Key management method, data encryption interaction method, blockchain and computer device

Abstract

The embodiment of the present application relates to the technical field of block chain, and discloses a secret key management method, which comprises the following steps: a request party sends a secret key negotiation request to a service party according to a request party first secret key; the request party first secret key is generated based on a request party smart contract; the service party receives the secret key negotiation request and returns a negotiation result according to a service party first secret key; the service party first secret key is generated based on a service party smart contract; the request party generates a business secret key according to the negotiation result; and the business secret key is used for encryption when the request party and the service party transfer information. Through the above method, the security of the secret key is effectively improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of blockchain technology, specifically to a key management method, a data encryption and interaction method, a blockchain, a computer device, and a computer-readable storage medium. Background Technology

[0002] Currently, when two parties in a blockchain exchange transmit keys, they typically manage the keys centrally through a key management center or by adding separate auditing and authentication nodes in addition to the sending and receiving nodes, and performing multi-factor verification on the business communication keys. The existing centralized key management method is vulnerable; if the key management center malfunctions, it may affect the security of all keys. Adding separate auditing and authentication nodes, due to the distributed and egalitarian environment of the blockchain, artificially selects the auditing and authentication center, which increases the key transmission chain. Furthermore, the use of private agreements at the auditing and authentication nodes does not necessarily increase security but also increases costs. Therefore, existing key management methods suffer from low security. Summary of the Invention

[0003] In view of the above problems, embodiments of the present invention provide a key management method, a data encryption interaction method, a blockchain, a computer device, and a computer-readable storage medium to solve the problem of low security in key management in the prior art.

[0004] According to one aspect of the present invention, a key management method is provided, the method comprising:

[0005] The requesting party sends a key negotiation request to the service provider based on its primary key; the primary key is generated based on the requesting party's smart contract.

[0006] The service provider receives the key negotiation request and returns the negotiation result based on the service provider's primary key; the service provider's primary key is generated based on the service provider's smart contract.

[0007] The requesting party generates a business key based on the negotiation result; the business key is used for encryption when the requesting party and the service provider transmit information.

[0008] In one alternative approach, the key negotiation request includes a first negotiation key; the requester sends the key negotiation request to the service provider based on the requester's primary key, including: the requester sending the first negotiation key to the service provider; the first negotiation key is obtained by randomly encoding and encrypting the requester's private key in the requester's primary key pair.

[0009] In one optional manner, the negotiation result includes a second negotiation key; the service provider receives the key negotiation request and returns the negotiation result based on the service provider's primary key, including: decrypting the first negotiation key using the public key in the requester's primary key pair to obtain the requester's random code; concatenating the requester's random code and the service provider's random code, and encrypting them using the private key in the service provider's primary key pair to generate the second negotiation key; and sending the negotiation result containing the second negotiation key to the requester.

[0010] In one optional approach, the requester's primary key is a requester's primary key pair; the requester generates a business key based on the negotiation result, including: decrypting the second negotiation key using the public key in the service provider's primary key pair to obtain the service provider's random code; and encrypting the service provider's random code using the public key in the requester's primary key pair to generate the business key.

[0011] In an alternative approach, after the requesting party generates a business key based on the negotiation result, the method further includes: the service provider sending an invalidation notification of the business key to the requesting party; and the requesting party re-executing the step of generating the business key based on the invalidation notification.

[0012] In one alternative approach, the requester's smart contract content includes a method for generating a requester's primary key pair, the validity period of the requester's primary key pair, a method for generating and transmitting a business key, the validity period of the business key, and a symmetric encryption method.

[0013] According to another aspect of the present invention, a data encryption interaction method is provided, the business interaction method being based on the aforementioned key management method; the business interaction method includes:

[0014] The requesting party uses the private key in the requesting party's primary key pair to decrypt the business key and obtain the original business key text;

[0015] The requesting party uses the original business key to encrypt the original business data, generates encrypted data, and sends it to the service provider;

[0016] The service provider obtains the business key through the request header of the encrypted data, decrypts the business key using the public key in the service provider's primary key pair to obtain the original business key, and uses the original business key to decrypt the encrypted data to obtain the original business data.

