Key determination method, device, computer equipment and storage medium

Abstract

The present application relates to a key determination method, apparatus, computer equipment, storage medium and computer program product. The method comprises: obtaining a key determination request; sending the key determination request to a key center; obtaining an encrypted data key and an encrypted master key fed back by the key center based on the key determination request; obtaining a user characteristic value and an operating system characteristic value corresponding to the key determination request, encrypting the encrypted data key based on the user characteristic value and the operating system characteristic value to obtain a target data key, and encrypting the encrypted master key based on the user characteristic value and the operating system characteristic value to obtain a target master key. The use of this method can improve the security of obtaining keys.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a key determination method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the development of computer technology, encryption technology has emerged. Encryption technology uses a special algorithm to change the original information data, so that even if unauthorized users obtain the encrypted information, they still cannot understand the content of the information because they do not know the decryption method.

[0003] In conventional technology, a fixed key is used to encrypt information data to ensure the security of the information data to be encrypted. However, the fixed key has the risk of being easily exposed and has low security. Summary of the invention

[0004] Based on this, it is necessary to provide a key determination method, apparatus, computer device, computer-readable storage medium and computer program product that can improve key security in response to the above technical problems.

[0005] In a first aspect, the present application provides a key determination method. The method comprises:

[0006] Get key confirmation request;

[0007] Sending the key determination request to a key center;

[0008] Obtaining the encrypted data key and the encrypted master key fed back by the key center based on the key determination request;

[0009] Obtain the user characteristic value and the operating system characteristic value corresponding to the key determination request, encrypt the encrypted data key based on the user characteristic value and the operating system characteristic value to obtain the target data key, and encrypt the encryption master key based on the user characteristic value and the operating system characteristic value to obtain the target master key.

[0010] In one embodiment, the encrypting the encryption data key based on the user characteristic value and the operating system characteristic value to obtain a target data key, and encrypting the encryption master key to obtain a target master key includes:

[0011] Merging the user characteristic value and the operating system characteristic value to obtain an initial characteristic value;

[0012] Performing hash algorithm encryption and scrambling on the initial eigenvalue to obtain a target eigenvalue;

[0013] Based on the target feature value, obtaining a storage key;

[0014] The encrypted data key is encrypted based on the saved key to obtain a target data key, and the encrypted master key is encrypted based on the saved key to obtain a target master key.

[0015] In one embodiment, the performing of hash algorithm encryption and scrambling on the initial eigenvalue to obtain the target eigenvalue comprises:

[0016] Get the number of statistics;

[0017] Performing a hash algorithm to encrypt the initial eigenvalue to obtain an intermediate eigenvalue;

[0018] Based on a preset method, the intermediate eigenvalues ​​are scrambled to obtain reference eigenvalues;

[0019] Updating the statistical number to obtain an updated statistical number, and comparing the updated statistical number with an encryption number threshold;

[0020] If the updated statistical number of times is less than the encryption number threshold, the reference eigenvalue is used as the initial eigenvalue, and the step of performing hash algorithm encryption on the initial eigenvalue to obtain the intermediate eigenvalue is returned to execute until the updated statistical number of times is equal to the encryption number threshold to obtain the target eigenvalue.

[0021] In one embodiment, obtaining the key determination request includes:

[0022] Obtaining an initial key determination request and sending a key;

[0023] The initial key determination request is encrypted based on the sending key to obtain a key determination request.

[0024] In one embodiment, the key determination method further includes:

[0025] Obtaining a target confusion factor and a target random number corresponding to the user characteristic value and the operating system characteristic value;

[0026] Constructing a target linear regression function based on the target random number;

[0027] For each bit of first data in the target data key, based on the first data and the target confusion factor, the target linear regression function is calculated to obtain a data parameter set corresponding to the first data;

[0028] For each bit of second data in the master key, based on the second data and the target confusion factor, the target linear regression function is calculated to obtain a set of master parameters corresponding to the second data;

[0029] The multiple data parameter sets corresponding to the target data key are saved, and the multiple master parameter sets corresponding to the master key are saved.

[0030] In one embodiment, applied to a key center, the method includes:

[0031] Obtaining a key confirmation request sent by the terminal;

[0032] Based on the key determination request, generate a data key and a master key;

[0033] Encrypting the data key to obtain an encrypted data key, and encrypting the master key to obtain an encrypted master key;

[0034] The encrypted data key and the encrypted master key are sent to the terminal to instruct the terminal to generate a target data key based on the user characteristic value, the operating system characteristic value and the encrypted data key, and to generate a target master key based on the user characteristic value, the operating system characteristic value and the encryption master key.

[0035] In one embodiment, encrypting the data key to obtain an encrypted data key and encrypting the master key to obtain an encrypted master key comprises:

[0036] Encrypting the data key based on the master key to obtain an encrypted data key;

[0037] Obfuscating the encrypted data key to obtain an obfuscated data key;

[0038] Based on the obfuscated data key, the master key is encrypted to obtain an encrypted master key.

[0039] In one embodiment, performing obfuscation processing on the encrypted data key to obtain the obfuscated data key includes:

[0040] Scrambling the encrypted data key to obtain an initial obfuscated key;

[0041] Based on a preset encryption method, encrypt the initial obfuscation key to obtain an intermediate obfuscation key;

[0042] The intermediate obfuscation key with a preset number of bits is determined as the obfuscated data key.

[0043] In one embodiment, generating a data key and a master key based on the key determination request includes:

[0044] Obtaining a sending key, and decrypting the key determination request based on the sending key to obtain an initial key determination request;

[0045] A user identifier corresponding to the initial key determination request is obtained, and a data key and a master key corresponding to the user identifier are generated.

[0046] In one embodiment, sending the encrypted data key and the encrypted master key to the terminal includes:

[0047] Generate response information based on the encrypted data key and the encrypted master key;

[0048] Acquire a response key, and encrypt the response information based on the response key to obtain encrypted response information;

[0049] The encrypted response information is sent to the terminal.

[0050] In a second aspect, the present application also provides a key determination device. The device comprises:

[0051] A first acquisition module, used to acquire a key determination request;

[0052] A sending module, used to send the key determination request to a key center;

[0053] A receiving module, used for obtaining the encrypted data key and the encrypted master key fed back by the key center based on the key determination request;

[0054] A determination module is used to obtain a user characteristic value and an operating system characteristic value corresponding to the key determination request, encrypt the encryption data key based on the user characteristic value and the operating system characteristic value to obtain a target data key, and encrypt the encryption master key based on the user characteristic value and the operating system characteristic value to obtain a target master key.

