Network key management method, system and computer readable storage medium

Abstract

The application provides a network key management method, system and computer readable storage medium, and relates to the technical field of network security. The method is applied to any network node in a network; the method comprises the following steps: after receiving a key generation instruction, generating an encryption key according to encryption configuration information through an encryption module; encrypting sample data by using the encryption key to obtain encrypted samples; judging whether the encrypted samples are successfully decrypted by a decryption module; if it is judged that the encrypted samples are not successfully decrypted by the decryption module, distributing the encryption key to other network nodes in the network, so that when any network node device is attacked, other network nodes can also generate keys to update the keys in the network segment, thereby improving the network security; in addition, the generated keys are also tried to be decrypted in advance by a decryption module, and the keys are distributed to other network nodes only when the decryption module fails to decrypt, thereby further improving the security of the keys.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a network key management method, system, and computer-readable storage medium. Background Technology

[0002] In existing encrypted network technology solutions, encryption is achieved by a central server or master node generating the encryption and decryption keys and then sending them to other network nodes.

[0003] However, with existing network encryption methods, if the central server or host is attacked, the keys for the entire encrypted network cannot be updated normally, resulting in low network security. Summary of the Invention

[0004] The purpose of this application is to provide a network key management method, system, and computer-readable storage medium to solve the problem of low network security caused by the use of a central server or master node to generate encryption and decryption keys in current traditional encryption methods.

[0005] In a first aspect, the present invention provides a network key management method applicable to a network comprising multiple network nodes; each of the multiple network nodes is configured with an encryption module and a decryption module, and the multiple network nodes are communicatively connected; the method is applied to any network node; the method includes: upon receiving a key generation instruction, acquiring encryption configuration information and sample data; generating an encryption key through the encryption module based on the encryption configuration information; encrypting the sample data using the encryption key to obtain an encrypted sample; determining whether the decryption module has successfully decrypted the encrypted sample; and if it is determined that the decryption module has failed to decrypt the encrypted sample, distributing the encryption key to other network nodes in the network.

[0006] The network key management method described above utilizes a network node within the network segment that receives a key instruction. This node uses its configured encryption module to generate an encryption key based on the encryption configuration information. Sample data is then encrypted using this key to obtain an encrypted sample. The encrypted sample is then decrypted using a configured decryption module. Only if the decryption module fails to decrypt the encrypted sample is the generated encryption key distributed to other network nodes. Thus, by configuring both encryption and decryption modules for each network node, this scheme enables each node to generate keys. Since key generation or updates are performed through a network node receiving the key instruction within the network segment—meaning no single network node is a fixed device—other network nodes can still generate keys to update the network's key pool even if one node is attacked, thereby improving network security. Furthermore, each network node pre-emptively attempts to decrypt the generated key using its own decryption module. Only if the decryption module fails to decrypt the key is the key distributed to other network nodes, further enhancing key security.

[0007] In an optional implementation of the first aspect, after determining whether the decryption module has successfully decrypted the encrypted sample, the method further includes: if it is determined that the decryption module has successfully decrypted the encrypted sample, then modifying the encrypted configuration information; generating an encryption change key by the encryption module based on the modified encryption configuration information; encrypting the sample data using the encryption change key to obtain an encrypted changed sample; determining whether the decryption module has successfully decrypted the encrypted changed sample; if the decryption module has successfully decrypted the encrypted changed sample, then returning to the step of modifying the encrypted configuration information, until the encryption module fails to decrypt the encrypted changed sample, and distributing the encryption change key corresponding to the decryption failure to other network nodes in the network. This implementation scheme, based on the successful decryption of the encryption key by the decryption module, modifies the encryption configuration information, regenerates the encryption modification key based on the modified encryption configuration information, encrypts the sample data using the encryption modification key to obtain the encrypted modification sample, and then decrypts the encrypted modification sample through the decryption module. If decryption fails, the encryption modification key is distributed to other network nodes. If decryption succeeds, the encryption configuration information is modified again until the encryption module fails to decrypt the encrypted modification sample. This ensures that the keys generated and distributed by the network nodes cannot be easily decrypted by general decryption algorithms, thereby improving the security of keys in the network.

