Key management method, device, apparatus and storage medium

Abstract

In the present application, the execution node in the computing node in the multi-party secure computing network splits the user input key into multiple sub-keys in the key generation period, and maps the sub-keys into matrix vectors according to the mapping relationship; the execution node obtains the position of the matrix element corresponding to the sub-key in the key according to the position of the sub-key in the user input key, generates a position matrix vector, and then obtains a key matrix vector through the position matrix vector and the matrix vector; finally, the execution node converts the position matrix vector into a preset sequence and returns it to the user, and splits the key matrix into N key fragments through a threshold secret sharing algorithm, sends the N key fragments to N computing nodes, and stores the key fragments on the chain for evidence by the N computing nodes, realizes trusted storage, restores the key through T computing nodes in the N computing nodes, realizes a decentralized key management scheme, and improves the scalability, reliability, maintainability and privacy of key management.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a key management method, apparatus, device, and storage medium. Background Technology

[0002] Key security is fundamental to ensuring the security of cryptographic algorithms. Key management in information systems involves several stages throughout its lifecycle, including generation, storage, import and export, distribution, use, backup and recovery, archiving, and destruction. Security vulnerabilities threaten the security of the system's keys at every stage.

[0003] Current key management schemes include centralized and distributed key management schemes. Centralized key management schemes utilize a "key management center" within the network to centrally manage all keys. This center receives user requests and provides secure key allocation services. Distributed key management schemes, on the other hand, involve the communicating parties negotiating and sharing session keys themselves, without any other restrictions.

[0004] However, centralized key management schemes rely too heavily on a "key management center." If this center fails, the entire key management communication system can collapse. Furthermore, centralized key storage significantly increases the risk of password leakage, reducing the reliability of key management. In distributed key management schemes, the two parties requiring secure communication communicate through a public channel to share a key. This approach is vulnerable to discrete logarithm attacks and man-in-the-middle attacks. While digital signatures can mitigate these attacks, storing the key yourself makes it susceptible to accidental or malicious loss, and the key is also at risk of theft. Summary of the Invention

[0005] This application provides a key management method, apparatus, device, and storage medium to solve the problems in the prior art that rely too heavily on a "key management center" and require both parties to communicate securely through a public channel to achieve a shared key, which leads to a high risk of password leakage and reduces the reliability of key management.

[0006] On one hand, this application provides a key management method, characterized in that the method is applied to a key management system, the system including a CA node, multiple computing nodes communicatively connected to the CA node, and a blockchain communicatively connected to the multiple computing nodes, the method comprising:

[0007] The execution node obtains the key input by the user and converts the key into a matrix vector; wherein, the execution node is a node among the plurality of computing nodes;

[0008] The execution node obtains a position matrix vector based on the corresponding position of each element in the matrix vector in the key, and obtains a key matrix vector based on the position matrix vector and the matrix vector.

[0009] The execution node splits the key matrix vector into N different key fragments using a threshold secret sharing algorithm, and distributes the N key fragments to N computing nodes so that the N computing nodes can store them in a trusted manner or store them through the blockchain. Each computing node distributes one key fragment, and different computing nodes distribute different key fragments. Any T key fragments can recover the key matrix vector, where T is less than N.

[0010] The execution node converts the position matrix vector into a preset sequence and returns it to the user.

[0011] Optionally, after the execution node converts the position matrix vector into a preset sequence and returns it to the user, the method further includes:

[0012] The execution node is selected from N computing nodes for decryption from T computing nodes;

[0013] The execution node obtains T key fragments from the T computing nodes and reconstructs the key matrix vector based on the T key fragments;

[0014] The execution node obtains the position matrix vector based on the preset sequence input by the user;

[0015] The execution node obtains a new matrix vector based on the position matrix vector and the key matrix vector;

[0016] The execution node obtains the key input by the user based on the new matrix vector.

[0017] Optionally, after the execution node obtains the user-input key based on the new matrix vector, the method includes:

[0018] The execution node encrypts the user key using a symmetric or asymmetric key and sends it to other key management devices.

[0019] Optionally, after the execution node converts the position matrix vector into a preset sequence and returns it to the user, the method further includes:

[0020] The execution node obtains the preset sequence input by the user through the login verification system;

[0021] The execution node obtains the position matrix vector according to the preset sequence;

[0022] The execution node obtains T key fragments from the T computing nodes and reconstructs the key matrix vector based on the T key fragments;

[0023] The execution node obtains a new matrix vector based on the position matrix vector and the key matrix vector;

[0024] The execution node obtains a new key based on the new matrix vector, verifies the new key, and logs in successfully after successful verification.

[0025] Optionally, the execution node converts the key into a matrix vector, including:

[0026] The execution node processes the key to obtain multiple sub-keys;

[0027] The execution node converts the multiple subkeys into a matrix vector according to a preset mapping relationship, wherein the preset mapping relationship is used to map the subkeys into elements in the matrix vector.

[0028] Optionally, the execution node obtains a position matrix vector based on the corresponding position of each element in the matrix vector within the key, including:

[0029] The execution node obtains the corresponding position of the element corresponding to each subkey in the key based on the position of each subkey in the key;

[0030] Based on the corresponding positions, a position matrix vector is obtained.

[0031] Secondly, this application provides a key management device, characterized in that the device is applied to a key management system, the system including a CA node, multiple computing nodes communicatively connected to the CA node, and a blockchain communicatively connected to the multiple computing nodes, the device comprising:

[0032] The acquisition module is used to acquire the key input by the user and convert the key into a matrix vector; wherein, the execution node is a node among the plurality of computing nodes;

[0033] The conversion module is used to obtain a position matrix vector based on the corresponding position of each element in the matrix vector in the key, and to obtain a key matrix vector based on the position matrix vector and the matrix vector.