[0055] In a second aspect, the present application also provides another key determination device. The device comprises:

[0056] A second acquisition module, used to acquire a key determination request sent by the terminal;

[0057] A generation module, configured to generate a data key and a master key based on the key determination request;

[0058] An encryption module, used for encrypting the data key to obtain an encrypted data key, and encrypting the master key to obtain an encrypted master key;

[0059] A transmission module is used to send the encrypted data key and the encryption master key to the terminal to instruct the terminal to generate a target data key based on the user characteristic value, the operating system characteristic value and the encrypted data key, and to generate a target master key based on the user characteristic value, the operating system characteristic value and the encryption master key.

[0060] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0061] Get key confirmation request;

[0062] Sending the key determination request to a key center;

[0063] Obtaining the encrypted data key and the encrypted master key fed back by the key center based on the key determination request;

[0064] Obtain the user characteristic value and the operating system characteristic value corresponding to the key determination request, encrypt the encrypted data key based on the user characteristic value and the operating system characteristic value to obtain the target data key, and encrypt the encryption master key based on the user characteristic value and the operating system characteristic value to obtain the target master key.

[0065] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0066] Get key confirmation request;

[0067] Sending the key determination request to a key center;

[0068] Obtaining the encrypted data key and the encrypted master key fed back by the key center based on the key determination request;

[0069] Obtain the user characteristic value and the operating system characteristic value corresponding to the key determination request, encrypt the encrypted data key based on the user characteristic value and the operating system characteristic value to obtain the target data key, and encrypt the encryption master key based on the user characteristic value and the operating system characteristic value to obtain the target master key.

[0070] The key determination method, device, computer equipment, storage medium and computer program product obtain a key determination request, send the key determination request to the key center, obtain the encrypted data key and the encrypted master key fed back by the key center based on the key determination request, obtain the user characteristic value and the operating system characteristic value corresponding to the key determination request, encrypt the encrypted data key based on the user characteristic value and the operating system characteristic value to obtain the target data key, encrypt the encrypted master key based on the user characteristic value and the operating system characteristic value to obtain the target master key. The encrypted data key and the encrypted master key are obtained from the key center through the key determination request, the encrypted data key protects the data key, and the encrypted master key protects the master key, thereby improving the security performance of the data key and the master key, and then the encrypted data key and the encrypted master key are encrypted through the user characteristic value and the operating system characteristic value, and the user characteristic value and the operating system characteristic value are directly obtained, thereby avoiding the risk of the user characteristic value and the operating system characteristic value being exposed during the transmission process, and the data key and the master key are encrypted again based on the user characteristic value and the operating system characteristic value, thereby further improving the security performance of the data key and the master key. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 A diagram showing an application environment of a key determination method in an embodiment;

[0072] Figure 2 A schematic diagram of a flow chart of a key determination method in an embodiment;

[0073] Figure 3 A schematic diagram of a process for determining a target data key and a target master key in one embodiment;

[0074] Figure 4 A schematic flow chart of a target feature value determination step in one embodiment;

[0075] Figure 5 It is a flowchart of a method for storing target data keys and target master keys in segments in one embodiment;

[0076] Figure 6 It is a flowchart of a method for determining a key corresponding to a key center in one embodiment;

[0077] Figure 7 A schematic diagram of five-layer key protection in an embodiment;

[0078] Figure 8 A schematic diagram of a five-layer key protection process in an embodiment;

[0079] Fig. 9 A flowchart of an obfuscation algorithm in one embodiment;

[0080] Fig.10A schematic diagram of a process for encrypting a user characteristic value and an operating system characteristic value in one embodiment;

[0081] Fig.11 It is a structural block diagram of a device for determining a key corresponding to a terminal in an embodiment;

[0082] Fig.12 It is a structural block diagram of a key center corresponding to a key determination device in an embodiment;

[0083] Fig.13 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0084] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0085] The key determination method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Both the terminal and the server can be used alone to execute the key determination method provided in the embodiment of the present application. The terminal and the server can also be used in collaboration to execute the key determination method provided in the embodiment of the present application. For example, the terminal obtains a key determination request, sends the key determination request to the key center, obtains the encrypted data key and the encrypted master key fed back by the key center based on the key determination request, obtains the user characteristic value and the operating system characteristic value corresponding to the key determination request, encrypts the encrypted data key based on the user characteristic value and the operating system characteristic value, obtains the target data key, and encrypts the encrypted master key based on the user characteristic value and the operating system characteristic value to obtain the target master key. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0086] In one embodiment, Figure 2As shown, a key determination method is provided, which can be applied to a computer device, which can be a terminal or a server, and can be executed by the terminal or the server itself, or can be implemented through interaction between the terminal and the server. This embodiment takes the method applied to a terminal as an example for explanation, and includes steps 202 to 208.

[0087] Step 202: Obtain a key determination request.

[0088] The key determination request refers to an instruction sent by the terminal to the key center for obtaining a key from the key center, which can be understood as a key acquisition request or a key update request, etc.

[0089] Exemplarily, the terminal obtains a key determination request.

[0090] In one embodiment, the terminal obtains a key determination request based on a preset time interval, and the key determination request is sent to the key center to obtain the key for updating from the key center. For example, the target terminal uses the key to encrypt the data information to be encrypted, and the key of the encrypted data information is updated every week, so the key determination request is generated every week.

[0091] In one embodiment, when the terminal is turned on, a key determination request is generated, the key determination request is sent to the key center, and the key used to encrypt the encrypted data information is obtained from the key center. For example, when a POS (Point of sales) machine is turned on, a key determination request is generated and sent to the key center.

[0092] Step 204: Send the key confirmation request to the key center.

[0093] Among them, the key center, also known as the key management center, is an important component of the public key infrastructure, responsible for providing key services such as key generation, storage, backup, update, recovery, and query for terminals.

[0094] Exemplarily, the terminal sends a key determination request to the key center.

[0095] Step 206: Obtain the encrypted data key and the encrypted master key fed back by the key center based on the key determination request.