[0008] In an optional implementation of the first aspect, after the decryption module successfully decrypts the encrypted sample, the method further includes: setting a flag for the encrypted configuration information and encryption key corresponding to the successful decryption. This implementation sets a flag for the encrypted configuration information and encryption key corresponding to the successful decryption, thereby preventing the flagged encrypted configuration information and encryption key from being used again in subsequent encryption key generation processes, thus avoiding the resource waste caused by repeatedly using encrypted configuration information and encryption keys that the decryption module can decrypt.

[0009] In an optional implementation of the first aspect, the encrypted configuration information includes geographic coordinate information and various network transmission data with different weights; generating an encryption key by an encryption module based on the encrypted configuration information includes: generating an encryption key by the encryption module using a target encryption algorithm based on the geographic coordinate information and various network transmission data with different weights.

[0010] In an optional implementation of the first aspect, the geographic coordinate information includes any one of the following: its own current geographic coordinates, the current geographic coordinates of any network node in the network, and the current geographic coordinates of all network nodes in the network.

[0011] In an alternative implementation of the first aspect, wherein multiple network nodes form a blockchain; distributing the encryption key to other network nodes in the network includes: broadcasting the encryption key to the blockchain for distribution to other network nodes in the network via the blockchain.

[0012] In an optional embodiment of the first aspect, after distributing the encryption key to other network nodes in the network, the method further includes: randomly determining a target network node from among the other network nodes; and sending a key generation instruction to the target network node, so that the target network node generates an update key according to the key update instruction within the key update cycle. In this embodiment, the next network node to generate an update key is randomly determined by the previous network node to generate the encryption key, thereby making the network nodes that generate the encryption key more random, avoiding the problem of low security caused by the existence of certain patterns in the network nodes that generate the encryption key, and further improving the security of network communication.

[0013] Secondly, the present invention provides a network key management system for managing a network comprising multiple network nodes; multiple network nodes communicating with each other; the network key management system includes an encryption module and a decryption module; the encryption module and decryption module are configured in each network node; the encryption module in each network node is configured to, upon receiving a key generation instruction, acquire encryption configuration information and sample data; generate an encryption key based on the encryption configuration information; encrypt the sample data using the encryption key to obtain an encrypted sample, and transmit the encrypted sample to the decryption module in the same network node; the decryption module is configured to decrypt the encrypted sample; the network node is used to determine whether the decryption module has successfully decrypted the sample; if the decryption module fails to decrypt the encrypted sample, the encryption key is distributed to other network nodes in the network.

[0014] The network key management system designed above utilizes a network node within the network segment that receives a key instruction. This node uses its configured encryption module to generate an encryption key based on the encryption configuration information. Sample data is then encrypted using this key to obtain an encrypted sample. The encrypted sample is then decrypted using a configured decryption module. Only if the decryption module fails to decrypt the encrypted sample is the generated encryption key distributed to other network nodes. Thus, by configuring both encryption and decryption modules for each network node, this solution enables each node to generate keys. Since key generation or updates are performed through a network node receiving the key instruction within the network segment—meaning no single network node is a fixed device—other network nodes can still generate keys to update the network's key pool even if one node is attacked, thereby improving network security. Furthermore, each network node pre-emptively attempts to decrypt the generated key using its own decryption module. Only if the decryption module fails to decrypt the key is the key distributed to other network nodes, further enhancing key security.

[0015] In the second optional implementation, multiple network nodes form a blockchain. The system also includes newly added network nodes, which are network nodes newly added to the blockchain or network nodes that have recovered from a network outage. The newly added network nodes are used to send target block synchronization requests to other network nodes in the blockchain to synchronize the target block. The target block includes the encryption method of the network nodes in the blockchain, encryption configuration information with an identifier that it is no longer used, and encryption keys.