[0034] The splitting module is used to split the key matrix vector into N different key fragments using a threshold secret sharing algorithm, and distribute the N key fragments to N computing nodes so that the N computing nodes can store them in a trusted manner or store them through the blockchain. Each computing node distributes one key fragment, and different computing nodes distribute different key fragments. Any T key fragments can recover the key matrix vector, where T is less than N.

[0035] The return module is used to convert the position matrix vector into a preset sequence and return it to the user.

[0036] Optionally, the device further includes: a selection module;

[0037] The selection module is used to select T computing nodes for decryption from N computing nodes, and the execution node is a node among the T computing nodes;

[0038] The acquisition module is further configured to acquire T key fragments from the T computing nodes, and recover the key matrix vector based on the T key fragments;

[0039] The acquisition module is further configured to acquire the position matrix vector based on the preset sequence input by the user;

[0040] The conversion module is further configured to obtain a new matrix vector based on the position matrix vector and the key matrix vector;

[0041] The conversion module is also used to obtain the key input by the user based on the new matrix vector.

[0042] Optionally, the device further includes: an encryption module;

[0043] The encryption module is used to encrypt the user key using a symmetric key or an asymmetric key and send it to other key management devices.

[0044] Optionally, the device further includes: a transmitting module;

[0045] The encryption module is further configured to encrypt the user key using a symmetric key or an asymmetric key, and the sending module is configured to send the encrypted user key to other key management devices.

[0046] The acquisition module is further configured to acquire a preset sequence input by the user through a login verification system; and acquire the position matrix vector based on the preset sequence.

[0047] The acquisition module is further configured to acquire T key fragments from the T computing nodes;

[0048] The conversion module is also used to recover the key matrix vector based on the T key fragments;

[0049] The conversion module is further configured to obtain a new matrix vector based on the position matrix vector and the key matrix vector;

[0050] The conversion module is also used to obtain a new key based on the new matrix vector;

[0051] The return module is also used to verify the new key. If the verification is successful, the login is successful.

[0052] Optionally, the splitting module is further configured to process the key to obtain multiple sub-keys;

[0053] The conversion module is further configured to convert the plurality of subkeys into a matrix vector according to a preset mapping relationship, wherein the preset mapping relationship is used to map the subkeys to elements in the matrix vector.

[0054] Optionally, the acquisition module is further configured to obtain the corresponding position of the element corresponding to the subkey in the key according to the position of each subkey in the key; and obtain a position matrix vector according to the corresponding position.

[0055] Thirdly, this application provides a key management system, characterized in that the system includes a CA node, multiple computing nodes communicatively connected to the CA node, and a blockchain communicatively connected to the multiple computing nodes, wherein the CA nodes form a regulatory agency network, the computer nodes form a multi-party secure computing network, and the blockchain nodes form a blockchain network.

[0056] The execution node in the multi-party secure computation network of the system is used to execute the method as described in any one of claims 1 to 6; the execution node is a node among the plurality of computation nodes;

[0057] The computing node is used to receive key fragments distributed by the execution node, and to store the key fragments in a trusted manner or through the blockchain;

[0058] Each computing node distributes a key shard, and different computing nodes distribute different key shards. Any T key shards can recover the key matrix vector, where T is less than N.

[0059] CA nodes provide identity certificates to nodes in the multi-party secure computation network (MPC) and blockchain network, proving the legitimacy of the nodes. The blockchain network is used to achieve trusted storage of keys; that is, computing nodes in the MPC encrypt and upload their stored key fragments to the blockchain for verification. The MPC is used to perform specific key management operations, ensuring the security and trustworthiness of keys throughout their entire lifecycle. Regulatory agency networks, the MPC network, and the blockchain network are interconnected and work together to achieve key management throughout the entire key lifecycle.

[0060] Fourthly, this application provides a key management device, comprising:

[0061] Memory;

[0062] processor;

[0063] The memory stores computer-executed instructions;

[0064] The processor executes computer execution instructions stored in the memory to implement the key management method as described in the first aspect and various possible implementations of the first aspect.

[0065] Fifthly, this application provides a computer storage medium storing computer execution instructions thereon, which are executed by a processor to implement the key management method as described in the first aspect and various possible implementations of the first aspect.

[0066] The key management method provided in this application involves an execution node splitting the user-input key into multiple sub-keys during the key generation cycle, and mapping the sub-keys into matrix vectors according to a mapping relationship. Subsequently, the execution node obtains the position of the matrix element corresponding to the sub-key within the user-input key based on the position of the sub-key, generating a position matrix vector. The execution node then obtains the key matrix vector using the position matrix vector and the sub-key mapped matrix vector. Finally, the execution node converts the position matrix vector into a preset sequence and returns it to the user. Simultaneously, a threshold secret sharing algorithm is used to split the key matrix into N key fragments, which are then sent to N computing nodes. The N computing nodes store the fragments on the blockchain for evidence, achieving trusted storage. This method proposes a way to convert the user key into a position matrix vector and a key matrix vector, and uses secret sharing to store each key fragment in trusted storage within a multi-party secure computing network. In blockchain trusted storage, only encrypted key fragments from computing nodes are stored. Other nodes can only see the encrypted information, ensuring the security and trustworthiness of this key management method throughout the key's entire lifecycle. Users holding the location matrix vector can clearly define key ownership, achieving secure, flexible, and diverse integrated management. The executing computing node sends N keys to N computing nodes via a threshold secret sharing algorithm. These N computing nodes jointly store the key fragments. This method avoids the situation where, if a computing node's stored key is attacked or leaked, the key cannot be recovered. This embodies decentralized key management, ensuring that key storage rights are not limited to a single node but are collaboratively stored by multiple nodes. Attached Figure Description

[0067] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0068] Figure 1 This is a schematic diagram of the key lifecycle of the key management method provided in this application.

