Key distribution method, server, terminal, and computer-readable storage medium

Abstract

The application provides a key distribution method, a server, a terminal and a computer readable storage medium, the key distribution method comprising: the server generating a first public-private key pair and a second public-private key pair, and sending a master encryption public key in the second public-private key pair to the terminal; receiving first encryption information sent by the terminal; decrypting the first encryption information by a master encryption private key in the second public-private key pair to obtain identity information of the terminal and a random key; generating a terminal private key based on the identity information of the terminal by a master signature private key in the first public-private key pair; and encrypting the identity information of the terminal and the terminal private key based on the random key to generate second encryption information and send the second encryption information to the terminal. The application considers the complexity of device certificate authentication, so that the certificate and the private key of the device do not need to be issued and pre-embedded, thereby making the private key acquisition method of the device more simple, and the device does not need to interact with the server for confirmation, thereby improving the security of the key acquisition method.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data communication, in particular to a key distribution method, a server, a terminal and a computer readable storage medium. BACKGROUND

[0002] With the wide popularity of monitoring devices and other intelligent devices, intelligent devices have collected a large amount of user privacy information, and the information security problem of intelligent services is increasingly prominent. To solve the security problem of intelligent scenes, an important point is to adopt a secure and appropriate encryption and authentication scheme.

[0003] Currently, the way for the server to distribute keys to each intelligent device includes a certificate pre-embedding mode, a certificate self-sign mode and an identity key acquisition. Among them, the certificate pre-embedding mode is that the key center issues a certificate and a private key for each device, and the device pre-imports the certificate and the key. However, the pre-embedded certificate and private key need to be issued by a certificate authority (CA) institution, so each device needs to go through the issuing process, which is cumbersome, and the security of the private key and the difficulty of on-site deployment will increase the installation difficulty. The certificate self-sign mode is that the device self-issues a certificate and generates a private key. However, if the other devices connected change, it is difficult to operate the preset counterpart certificate or public key, and the security of the superior certificate private key is at risk. The identity key acquisition is that the device interacts with the key center to apply for the key. If the device directly interacts with the key center, the device with key demand needs to be connected to the key center, which requires the deployment of the key center to be in the intranet local area network, otherwise it is difficult for the intranet device to acquire. This has high requirements for the authority, reliability and security of the key center, and is not friendly to the intranet device. SUMMARY

[0004] The technical problem solved by the present application is to provide a key distribution method, a server, a terminal and a computer readable storage medium, which solves the problem of cumbersome process of acquiring the private key of the terminal in the prior art.

[0005] To solve the above technical problems, the first technical solution adopted by the present application is to provide a key distribution method applicable to a server, the key distribution method comprising:

[0006] The server generates a first public-private key pair and a second public-private key pair, and sends a master encryption public key in the second public-private key pair to the terminal;

[0007] Receiving the first encryption information sent by the terminal, the first encryption information being encrypted by the terminal by using the master encryption public key on the identity identification information of the terminal and a random key generated by the terminal;

[0008] The first encrypted information is decrypted using the master encryption private key in the second public-private key pair to obtain the terminal's identity information and random key;

[0009] If the terminal is a preset terminal, a terminal private key is generated based on the terminal's identity information using the master signature private key in the first public-private key pair.

[0010] The terminal's identity information and private key are encrypted using a random key to generate a second encrypted message, which is then sent to the terminal.

[0011] Prior to the step of generating a terminal private key based on the terminal's identity information using the master signature private key in the first public-private key pair, in response to the terminal belonging to a preset terminal, the method further includes:

[0012] Based on the terminal's identity information, determine whether the terminal belongs to a preset terminal.

[0013] Specifically, the process of generating a terminal private key based on the terminal's identity information using the master signature private key from the first public-private key pair includes:

[0014] The terminal private key is generated using the SM9 algorithm based on the terminal's identity information through the master signature private key.

[0015] Specifically, the terminal's identity information and private key are encrypted using a random key to generate second encrypted information, which is then sent to the terminal, including:

[0016] The terminal's identity information and private key are symmetrically encrypted using a random key to obtain the second encrypted information.

[0017] In response to the terminal having an image acquisition end, the second encrypted information is converted into a second string corresponding to the second encrypted information and sent to the APP software; the APP software converts the second string into a second identifier code so that the terminal can obtain the terminal private key based on the second identifier code.