[0016] Thirdly, this application provides a network key management device for a network comprising multiple network nodes; each of the multiple network nodes is configured with an encryption module and a decryption module, and the multiple network nodes are communicatively connected; the device is located at any of the network nodes; the device includes: an acquisition module, used to acquire encryption configuration information and sample data after receiving a key generation instruction; an encryption generation module, used to generate an encryption key based on the encryption configuration information through the encryption module, and use the encryption key to encrypt the sample data to obtain an encrypted sample; a judgment module, used to judge whether the decryption module has successfully decrypted the encrypted sample; and a distribution module, used to distribute the encryption key to other network nodes in the network after the judgment module judges that the decryption module has failed to decrypt the encrypted sample.

[0017] The network key management device designed above utilizes a network node within the network segment that receives a key instruction. This node uses its configured encryption module to generate an encryption key based on the encryption configuration information. The sample data is then encrypted using this key to obtain an encrypted sample. A configured decryption module then decrypts the encrypted sample. Only if the decryption module fails to decrypt the encrypted sample is the generated encryption key distributed to other network nodes. Therefore, this solution configures a key management module for each network node within the network.

[0018] The encryption and decryption modules enable each network node within the network to generate keys. During key generation or update, the key is generated through the network segment that receives the key command.

[0019] The key is generated by any network node within the network, not a fixed network device. This allows other network nodes to generate keys and update the keys within the network segment even if one network node is attacked, thereby improving network security. Furthermore, each network node device...

[0020] It also uses its own decryption module to attempt to decrypt the generated key in advance. Only if the decryption module fails to decrypt the key will it distribute the key to other network nodes, thereby further improving the security of the key.

[0021] In an optional embodiment of the third aspect, the device further includes a modification module for modifying the encryption configuration information after the determination module determines that the decryption module has successfully decrypted the encrypted sample; the generation

[0022] The encryption module is also used to generate an encryption change key based on the modified encryption configuration information, and to encrypt the sample data using the encryption change key to obtain an encrypted changed sample; this judgment

[0023] The interrupt module is also used to determine whether the decryption module has successfully decrypted the encrypted change sample; the return execution module is used to return to the execution steps of changing the encrypted configuration information; the distribution module is also used to distribute the encrypted change key corresponding to the decryption failure to other network nodes in the network until the encryption module fails to decrypt the encrypted change sample.

[0024] In an alternative embodiment of the third aspect, the device further includes a tagging module for decrypting...

[0025] The corresponding encryption configuration information and encryption key setting markers.

[0026] Fourthly, this application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the method described in the first aspect or any optional implementation thereof.

[0027] Fifthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the method described in the first aspect or any optional implementation thereof.

[0028] In a sixth aspect, this application provides a computer program product that, when run on a computer, causes the computer to perform the method described in the first aspect or any optional implementation thereof.

[0029] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0030] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a first flowchart illustrating the network key management method provided in an embodiment of this application;

[0032] Figure 2 This is a schematic diagram of the network key management system provided in an embodiment of this application;

[0033] Figure 3This is a second flowchart illustrating the network key management method provided in the embodiments of this application;

[0034] Figure 4 This is a schematic diagram of the network key management device provided in the embodiments of this application;

[0035] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0036] Icons: 10-Network Node; 110-Router; 120-Switch; 130-Repeater; 140-Server; 150-Computer; 20-Encryption Module; 30-Decryption Module; 400-Acquisition Module; 410-Generate Encryption Module; 420-Judgment Module; 430-Distribution Module; 440-Modification Module; 450-Execution Module; 460-Tag Module; 5-Electronic Device; 501-Processor; 502-Memory; 503-Communication Bus. Detailed Implementation

[0037] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be used to limit the scope of protection of this application.

[0038] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0039] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0040] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0041] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0042] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0043] With the development of Internet technology, the transmission of network data has become increasingly convenient. Terminal smart hardware has a certain dependence on gateway nodes and repeaters of various forms and types, which has also brought many security risks. If someone maliciously intercepts and copies the traffic data of the gateway or repeater, it means that the access traffic of smart terminal devices in this network segment is exposed, posing a great threat to the data security and privacy of groups and individuals. Therefore, encrypted network technology has developed rapidly.