[0069] Figure 2 This is a schematic diagram illustrating a scenario of the key management method provided in this application.

[0070] Figure 3 This application provides a flowchart of the key management method. Figure 1 .

[0071] Figure 4 This application provides a flowchart of the key management method. Figure 2 .

[0072] Figure 5 This application provides a flowchart of the key management method. Figure 3 .

[0073] Figure 6 This application provides a flowchart of the key management method. Figure 4 .

[0074] Figure 7 This is a schematic diagram of the key management device provided in this application.

[0075] Figure 8 This is a schematic diagram of the key management device provided in this application.

[0076] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0077] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0078] The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented, for example, in orders other than those illustrated or described herein.

[0079] In this application, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0080] First, the terms used in this application will be explained.

[0081] Key: A key is a secret piece of information used to perform cryptographic applications such as encryption, decryption, and integrity verification. In symmetric cryptography, the same key is used for encryption and decryption, so the key must be kept secret. In public-key cryptography, however, different keys are used for encryption and decryption; typically, one is public, called the public key, and the other is kept secret, called the private key.

[0082] Symmetric and asymmetric encryption: Symmetric encryption uses a single-key cryptosystem, where the same key can be used for both encryption and decryption. This method is called symmetric encryption, also known as single-key encryption. Asymmetric encryption uses a pair of unique keys: a public key and a private key. In public-key cryptography, the key not publicly disclosed is the private key, and the key publicly disclosed is the public key.

[0083] Key management: A key, also known as a cryptographic key, generally refers to various encryption technologies used in production and daily life, enabling effective supervision of personal data and corporate secrets. Key management refers to the act of managing keys. Key management spans all stages from key generation to key destruction, mainly manifested in the management of key systems, protocols, and the generation, distribution, replacement, and injection of keys.

[0084] CA Nodes: CA nodes are the Certificate Authorities (CAs) of the Fabric network, a blockchain network with access control. CA nodes provide members of the Fabric network with identity information based on digital certificates, and can generate or revoke member identity certificates. All operations on the blockchain network require user identity verification.

[0085] Blockchain: A blockchain is a chain of multiple blocks. Each block stores corresponding information, and the blocks are linked together in chronological order of their creation. The blockchain is stored on all servers, and as long as there are normally functioning servers in the entire system, the entire blockchain is secure. Servers in the blockchain are called nodes, and each server node provides storage space and computing power support for the entire blockchain system.

[0086] Key security in network applications requires different types of keys to play different roles in the security system. For example, a session key is used to encrypt the data information of the communication, while a key encryption key is used to encrypt and protect the session key.

[0087] Based on the key system, cryptography can be classified into symmetric encryption and asymmetric encryption. Based on the function of the key, it can be classified into session keys, key encryption keys, and master keys. A session key is used to encrypt user data during communication or data exchange; a key encryption key is used to encrypt the session key, i.e., the session key used to encrypt user data; the master key is a long-term shared secret key between a pair of users, often serving as a seed for generating session and key encryption keys, and ensuring the distribution and security of these keys. Key security is fundamental to the security of cryptographic algorithms.

[0088] Key management in information systems spans the entire lifecycle of keys. Figure 1 The key lifecycle diagram for the key management method provided in this application is shown. According to GM / T-0054-2018 "Basic Requirements for Cryptographic Applications in Information Systems", key management in information systems involves generation, storage, import and export, distribution, use, backup and recovery, archiving, and destruction during its lifecycle. In all these processes, there are potential threats to the security of system keys.

[0089] Current key management schemes include centralized and distributed key management schemes. Centralized key management schemes manage all communication nodes through a "key management center" in the network, which can also act as a trusted third party. Centralized key management makes the tasks of the key management center high-frequency and complex. Distributed key management schemes, on the other hand, involve the communicating parties negotiating and sharing session keys themselves, without any other restrictions.

[0090] However, in centralized key management schemes, the failure of the key management center can easily lead to the collapse of the entire key management communication, reducing the reliability of key management and increasing security risks. Simultaneously, as the network scales up, the maintenance and update costs of the key management center increase, and the existence of the key management center can easily cause disputes over copyright issues related to shared resources. Although this scheme has certain advantages in management and control for small key management networks, given its various shortcomings, it is not suitable for large-scale key management applications. In distributed key management schemes, the process of two parties communicating securely through a public channel to achieve a shared key is vulnerable to discrete logarithm attacks and man-in-the-middle attacks. Although digital signature technology can be used to prevent attacks, storing the key yourself makes it susceptible to accidental or malicious loss, and the key is also at risk of being stolen.

[0091] To address the problems existing in current technologies, this application proposes a key management method with three fundamental characteristics: secure and trustworthy key throughout its entire lifecycle, user-controlled key autonomy, and support for distributed collaborative governance among all parties. This scheme, based on the principle of interoperability and collaboration among various communication service components, establishes collaborative management, generation, storage, and supervision of various service modules, achieving secure, resilient, and flexible integrated key management.