[0096] Among them, the key is a parameter, which refers to the parameter input in the algorithm that converts plaintext to ciphertext or ciphertext to plaintext. The key can be divided into data key and master key. The data key, also known as the working key, is used to encrypt the data information to be encrypted, or to decrypt the encrypted data information. The master key is used to encrypt and protect the data key, or to verify whether the data key is legal. The master key is divided into plaintext and ciphertext. The encrypted data key refers to the encrypted data key. The encrypted master key refers to the encrypted master key.

[0097] Exemplarily, the key center receives a key determination request, generates an encrypted data key and an encrypted master key, and then sends the encrypted data key and the encrypted master key to the terminal, and the terminal obtains the encrypted data key and the encrypted master key.

[0098] In one embodiment, the terminal obtains the encrypted data key and the master key fed back by the key center based on the key determination request, and the encrypted data key is encrypted based on the master key.

[0099] Step 208, obtain the user characteristic value and operating system characteristic value corresponding to the key determination request, encrypt the encryption data key based on the user characteristic value and the operating system characteristic value to obtain the target data key, and encrypt the encryption master key based on the user characteristic value and the operating system characteristic value to obtain the target master key.

[0100] Among them, user characteristic value refers to information used to characterize user characteristics. For example, user ID, user name, etc. Operating system characteristic value refers to information used to characterize terminal characteristics. For example, MAC (Media Access Control Address, local area network address, refers to the address of each terminal location) address, IP (Internet Protocol Address, Internet Protocol address, refers to a logical address corresponding to each terminal) address, etc. The target data key refers to the data key obtained after the encrypted data key is encrypted again. The target master key refers to the master key obtained after the encrypted master key is encrypted again.

[0101] Exemplarily, the terminal obtains user characteristic values ​​and operating system characteristic values, then encrypts the encryption data key based on the user characteristic values ​​and operating system characteristic values ​​to obtain a target data key, and then encrypts the encryption master key based on the user characteristic values ​​and operating system characteristic values ​​to obtain a target master key.

[0102] In one embodiment, the terminal obtains the user characteristic value and the operating system characteristic value, and then encrypts the encryption data key based on the user characteristic value and the operating system characteristic value to obtain the target data key. Alternatively, the terminal obtains the user characteristic value and the operating system characteristic value, and then encrypts the encryption master key based on the user characteristic value and the operating system characteristic value to obtain the target master key.

[0103] In the above-mentioned key determination method, the encrypted data key and the encrypted master key are obtained from the key center through the key determination request, the encrypted data key protects the data key, and the encrypted master key protects the master key, thereby improving the security performance of the data key and the master key, and then the encrypted data key and the encrypted master key are encrypted by the user characteristic value and the operating system characteristic value, and the user characteristic value and the operating system characteristic value are directly obtained, thereby avoiding the risk of the user characteristic value and the operating system characteristic value being exposed during the transmission process, and the data key and the master key are encrypted again based on the user characteristic value and the operating system characteristic value, thereby further improving the security performance of the data key and the master key.

[0104] In one embodiment, Figure 3 As shown, the encrypted data key is encrypted based on the user characteristic value and the operating system characteristic value to obtain the target data key, and the encrypted master key is encrypted based on the user characteristic value and the operating system characteristic value to obtain the target master key, including:

[0105] Step 302: The user characteristic value and the operating system characteristic value are merged to obtain an initial characteristic value.

[0106] Fusion refers to the process of processing two or more data to obtain one data. For example, two or more data are concatenated, added or multiplied. The initial eigenvalue refers to the data obtained by fusing the user eigenvalue and the operating system eigenvalue.

[0107] Exemplarily, the terminal fuses the user characteristic value and the operating system characteristic value to obtain initial characteristic values ​​corresponding to the user characteristic value and the operating system characteristic value.

[0108] In one embodiment, the terminal concatenates the user characteristic value and the operating system characteristic value to obtain a concatenated characteristic value, and then sorts the concatenated characteristic value according to a preset rule to obtain an initial characteristic value.

[0109] Step 304, encrypt and scramble the initial eigenvalue using a hash algorithm to obtain a target eigenvalue.

[0110] Among them, hash algorithm encryption refers to the process of using a hash function to calculate data of any length to obtain data of a fixed length. For example, MD5 (Message-Digest Algorithm 5) is a widely used hash function that can generate a 128-bit, 16-byte hash value. Scrambling refers to the process of exchanging the position of data in the data. The target eigenvalue refers to the data obtained after the initial eigenvalue is hashed and scrambled.

[0111] Exemplarily, the terminal performs a hash algorithm to encrypt the initial eigenvalue to obtain a hash eigenvalue, and then scrambles the hash eigenvalue to obtain a target eigenvalue.

[0112] Step 306, based on the target feature value, obtain the storage key.

[0113] The storage key refers to the key used to encrypt the encrypted data key and the encrypted master key.

[0114] Exemplarily, the terminal obtains data of a preset number of digits of the target characteristic value, and uses the data of the preset number of digits as a storage key.

[0115] Step 308: Encrypt the encrypted data key based on the saved key to obtain the target data key, and encrypt the encrypted master key based on the saved key to obtain the target master key.

[0116] Exemplarily, the terminal uses the saved key to encrypt the encrypted data key to obtain the target data key, and uses the saved key to encrypt the encrypted master key to obtain the target master key.

[0117] In this embodiment, the encrypted data key and the encrypted master key are encrypted by user characteristic values ​​and operating system characteristic values, and the user characteristic values ​​and operating system characteristic values ​​are directly obtained, thereby avoiding the risk of user characteristic values ​​and operating system characteristic values ​​being exposed during transmission. The data key and the master key are encrypted again based on the user characteristic values ​​and operating system characteristic values, thereby further improving the security performance of the data key and the master key.

[0118] In one embodiment, Figure 4 As shown, the initial eigenvalue is encrypted and scrambled by the hash algorithm, and the target eigenvalue is obtained including:

[0119] Step 402, obtaining the statistical number.

[0120] The statistical number refers to the initial statistical number, which can be understood as the obtained statistical number is zero.

[0121] Exemplarily, the terminal obtains the statistical number of times.

[0122] Step 404, encrypt the initial eigenvalue using a hash algorithm to obtain an intermediate eigenvalue.