[0044] In current encrypted network technology solutions, the common encryption method is to have a central server or master network node generate the encryption and decryption keys required, and then send them to other network nodes within the network segment.

[0045] The inventors have discovered that the aforementioned traditional encrypted network technology solutions, when the central server or main network node device is compromised, will cause the keys of the entire encrypted network to be exposed and the keys to be unable to be updated, thereby affecting network security and causing low network security.

[0046] To address the aforementioned problems, the inventors have designed a network key management method, system, and computer-readable storage medium. By equipping each network node with an encryption and decryption module, each network node gains the ability to generate keys. During key generation or updating, since the key is generated by a network node receiving the key instruction within the network segment—meaning no single network node is a fixed device—other network nodes can still generate keys to update the network segment's keys even if one node is attacked, thus improving network security. Furthermore, each network node pre-emptively attempts to decrypt the generated key using its own decryption module. Only if the decryption module fails to decrypt the key is the key distributed to other network nodes, further enhancing key security.

[0047] Based on the above ideas, this application provides a network key management method. This method is applicable to networks comprising multiple network nodes that are interconnected. The method can be applied to any one of the network nodes, such as... Figure 1 As shown, this method can be implemented in the following ways, including:

[0048] Step S100: After receiving the key generation instruction, obtain the encryption configuration information and sample data.

[0049] Step S110: Generate an encryption key using the encryption module based on the encryption configuration information.

[0050] Step S120: Encrypt the sample data using the encryption key to obtain an encrypted sample.

[0051] Step S130: Determine whether the decryption module has successfully decrypted the encrypted sample. If decryption fails, proceed to step S140.

[0052] Step S140: Distribute the encryption key to other network nodes in the network.

[0053] In the above embodiments, the network including multiple network nodes can be as follows: Figure 1 As shown in the network key management system, a network of multiple network nodes can be constructed by connecting and building multiple network nodes 10 and various communication cables, etc. These multiple network nodes 10 include, but are not limited to, Figure 1 The router 110, switch 120, repeater 130, server 140, computer 150, and fax machine 160 shown are among the components.

[0054] The network key management system also includes multiple encryption modules 20 and decryption modules 30. Each network node 10 is configured with an encryption module 20 and a decryption module 30. Specifically, the encryption module 20 and decryption module 30 configured in each network node can be programmed into each network node 10 via firmware. Similarly, the required parameters can be configured after connecting multiple network nodes 10.

[0055] The network key management method designed in this scheme requires a key to encrypt data during network communication to achieve encrypted communication. Each network node in this scheme has an encryption module and a decryption module, that is, each network node has the ability to generate keys. However, the generation of each key needs to be executed by the network node that receives the key generation instruction. The network node that receives the key generation instruction can be randomly assigned by the user.

[0056] In step S100, the encryption configuration information and sample data can be pre-configured in each network node, and the encryption configuration information and sample data configured for different network nodes can be different.

[0057] Specifically, as one possible implementation, the sample data may be a sample file, sample message information, or other forms of data transmitted over the network.

[0058] The encryption configuration information may include geographic coordinate information and various network transmission data with different weights. The geographic coordinate information may include the current geographic coordinates of the network node itself, the current geographic coordinates of any network node in the network, or any one of the current geographic coordinates of all network nodes in the network. The various network transmission data with different weights may include some common network transmission data with different weights, such as 10% of social software data, 20% of file transfer data, 50% of audio and video stream data, and 20% of web browser access data.

[0059] It should be noted that the geographic coordinate information mentioned above can be selected according to the actual application scenario, and is not limited to the specific geographic coordinate information mentioned above; in addition, the various network transmission data with different weights mentioned above are just specific examples, and the specific network transmission data and the weight of each type of network transmission data can be adaptively adjusted according to the actual situation.