[0017] The request header contains the requester's account name and / or business code; the requester's account name and / or business code corresponds to the business key.

[0018] According to another aspect of the present invention, a blockchain is provided, the blockchain including a requester and a servicer;

[0019] The requesting party is used to send a key negotiation request to the service provider based on its primary key; the primary key of the requesting party is generated based on the requesting party's smart contract.

[0020] The service provider is configured to receive the key negotiation request and return the negotiation result based on the service provider's primary key; the service provider's primary key is generated based on the service provider's smart contract.

[0021] The requesting party is used to generate a business key based on the negotiation result; the business key is used for encryption when the requesting party and the service provider transmit information.

[0022] According to another aspect of the present invention, a computer device is provided, including: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus;

[0023] The memory is used to store at least one executable instruction that causes the processor to perform the operation of the key management method.

[0024] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing at least one executable instruction, which, when executed on a computer device, causes the computer device to perform the operation of the key management method.

[0025] In this embodiment of the invention, the requester sends a key negotiation request to the service provider based on its primary key; the primary key is generated based on the requester's smart contract; the service provider receives the key negotiation request and returns a negotiation result based on its primary key; the primary key is generated based on its smart contract; the requester generates a business key based on the negotiation result; the business key is used for encryption when the requester and the service provider transmit information, enabling automatic negotiation and management of keys based on smart contracts, avoiding centralized key management, improving the understandability and flexibility of key management, reducing complexity, distinguishing only between the requester and the service provider, eliminating the need for audit nodes and identity authentication nodes, reducing costs, and improving performance.

[0026] The above description is merely an overview of the technical solutions of the embodiments of the present invention. In order to better understand the technical means of the embodiments of the present invention and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0027] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0028] Figure 1 A flowchart illustrating the key management method provided in an embodiment of the present invention is shown;

[0029] Figure 2 This diagram illustrates the application environment of the key management method provided in this embodiment of the invention.

[0030] Figure 3 A flowchart illustrating the data encryption interaction method provided in an embodiment of the present invention is shown;

[0031] Figure 4 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention is shown. Detailed Implementation

[0032] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0033] The main idea of ​​this invention is to deploy and sign a smart contract between the requester and the service provider in a blockchain environment, and to negotiate and transmit the business keys through the smart contract. In this way, there is no problem of centralized management of business keys. In addition, the key transmission channel and the business data interaction channel are isolated, and the keys can be automatically negotiated through the contract. Figure 1 The flowchart illustrates a key management method provided in an embodiment of the present invention. This method is executed by a computer device, which may specifically be a distributed device, a blockchain, etc. Specifically, it can be executed by a requester and a service provider through a requester's smart contract and a service provider's smart contract. The requester and service provider can be various nodes on a distributed device, blockchain, etc., and the embodiments of the present invention do not impose specific limitations. Figure 2 The diagram illustrates an application environment for the key management method provided in this embodiment of the invention, including a requester and a service provider, with the requester and service provider exchanging information via business keys. Figure 1 As shown, the method includes the following steps:

[0034] Step 110: The requester sends a key negotiation request to the service provider based on the requester's primary key; the requester's primary key is generated based on the requester's smart contract.

[0035] The requester's primary key is a primary key pair, comprising a public key and a private key. In this embodiment, different requesters and service providers establish their own blockchain contract accounts, independently deploying their own smart contracts on these accounts. Therefore, before the requester sends the negotiated key to the service provider, the method further includes: the requester generating a primary key pair based on the content of its smart contract; the primary key pair includes a public key and a private key. The service provider generating a primary key pair based on the content of its smart contract; the primary key pair includes a public key and a private key. Specifically, the content of the requester's smart contract includes a method for generating the primary key pair, the validity period of the primary key pair, a method for generating and transmitting the business key, the validity period of the business key, and a symmetric encryption method. The primary key needs to have a validity period set. Within this validity period, key negotiation is performed using the primary key. After the validity period of the primary key expires, a new primary key is generated and its corresponding validity period is set. In this embodiment of the invention, the requester's first-level key pair, which has been updated twice most recently, is stored, with an overlap in their validity periods. This method allows for fault tolerance in special circumstances regarding key pair update anomalies.