[0092] Figure 2 A schematic diagram illustrating a scenario for the key management method provided in this application. For example... Figure 2As shown, the scenario includes a CA node, multiple computing nodes communicatively connected to the CA node, and a blockchain communicatively connected to the multiple computing nodes. The CA nodes form a regulatory network, the computer nodes form a multi-party secure computing network, and the blockchain nodes form a blockchain network. The CA node provides identity certificates to each node in the multi-party secure computing network and the blockchain network, proving the legitimacy of the node. The blockchain network is used to achieve trusted storage of keys, that is, the computing nodes in the multi-party secure computing network encrypt their stored key fragments and upload them to the blockchain for evidence storage. The multi-party secure computing network is used to perform specific key management operations, ensuring the security and trustworthiness of the key throughout its entire lifecycle. The regulatory network, the multi-party secure computing network, and the blockchain network are interconnected and work together to achieve key management throughout its entire lifecycle.

[0093] In this application, the execution node among the computing nodes in the multi-party secure computation network splits the user-input key into multiple sub-keys during the key generation cycle, and maps the sub-keys into matrix vectors according to the mapping relationship. Subsequently, the execution node obtains the position of the matrix element corresponding to the sub-key in the key according to the position of the sub-key in the user-input key, and generates a position matrix vector. The execution node then obtains the key matrix vector through the position matrix vector and the matrix vector. Finally, the execution node converts the position matrix vector into a preset sequence and returns it to the user. At the same time, it splits the key matrix into N key fragments through a threshold secret sharing algorithm, and sends the N key fragments to N computing nodes. The N computing nodes put the key fragments on the blockchain for evidence storage, realizing trusted storage. The key can be recovered through T computing nodes among the N computing nodes, thereby realizing a decentralized key management scheme and improving the scalability, reliability, maintainability and privacy of key management.

[0094] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0095] Figure 3 This application provides a flowchart of the key management method. Figure 1 This embodiment applies to a key management system, which includes a CA node, multiple computing nodes communicatively connected to the CA node, and a blockchain communicatively connected to the multiple computing nodes. (Example:) Figure 3 As shown in this embodiment, the key management method includes:

[0096] S101: The execution node obtains the key input by the user and converts the key into a matrix vector; wherein, the execution node is a node among the plurality of computing nodes.

[0097] In this system, the user-input key is in the form of words or Chinese character sequences that are easy for the user to understand. The computer system converts these words or character sequences into binary strings that are easy for machines to read and write. That is, the user key obtained by the execution node is the binary string converted by the computer system. It is understood that binary strings have many conversion forms in a computer system. For example, splitting a binary string by different bits can result in substrings that represent different decimal numbers. The key management system can preset mapping tables according to different mapping methods. These mapping tables store the converted forms of the substrings, i.e., the elements in the matrix vector. This scheme does not restrict the mapping method. After mapping all substrings in the binary string, the matrix vector is obtained.

[0098] The execution node is a node among the plurality of computing nodes. The number of execution nodes may be the same as or different from the total number of computing nodes. The function of the execution node can be understood as the primary operation node in key management, used to complete various operations in key management.

[0099] S102: The execution node obtains a position matrix vector based on the corresponding position of each element in the matrix vector in the key, and obtains a key matrix vector based on the position matrix vector and the matrix vector.

[0100] The execution node can obtain the binary substrings corresponding to each element in the matrix vector through the mapping table. It can be understood that since the substrings are obtained by the execution node converting the user-input key into a binary string and splitting it, the substrings have corresponding positions in the complete string. That is, the matrix elements mapped to the substrings have corresponding positions in the key. The execution node can obtain the position matrix vector based on the corresponding positions. The position matrix vector must satisfy the condition of matrix inversion operation, that is, the position matrix vector should be an invertible matrix vector, so as to satisfy the condition of obtaining the key matrix vector from the position matrix vector and the matrix vector in the subsequent steps.

[0101] Understandably, each element in the position matrix vector represents the corresponding position of each element in the key. The corresponding position can be, for example, the position number obtained by calculating the binary substring mapped by each element in the matrix vector in order from high bit to low bit before splitting, or the position number obtained by calculating the position in order from low bit to high bit. This scheme does not restrict the way the corresponding position is obtained, and the position number is an integer.

[0102] The method for obtaining the key matrix vector based on the position matrix vector and the matrix vector can be, for example, by multiplying the inverse of the position matrix vector on the left by the matrix vector according to the matrix operation rules, to obtain the key matrix vector; or by multiplying the inverse of the position matrix vector on the right by the matrix vector, to obtain the key matrix vector. This scheme does not limit the method for obtaining the key matrix vector.

[0103] S103: The execution node splits the key matrix vector into N different key fragments using a threshold secret sharing algorithm, and distributes the N key fragments to N computing nodes so that the N computing nodes can perform trusted storage or store them through the blockchain. Each computing node distributes one key fragment, and different computing nodes distribute different key fragments. Any T key fragments can recover the key matrix vector, where T is less than N.

[0104] In this process, the execution node splits the key matrix vector into N distinct key fragments using a threshold secret sharing algorithm. The number of key fragments may be the same as or different from the total number of computing nodes in the multi-party secure computation network. Understandably, the execution node sends the N key fragments to the N computing nodes, with different computing nodes distributing different key fragments, reflecting the decentralization of key management. To ensure key security, the N computing nodes need to store their key fragments in a trusted manner or via a blockchain. This storage process can be, for example, where a computing node encrypts its stored key fragments using a public key and stores the encrypted key fragments on the blockchain.

[0105] S104: The execution node converts the position matrix vector into a preset sequence and returns it to the user.

[0106] The preset sequence is a sequence of words or Chinese characters that are easy for users to understand, corresponding to each element in the position matrix. The preset sequence can be generated, for example, by converting the elements in the position matrix into ASCII codes or Chinese character codes that are the same as the position numbers they represent.