[0018] Specifically, the terminal's identity information and private key are encrypted using a random key to generate second encrypted information, which is then sent to the terminal, including:

[0019] The terminal's identity information and private key are symmetrically encrypted using a random key to obtain the second encrypted information.

[0020] In response to the fact that the terminal has not set up an image acquisition end, the terminal key is obtained by importing the second encrypted information into the terminal.

[0021] To solve the above-mentioned technical problems, the second technical solution adopted by the present invention is: to provide a key distribution method, applicable to terminals, the key distribution method comprising:

[0022] The terminal generates a random key, and the terminal has identity information;

[0023] The terminal receives a main encryption public key in a second public-private key pair, and obtains first encryption information based on the identity information and the random key through the main encryption public key;

[0024] The terminal sends the first encryption information to the server;

[0025] The terminal receives second encryption information sent by the server, wherein the second encryption information is obtained by the server by encrypting the identity information and a terminal private key through the random key, and the terminal private key is generated by the server based on the identity information of the terminal through a main signature private key in a first public-private key pair;

[0026] The terminal decrypts the second encryption information through the random key to obtain the terminal private key and the identity information of the terminal.

[0027] The terminal obtains the first encryption information based on the identity information and the random key through the main encryption public key, including:

[0028] The terminal splices the identity information and the random key to obtain spliced information;

[0029] The terminal encrypts the spliced information through the main encryption public key to obtain the first encryption information.

[0030] The terminal encrypts the spliced information through the main encryption public key to obtain the first encryption information, including:

[0031] The terminal encrypts the spliced information through the main encryption public key to obtain the first encryption information.

[0032] The terminal sends the first encryption information to the server, and before that, the method further includes:

[0033] The terminal converts the first encryption information to obtain a first string corresponding to the first encryption information;

[0034] The terminal generates a first identification code based on the first string;

[0035] The terminal sends the first encryption information to the server, and before that, the method further includes:

[0036] The terminal obtains the first identification code through an APP software, and restores the first identification code to obtain the first encryption information;

[0037] The terminal sends the first encryption information to the server through the APP software.

[0038] The key distribution method further includes:

[0039] In response to the identity information obtained by the terminal decryption matching the identity information of the terminal, the terminal determines to save the terminal private key.

[0040] To solve the above technical problems, the third technical solution adopted by the present application is to provide a server, the server comprising a memory, a processor, and a computer program stored in the memory and running on the processor, the processor being configured to execute the program data to implement the steps of the key distribution method described above.

[0041] To solve the above technical problems, the fourth technical solution adopted by the present application is to provide a terminal, the terminal comprising a memory, a processor, and a computer program stored in the memory and running on the processor, the processor being configured to execute the program data to implement the steps of the key distribution method described above.

[0042] To solve the above technical problems, the fifth technical solution adopted by the present application is to provide a computer-readable storage medium, the computer-readable storage medium storing a computer program, the computer program being executed by a processor to implement the steps of the key distribution method described above.

[0043] The present application has the following advantages: Unlike the prior art, the key distribution method, server, terminal, and computer-readable storage medium provided by the present application comprise the following steps: the server generates a first public-private key pair and a second public-private key pair, and sends a master encryption public key in the second public-private key pair to the terminal; receives first encryption information sent by the terminal, the first encryption information being encrypted by the terminal by using the master encryption public key on terminal identity information and a random key generated by the terminal; decrypts the first encryption information by using a master encryption private key in the second public-private key pair to obtain the terminal identity information and the random key; in response to the terminal belonging to a preset terminal, generates a terminal private key based on the terminal identity information by using a master signature private key in the first public-private key pair; encrypts the terminal identity information and the terminal private key based on the random key to generate second encryption information, and sends the second encryption information to the terminal. The present application takes into account the complexity of device certificate authentication, so it is not necessary to issue and pre-embed the certificate and private key of the device, thereby making the private key acquisition method of the device more convenient, and it is not necessary for the device to interact with the server for confirmation, thereby improving the security of the key acquisition method. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0045] Figure 1 is a structure diagram of an application scenario in the key distribution method provided by the present application;

[0046] Figure 2 is Figure 1 A data flow diagram of data transmission between a server and a terminal in an application scenario;

[0047] Figure 3 is a flowchart of a key distribution method suitable for a server provided by the present application;