[0036] The key negotiation request includes a first negotiation key, which is obtained by encrypting the private key in the requester's primary key pair using a random code. The requester sends the first negotiation key to the service provider for key negotiation. The random code incorporates business code to enhance the security of the business code.

[0037] Step 120: The service provider receives the key negotiation request and returns the negotiation result based on the service provider's primary key.

[0038] The service provider's primary key is generated based on the service provider's smart contract. The service provider's primary key is a primary key pair, which includes the public key and the private key of the primary key pair.

[0039] In this embodiment of the invention, the service provider also pre-obtains the public key and public key validity period from the requester's primary key pair. The public key and public key validity period in the requester's primary key pair are encrypted using the public key in the service provider's primary key pair and then sent by the requester to the service provider. The service provider's primary key pair is generated by the service provider's smart contract, and the specific generation process is largely the same as that of the requester's primary key pair, and will not be repeated here.

[0040] The negotiation result includes a second negotiation key. Specifically, the service provider decrypts the first negotiation key using the public key in the requester's primary key pair to obtain the requester's random code, and generates a service provider's random code. The service provider then concatenates the requester's random code and the service provider's random code, encrypts them using the private key in the service provider's primary key pair, and generates the second negotiation key. The second negotiation key is then sent to the requester. The method for generating the service provider's random code is the same as that for the requester's random code.

[0041] Step 130: The requesting party generates a business key based on the negotiation result.

[0042] The business key is used for encryption when the requester and the service provider exchange information.

[0043] In this embodiment of the invention, the requesting party decrypts the second negotiated key using the public key in the service provider's primary key pair to obtain the service provider's random code, and then encrypts the service provider's random code using the public key in the requesting party's primary key pair to generate a business key. After generating the business key, the validity period of the business key is set, and the requesting party's account name, business code, business key, validity period of the business key, and the corresponding symmetric encryption method are stored in memory to facilitate symmetric encryption during subsequent daily information transmission between the requesting party and the service provider, thereby improving encryption performance. Specifically, when storing the business key, the two most recently updated business keys are stored, with an overlap in their validity periods, to address the issue of abnormal key updates in special circumstances.

[0044] The requesting party also sends the business key to the service provider. The service provider receives the business key, its validity period, and the symmetric encryption method returned by the requesting party and stores them in the service provider's memory so that symmetric encryption can be used to improve encryption performance during subsequent daily information transmission between the requesting party and the service provider.

[0045] In this embodiment of the invention, when the service provider cannot obtain the business key from memory, it notifies the requesting party that the business key is invalid. Specifically, when the business key is invalid, the service provider sends an invalidation notification of the business key to the requesting party; the requesting party then re-executes the step of generating the business key based on the invalidation notification.

[0046] In this embodiment of the invention, the requester sends a key negotiation request to the service provider based on its primary key; the primary key is generated based on the requester's smart contract; the service provider receives the key negotiation request and returns a negotiation result based on its primary key; the primary key is generated based on its smart contract; the requester generates a business key based on the negotiation result; the business key is used for encryption when the requester and the service provider transmit information, enabling automatic negotiation and management of keys based on smart contracts, avoiding centralized key management, improving the understandability and flexibility of key management, reducing complexity, distinguishing only between the requester and the service provider, eliminating the need for audit nodes and identity authentication nodes, reducing costs, and improving performance.

[0047] Figure 2 This diagram illustrates an application environment for the key management method provided in this embodiment of the invention. This key management method can be applied to a blockchain or distributed device, which includes a requester and a service provider. The requester sends a key negotiation request to the service provider based on its primary key. The service provider receives the key negotiation request and returns a negotiation result based on its primary key. The requester generates a business key based on the negotiation result. The business key is used for encryption during information transmission between the requester and the service provider. Figure 2 and 3 As shown, according to another aspect of the present invention, a data encryption interaction method is provided. This business interaction method is based on the key management method of the above embodiments, in which a requester-level key pair, a service-level key pair, and a business key have been generated. At this time, the service provider and the requester have respectively stored the requester-level key pair, the service-level key pair, and the business key. Specifically, the service provider stores the public key, the public and private keys of the requester-level key pair, and the business key; the requester stores the public and private keys of the requester-level key pair, the public key of the service-level key pair, and the business key.