[0107] Understandably, in order to further ensure the security of the user's key, the execution node can use symmetric or asymmetric encryption methods to encrypt the above preset sequence, that is, the preset sequence returned to the user can be the encrypted ciphertext sequence.

[0108] The key management method provided in this embodiment obtains the user-input key through an execution node, and converts the key into a matrix vector according to a preset mapping relationship. Each element in the matrix vector has a corresponding mapping position in the key. The execution node generates a position matrix vector based on these positions, and then obtains the key matrix vector using the position matrix vector and the matrix vector. Finally, the execution node converts the position matrix vector into a preset sequence and returns it to the user. A threshold secret sharing algorithm is then used to split the key matrix into fragments, which are sent to the computing node. The computing node then stores these fragments on the blockchain for evidence. This method achieves collaborative key generation and collaborative key storage in key management, ensuring key security throughout its lifecycle and providing trusted key storage.

[0109] Figure 4 This is the flow chart of the key management method provided in the embodiments of this application. Figure 2 This embodiment is... Figure 2 Based on the embodiments, a detailed description of the key management method in terms of the key generation cycle and key storage cycle is provided. For example... Figure 4 As shown in this embodiment, the key management method includes:

[0110] S201: The execution node obtains the key input by the user, processes the key, and obtains multiple sub-keys.

[0111] The user-input key is in the form of easily understandable words or Chinese character sequences. Since the computer system uses binary storage and processing, this word or character sequence is converted into a binary string. Therefore, the user key obtained by the execution node is in binary string form. Understandably, binary strings have many conversion forms in a computer system. For example, splitting a binary string by different bits can result in substrings that represent different decimal numbers. These split substrings are the subkeys.

[0112] S202: The execution node converts the plurality of subkeys into a matrix vector according to a preset mapping relationship, wherein the preset mapping relationship is used to map the subkeys into elements in the matrix vector.

[0113] The binary string has many conversion forms in the computer system. Based on different conversion forms, the mapping relationship between the binary substring and its conversion element can be obtained, that is, the mapping relationship between the subkey and its corresponding element. The set of all subkey preset relationships constitutes a preset mapping table. After all the subkeys are mapped according to the preset mapping table, the matrix vector is obtained.

[0114] The execution node is a node among the plurality of computing nodes. The number of execution nodes may be the same as or different from the total number of computing nodes. The function of the execution node can be understood as the primary operation node in key management, used to complete various operations in key management.

[0115] S203: The execution node obtains the corresponding position of the element corresponding to each subkey in the key based on the position of each subkey in the key, and obtains the position matrix vector based on the corresponding position.

[0116] The execution node can obtain the binary substrings corresponding to each element in the matrix vector, i.e., the subkeys, through the mapping table. It is understood that since the subkeys are obtained by the execution node converting the user-input key into a binary string and splitting it, the subkeys have corresponding positions in the complete string. That is, the matrix elements mapped to the subkeys have corresponding positions in the key. The execution node can obtain a position matrix vector based on these corresponding positions. The position matrix vector must satisfy the conditions for matrix inversion, i.e., the position matrix vector should be an invertible matrix vector, to satisfy the condition for obtaining the key matrix vector from the position matrix vector and the matrix vector in subsequent steps.

[0117] Understandably, each element in the position matrix vector represents the corresponding position of each element in the key. The corresponding position can be, for example, the position number obtained by calculating the binary substring mapped by each element in the matrix vector in order from high bit to low bit before splitting, or the position number obtained by calculating the position in order from low bit to high bit. This scheme does not restrict the way the corresponding position is obtained, and the position number is an integer.

[0118] S204: The execution node obtains the key matrix vector based on the position matrix vector and the matrix vector.

[0119] The method for obtaining the key matrix vector based on the position matrix vector and the matrix vector can be, for example, by multiplying the inverse of the position matrix vector on the left by the matrix vector according to matrix operation rules to obtain the key matrix vector; or by multiplying the inverse of the position matrix vector on the right by the matrix vector to obtain the key matrix vector. This scheme does not limit the method for obtaining the key matrix vector. The key matrix vector is split into key fragments and stored on the blockchain in subsequent steps.

[0120] S205: The execution node splits the key matrix vector into N different key fragments using a threshold secret sharing algorithm, and distributes the N key fragments to N computing nodes so that the N computing nodes can store them in a trusted manner or store them through the blockchain. Each computing node distributes one key fragment, and different computing nodes distribute different key fragments. Any T key fragments can recover the key matrix vector, where T is less than N.

[0121] The execution node uses a threshold secret sharing algorithm to split the key matrix vector into N different key fragments. The number of key fragments may be the same as or different from the total number of computing nodes in the multi-party secure computation network. For example, the splitting method may be to randomly split the key matrix vector into matrices with the same or different number of rows and columns, where the number of rows and columns of the matrices is less than the number of rows and columns of the key matrix vector. This scheme does not impose restrictions on the splitting method.

[0122] Understandably, the execution node sends N key fragments to N computing nodes, with different computing nodes distributing different key fragments. This method embodies decentralization in the key management process. To ensure key security, the N computing nodes need to store their stored key fragments in a trusted manner or via a blockchain. For example, the storage process could involve a computing node encrypting its stored key fragments using a public key and then storing the encrypted key fragments on the blockchain.

[0123] S206: The execution node converts the position matrix vector into a preset sequence and returns it to the user.

[0124] The preset sequence is a sequence of words or Chinese characters that are easy for users to understand, corresponding to each element in the position matrix. In order to further ensure the security of the user's key, the execution node can use symmetric encryption or asymmetric encryption methods to encrypt the preset sequence. That is, the preset sequence returned to the user can be an encrypted ciphertext sequence.