[0060] After obtaining the encryption configuration information and sample data through the above methods, the configured encryption module generates an encryption key based on the encryption configuration information. Specifically, based on the encryption configuration information, which includes the geographic coordinate information described above and various network transmission data with different weights, this scheme can use the encryption module to generate an encryption key using a target encryption algorithm based on the geographic coordinate information and various network transmission data with different weights. For example, this scheme can use the current geographic coordinates of the network node itself, with 10% of the data from social software, 20% from file transfers, 50% from audio and video streams, and 20% from web browser access data to perform a target encryption algorithm, thereby generating an encryption key. The target encryption algorithm can be a commonly used encryption / decryption algorithm, such as DES, AES, etc.

[0061] Based on the generated encryption key, this scheme can encrypt sample data using the encryption key to obtain an encrypted sample. The encrypted sample is then transmitted to a configured decryption module, which attempts to decrypt it. This decryption module can be pre-configured with some common decryption algorithms, thus giving it a certain decryption capability.

[0062] Based on the above, the network node receiving the key generation instruction can determine whether the decryption module has successfully decrypted the encrypted sample. As a specific implementation, this scheme can determine whether the data obtained by the decryption module after decrypting the encrypted sample is the same as the sample data, thereby determining whether the decryption module has successfully decrypted the sample.

[0063] If the data obtained by the decryption module after decrypting the encrypted sample is different from the sample data, it is determined that the decryption module failed to decrypt the encrypted sample, thus indicating that the generated key has a certain anti-decryption capability and the decryption module configured inside the network node cannot easily decrypt it. Based on this, the network node distributes the encryption key to other network nodes in the network, so that multiple network nodes in the network can encrypt communication data based on the encryption key.

[0064] The network key management method described above utilizes a network node within the network segment that receives a key instruction. This node uses its configured encryption module to generate an encryption key based on the encryption configuration information. Sample data is then encrypted using this key to obtain an encrypted sample. The encrypted sample is then decrypted using a configured decryption module. Only if the decryption module fails to decrypt the encrypted sample is the generated encryption key distributed to other network nodes. Thus, by configuring both encryption and decryption modules for each network node, this scheme enables each node to generate keys. Since key generation or updates are performed through a network node receiving the key instruction within the network segment—meaning no single network node is a fixed device—other network nodes can still generate keys to update the network's key pool even if one node is attacked, thereby improving network security. Furthermore, each network node pre-emptively attempts to decrypt the generated key using its own decryption module. Only if the decryption module fails to decrypt the key is the key distributed to other network nodes, further enhancing key security.

[0065] In an optional embodiment of this example, after executing step S130 to determine whether the decryption module has successfully decrypted the encrypted sample, if the decryption module has successfully decrypted the encrypted sample, for example, if the data obtained after decryption as described above is the same as the sample data, then... Figure 3 As shown, this scheme can further generate encryption keys in the following ways, including:

[0066] Step S300: Modify the encryption configuration information.

[0067] Step S310: Generate an encryption change key using the encryption module based on the modified encryption configuration information.

[0068] Step S320: Encrypt the sample data using the encryption change key to obtain the encrypted changed sample.

[0069] Step S330: Determine whether the decryption module has successfully decrypted the encrypted modified sample. If decryption fails, proceed to step S340; if decryption is successful, return to step S300.

[0070] Step S340: Distribute the encryption change key corresponding to the decryption failure to other network nodes in the network.

[0071] In the above implementation, if the decryption module successfully decrypts the encrypted sample, the network node can modify the encryption configuration information. For example, this solution can modify the geographical coordinate information in the encryption configuration information, or modify multiple network transmission data with different weights in the encryption configuration information, or modify the geographical coordinate information and multiple network transmission data with different weights in the encryption configuration information, or modify the weights of multiple network transmission data in the encryption configuration information, etc., to achieve the modification of the encryption configuration information. As a specific example, as described above, the encryption key is generated based on the network node's own current geographical coordinates and the following data proportions for the target encryption algorithm: 10% for social software data, 20% for file transfer types, 50% for audio / video stream types, and 20% for web browser access data. Therefore, this solution can change the encryption configuration information to the current geographical coordinates of all network nodes in the network, the following data proportions: 10% for social software data, 20% for file transfer types, 50% for audio / video stream types, and 20% for web browser access data. The encryption module then generates a modified encryption key based on the modified encryption configuration information and the target algorithm. To further enhance key security, network nodes can store multiple sample data points, and these sample data points can be modified when the encryption configuration information is changed.