[0048] Figure 4 is Figure 3 a flowchart of a specific embodiment of step S15 in the key distribution method suitable for a server provided by the present application;

[0049] Figure 5 is Figure 3 a flowchart of another specific embodiment of step S15 in the key distribution method suitable for a server provided by the present application;

[0050] Figure 6 is a flowchart of a key distribution method suitable for a terminal provided by the present application;

[0051] Figure 7 is a framework diagram of an embodiment of a server provided by the present application;

[0052] Figure 8 is a framework diagram of an embodiment of a terminal provided by the present application;

[0053] Figure 9 is a framework diagram of an embodiment of a computer readable storage medium provided by the present application. DETAILED DESCRIPTION

[0054] The scheme of the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0055] In the following description, specific details are set forth in order to provide a thorough understanding of the present application. However, persons having ordinary skill in the art will appreciate that the present application can be practiced without many of the details as set forth herein.

[0056] The term "and / or" herein merely describes an association relationship of associated objects, and can represent three relationships, for example, A and / or B can represent three cases of existence of A alone, existence of A and B simultaneously, and existence of B alone. In addition, the character " / " herein generally represents an "or" relationship between the front and rear associated objects. In addition, "multiple" herein represents two or more than two.

[0057] In order for those skilled in the art to better understand the technical solutions of the present application, a key distribution method provided by the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0058] Please refer to Figure 1 , Figure 1A structure schematic diagram of an application scenario in the key distribution method provided by the application.

[0059] The server 10 and the terminal 20 are connected through an intranet. The terminal 20 includes a terminal with an image acquisition end and a terminal without an image acquisition end. The interaction information between the server 10 and the terminal with the image acquisition end needs to be transmitted by means of the APP software 30. The interaction information between the server 10 and the terminal without the image acquisition end needs to be imported by means of other equipment.

[0060] Please refer to Figure 1 , Figure 2 is Figure 1 A data flow diagram of data transmission between the server and the terminal in the application scenario.

[0061] The server 10 generates a first public-private key pair and a second public-private key pair. The terminal 20 generates a random key. The server 10 sends a main encryption public key in the second public-private key pair to the terminal 20. The terminal 20 receives the main encryption public key in the second public-private key pair sent by the server 10. The terminal 20 obtains first encryption information based on identity recognition information and the random key through the main encryption public key. The terminal 20 generates a first identification code according to the first encryption information. The first identification code is obtained through the APP software, and data conversion is performed to obtain the first encryption information, which is sent to the server 10. The server 10 receives the first encryption information. The server 10 decrypts the first encryption information through a main encryption private key in the second public-private key pair to obtain the identity recognition information of the terminal 20 and the random key. The server 10 generates a terminal 20 private key based on the identity recognition information of the terminal 20 through a main signature private key in the first public-private key pair. The server 10 encrypts the identity recognition information of the terminal 20 and the terminal 20 private key based on the random key to generate second encryption information. The server 10 sends the second encryption information to the terminal 20, and the terminal 20 receives the second encryption information sent by the server 10. The terminal 20 decrypts the second encryption information through the random key to obtain the terminal 20 private key and the identity recognition information of the terminal 20.

[0062] Please refer to Figure 3 , Figure 3 A flowchart of the key distribution method suitable for the server provided by the application.

[0063] The embodiment provides a key distribution method, which is suitable for a server. The server can be a key center. The server and the terminal are connected through an intranet. The key distribution method comprises the following steps.

[0064] S11: The server generates a first public-private key pair and a second public-private key pair, and sends a main encryption public key in the second public-private key pair to the terminal.

[0065] Specifically, the server generates a first public-private key pair and a second public-private key pair based on an SM9 identity cryptography algorithm. The first public-private key pair is a main signature public-private key pair, and the second public-private key pair is a main encryption public-private key pair. The server sends the main encryption public key of the second public-private key pair to the terminal, so that the terminal pre-embeds the received main encryption public key in the terminal after receiving the main encryption public key of the second public-private key pair. The first public-private key pair and the second public-private key pair can be used by all terminals without distinguishing the terminals.

[0066] S12: receiving the first encrypted information sent by the terminal, the first encrypted information being obtained by encrypting the identity identification information of the terminal and the random key generated by the terminal by the main encryption public key.