[0123] The intermediate eigenvalue refers to the data obtained by calculating the initial eigenvalue using a hash algorithm.

[0124] Exemplarily, the terminal uses a hash algorithm to calculate the initial eigenvalue to obtain an intermediate eigenvalue corresponding to the initial eigenvalue.

[0125] Step 406: Based on a preset method, the intermediate eigenvalues ​​are shuffled to obtain reference eigenvalues.

[0126] The preset method refers to a preset shuffling rule, for example, moving each bit of the intermediate characteristic value forward by one bit, and moving the first bit of the intermediate characteristic value to the last bit.

[0127] Exemplarily, the terminal scrambles the intermediate eigenvalues ​​in a preset manner to obtain corresponding reference eigenvalues.

[0128] Step 408, updating the statistical times to obtain the updated statistical times, and comparing the updated statistical times with the encryption times threshold.

[0129] The encryption times threshold refers to the threshold value of the encryption times, which can be understood as the set encryption times.

[0130] Exemplarily, after executing step 406, the terminal adds 1 to the statistical number to obtain an updated statistical number, and then compares the updated statistical data with the encryption number threshold.

[0131] Step 410, if the updated statistical number is less than the encryption number threshold, the reference eigenvalue is used as the initial eigenvalue, and the process returns to the step of encrypting the initial eigenvalue using the hash algorithm to obtain the intermediate eigenvalue, until the updated statistical number is equal to the encryption number threshold, and the target eigenvalue is obtained.

[0132] Exemplarily, the terminal compares the updated statistical number with the encryption number threshold. If the updated statistical number is less than the encryption number threshold, the reference characteristic value is used as the initial characteristic value, and the process returns to execute steps 404, 406 and 408 until the updated statistical number is equal to the encryption number threshold, thereby obtaining the target characteristic value.

[0133] In this embodiment, the initial eigenvalue is encrypted and scrambled by a hash algorithm to obtain the target eigenvalue, which can be understood as encrypting the initial eigenvalue to avoid directly obtaining the target eigenvalue through the user eigenvalue and the operating system eigenvalue, thereby improving the security of the target eigenvalue.

[0134] In one embodiment, obtaining a key determination request includes:

[0135] An initial key determination request and a sending key are obtained; based on the sending key, the initial key determination request is encrypting to obtain a key determination request.

[0136] The initial key determination request refers to a key determination request generated by the terminal. It can be understood as a key determination request that is not encrypted. The initial key determination request includes but is not limited to a user identifier. The sending key refers to a key used to encrypt the initial key determination request. The sending key can be a key stored by the terminal and the key center. The terminal uses the sending key to encrypt the initial key determination request, and the key center uses the sending key to decrypt the key determination request to obtain the initial key determination request.

[0137] Exemplarily, the terminal generates an initial key determination request, then obtains a sending key, and uses the sending key to encrypt the initial key determination request to obtain a key determination request.

[0138] In this embodiment, the terminal encrypts the initial key determination request that needs to be transmitted, thereby improving the security of the key determination request in transmission between the terminal and the key center and preventing the key determination request from being exposed during the transmission process.

[0139] In one embodiment, Figure 5 As shown, the key determination method also includes:

[0140] Step 502: Obtain a target confusion factor and a target random number corresponding to the user characteristic value and the operating system characteristic value.

[0141] The target confusion factor refers to a parameter that determines the number of parameter sets corresponding to a data. For example, if the target confusion factor is 5, the number of parameter sets corresponding to data whose key median is a multiple of 5 is 2, and the number of parameter sets corresponding to data whose key median is not a multiple of 5 is 1. The target random number refers to a value added to the linear regression equation to affect the security of the key segmentation.

[0142] In one embodiment, the terminal merges the user characteristic value and the operating system characteristic value to obtain a target characteristic value, performs a hash encryption operation on the target characteristic value to obtain a first character string, performs 64-bit encoding on the first character string to obtain a second character string, sorts the second character string in ascending order based on the values ​​corresponding to each character in the second character string to obtain a target character string, uses the value corresponding to the first character in the target character string as a target random number, and uses the value corresponding to a forward character in a middle position in the target character string as a target confusion factor, wherein the forward character refers to a character before the character in the middle position.

[0143] Exemplarily, the terminal obtains a user characteristic value and an operating system characteristic value, and based on the user characteristic value and the operating system characteristic value, obtains a target confusion factor and a target random number corresponding to the user characteristic value and the operating system characteristic value.

[0144] Step 504: construct a target linear regression function based on the target random number.

[0145] Among them, the target linear regression function refers to a linear regression function that includes a target random number. The construction of the target linear regression function requires the participation of the target random number, which can be set according to actual needs. For example, in actual needs, the parameter set needs to include 4 parameter values, then the target linear regression function includes 4 parameters, and the target linear regression function can be set to m=a*x+b*y+c*d+n, where a, b, c, d are 4 parameters in the parameter set, n is the target random number, and m can be a single-digit value in the target data key or a single-digit value in the target master key.

[0146] Exemplarily, the terminal obtains a linear regression function, and substitutes the target random number into the linear regression function to obtain a target linear regression function.

[0147] Step 506: For each bit of the first data in the target data key, based on the first data and the target confusion factor, calculate the target linear regression function to obtain a data parameter set corresponding to the first data.

[0148] Among them, the first data refers to the value corresponding to a letter in the target data key, or a digit. For example, the target data key is U2h1U2hlbmcwMDc, the value corresponding to the first U is the first data, and the second 2 is the first data. The data parameter set refers to the set of parameter values ​​corresponding to the parameters in the target linear regression function obtained by calculating the target linear regression function based on the first data and the target confusion factor. For example, the target linear regression function is m=a*x+b*y+c*d+n, where a, b, c, and d are 4 parameters, and the set of parameter values ​​corresponding to a, b, c, and d obtained by calculation is the data parameter set.