[0125] The key management method provided in this embodiment involves an execution node splitting the user-input key into multiple sub-keys during the key generation cycle, and mapping the sub-keys into matrix vectors according to a mapping relationship. Subsequently, the execution node obtains the position of the matrix element corresponding to the sub-key in the key based on the position of the sub-key within the user-input key, generating a position matrix vector. The execution node then obtains the key matrix vector using the position matrix vector and the sub-key mapped matrix vector. Finally, the execution node converts the position matrix vector into a preset sequence and returns it to the user. Simultaneously, a threshold secret sharing algorithm is used to split the key matrix into N key fragments, which are then sent to N computing nodes. The N computing nodes store the fragments on the blockchain for evidence, achieving trusted storage. This method proposes a way to convert the user key into a position matrix vector and a key matrix vector, and uses secret sharing to store each key fragment in trusted storage within a multi-party secure computing network. In blockchain trusted storage, only encrypted key fragments from computing nodes are stored. Other nodes can only see the encrypted information, ensuring the security and trustworthiness of this key management method throughout the key's entire lifecycle. Users holding the location matrix vector can clearly define key ownership, achieving secure, flexible, and diverse integrated management. The executing computing node sends N keys to N computing nodes via a threshold secret sharing algorithm. These N computing nodes jointly store the key fragments. This method avoids the situation where, if a computing node's stored key is attacked or leaked, the key cannot be recovered. This embodies decentralized key management, ensuring that key storage rights are not limited to a single node but are collaboratively stored by multiple nodes.

[0126] Figure 5 This is the flow chart of the key management method provided in the embodiments of this application. Figure 3 This embodiment is... Figure 3 Based on Embodiment 4, a detailed description of the key management method during the key export cycle is provided. For example... Figure 5 As shown in this embodiment, the key management method includes:

[0127] S301: The execution node selects T computing nodes from N computing nodes for decryption, wherein the execution node is a node among the T computing nodes.

[0128] According to the threshold secret sharing algorithm, when it is necessary to decrypt and recover the key, any T computing nodes out of the N computing nodes can cooperate to recover the key. If the number of computing nodes used to recover the key is less than T, then recovery is not possible, where T is less than N.

[0129] S302: The execution node obtains T key fragments from the T computing nodes and restores the key matrix vector based on the T key fragments.

[0130] The T computing nodes store encrypted key fragments in their trusted storage. Each of the T computing nodes needs to decrypt its own stored key fragments; that is, the T key fragments obtained by the execution node from the T computing nodes are the decrypted key fragments. The execution node can recover the key matrix vector before splitting from the T key fragments using the threshold secret sharing algorithm; that is, the execution node recovers the key matrix vector based on the T key fragments.

[0131] S303: The execution node obtains the position matrix vector based on the preset sequence input by the user.

[0132] The preset sequence is a sequence of words or Chinese characters that are easy for the user to understand, corresponding to each element in the position matrix. The execution node can obtain the position matrix vector based on the preset sequence input by the user, according to the correspondence. If the execution node encrypts the preset sequence input by the user using symmetric or asymmetric encryption during the key generation cycle, the preset sequence input by the user must first be decrypted, and the position matrix can be obtained from the decrypted sequence according to the correspondence.

[0133] S304: The execution node obtains a new matrix vector based on the position matrix vector and the key matrix vector.

[0134] The method for obtaining the new matrix vector can be either left-multiplying the position matrix vector by the key matrix vector, or right-multiplying the position matrix vector by the key matrix vector. The vector multiplication rule must conform to the matrix multiplication logic of the step in the key generation cycle where the key matrix vector is obtained from the matrix vector and the position matrix vector.

[0135] S305: The execution node obtains the key input by the user based on the new matrix vector.

[0136] In this new matrix vector, each element corresponds to a binary character substring with a mapping relationship. The binary character substring is obtained by splitting the binary string converted from the user-input key in the computer system.

[0137] Understandably, the steps by which the execution node obtains the user-input key based on the new matrix vector include: the execution node obtains a binary character substring that has a mapping relationship with each element in the matrix, thereby obtaining the binary string of the user-input key converted in the computer system, and finally converting the binary string into words or Chinese character sequences to obtain the user-input key.

[0138] Optionally, after the execution node obtains the user-input key based on the new matrix vector, the key can be shared among different key management devices, i.e., the key can be distributed to different key management devices. This process represents the key distribution cycle in the entire key management lifecycle, including:

[0139] The execution node encrypts the user key using either a symmetric or asymmetric key and sends it to other key management devices. Encrypting the key during the key distribution cycle ensures key security throughout the distribution period.

[0140] The key management method provided in this embodiment involves an execution node obtaining T key fragments from T computing nodes using a threshold secret sharing algorithm. Based on these T key fragments, a key matrix vector is reconstructed. Then, a position matrix vector is obtained based on a preset sequence input by the user. Finally, a new matrix vector is generated using the position matrix vector and the key matrix vector to obtain the user-input key. After obtaining the user-input key, it is encrypted and sent to other key management devices for sharing. This method ensures that the key is not exported outside the key management device in plaintext, guaranteeing key security during both the key export and distribution phases throughout the key's lifecycle.

[0141] Figure 6 This is the flow chart of the key management method provided in the embodiments of this application. Figure 4 This embodiment is... Figure 3 Based on the embodiments or 4, a detailed description of the key management method during the key usage cycle is provided. For example... Figure 6 As shown in this embodiment, the key management method includes:

[0142] S401: The execution node obtains the preset sequence input by the user by verifying the login system.