[0067] Specifically, the server receives the first encrypted information sent by the terminal, and the first encrypted information is obtained by encrypting the identity identification information of the terminal and the random key generated by the terminal by the main encryption public key. The identity identification information is the product serial number (SN) number of the terminal itself obtained. In this embodiment, the identity identification information of the terminal can be used as the terminal public key. The random key generated by the terminal can be a symmetric key.

[0068] Specifically, the terminal splices the identity identification information of the terminal and the random key generated by the terminal to obtain spliced information, and encrypts the spliced information based on the SM9 identity cryptography algorithm by using the pre-embedded main encryption public key in the terminal to obtain the first encrypted information. The terminal sends the first encrypted information obtained by encryption to the server, and the server receives the first encrypted information.

[0069] S13: decrypting the first encrypted information by using the main encryption private key in the second public-private key pair to obtain the identity identification information of the terminal and the random key.

[0070] Specifically, the first encrypted information is decrypted by using the main encryption private key in the second public-private key pair to obtain the identity identification information of the terminal and the random key generated by the terminal.

[0071] S14: in response to the terminal belonging to a preset terminal, generating a terminal private key based on the identity identification information of the terminal by using the main signature private key in the first public-private key pair.

[0072] Specifically, based on the identity identification information of the terminal, it is determined whether the terminal belongs to a preset terminal. In an embodiment, the server queries the identity information database based on the decrypted identity identification information to determine whether the terminal corresponding to the identity identification information belongs to a preset terminal. The preset terminal is a terminal that needs to establish a connection relationship and information interaction with the server. The identity information database is a list of SN numbers of terminals allowed to be distributed.

[0073] If the identity identification information is identical to any one of the preset identity information in the identity information library, it is determined that the terminal corresponding to the identity identification information belongs to the preset terminal, and the preset terminal is the terminal corresponding to the preset identity information.

[0074] Specifically, the server generates a terminal private key based on the identity identification information of the terminal by using a main signature private key in the first public-private key pair and the SM9 algorithm.

[0075] S15: The identity identification information of the terminal and the terminal private key are encrypted based on the random key to generate second encrypted information, and the second encrypted information is sent to the terminal.

[0076] Specifically, the server encrypts the identity identification information of the terminal and the generated terminal private key using the decrypted random key to obtain the second encrypted information. The second encrypted information is sent or transmitted to the terminal to enable the terminal to obtain the terminal private key.

[0077] In an embodiment, when the terminal has an image acquisition end, information can be acquired. The terminal private key is obtained by the following method.

[0078] Please refer to Figure 4 , Figure 4 is Figure 3 A flowchart of a specific embodiment of step S15 in the key distribution method applicable to the server provided by the application is shown in FIG. 6.

[0079] S151a: The identity identification information of the terminal and the terminal private key are symmetrically encrypted based on the random key to obtain the second encrypted information.

[0080] Specifically, in order to facilitate subsequent information transmission, the server encrypts the identity identification information of the terminal, the generated terminal private key, and the main signature public key in the first public-private key pair using the decrypted random key to obtain the second encrypted information.

[0081] S152a: In response to the terminal having an image acquisition end, the second encrypted information is data-converted to obtain a second string corresponding to the second encrypted information, and the second string is sent to the APP software.

[0082] Specifically, if the terminal has an image acquisition end, i.e., the terminal having an image acquisition end is a terminal having a camera, in order to facilitate the terminal to obtain the second encrypted information, the second encrypted information needs to be data-converted. In an embodiment, the second encrypted information is data-converted so that the server base64 encodes the second encrypted information to convert the second encrypted information into a second string. The server sends the second string to the device end loaded with the APP software.

[0083] S153a: The second string is converted into a second identification code by the APP software.

[0084] Specifically, the APP software loaded on the device end converts the second string into a second identification code, where the second identification code can be a two-dimensional code. It can also be other identification codes that can be recognized by the image acquisition end of the terminal. For example, the identification code can also be a bar code.

[0085] S154a: Scanning the second identification code through the image acquisition end of the terminal to obtain the terminal private key.

[0086] Specifically, the second identification code presented on the interface of the device end is scanned through the image acquisition end of the terminal, and the second identification code is data-converted by the terminal to convert the second string corresponding to the second identification code into second encrypted information. The terminal uses the random key to decrypt the second encrypted information to obtain the identity information, the generated terminal private key, and the main signature public key in the first public-private key pair. Wherein, the identity information of the terminal is used as the terminal public key, and the terminal can obtain the terminal private key by decrypting the second identification code.