[0048] The business interaction method includes:

[0049] Step 210: The requester uses the private key in the requester's primary key pair to decrypt the business key and obtain the original business key.

[0050] Step 220: The requesting party uses the plaintext of the business key to encrypt the original business data, generating encrypted data, and sends it to the service provider. The requesting party encrypts the original business data using the plaintext of the business key in a symmetric encryption method based on a pre-stored business key.

[0051] Step 230: The service provider obtains the business key through the request header of the encrypted data, decrypts the business key using the public key in the service provider's primary key pair to obtain the original business key, and then uses the original business key to decrypt the encrypted data to obtain the original business data. The request header contains the requester's account name and / or business code; the requester's account name and / or business code corresponds to the business key. The service provider, through the request header of the encrypted data, reads the corresponding business key from memory based on the requester's account name and / or business code in the request header, decrypts the business key using the public key in the service provider's primary key pair to obtain the original business key, and then uses the original business key to decrypt the encrypted data to obtain the original business data.

[0052] In this embodiment of the invention, the requester sends a key negotiation request to the service provider based on its primary key; the primary key is generated based on the requester's smart contract; the service provider receives the key negotiation request and returns a negotiation result based on its primary key; the primary key is generated based on its smart contract; the requester generates a business key based on the negotiation result; the business key is used for encryption when the requester and the service provider transmit information, enabling automatic negotiation and management of keys based on smart contracts, avoiding centralized key management, improving the understandability and flexibility of key management, reducing complexity, distinguishing only between the requester and the service provider, eliminating the need for audit nodes and identity authentication nodes, reducing costs, and improving performance.

[0053] According to another aspect of the present invention, a blockchain is provided, the blockchain including a requester and a servicer;

[0054] The requesting party is used to send a key negotiation request to the service provider based on its primary key; the primary key of the requesting party is generated based on the requesting party's smart contract.

[0055] The service provider is configured to receive the key negotiation request and return the negotiation result based on the service provider's primary key; the service provider's primary key is generated based on the service provider's smart contract.

[0056] The requesting party is used to generate a business key based on the negotiation result; the business key is used for encryption when the requesting party and the service provider transmit information.

[0057] The process of key management in the blockchain according to this embodiment of the invention is largely the same as the steps of the key management method described above, and will not be repeated here.

[0058] Figure 4The diagram shows a structural schematic of a computer device provided in an embodiment of the present invention. The specific embodiments of the present invention do not limit the specific implementation of the computer device.

[0059] like Figure 4 As shown, the computer device may include: a processor 402, a communications interface 404, a memory 406, and a communications bus 408.

[0060] The processor 402, communication interface 404, and memory 406 communicate with each other via communication bus 408. Communication interface 404 is used to communicate with other network elements such as clients or other servers. The processor 402 executes program 410, specifically performing the relevant steps described above in the key management method embodiment.

[0061] Specifically, program 410 may include program code, which includes computer-executable instructions.

[0062] Processor 402 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The computer device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or they may be processors of different types, such as one or more CPUs and one or more ASICs.

[0063] Memory 406 is used to store program 410. Memory 406 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0064] Specifically, program 410 can be called by processor 402 to cause the computer device to perform the following operations:

[0065] The requesting party sends a key negotiation request to the service provider based on its primary key; the primary key is generated based on the requesting party's smart contract.

[0066] The service provider receives the key negotiation request and returns the negotiation result based on the service provider's primary key; the service provider's primary key is generated based on the service provider's smart contract.

[0067] The requesting party generates a business key based on the negotiation result; the business key is used for encryption when the requesting party and the service provider transmit information.

[0068] In one alternative approach, the key negotiation request includes a first negotiation key; the requester sends the key negotiation request to the service provider based on the requester's primary key, including: the requester sending the first negotiation key to the service provider; the first negotiation key is obtained by randomly encoding and encrypting the requester's private key in the requester's primary key pair.