[0143] The verification login system is a third-party system, where users enter a preset sequence to log in to the third-party system using a key.

[0144] S402: The execution node obtains the position matrix vector according to the preset sequence.

[0145] Step S402 is the same as step S303, and will not be described in detail here.

[0146] S403: The execution node obtains T key fragments from T computing nodes and restores the key matrix vector based on the T key fragments.

[0147] Step S403 is the same as step S302, and will not be described in detail here.

[0148] S404: The execution node obtains a new matrix vector based on the position matrix vector and the key matrix vector.

[0149] Step S404 is the same as step S304, and will not be described in detail here.

[0150] S405: The execution node obtains a new key based on the new matrix vector, verifies the new key, and logs in successfully after successful verification.

[0151] The execution node obtains a new key based on the new matrix vector, and the steps are the same as in S305, so they will not be repeated here.

[0152] The verification failure could be due to reasons such as the key already being used by another key management system, meaning the key has been used for different purposes. Understandably, using a key for different purposes may reduce its security; keys for different purposes have different requirements; restricting the use of a key can reduce the potential damage caused by key leakage, hence the verification failure in this case.

[0153] The key management method provided in this embodiment involves an execution node obtaining a preset sequence of user input through a login verification system, and acquiring a position matrix vector. The execution node then recovers the key matrix vector from the computing node using a threshold secret sharing algorithm. Based on the position matrix vector and the key matrix vector, a new matrix vector is obtained and converted into a new key. Finally, the execution node verifies the new key and returns the login verification result to the login verification system. The key can generally only be used within an approved key management device. This method ensures the security of the key throughout its lifecycle and reduces the potential damage caused by key leakage.

[0154] Figure 2 This is a schematic diagram of a scenario for the key management method provided in this application, illustrating the key management system provided in this application.

[0155] The system includes CA nodes, multiple computing nodes communicatively connected to the CA nodes, and a blockchain communicatively connected to the multiple computing nodes. The CA nodes form a regulatory network, the computing nodes form a multi-party secure computation network, and the blockchain nodes form a blockchain network. The CA nodes provide identity certificates to each node in the multi-party secure computation network and the blockchain network, proving the node's legitimacy. The blockchain network is used to achieve trusted key storage; that is, computing nodes in the multi-party secure computation network encrypt their stored key fragments and upload them to the blockchain for verification. The multi-party secure computation network is used to perform specific key management operations, ensuring the security and trustworthiness of the key throughout its entire lifecycle. The regulatory network, the multi-party secure computation network, and the blockchain network are interconnected and collaboratively achieve key management throughout its entire lifecycle.

[0156] Figure 7 This is a schematic diagram of the key management device provided in this application. The device is applied to a key management system, which includes a CA node, multiple computing nodes communicatively connected to the CA node, and a blockchain communicatively connected to the multiple computing nodes. The device includes:

[0157] The acquisition module 401 is used to acquire the key input by the user and convert the key into a matrix vector; wherein, the execution node is a node among the plurality of computing nodes;

[0158] The conversion module 402 is used to obtain a position matrix vector based on the corresponding position of each element in the matrix vector in the key, and to obtain a key matrix vector based on the position matrix vector and the matrix vector.

[0159] The splitting module 403 is used to split the key matrix vector into N different key fragments using a threshold secret sharing algorithm, and distribute the N key fragments to N computing nodes so that the N computing nodes can perform trusted storage or store them through the blockchain. Each computing node distributes one key fragment, and different computing nodes distribute different key fragments. Any T key fragments can recover the key matrix vector, where T is less than N.

[0160] The return module 404 is used to convert the position matrix vector into a preset sequence and return it to the user.

[0161] Optionally, the device further includes: a selection module 405;

[0162] The selection module 405 is used to select T computing nodes for decryption from N computing nodes, and the execution node is a node among the T computing nodes;

[0163] The acquisition module 401 is further configured to acquire T key fragments from the T computing nodes and recover the key matrix vector based on the T key fragments;

[0164] The acquisition module 401 is further configured to acquire the position matrix vector based on the preset sequence input by the user;

[0165] The conversion module 402 is further configured to obtain a new matrix vector based on the position matrix vector and the key matrix vector;

[0166] The conversion module 402 is also used to obtain the key input by the user based on the new matrix vector.

[0167] Optionally, the device further includes: an encryption module 406;

[0168] The encryption module 406 is used to encrypt the user key using a symmetric key or an asymmetric key and send it to other key management devices.

[0169] Optionally, the device further includes: a transmitting module 407;

[0170] The encryption module 406 is further configured to encrypt the user key using a symmetric key or an asymmetric key, and the sending module 407 is configured to send the encrypted user key to other key management devices.

[0171] The acquisition module 401 is further configured to acquire a preset sequence input by the user through the login verification system; and acquire the position matrix vector according to the preset sequence.

[0172] The acquisition module 401 is further configured to acquire T key fragments from the T computing nodes;

[0173] The conversion module 402 is further configured to recover the key matrix vector based on the T key fragments;

[0174] The conversion module 402 is further configured to obtain a new matrix vector based on the position matrix vector and the key matrix vector;

[0175] The conversion module 402 is further configured to obtain a new key based on the new matrix vector;

[0176] The return module 404 is also used to verify the new key. If the verification is successful, the login is successful.

[0177] Optionally, the splitting module 403 is further configured to process the key to obtain multiple sub-keys;

[0178] The conversion module 402 is further configured to convert the plurality of subkeys into a matrix vector according to a preset mapping relationship, wherein the preset mapping relationship is used to map the subkeys to elements in the matrix vector.