[0087] In an embodiment, when the terminal does not have an image acquisition end and cannot acquire information, the terminal private key is obtained by the following method.

[0088] Please refer to Figure 5 , Figure 5 is Figure 3 the flowchart of another specific embodiment of step S15 in the key distribution method applicable to the server provided.

[0089] S151b: Based on the random key, the identity information of the terminal and the terminal private key are symmetrically encrypted to obtain the second encrypted information.

[0090] Specifically, in order to facilitate subsequent information transmission, the server uses the decrypted random key to encrypt the identity information of the terminal, the generated terminal private key, and the main signature public key in the first public-private key pair to obtain the second encrypted information.

[0091] S152b: In response to the terminal not being provided with an image acquisition end, the terminal key is obtained by importing the second encrypted information into the terminal.

[0092] Specifically, when the terminal does not have a camera and cannot acquire images, the second encrypted information downloaded from the server can be imported into the terminal in a page import manner, so that the terminal decrypts the obtained second encrypted information. The terminal uses the random key to decrypt the second encrypted information to obtain the identity information, the generated terminal private key, and the main signature public key in the first public-private key pair. Wherein, the identity information of the terminal is used as the terminal public key, and the terminal can obtain the terminal private key by decrypting the second identification code.

[0093] In another embodiment, the server can also perform data conversion on the second encrypted information to obtain a second string corresponding to the second encrypted information. The second string downloaded from the server is imported into the terminal, so that the terminal performs data conversion on the obtained second encrypted information to obtain the second encrypted information. The terminal decrypts the second encrypted information using the random key to obtain the identity information of the terminal, the generated private key of the terminal, and the main signature public key in the first public-private key pair. The identity information of the terminal is used as the public key of the terminal, and the terminal can obtain the private key of the terminal by decrypting the second identification code.

[0094] The key distribution method provided in the embodiment includes that a server generates a first public-private key pair and a second public-private key pair, and sends a main encryption public key in the second public-private key pair to a terminal; receives first encrypted information sent by the terminal, the first encrypted information being obtained by encrypting identity information of the terminal and a random key generated by the terminal by the main encryption public key; decrypts the first encrypted information by a main encryption private key in the second public-private key pair to obtain the identity information of the terminal and the random key; in response to the terminal belonging to a preset terminal, generates a private key of the terminal based on the identity information of the terminal by a main signature private key in the first public-private key pair; and encrypts the identity information of the terminal and the private key of the terminal based on the random key to generate second encrypted information and sends the second encrypted information to the terminal. The application considers the complexity of device certificate authentication, so that the certificate and the private key of the device do not need to be issued and pre-embedded, thereby making the private key obtaining method of the device more simple, and the device does not need to interact with the server for confirmation, thereby improving the security of the key obtaining method.

[0095] Please refer to Figure 6 , Figure 6 is a flowchart of a key distribution method suitable for a terminal provided by the application. The embodiment provides a key distribution method, which is suitable for a terminal. The server and the terminal are connected through an intranet. The terminal can be a camera device, other image acquisition device or device without camera, and the key distribution method includes the following steps.

[0096] S21: The terminal generates a random key, and the terminal has identity information.

[0097] Specifically, the terminal randomly generates a symmetric key, and the symmetric key is used as the random key. Each terminal has identity information. The identity information can be an SN number.

[0098] S22: Receive a main encryption public key in a second public-private key pair, and obtain first encrypted information based on the identity information and the random key by the main encryption public key.

[0099] Specifically, the terminal receives a main encryption public key in a second public-private key pair sent by the server, and the terminal encrypts the identity information and the random key by the main encryption public key to obtain first encrypted information.

[0100] In an embodiment, the identity recognition information and the random key are spliced to obtain spliced information. The spliced information is encrypted by the main encryption public key to obtain first encrypted information. In a specific embodiment, the spliced information is encrypted by the main encryption public key through SM9 to obtain the first encrypted information.

[0101] S23: The first encrypted information is sent to the server.

