute already has a value, copy the key chain number in the key to be updated to the key chain number of the new key, and assign the current timestamp to the update time attribute of the key to be updated, so as to complete the key chain update; When the key chain number attribute has no value, generate a random number as the key chain number of the key to be updated and the new key, and assign the current timestamp to the update time attribute of the key to be updated, so as to complete the key chain update; The method further comprises: After completing the chain update of the key to be updated, construct an encrypted response data structure, the encrypted response data structure including a structure version number, a key sequence number, an IV value, and an original encryption result; The structure version number is used to represent the version number of the encrypted response data structure, and one structure version number corresponds to a fixed data structure; The key sequence number is used to represent the attribute value of the key sequence number in the key attribute; A decryption operation is performed according to the encrypted response data structure to obtain plain text.
2. A key chain update method according to claim 1, characterized in that: The method further comprises the step of constructing a new key attribute structure, The key attributes include, but are not limited to, key serial number, key identifier, update time, key chain number, expiration time, and number of uses; The key serial number, the key identifier and the key chain number are all globally unique attributes; The update time attribute is used to record the timestamp when the key is updated. When the update time attribute has a value, it means that the corresponding key has been updated. When the update time attribute has no value, it means that the corresponding key has not been updated. The attribute of the key chain number is used to indicate whether the corresponding key is a key on a key chain, and the specific value of the attribute is used to identify the key chain to which the key belongs.
3. A key chain update method according to claim 1, characterized in that: The method further comprises the step of regularly and automatically performing chain updates: Configure a scheduled scan time, and when the scheduled scan time is reached, filter out keys that meet the key update conditions according to the key's expiration time attribute or the use count limit attribute; The filtered keys are chain updated to complete regular and automatic chain updates.
4. A key chain update method according to claim 1, characterized in that: The step of performing a decryption operation according to the encrypted response data structure to obtain a plain text comprises: Obtain each data in the encrypted response data structure, parse to obtain the structure version number, and then determine the data structure of the incoming data; The key serial number is parsed from the incoming data, and the corresponding target key is found according to the key serial number; the IV value of the target key and the original encryption result are obtained, and a decryption operation is performed to obtain the plain text.
5. A key chain update method according to claim 4, characterized in that: The method further comprises: After decrypting and obtaining the plaintext, check the key chain number and update time of the target key. If both the key chain number and the update time have values, it indicates that the current key has been updated. Then find the latest key through the key chain, re-encrypt the decryption result and respond to the business application, and update the saved encrypted data in the business application.
6. A key chain updating device, characterized in that: include: The first module is used to update the old key identifier of the key to be updated and add timestamp information; A second module is used to generate a new key according to the key to be updated, wherein the key identifier of the new key is consistent with the key identifier of the key to be updated; The third module is used to obtain the key chain number attribute of the key to be updated; The fourth module is used for, when the key chain number attribute has a value, copying the key chain number in the key to be updated to the key chain number of the new key, and assigning the current timestamp to the update time attribute of the key to be updated, so as to complete the key chain update; A fifth module, for generating a random number as the key chain number of the key to be updated and the new key when the key chain number attribute has no value, and assigning a current timestamp to the update time attribute of the key to be updated to complete the key chain update; The device is also used for: After completing the chain update of the key to be updated, construct an encrypted response data structure, the encrypted response data structure including a structure version number, a key sequence number, an IV value, and an original encryption result; The structure version number is used to represent the version number of the encrypted response data structure, and one structure version number corresponds to a fixed data structure; The key sequence number is used to represent the attribute value of the key sequence number in the key attribute; A decryption operation is performed according to the encrypted response data structure to obtain plain text.
7. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 5.
8. A computer-readable storage medium, characterized in that: The storage medium stores a program, and the program is executed by a processor to implement the method according to any one of claims 1 to 5.