[0069] In one optional manner, the negotiation result includes a second negotiation key; the service provider receives the key negotiation request and returns the negotiation result based on the service provider's primary key, including: decrypting the first negotiation key using the public key in the requester's primary key pair to obtain the requester's random code; concatenating the requester's random code and the service provider's random code, and encrypting them using the private key in the service provider's primary key pair to generate the second negotiation key; and sending the second negotiation key to the requester.

[0070] In one alternative approach, the requesting party generates a business key based on the negotiation result, including: decrypting the second negotiation key using the public key in the first-level key pair of the service provider to obtain the service provider's random code; and encrypting the service provider's random code using the public key in the first-level key pair of the requesting party to generate the business key.

[0071] In an alternative approach, after the requesting party generates a business key based on the negotiation result, the method further includes: the service provider sending an invalidation notification of the business key to the requesting party; and the requesting party re-executing the step of generating the business key based on the invalidation notification.

[0072] In one optional approach, the requester's smart contract content includes a method for generating a requester's primary key pair, the validity period of the requester's primary key pair, a method for generating and transmitting a business key, the validity period of the business key, and a symmetric encryption method; there is an overlap period between the validity periods of the two most recently updated requester's primary key pairs.

[0073] In this embodiment of the invention, the requester sends a key negotiation request to the service provider based on its primary key; the primary key is generated based on the requester's smart contract; the service provider receives the key negotiation request and returns a negotiation result based on its primary key; the primary key is generated based on its smart contract; the requester generates a business key based on the negotiation result; the business key is used for encryption when the requester and the service provider transmit information, enabling automatic negotiation and management of keys based on smart contracts, avoiding centralized key management, improving the understandability and flexibility of key management, reducing complexity, distinguishing only between the requester and the service provider, eliminating the need for audit nodes and identity authentication nodes, reducing costs, and improving performance.

[0074] This invention provides a computer-readable storage medium storing at least one executable instruction that, when executed on a computer device, causes the computer device to perform the key management method in any of the above method embodiments.

[0075] Executable instructions can be used to cause computer devices to perform the following operations:

[0076] The requesting party sends a key negotiation request to the service provider based on its primary key; the primary key is generated based on the requesting party's smart contract.

[0077] The service provider receives the key negotiation request and returns the negotiation result based on the service provider's primary key; the service provider's primary key is generated based on the service provider's smart contract.

[0078] The requesting party generates a business key based on the negotiation result; the business key is used for encryption when the requesting party and the service provider transmit information.

[0079] In one alternative approach, the key negotiation request includes a first negotiation key; the requester sends the key negotiation request to the service provider based on the requester's primary key, including: the requester sending the first negotiation key to the service provider; the first negotiation key is obtained by randomly encoding and encrypting the requester's private key in the requester's primary key pair.

[0080] In one optional manner, the negotiation result includes a second negotiation key; the service provider receives the key negotiation request and returns the negotiation result based on the service provider's primary key, including: decrypting the first negotiation key using the public key in the requester's primary key pair to obtain the requester's random code; concatenating the requester's random code and the service provider's random code, and encrypting them using the private key in the service provider's primary key pair to generate the second negotiation key; and sending the second negotiation key to the requester.

[0081] In one alternative approach, the requesting party generates a business key based on the negotiation result, including: decrypting the second negotiation key using the public key in the first-level key pair of the service provider to obtain the service provider's random code; and encrypting the service provider's random code using the public key in the first-level key pair of the requesting party to generate the business key.

[0082] In an alternative approach, after the requesting party generates a business key based on the negotiation result, the method further includes: the service provider sending an invalidation notification of the business key to the requesting party; and the requesting party re-executing the step of generating the business key based on the invalidation notification.

[0083] In one optional approach, the requester's smart contract content includes a method for generating a requester's primary key pair, the validity period of the requester's primary key pair, a method for generating and transmitting a business key, the validity period of the business key, and a symmetric encryption method; there is an overlap period between the validity periods of the two most recently updated requester's primary key pairs.