[0179] Optionally, the acquisition module 401 is further configured to acquire the corresponding position of the element corresponding to the subkey in the key according to the position of each subkey in the key; and obtain a position matrix vector according to the corresponding position.

[0180] Figure 8 This is a schematic diagram of the key management device provided in this application. The key management device includes:

[0181] Memory;

[0182] processor;

[0183] The memory stores computer-executed instructions;

[0184] The processor executes computer execution instructions stored in the memory to implement the key management method as described in the first aspect and various possible implementations of the first aspect.

[0185] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the key management method performed by the aforementioned key management device.

[0186] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0187] The technical solutions of this application have been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it is readily understood by those skilled in the art that the scope of protection of this application is obviously not limited to these specific embodiments. The above embodiments are only used to illustrate the technical solutions of this application and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A key management method, characterized in that, The method is applied to a key management system, the system including a CA node, multiple computing nodes communicatively connected to the CA node, and a blockchain communicatively connected to the multiple computing nodes, the method including: An execution node obtains the key input by the user, processes the key to obtain multiple subkeys, and converts the multiple subkeys into a matrix vector according to a preset mapping relationship; wherein, the preset mapping relationship is used to map the subkeys to elements in the matrix vector; the execution node is a node among the multiple computing nodes; the key is a binary string, and the subkeys are substrings obtained by splitting the key according to different bit positions; The execution node obtains the corresponding position of the element corresponding to each subkey in the key based on the position of each subkey in the key; obtains a position matrix vector based on the corresponding position, the position matrix vector being an invertible matrix vector; and obtains a key matrix vector based on the position matrix vector and the matrix vector. The execution node splits the key matrix vector into N different key fragments using a threshold secret sharing algorithm, and distributes the N key fragments to N computing nodes so that the N computing nodes can store them in a trusted manner or store them through the blockchain. Each computing node distributes one key fragment, and different computing nodes distribute different key fragments. Any T key fragments can recover the key matrix vector, where T is less than N. The execution node converts the position matrix vector into a preset sequence and returns it to the user; the preset sequence is a sequence of words or Chinese characters corresponding to each element in the position matrix.

2. The method according to claim 1, characterized in that, After the execution node converts the position matrix vector into a preset sequence and returns it to the user, the method further includes: The execution node is selected from N computing nodes for decryption from T computing nodes; The execution node obtains T key fragments from the T computing nodes and reconstructs the key matrix vector based on the T key fragments; The execution node obtains the position matrix vector based on the preset sequence input by the user; The execution node obtains a new matrix vector based on the position matrix vector and the key matrix vector; The execution node obtains the key input by the user based on the new matrix vector.

3. The method according to claim 2, characterized in that, After the execution node obtains the user-input key based on the new matrix vector, the method includes: The execution node encrypts the user key using a symmetric or asymmetric key and sends it to other key management devices.

4. The method according to claim 1, characterized in that, After the execution node converts the position matrix vector into a preset sequence and returns it to the user, the method further includes: The execution node obtains the preset sequence input by the user through the login verification system; The execution node obtains the position matrix vector according to the preset sequence; The execution node obtains T key fragments from the T computing nodes and reconstructs the key matrix vector based on the T key fragments; The execution node obtains a new matrix vector based on the position matrix vector and the key matrix vector; The execution node obtains a new key based on the new matrix vector, verifies the new key, and logs in successfully after successful verification.

5. A key management device, characterized in that, An application is made in a key management system, the system comprising a CA node, multiple computing nodes communicatively connected to the CA node, and a blockchain communicatively connected to the multiple computing nodes, wherein the device is a computing node among the multiple computing nodes, and the device comprises: The acquisition module is used to execute nodes to acquire the key input by the user, process the key to obtain multiple subkeys, and convert the multiple subkeys into a matrix vector according to a preset mapping relationship; wherein, the preset mapping relationship is used to map the subkeys to elements in the matrix vector; the execution node is a node among the multiple computing nodes; the key is a binary string, and the subkeys are substrings obtained by splitting the key according to different bit positions; The conversion module is used by the execution node to obtain the corresponding position of the element corresponding to each subkey in the key according to the position of each subkey in the key; to obtain a position matrix vector according to the corresponding position, wherein the position matrix vector is an invertible matrix vector; and to obtain a key matrix vector according to the position matrix vector and the matrix vector. The splitting module is used to split the key matrix vector into N different key fragments using a threshold secret sharing algorithm, and distribute the N key fragments to N computing nodes so that the N computing nodes can store them in a trusted manner or store them through the blockchain. Each computing node distributes one key fragment, and different computing nodes distribute different key fragments. Any T key fragments can recover the key matrix vector, where T is less than N. The return module is used to convert the position matrix vector into a preset sequence and return it to the user; the preset sequence is a sequence of words or Chinese characters corresponding to each element in the position matrix.

6. A key management system, characterized in that, The system includes a CA node, multiple computing nodes communicatively connected to the CA node, and a blockchain communicatively connected to the multiple computing nodes, wherein... The execution node is used to perform the method as described in any one of claims 1 to 4; The execution node is a node among the plurality of computing nodes; The computing node is used to receive key fragments distributed by the execution node, and to store the key fragments in a trusted manner or through the blockchain; Each computing node distributes a key shard, and different computing nodes distribute different key shards. Any T key shards can recover the key matrix vector, where T is less than N.

7. A key management device, characterized in that, include: Memory and at least one processor; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory to implement the key management method as described in any one of claims 1-4.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the key management method as described in any one of claims 1-4.

Images