[0149] In one embodiment, the terminal obtains the current first data corresponding to the current character in the target data key, and the current number of digits corresponding to the current first data, and substitutes the current first data into the target linear regression function, substitutes the randomly generated coefficient into the target linear regression function, and obtains a linear regression equation group, wherein the number of linear regression equations in the linear regression equation group is the same as the number of parameters, and solves the above linear regression equation group to obtain the parameter value corresponding to each parameter, and the parameter values ​​are combined into a current parameter set. It is determined whether the current number of digits is an integer multiple of the target confusion factor. If the current number of digits is not an integer multiple of the target confusion factor, it is determined that the current first data corresponds to a parameter set, and the above current parameter set is used as the data parameter set corresponding to the current first data; if the current number of digits is an integer multiple of the target confusion factor, a random parameter set is randomly generated, and the above current parameter set and the above random parameter set are used as the data parameter set corresponding to the current first data.

[0150] Exemplarily, the terminal calculates a target linear regression function for each bit of first data in the target data key based on the first data and a target confusion factor to obtain a data parameter set corresponding to the first data.

[0151] Step 508: For each bit of second data in the master key, based on the second data and the target confusion factor, a target linear regression function is calculated to obtain a set of master parameters corresponding to the second data.

[0152] The second data refers to a numerical value corresponding to a letter in the master key, or a digit. The master parameter set refers to a set of parameter values ​​corresponding to parameters in the target linear regression function obtained by calculating the target linear regression function based on the second data and the target confusion factor.

[0153] Exemplarily, the terminal calculates a target linear regression function for each bit of second data in the master key based on the second data and a target confusion factor to obtain a set of main parameters corresponding to the second data.

[0154] Step 510: Save the multiple data parameter sets corresponding to the target data key, and save the multiple master parameter sets corresponding to the master key.

[0155] Exemplarily, the terminal saves the multiple data parameter sets corresponding to the target data key, and saves the multiple master parameter sets corresponding to the master key.

[0156] In one embodiment, the terminal stores the target data key and the target master key in segments, respectively. The terminal stores the target data key in multiple groups of data keys, stores each group of data keys in one storage address, and stores the target master key in multiple groups of master keys, stores each group of master keys in one storage address, wherein the storage address may include a registry, a configuration file, etc. For example, if the key is 32-bit data, the 32-bit data may be divided into four groups of 8-bit data, and each group of 8-bit data may be stored in one address.

[0157] In this embodiment, by saving the data parameter set corresponding to the first data of each bit in the target data key, the segmented storage of the target data key is achieved, and by saving the data parameter set corresponding to the first data of each bit in the master key, the segmented storage of the target master key is achieved, thereby avoiding exposure of the saved target data key and target master key, and further improving the security performance of the target data key and target master key.

[0158] In one embodiment, Figure 6 As shown, a key determination method applied to a key center includes:

[0159] Step 602: Obtain a key determination request sent by the terminal.

[0160] The terminal refers to an object that obtains and uses a key, such as an ERP (Enterprise Resource Planning) system, a POS machine, or other equipment that needs to use a key.

[0161] Exemplarily, the key center obtains a key determination request sent by the terminal.

[0162] Step 604, based on the key determination request, generate a data key and a master key.

[0163] Exemplarily, the key center generates a data key and a master key corresponding to the user identifier based on the user identifier in the key determination request.

[0164] Step 606: encrypt the data key to obtain an encrypted data key, and encrypt the master key to obtain an encrypted master key.

[0165] Exemplarily, the key center encrypts the data key to obtain an encrypted data key corresponding to the data key, and encrypts the master key to obtain an encrypted master key corresponding to the master key.

[0166] In one embodiment, the key center encrypts the data key based on the master key to obtain an encrypted data key corresponding to the data key, and encrypts the master key based on the fixed key to obtain an encrypted master key corresponding to the master key.

[0167] Step 608, sending the encrypted data key and the encrypted master key to the terminal to instruct the terminal to generate a target data key based on the user characteristic value, the operating system characteristic value and the encrypted data key, and to generate a target master key based on the user characteristic value, the operating system characteristic value and the encrypted master key.

[0168] Exemplarily, the key center sends the encrypted data key and the encrypted master key to the terminal, and the terminal obtains the encrypted data key and the encrypted master key.

[0169] In one embodiment, the key center generates response information based on the encrypted data key and the encrypted master key, and sends the response information to the terminal.

[0170] In this embodiment, the key center generates a data key and a master key based on a key determination request, and then encrypts the data key and the master key to obtain the corresponding encrypted data key and encrypted master key. Through the above encryption processing, the data key and the master key are encrypted and protected, thereby improving the security performance of the data key and the master key. The encrypted data key and the encrypted master key are sent to the terminal, thereby avoiding exposure of the data key and the master key during transmission, thereby further improving the security performance of the data key and the master key.

[0171] In one embodiment, encrypting the data key to obtain the encrypted data key and encrypting the master key to obtain the encrypted master key include:

[0172] The data key is encrypted based on the master key to obtain an encrypted data key; the encrypted data key is obfuscated to obtain an obfuscated data key; based on the obfuscated data key, the master key is encrypted to obtain an encrypted master key.

[0173] Among them, obfuscation processing refers to the use of an obfuscation algorithm to perform computational processing on the encrypted data key. The obfuscation process includes but is not limited to scrambling, hash encryption, lowercase character conversion to uppercase character processing and other processing methods. Obfuscation processing can be set according to actual needs. The obfuscated data key refers to the key obtained by obfuscating the encrypted data key.

[0174] Exemplarily, the key center encrypts the data key based on the master key to obtain an encrypted data key, then obfuscates the encrypted data key to obtain an obfuscated data key, and then encrypts the master key based on the obfuscated data key to obtain an encrypted master key.

[0175] In this embodiment, the master key is used to encrypt the data key, which improves the security of the data key. The encrypted data key is then obfuscated to obtain an obfuscated data key. The obfuscated key is used to encrypt the master key, which improves the security of the master key. The obfuscated key is used to encrypt the master key, and there is no need to save another key additionally, which reduces the risk of key exposure and further improves the security of the encrypted data key and the encrypted master key.

[0176] In one embodiment, performing obfuscation processing on the encrypted data key to obtain the obfuscated data key includes:

[0177] The encrypted data key is scrambled to obtain an initial obfuscation key; based on a preset encryption method, the initial obfuscation key is encrypted to obtain an intermediate obfuscation key; the intermediate obfuscation key of a preset number of bits is determined as the obfuscated data key.