[0084] In this embodiment of the invention, the requester sends a key negotiation request to the service provider based on its primary key; the primary key is generated based on the requester's smart contract; the service provider receives the key negotiation request and returns a negotiation result based on its primary key; the primary key is generated based on its smart contract; the requester generates a business key based on the negotiation result; the business key is used for encryption when the requester and the service provider transmit information, enabling automatic negotiation and management of keys based on smart contracts, avoiding centralized key management, improving the understandability and flexibility of key management, reducing complexity, distinguishing only between the requester and the service provider, eliminating the need for audit nodes and identity authentication nodes, reducing costs, and improving performance.

[0085] This invention provides a key management device for executing the above-described key management method.

[0086] This invention provides a computer program that can be called by a processor to cause a computer device to execute the key management method in any of the above method embodiments.

[0087] This invention provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions, which, when executed on a computer, cause the computer to perform the key management method in any of the above method embodiments.

[0088] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, the embodiments of the present invention are not directed to any particular programming language. It should be understood that the content of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0089] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0090] Similarly, it should be understood that, in order to streamline the invention and aid in understanding one or more of the various aspects of the invention, features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof in the above description of exemplary embodiments of the invention. However, this disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim.

[0091] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0092] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be construed as limiting the order of execution.

Claims

1. A key management method, characterized in that, The method involves deploying and signing a smart contract between the requester and the service provider in a blockchain environment, and negotiating and transmitting various business keys through the smart contract; the method includes: The requesting party encrypts the private key in the requesting party's primary key pair using random encoding to obtain the first negotiation key, and sends a key negotiation request containing the first negotiation key to the service provider; the requesting party's primary key pair is generated based on the requesting party's smart contract. The service provider receives the key negotiation request and returns the negotiation result based on the service provider's primary key pair; the service provider's primary key pair is generated based on the service provider's smart contract. The requesting party generates a business key based on the negotiation result; the business key is used for encryption when the requesting party and the service provider transmit information. The service provider receives the key negotiation request and returns the negotiation result based on the service provider's primary key pair, including: The first negotiated key is decrypted using the public key in the requester's first-level key pair to obtain the requester's random code; The requester's random code and the service provider's random code are concatenated and then encrypted using the private key in the service provider's first-level key pair to generate the second negotiation key. The negotiation result, containing the second negotiation key, is sent to the requesting party.

2. The method according to claim 1, characterized in that, The requesting party generates a business key based on the negotiation result, including: The service provider's random code is obtained by decrypting the second negotiated key using the public key in the service provider's primary key pair. The public key from the requester's first-level key pair is used to randomly encode and encrypt the service provider's key to generate a business key.

3. The method according to claim 1, characterized in that, After the requesting party generates a business key based on the negotiation result, the method includes: The service provider sends an expiration notification of the business key to the requesting party; The requesting party re-executes the step of generating the business key based on the failure notification.

4. The method according to claim 3, characterized in that, The requester's smart contract content includes one or a combination of the following: a method for generating a requester's primary key pair, the validity period of the requester's primary key pair, a method for generating and transmitting a business key, the validity period of the business key, and a symmetric encryption method.

5. A blockchain system, characterized in that, The blockchain system includes a requester and a service provider; smart contracts are deployed and signed between the requester and the service provider in the blockchain environment, and the negotiation and transmission of business keys are carried out through the smart contracts. The requesting party is used to encrypt the requesting party's random code based on the private key in the requesting party's primary key pair to obtain the first negotiation key, and send a key negotiation request containing the first negotiation key to the service party. The requester's primary key pair is generated based on the requester's smart contract; The service provider is configured to receive the key negotiation request and return the negotiation result based on the service provider's primary key pair; The service provider's primary key pair is generated based on the service provider's smart contract; The requesting party is used to generate a business key based on the negotiation result; the business key is used for encryption when the requesting party and the service provider transmit information. The service provider is further used for: The first negotiated key is decrypted using the public key in the requester's first-level key pair to obtain the requester's random code; The requester's random code and the service provider's random code are concatenated and then encrypted using the private key in the service provider's first-level key pair to generate the second negotiation key. The negotiation result, containing the second negotiation key, is sent to the requesting party.

6. A computer device, characterized in that, include: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction that causes the processor to perform the operation of the key management method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The storage medium stores at least one executable instruction, which, when executed on a computer device, causes the computer device to perform the key management method as described in any one of claims 1-4.

Images