[0102] Specifically, in order to facilitate the transmission of the first encrypted information to the server, the terminal performs data conversion on the first encrypted information to obtain a first string corresponding to the first encrypted information, and generates a first identification code corresponding to the first encrypted information according to the first string. The first identification code is scanned by the APP software, and the first encrypted information is obtained by data restoration; the first encrypted information is sent to the server by the APP software.

[0103] S24: The second encrypted information sent by the server is received.

[0104] Specifically, after the server receives the first encrypted information, the first encrypted information is decrypted by the main encryption private key in the second public-private key pair to obtain the identity recognition information of the terminal and the random key generated by the terminal. The server queries the identity information database based on the decrypted identity recognition information to determine whether the terminal corresponding to the identity recognition information belongs to a preset terminal. The preset terminal is a terminal that needs to establish a connection relationship and information interaction with the server. The identity information database is a list of SN numbers of terminals allowed to be distributed. If the identity recognition information is the same as any one of the preset identity information in the identity information database, it is determined that the terminal corresponding to the identity recognition information belongs to the preset terminal, and the preset terminal is the terminal corresponding to the preset identity information. The server generates a terminal private key based on the identity recognition information of the terminal by using the SM9 algorithm through the main signature private key in the first public-private key pair. The server encrypts the identity recognition information of the terminal, the generated terminal private key, and the main signature public key in the first public-private key pair by using the decrypted random key to obtain the second encrypted information, and sends the second encrypted information to the terminal.

[0105] The terminal receives the second encrypted information sent or transmitted by the server. That is, the second encrypted information is encrypted by the server by using the random key on the identity recognition information and the terminal private key, and the terminal private key is generated by the server based on the identity recognition information of the terminal by using the main signature private key in the first public-private key pair.

[0106] S25: The second encrypted information is decrypted by the random key to obtain the terminal private key and the identity recognition information of the terminal.

[0107] Specifically, in order to obtain the terminal private key, the terminal decrypts the second encrypted information by using the random key to obtain the identity information of the terminal and the terminal private key. In a specific embodiment, the terminal decrypts the second encrypted information by using the random key to obtain the identity information of the terminal, the terminal private key and the master signature public key in the first public-private key pair.

[0108] In order to further verify whether the terminal private key matches the terminal, the identity information obtained by decrypting the second encrypted information is matched with the identity information of the terminal itself.

[0109] In an embodiment, in response to the identity information obtained by the terminal decryption matching the identity information of the terminal, the terminal private key and the master signature public key in the first public-private key pair are determined to be saved. That is, when the identity information obtained by the terminal decryption is consistent with the identity information of the terminal, it is determined that the terminal private key obtained by decryption is the terminal private key corresponding to the terminal.

[0110] In an embodiment, in response to the identity information obtained by the terminal decryption not matching the identity information of the terminal, the terminal private key and the master signature public key in the first public-private key pair are deleted, and the terminal private key is re-obtained.

[0111] The key distribution method provided in the embodiment includes a key distribution method, a terminal generates a random key, the terminal has identity information; receives a master encryption public key in a second public-private key pair, and obtains first encrypted information based on the identity information and the random key by using the master encryption public key; sends the first encrypted information to a server; receives second encrypted information sent by the server; the second encrypted information is obtained by the server by encrypting the identity information and a terminal private key by using the random key, the terminal private key is generated by the server based on the identity information of the terminal by using a master signature private key in a first public-private key pair; and the second encrypted information is decrypted by using the random key to obtain the terminal private key and the identity information of the terminal. The present application considers the complexity of device certificate authentication, so that the certificate and the private key of the device do not need to be issued and pre-embedded, thereby making the private key obtaining method of the device more simple, and the device does not need to interact with the server for confirmation, and the security of the key obtaining method is improved.

[0112] Reference is made to Figure 7 , Figure 7 is a framework schematic diagram of an embodiment of the server provided by the present application. The embodiment provides a server, the server 70 includes a memory 71 and a processor 72 coupled with each other, the processor 72 is used for executing program instructions stored in the memory 71 to realize the steps of any one of the key distribution method embodiments suitable for the server. In a specific implementation scenario, the server 70 can include but is not limited to: a microcomputer, a server, in addition, the server 70 can also include a notebook computer, a tablet computer and the like mobile devices, which are not limited here.