[0178] Among them, the preset encryption method refers to a preset encryption algorithm. The preset encryption method includes but is not limited to hash encryption, lowercase character to uppercase character encryption, Base64 encryption (Base64 is a method based on 64 printable characters to represent binary data) and other encryption methods. The preset encryption method can be set according to actual needs. The preset number of digits refers to the preset number of digits. For example, the preset number of digits is from the 1st to the 32nd bit of data. The obfuscated data key refers to the key used to encrypt the master key.

[0179] Exemplarily, the key center scrambles the encrypted data key to obtain an initial obfuscation key, then encrypts the initial obfuscation key based on a preset encryption method to obtain an intermediate obfuscation key, and then obtains the intermediate obfuscation key with a preset number of bits as the obfuscated data key.

[0180] In this embodiment, the encrypted data key is obfuscated to obtain an obfuscated data key, and the obfuscated key is used to encrypt the master key. No additional key is stored, which reduces the risk of key exposure and further improves the security performance of the encrypted master key.

[0181] In one embodiment, based on the key determination request, generating the data key and the master key includes:

[0182] Obtain a sending key, decrypt the key determination request based on the sending key, and obtain an initial key determination request; obtain a user identifier corresponding to the initial key determination request, and generate a data key and a master key corresponding to the user identifier.

[0183] The user identifier refers to a character string corresponding to a user one by one. The user identifier may be the name of the terminal.

[0184] Exemplarily, the key center obtains a sending key, decrypts the key determination request based on the sending key to obtain an initial key determination request, obtains a user identifier from the initial key determination request, and then generates a data key and a master key corresponding to the user identifier.

[0185] In this embodiment, the key center decrypts the key determination request based on the sending key, obtains the user identifier corresponding to the initial key determination request, generates a data key and a master key corresponding to the user identifier, and the key determination request transmitted between the terminal and the key center is encrypted, reducing the risk of exposure of the initial key determination request and improving the security performance of the key determination request transmission.

[0186] In one embodiment, sending the encrypted data key and the encrypted master key to the terminal includes:

[0187] Generate response information based on the encrypted data key and the encrypted master key; obtain the response key, encrypt the response information based on the response key to obtain encrypted response information; and send the encrypted response information to the terminal.

[0188] The response information refers to the feedback information generated by the key center based on the key determination request. The response information includes but is not limited to the encrypted data key and the encrypted master key. The response key refers to the key used to encrypt the response information. It can be understood that the key center uses the response key to encrypt the response information, and the terminal uses the response key to decrypt the encrypted response information. The encrypted response information refers to the response information obtained after the response information is encrypted.

[0189] Exemplarily, the key center generates response information based on the encrypted data key and the encrypted master key, then obtains the response key, encrypts the response information based on the response key, obtains encrypted response information, and then sends the encrypted response information to the terminal.

[0190] In this embodiment, the key center encrypts the response information sent to the terminal and sends the encrypted response information to the terminal, thereby reducing the risk of exposure of the response information and improving the security of transmission of the response information between the key center and the terminal.

[0191] In an exemplary embodiment, the terminal obtains a key from a key center, and the process of storing the obtained key includes the following steps: Figure 7The five-fold protection shown is that the first layer of protection is that the terminal encrypts the initial key determination request, thereby improving the security performance of the key determination request transmitted between the terminal and the key center; the second layer of protection is that the key center uses the master key to encrypt the data key, thereby improving the security performance of the data key; the third layer of protection is that the key center uses the encrypted data key to encrypt the master key, thereby improving the security performance of the master key, and encrypts the response information generated based on the encrypted data key and the encrypted master key, thereby improving the security performance of the response information transmitted between the key center and the terminal; the fourth layer of protection is that after the terminal obtains the encrypted data key and the encrypted master key, the encrypted data key and the encrypted master key are encrypted again, thereby further improving the security performance of the data key and the master key; the fifth layer of protection is that the target data key and the target master key are stored in segments, thereby improving the security performance of the data key and the master key during the storage process.

[0192] The terminal obtains the key from the key center and saves the obtained key. Figure 8 As shown, the terminal obtains the initial key determination request and the sending key, encrypts the initial key determination request with the sending key to obtain the key determination request, and then sends the key determination request to the key center. The key center obtains the key determination request, then obtains the sending key, decrypts the key determination request with the sending key to obtain the initial key determination request, obtains the user identification from the initial key determination request, generates the data key and the master key corresponding to the identification, and the key center encrypts the data key with the master key to obtain the encrypted data key. The key center performs obfuscation processing on the encrypted data key, as shown in FIG. Fig. 9 As shown, an obfuscated key is obtained, the obfuscated key is used to encrypt the master key to obtain an encrypted master key, a key is generated based on the encrypted data key and the encrypted master key to determine the response information corresponding to the request, and then the response key is obtained, the response key is used to encrypt the response information to obtain encrypted response information, and then the encrypted response information is sent to the terminal.

[0193] The terminal receives the encrypted response information, then obtains the response key, uses the response key to decrypt the encrypted response information, obtains the encrypted data key and the encrypted master key corresponding to the user identification, obtains the user characteristic value and the operating system characteristic value, and performs the following operations on the user characteristic value and the operating system characteristic value: Fig.10 The processing shown generates a storage key, uses the storage key to encrypt the encrypted data key to obtain the target data key, uses the storage key to encrypt the encrypted master key to obtain the target master key, and then separately stores the target data key and the target master key in segments.

[0194] When the terminal needs to use the data key to encrypt the data to be encrypted, the terminal obtains the target data key and the target master key, and then obtains the user characteristic value and the operating system characteristic value, generates a storage key according to the user characteristic value and the operating system characteristic value, uses the storage key to decrypt the target data key and the target master key respectively, obtains the corresponding encrypted data key and encrypted master key, obfuscates the encrypted data key to obtain the obfuscated data key, uses the obfuscated data key to decrypt the encrypted master key to obtain the master key, uses the master key to decrypt the encrypted data key to obtain the data key, uses the data key to encrypt the data to be encrypted, and obtains the encrypted data corresponding to the data to be encrypted.