[0072] Based on the generated encrypted change key, this scheme continues to encrypt the sample data using the encrypted change key to obtain an encrypted change sample. Then, the decryption module is used to decrypt the encrypted change sample. The decryption module determines whether it has succeeded. If the decryption fails, it means that the security of the encrypted change key is sufficient, and the encrypted change key is distributed to other network nodes. If the decryption module still succeeds, the encrypted configuration information continues to be changed until the encryption module fails to decrypt the encrypted change sample.

[0073] In the implementation of the above design, this scheme, based on the successful decryption of the encryption key by the decryption module, modifies the encryption configuration information, regenerates the encryption modification key based on the modified encryption configuration information, encrypts the sample data using the encryption modification key to obtain the encrypted modification sample, and then decrypts the encrypted modification sample through the decryption module. If decryption fails, the encryption modification key is distributed to other network nodes. If decryption succeeds, the encryption configuration information is modified again until the encryption module fails to decrypt the encrypted modification sample. This ensures that the keys generated and distributed by the network nodes cannot be easily decrypted by general decryption algorithms, thereby improving the security of keys in the network.

[0074] In an optional implementation of this embodiment, after the decryption module successfully decrypts the encrypted sample, this solution can set a mark on the encrypted configuration information and encryption key corresponding to the successful decryption, so that the marked encrypted configuration information and encryption key will not be used in the subsequent encryption key generation process, thus avoiding the resource waste caused by repeatedly using the encrypted configuration information and encryption key that the decryption module can decrypt.

[0075] In an optional implementation of this embodiment, as described above, the network node receiving the key generation instruction can be randomly assigned by the user. As another possible implementation, in the initial stage, the network node initially receiving the key generation instruction can be determined by user assignment. In subsequent key generation or update processes, the network node generating the next key can be determined by the network node generating the encryption key. Based on this, after distributing the encryption key to other network nodes, the network node can also randomly select a target network node from among the other network nodes and send a key generation instruction to that target network node, so that the target network node generates an updated key within the key update cycle according to the key instruction. There are various ways to determine the target network node, such as using a random algorithm, determining it based on the nearest distance, etc.

[0076] Furthermore, the key update cycle of this scheme can be pre-configured in each network node. For example, if the key update cycle is 12 hours, then the keys in the network need to be updated every 12 hours. Specifically, this scheme can start timing after a network node distributes the encryption key to other network nodes. The target network node then needs to generate an update key within 12 hours and distribute the update key to other network nodes 12 hours after the timing starts.

[0077] It should be noted that if the target network node completes the key update generation within 12 hours, it can temporarily store the updated key and distribute it to other network nodes after the 12-hour countdown. If the target network node fails to send the updated key after 12 hours, an alarm will be generated.

[0078] In the above-described implementation, the next network node to generate the update key is randomly determined by the previous network node that generated the encryption key. This makes the network nodes that generate the encryption key more random, avoiding the security problem caused by the existence of certain patterns in the network nodes that generate the encryption key, and further improving the security of network communication.

[0079] In an optional implementation of this embodiment, as one possible approach, the network node may distribute the encryption key to other network nodes by means of messages or other network data transmissions. The specific method may be adapted to the actual application scenario.

[0080] As another possible implementation, multiple network nodes in the network designed in this scheme can form a blockchain. The blockchain can be pre-written into each network node in the form of firmware. On this basis, the network node that generates the encryption key can broadcast the generated encryption key to the blockchain, thereby distributing it to other network nodes in the network through the blockchain consensus mechanism.

[0081] In an optional implementation of this embodiment, when multiple network nodes form a blockchain, if a new network node is added (either a newly added network node or a network node that has recovered from a network outage), the new network node can send a target block synchronization request to other network nodes in the blockchain to synchronize the target block. The target block includes information such as the encryption method of the network node in the blockchain, the encryption configuration information with identification, and the encryption key.