[0113] Specifically, processor 72 controls itself and memory 71 to implement the steps of any of the above-described key distribution method embodiments applicable to a server. Processor 72 may also be referred to as a CPU (Central Processing Unit). Processor 72 may be an integrated circuit chip with signal processing capabilities. Processor 72 may also be a general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component. A general-purpose processor may be a microprocessor or any conventional processor. Furthermore, processor 72 may be implemented using integrated circuit chips.

[0114] Please see Figure 8 , Figure 8 This is a schematic diagram of a terminal embodiment provided by the present invention. The terminal 80 includes a memory 81 and a processor 82 coupled to each other. The processor 82 is used to execute program instructions stored in the memory 81 to implement the steps of any of the above-described key distribution method embodiments applicable to the terminal. In a specific implementation scenario, the terminal 80 may include, but is not limited to, a microcomputer, a server, etc. In addition, the terminal 80 may also include mobile devices such as laptops and tablets, which are not limited here.

[0115] Specifically, processor 82 controls itself and memory 81 to implement the steps of any of the above-described key distribution method embodiments applicable to the terminal. Processor 82 may also be referred to as a CPU (Central Processing Unit). Processor 82 may be an integrated circuit chip with signal processing capabilities. Processor 82 may also be a general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component. A general-purpose processor may be a microprocessor or any conventional processor. Furthermore, processor 82 may be implemented using integrated circuit chips.

[0116] Please refer to Figure 9 , Figure 9 is a framework schematic diagram of an embodiment of the computer readable storage medium provided by the present application. The computer readable storage medium 90 stores program instructions 901 capable of being run by a processor, and the program instructions 901 are used to implement the steps of the training method embodiment of any of the key distribution methods described above.

[0117] In some embodiments, the apparatus provided by the embodiments of the present disclosure has functions or includes modules that can be used to perform the methods described in the above method embodiments, and the specific implementation can refer to the description of the above method embodiments. For brevity, it will not be repeated here.

[0118] The above description of various embodiments tends to emphasize the differences between various embodiments, and the same or similar parts can be mutually referred to. For brevity, it will not be repeated here.

[0119] In several embodiments provided in the present application, it should be understood that the disclosed method and device can be implemented in other ways. For example, the above-described device implementation is only schematic, for example, the division of modules or units is only a logical function division, and actual implementation can have another division manner, for example, a unit or component can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed mutual ones can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0120] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The above integrated unit can be realized in the form of hardware, or in the form of a software functional unit.

[0121] If the integrated unit is implemented in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the methods of the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0122] If the technical solutions of the present application involve personal information, the product applying the technical solutions of the present application has been explicitly informed of the personal information processing rules before processing the personal information and has obtained the personal independent consent. If the technical solutions of the present application involve sensitive personal information, the product applying the technical solutions of the present application has obtained the personal independent consent before processing the sensitive personal information and at the same time meets the requirement of "explicit consent". For example, at the personal information collection device such as a camera, an explicit and prominent mark is set to inform that the personal information collection range has been entered and the personal information will be collected. If the person voluntarily enters the collection range, it is regarded as consent to collect the personal information. Or, on the device for processing personal information, the personal information processing rules are informed by using obvious marks / information, and the personal authorization is obtained by means of pop-up information or asking the person to upload his / her personal information. The personal information processing rules can include the personal information processor, the processing purpose, the processing method, and the type of processed personal information.

[0123] The above is only an embodiment of the present application, and does not limit the patent protection scope of the present application. Any equivalent structure or equivalent process transformation based on the content of the specification and drawings, or direct or indirect application in other related technical fields, is also included in the patent protection scope of the present application.

Claims

1. A key distribution method, adapted for a server, characterized by, The key distribution method comprises: The server generates a first public-private key pair and a second public-private key pair, and sends a master encryption public key in the second public-private key pair to a terminal; Receiving the first encryption information sent by the terminal, the first encryption information being encrypted by the terminal by using the master encryption public key to encrypt the identity information of the terminal and a random key generated by the terminal; Decrypting the first encryption information by using a master encryption private key in the second public-private key pair to obtain the identity information of the terminal and the random key; In response to the terminal belonging to a preset terminal, generating a terminal private key based on the identity information of the terminal by using a master signature private key in the first public-private key pair; Encrypting the identity information of the terminal and the terminal private key based on the random key to generate second encryption information, and sending the second encryption information to the terminal, so that the terminal matches the identity information obtained by decrypting the received second encryption information with the identity information of the terminal itself; when the identity information obtained by decryption is consistent with the identity information of the terminal itself, it is determined that the terminal private key in the second encryption information is saved; or when the identity information obtained by decryption is inconsistent with the identity information of the terminal itself, the terminal private key in the second encryption information is deleted and a terminal private key is reacquired.