[0195] In the above key determination method, a key determination request is obtained, the key determination request is sent to the key center, the encrypted data key and the encrypted master key fed back by the key center based on the key determination request are obtained, the user characteristic value and the operating system characteristic value corresponding to the key determination request are obtained, the encrypted data key is encrypted based on the user characteristic value and the operating system characteristic value to obtain the target data key, and the encrypted master key is encrypted to obtain the target master key. The encrypted data key and the encrypted master key are obtained from the key center through the key determination request, the encrypted data key protects the data key, and the encrypted master key protects the master key, thereby improving the security performance of the data key and the master key, and then the encrypted data key and the encrypted master key are encrypted through the user characteristic value and the operating system characteristic value, the user characteristic value and the operating system characteristic value are directly obtained, thereby avoiding the risk of the user characteristic value and the operating system characteristic value being exposed during the transmission process, and the preservation key is generated based on the user characteristic value and the operating system characteristic value, the preservation key corresponding to different user characteristic values ​​and operating system characteristic values ​​is different, and the preservation key does not need to be stored locally, thereby improving the security of the preservation key, and the data key and the master key are encrypted again using the preservation key, thereby further improving the security performance of the data key and the master key.

[0196] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0197] Based on the same inventive concept, the embodiments of the present application also provide two key determination devices for implementing the key determination method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more key determination device embodiments provided below can refer to the limitations on the key determination method above, and will not be repeated here.

[0198] In one embodiment, Fig.11 As shown, a key determination device is provided, including: a first acquisition module 1102, a sending module 1104, a receiving module 1106 and a determination module 1108, wherein:

[0199] The first acquisition module 1102 is used to acquire a key determination request.

[0200] The sending module 1104 is used to send the key determination request to the key center.

[0201] The receiving module 1106 is used to obtain the encrypted data key and the encrypted master key fed back by the key center based on the key determination request.

[0202] The determination module 1108 is used to obtain the user characteristic value and the operating system characteristic value corresponding to the key determination request, encrypt the encrypted data key based on the user characteristic value and the operating system characteristic value to obtain the target data key, and encrypt the encryption master key with the user characteristic value and the operating system characteristic value to obtain the target master key.

[0203] In one embodiment, the determination module 1108 is also used to: merge the user characteristic value and the operating system characteristic value to obtain an initial characteristic value; perform hash algorithm encryption and scrambling on the initial characteristic value to obtain a target characteristic value; obtain a storage key based on the target characteristic value; encrypt the encrypted data key based on the storage key to obtain a target data key, and encrypt the encryption master key based on the storage key to obtain a target master key.

[0204] In one embodiment, the determination module 1108 is also used to: obtain the statistical number of times; perform hash algorithm encryption on the initial eigenvalue to obtain an intermediate eigenvalue; based on a preset method, scramble the intermediate eigenvalue to obtain a reference eigenvalue; update the statistical number of times to obtain an updated statistical number of times, and compare the updated statistical number of times with an encryption number threshold; if the updated statistical number of times is less than the encryption number threshold, use the reference eigenvalue as the initial eigenvalue, return to execute the step of performing hash algorithm encryption on the initial eigenvalue to obtain an intermediate eigenvalue, until the updated statistical number of times is equal to the encryption number threshold, and obtain the target eigenvalue.

[0205] In one embodiment, the first acquisition module 1102 is further used to: acquire an initial key determination request and a sending key; and encrypt the initial key determination request based on the sending key to obtain a key determination request.

[0206] In one embodiment, the key determination device also includes a saving module, which is used to: obtain a target confusion factor and a target random number corresponding to the user characteristic value and the operating system characteristic value; construct a target linear regression function based on the target random number; for each first data in the target data key, based on the first data and the target confusion factor, calculate the target linear regression function to obtain a data parameter set corresponding to the first data; for each second data in the master key, based on the second data and the target confusion factor, calculate the target linear regression function to obtain a main parameter set corresponding to the second data; save multiple data parameter sets corresponding to the target data key, and save multiple main parameter sets corresponding to the master key.

[0207] In one embodiment, Fig.12 As shown, a key determination device is provided, including: a second acquisition module 1202, a generation module 1204, an encryption module 1206 and a transmission module 1208, wherein:

[0208] The second acquisition module 1202 is used to acquire a key determination request sent by the terminal.

[0209] The generating module 1204 is used to generate a data key and a master key based on the key determination request.

[0210] The encryption module 1206 is used to encrypt the data key to obtain an encrypted data key, and to encrypt the master key to obtain an encrypted master key.

[0211] The transmission module 1208 is used to send the encrypted data key and the encryption master key to the terminal to instruct the terminal to generate a target data key based on the user characteristic value, the operating system characteristic value and the encrypted data key, and to generate a target master key based on the user characteristic value, the operating system characteristic value and the encryption master key.

[0212] In one embodiment, the encryption module 1206 is also used to: encrypt the data key based on the master key to obtain an encrypted data key; obfuscate the encrypted data key to obtain an obfuscated data key; and encrypt the master key based on the obfuscated data key to obtain an encrypted master key.

[0213] In one embodiment, the encryption module 1206 is also used to: scramble the encrypted data key to obtain an initial obfuscation key; encrypt the initial obfuscation key based on a preset encryption method to obtain an intermediate obfuscation key; and determine the intermediate obfuscation key with a preset number of bits as the obfuscated data key.

[0214] In one embodiment, the generation module 1204 is also used to: obtain a sending key, decrypt the key determination request based on the sending key to obtain an initial key determination request; obtain a user identifier corresponding to the initial key determination request, and generate a data key and a master key corresponding to the user identifier.

[0215] In one embodiment, the transmission module 1208 is also used to: generate response information based on the encrypted data key and the encryption master key; obtain a response key, encrypt the response information based on the response key to obtain encrypted response information; and send the encrypted response information to the terminal.

[0216] Each module in the key determination device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0217] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.13As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a key determination method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0218] Those skilled in the art will understand that Fig.13 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0219] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0220] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0221] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0222] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0223] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0224] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0225] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A key determination method, characterized in that: The method comprises: Get key confirmation request; Sending the key determination request to a key center; Obtaining the encrypted data key and the encrypted master key fed back by the key center based on the key determination request; Obtaining a user characteristic value and an operating system characteristic value corresponding to the key determination request, and fusing the user characteristic value and the operating system characteristic value to obtain an initial characteristic value; Obtain the statistical number of times; encrypt the initial eigenvalue by a hash algorithm to obtain an intermediate eigenvalue; based on a preset method, scramble the intermediate eigenvalue to obtain a reference eigenvalue; update the statistical number of times to obtain an updated statistical number of times, and compare the updated statistical number of times with an encryption number threshold; if the updated statistical number of times is less than the encryption number threshold, use the reference eigenvalue as the initial eigenvalue, return to execute the step of encrypting the initial eigenvalue by a hash algorithm to obtain an intermediate eigenvalue, until the updated statistical number of times is equal to the encryption number threshold, and obtain the target eigenvalue; Based on the target feature value, obtaining a storage key; The encrypted data key is encrypted based on the saved key to obtain a target data key, and the encrypted master key is encrypted based on the saved key to obtain a target master key.