[0082] In an optional implementation of this embodiment, the solution can also determine whether the newly added network node is a trusted device. For example, it can determine whether the device of the newly added network node is a preset model or a preset manufacturer's device. If it is a preset model or a preset manufacturer's device, it is determined to be a trusted device, thereby allowing it to join the blockchain; if it is an untrusted device, it is rejected from joining the blockchain.

[0083] Figure 4 A schematic structural block diagram of a network key management device provided in this application is presented. It should be understood that this device is related to... Figure 1-3 The method implementation described above corresponds to the method embodiment, and can perform the steps involved in the aforementioned method. The specific functions of this device can be found in the description above; to avoid repetition, detailed descriptions are omitted here. This device includes at least one software functional module that can be stored in a memory or embedded in the device's operating system (OS) in the form of software or firmware. Specifically, the device includes: an acquisition module 400, used to acquire encryption configuration information and sample data after receiving a key generation instruction; an encryption generation module 410, used to generate an encryption key based on the encryption configuration information and use the encryption key to encrypt the sample data to obtain an encrypted sample; a judgment module 420, used to determine whether the decryption module has successfully decrypted the encrypted sample; and a distribution module 430, used to distribute the encryption key to other network nodes in the network after the judgment module 420 determines that the decryption module has failed to decrypt the encrypted sample.

[0084] The network key management device designed above utilizes a network node within the network segment that receives a key instruction. This node uses its configured encryption module to generate an encryption key based on the encryption configuration information. Sample data is then encrypted using this key to obtain an encrypted sample. The encrypted sample is then decrypted using a configured decryption module. Only if the decryption module fails to decrypt the encrypted sample is the generated encryption key distributed to other network nodes. Thus, by equipping each network node with both encryption and decryption modules, this solution enables each network node to generate keys. Since key generation or updates are performed through a network node receiving the key instruction within the network segment—meaning no single network node is a fixed device—other network nodes can still generate keys to update the network's key hierarchy even if one node is attacked, thereby improving network security. Furthermore, each network node pre-emptively attempts to decrypt the generated key using its own decryption module. Only if the decryption module fails to decrypt the key is the key distributed to other network nodes, further enhancing key security.

[0085] In an optional embodiment of this example, the device further includes a modification module 440, used to modify the encrypted configuration information after the judgment module determines that the decryption module has successfully decrypted the encrypted sample; the encryption generation module 410 is also used to generate an encryption modification key based on the modified encrypted configuration information and use the encryption modification key to encrypt the sample data to obtain an encrypted modified sample; the judgment module 420 is also used to determine whether the decryption module has successfully decrypted the encrypted modified sample; the return execution module 450 is used to return to the execution of the step of modifying the encrypted configuration information; and the distribution module 430 is also used to distribute the encryption modification key corresponding to the decryption failure to other network nodes in the network until the encryption module fails to decrypt the encrypted modified sample.

[0086] In an optional embodiment of this example, the device further includes a marking module 460, which is used to mark the encryption configuration information and encryption key corresponding to successful decryption.

[0087] According to some embodiments of this application, such as Figure 5As shown, this application provides an electronic device 5, including: a processor 501 and a memory 502. The processor 501 and the memory 502 are interconnected and communicate with each other through a communication bus 503 and / or other forms of connection mechanism (not shown). The memory 502 stores a computer program executable by the processor 501. When the computing device is running, the processor 501 executes the computer program to perform the method executed in the aforementioned implementation, such as steps S100 to S130: after receiving a key generation instruction, obtaining encryption configuration information and sample data; generating an encryption key through an encryption module according to the encryption configuration information; encrypting the sample data using the encryption key to obtain an encrypted sample; determining whether the decryption module has successfully decrypted the encrypted sample; if decryption fails, distributing the encryption key to other network nodes in the network.

[0088] This application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the aforementioned method.

[0089] The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0090] This application provides a computer program product that, when run on a computer, causes the computer to perform the aforementioned method.