2. The key distribution method of claim 1, wherein, before the step of generating a terminal private key based on the identity information of the terminal by using a master signature private key in the first public-private key pair in response to the terminal belonging to a preset terminal, the method further comprises: Determining whether the terminal belongs to the preset terminal based on the identity information of the terminal.

3. The key distribution method of claim 1, wherein, the step of generating a terminal private key based on the identity information of the terminal by using a master signature private key in the first public-private key pair comprises: Generating the terminal private key based on the identity information of the terminal by using the master signature private key through an SM9 algorithm.

4. The key distribution method of claim 1, wherein, the step of encrypting the identity information of the terminal and the terminal private key based on the random key to generate second encryption information, and sending the second encryption information to the terminal comprises: Symmetrically encrypting the identity information of the terminal and the terminal private key based on the random key to obtain the second encryption information; In response to the terminal having an image acquisition end, performing data conversion on the second encryption information to obtain a second string corresponding to the second encryption information, and sending the second string to an APP software; Converting the second string into a second identification code by using the APP software, so that the terminal acquires the terminal private key based on the second identification code.

5. The key distribution method of claim 1, wherein, the step of encrypting the identity information of the terminal and the terminal private key based on the random key to generate second encryption information, and sending the second encryption information to the terminal comprises: ​ ​ ​ ​ encrypt the identity information of the terminal and the terminal private key based on the random key to obtain the second encrypted information; in response to the terminal not being provided with an image collection terminal, the second encrypted information is imported into the terminal to obtain the terminal private key.

6. A key distribution method suitable for a terminal, characterized by, The key distribution method comprises: The terminal generates a random key, and the terminal has identity information; receive a main encryption public key in a second public-private key pair, and obtain first encrypted information based on the identity information and the random key through the main encryption public key; the second public-private key pair is generated by a server; send the first encrypted information to the server; receive the second encrypted information sent by the server; the second encrypted information is obtained by the server by encrypting the identity information and the terminal private key based on the random key, and the terminal private key is generated by the server based on the identity information of the terminal through a main signature private key in a first public-private key pair; the identity information and the terminal private key are obtained by the server by decrypting the first encrypted information through a main encryption private key in the second public-private key pair; decrypt the second encrypted information through the random key to obtain the terminal private key and the identity information of the terminal; match the identity information obtained by decrypting the second encrypted information with the identity information of the terminal itself; in response to the identity information obtained by decrypting the terminal matching the identity information of the terminal, determine to save the terminal private key; or, in response to the identity information obtained by decrypting the terminal not matching the identity information of the terminal, delete the terminal private key in the second encrypted information and re-obtain the terminal private key.

7. The key distribution method of claim 6, wherein obtaining the first encrypted information based on the identity information and the random key through the main encryption public key comprises: splicing the identity information and the random key to obtain spliced information; encrypting the spliced information through the main encryption public key to obtain the first encrypted information.

8. The key distribution method of claim 7, wherein encrypting the spliced information through the main encryption public key to obtain the first encrypted information comprises: performing SM9 encryption processing on the spliced information through the main encryption public key to obtain the first encrypted information.

9. The key distribution method of claim 6, wherein before sending the first encrypted information to the server, it further comprises: performing data conversion on the first encrypted information to obtain a first string corresponding to the first encrypted information; generating a first identification code based on the first string; sending the first encrypted information to the server further comprises: obtaining the first identification code through an APP software, and performing data restoration on the first identification code to obtain the first encrypted information; sending the first encrypted information to the server through the APP software.

10. A server, characterized by The server comprises a memory, a processor, and a computer program stored in the memory and running on the processor, the processor being configured to execute program data to implement the steps in the key distribution method according to any one of claims 1-5.

11. A terminal, characterized by comprising: The terminal comprises a memory, a processor, and a computer program stored in the memory and running on the processor, the processor being configured to execute program data to implement the steps in the key distribution method according to any one of claims 6-9.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps in the key distribution method according to any one of claims 1-9.

Images