2. The method according to claim 1, characterized in that The fusing the user characteristic value and the operating system characteristic value to obtain the initial characteristic value comprises: splicing the user characteristic value and the operating system characteristic value to obtain a spliced ​​characteristic value; The concatenated eigenvalues ​​are sorted according to a preset rule to obtain initial eigenvalues.

3. The method according to claim 1, characterized in that The obtaining key determination request comprises: When the terminal is turned on, a key confirmation request is generated.

4. The method according to claim 1, characterized in that: The obtaining key determination request comprises: Obtaining an initial key determination request and sending a key; The initial key determination request is encrypted based on the sending key to obtain a key determination request.

5. The method according to claim 1, characterized in that The key determination method further comprises: Obtaining a target confusion factor and a target random number corresponding to the user characteristic value and the operating system characteristic value; Constructing a target linear regression function based on the target random number; For each bit of first data in the target data key, based on the first data and the target confusion factor, the target linear regression function is calculated to obtain a data parameter set corresponding to the first data; For each bit of second data in the master key, based on the second data and the target confusion factor, the target linear regression function is calculated to obtain a set of master parameters corresponding to the second data; The multiple data parameter sets corresponding to the target data key are saved, and the multiple master parameter sets corresponding to the master key are saved.

6. The method according to claim 5, characterized in that The obtaining of the target confusion factor and the target random number corresponding to the user characteristic value and the operating system characteristic value comprises: Obtain user characteristic values ​​and operating system characteristic values; Based on the user characteristic value and the operating system characteristic value, a target confusion factor and a target random number corresponding to the user characteristic value and the operating system characteristic value are obtained.

7. The method according to claim 6, characterized in that The obtaining, based on the user characteristic value and the operating system characteristic value, a target confusion factor and a target random number corresponding to the user characteristic value and the operating system characteristic value comprises: fusing the user characteristic value and the operating system characteristic value to obtain a target characteristic value; Performing a hash encryption operation on the target feature value to obtain a first character string; Performing 64-bit encoding on the first character string to obtain a second character string; Sort the values ​​corresponding to the characters in the second character string in ascending order to obtain a target character string; The value corresponding to the first character in the target character string is used as the target random number, and the value corresponding to the forward character in the middle position of the target character string is used as the target confusion factor.

8. A key determination method, characterized in that: Applied to a key center, the method comprises: Obtaining a key confirmation request sent by the terminal; Based on the key determination request, generate a data key and a master key; Encrypting the data key based on the master key to obtain an encrypted data key; The encrypted data key is scrambled to obtain an initial obfuscated key; based on a preset encryption method, the initial obfuscated key is encrypted to obtain an intermediate obfuscated key; the intermediate obfuscated key with a preset number of bits is determined as the obfuscated data key; Based on the obfuscated data key, encrypting the master key to obtain an encrypted master key; The encrypted data key and the encrypted master key are sent to the terminal to instruct the terminal to generate a target data key based on the user characteristic value, the operating system characteristic value and the encrypted data key, and to generate a target master key based on the user characteristic value, the operating system characteristic value and the encryption master key.

9. The method according to claim 8, characterized in that The generating of the data key and the master key based on the key determination request includes: Obtaining a sending key, and decrypting the key determination request based on the sending key to obtain an initial key determination request; A user identifier corresponding to the initial key determination request is obtained, and a data key and a master key corresponding to the user identifier are generated.

10. The method according to claim 8, characterized in that The sending the encrypted data key and the encrypted master key to the terminal comprises: Generate response information based on the encrypted data key and the encrypted master key; Acquire a response key, and encrypt the response information based on the response key to obtain encrypted response information; The encrypted response information is sent to the terminal.

11. A key determination device, characterized in that: The device comprises: A first acquisition module, used to acquire a key determination request; A sending module, used to send the key determination request to a key center; A receiving module, used for obtaining the encrypted data key and the encrypted master key fed back by the key center based on the key determination request; A determination module is used to obtain a user characteristic value and an operating system characteristic value corresponding to the key determination request, merge the user characteristic value and the operating system characteristic value to obtain an initial characteristic value; obtain a statistical number of times; encrypt the initial characteristic value by a hash algorithm to obtain an intermediate characteristic value; scramble the intermediate characteristic value based on a preset method to obtain a reference characteristic value; update the statistical number of times to obtain an updated statistical number of times, and compare the updated statistical number of times with an encryption number threshold; if the updated statistical number of times is less than the encryption number threshold, use the reference characteristic value as the initial characteristic value, return to execute the step of encrypting the initial characteristic value by a hash algorithm to obtain an intermediate characteristic value, until the updated statistical number of times is equal to the encryption number threshold, and obtain a target characteristic value; obtain a saved key based on the target characteristic value; encrypt the encrypted data key based on the saved key to obtain a target data key, and encrypt the encrypted master key based on the saved key to obtain a target master key.

12. A key determination device, characterized in that: Applied to a key center, the device comprises: A second acquisition module, used to acquire a key determination request sent by the terminal; A generation module, configured to generate a data key and a master key based on the key determination request; An encryption module is used to encrypt the data key based on the master key to obtain an encrypted data key; scramble the encrypted data key to obtain an initial obfuscation key; encrypt the initial obfuscation key based on a preset encryption method to obtain an intermediate obfuscation key; determine the intermediate obfuscation key with a preset number of bits as the obfuscated data key; encrypt the master key based on the obfuscated data key to obtain an encrypted master key; A transmission module is used to send the encrypted data key and the encryption master key to the terminal to instruct the terminal to generate a target data key based on the user characteristic value, the operating system characteristic value and the encrypted data key, and to generate a target master key based on the user characteristic value, the operating system characteristic value and the encryption master key.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images