[0091] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and not to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application, and they should all be covered within the scope of the claims and specification of this application. In particular, as long as there is no structural conflict, the various technical features mentioned in the embodiments can be combined in any way. This application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A network key management method characterized by comprising: The method is applicable to a network comprising multiple network nodes; each of the multiple network nodes is configured with an encryption module and a decryption module, the multiple network nodes are communicatively connected, and the method is applied to any one of the network nodes; the method includes: Upon receiving the key generation instruction, obtain the encryption configuration information and sample data; The encryption module generates an encryption key based on the encryption configuration information. The sample data is encrypted using the encryption key to obtain an encrypted sample; Determine whether the decryption module has successfully decrypted the encrypted sample; If the decryption module fails to decrypt the encrypted sample, the encryption key is distributed to other network nodes in the network. The encryption configuration information includes geographic coordinate information and various network transmission data with different weights; the step of generating an encryption key based on the encryption configuration information by the encryption module includes: The encryption module generates the encryption key using a target encryption algorithm based on the geographic coordinate information and various network transmission data with different weights. After distributing the encryption key to other network nodes in the network, the method further includes: Randomly select a target network node from among the other network nodes in the network; Send a key generation instruction to the target network node so that the target network node generates an update key within the key update cycle according to the key instruction.

2. The method of claim 1, wherein, After determining whether the decryption module has successfully decrypted the encrypted sample, the method further includes: If the decryption module determines that it has successfully decrypted the encrypted sample, then the encryption configuration information is modified. The encryption module generates an encryption change key based on the modified encryption configuration information. The sample data is encrypted using the encryption change key to obtain an encrypted changed sample; Determine whether the decryption module has successfully decrypted the encrypted modified sample; If the decryption module successfully decrypts the encrypted change sample, it returns to the step of changing the encrypted configuration information until the encryption module fails to decrypt the encrypted change sample, and then distributes the encryption change key corresponding to the decryption failure to other network nodes in the network.

3. The method of claim 2, wherein, After the decryption module successfully decrypts the encrypted sample, the method further includes: Set a flag for the encryption configuration information and encryption key corresponding to successful decryption.

4. The method of claim 1, wherein, in, The geographic coordinate information includes any one of the following: its own current geographic coordinates, the current geographic coordinates of any network node in the network, or the current geographic coordinates of all network nodes in the network.

5. The method of claim 1, wherein, in, The plurality of network nodes form a blockchain; the distribution of the encryption key to other network nodes in the network includes: The encryption key is broadcast to the blockchain for distribution to other network nodes in the network.

6. A network key management system characterized by comprising: The network key management system is used to manage a network comprising multiple network nodes; the multiple network nodes are connected in communication. The network key management system includes an encryption module and a decryption module; the encryption module and the decryption module are configured in each of the network nodes. The encryption module in each network node is configured to obtain encryption configuration information and sample data after receiving a key generation instruction; An encryption key is generated based on the encryption configuration information, wherein the encryption configuration information includes geographic coordinate information and various network transmission data with different weights; the encryption module generates the encryption key based on the encryption configuration information, including: the encryption module generates the encryption key using a target encryption algorithm based on the geographic coordinate information and various network transmission data with different weights; The sample data is encrypted using the encryption key to obtain an encrypted sample, and the encrypted sample is transmitted to the decryption module in the same network node; The decryption module is configured to decrypt the encrypted sample; The network node is used to determine whether the decryption module has successfully decrypted the data; If the decryption module fails to decrypt the encrypted sample, it distributes the encryption key to other network nodes in the network and randomly selects a target network node from among the other network nodes; it then sends a key generation instruction to the target network node so that the target network node generates an update key within the key update cycle according to the key instruction.

7. The system of claim 6, wherein, The multiple network nodes form a blockchain, and the system also includes newly added network nodes, wherein the newly added network nodes are network nodes newly added to the blockchain or network nodes that have recovered from a network outage. The newly added network node is used to send a target block synchronization request to other network nodes in the blockchain to synchronize the target block. The target block includes the encryption method of the network node in the blockchain, encryption configuration information with an identifier that is no longer used, and encryption key.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 5.

Images