Key information processing method and device, computer device, and storage medium

Abstract

The application relates to a key information processing method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: acquiring key configuration information in a timely manner; the key configuration information comprises an authorization identifier, an expiration extension time and first key information; the first key information comprises a first key expiration time and a first key identifier; for each first key identifier, when the first key expiration time is reached, the authorization identifier is acquired; when the authorization identifier corresponds to automatic authorization, the first key information is updated based on the first key expiration time and the expiration extension time to obtain second key information; and the second key information is stored in the key configuration information as new first key information. The method can dynamically update the key configuration information and improve the security of key data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and in particular to a key information processing method and device, computer equipment, a storage medium and a computer program product. BACKGROUND

[0002] With the development of information technology, massive data is transmitted and circulated in the Internet, and secure communication between the client and the server has become a hot issue in information interaction.

[0003] In the traditional technology, the first system public key and the second system private key are usually stored locally on the client.

[0004] However, the algorithm for generating public and private keys in the traditional technology is fixed and cannot be updated for a long time, which is easy to be illegally obtained and utilized by attackers. SUMMARY

[0005] Therefore, it is necessary to provide a key information processing method, device, computer equipment, computer readable storage medium and computer program product capable of improving the degree of information security.

[0006] In a first aspect, the present application provides a key information processing method. The method comprises:

[0007] acquiring key configuration information in a timely manner; the key configuration information comprises an authorization identifier, an expiration extension time and first key information; the first key information comprises a first key expiration time and a first key identifier;

[0008] for each first key identifier, when the first key expiration time is reached, the authorization identifier is acquired;

[0009] when the authorization identifier corresponds to automatic authorization, the first key information is updated based on the first key expiration time and the expiration extension time to obtain second key information;

[0010] the second key information is stored in the key configuration information as new first key information.

[0011] In one of the embodiments, the second key information comprises a second key expiration time and a second key identifier; the first key information is updated based on the first key expiration time and the expiration extension time to obtain the second key information, comprising:

[0012] the first key identifier is updated to obtain the second key identifier;

[0013] based on the first key expiration time and the expiration extension time, the second key expiration time corresponding to the second key identifier is determined.

[0014] In one of the embodiments, the key configuration information further comprises a key buffer period; after the first key information is updated based on the first key expiration time and the expiration continuation time to obtain the second key information, the method further comprises:

[0015] After the first key information is updated, the validity time of the first key identifier is extended based on the key buffer period.

[0016] In one of the embodiments, after the authorized identifier is obtained when the first key expiration time is reached, the method further comprises:

[0017] When the authorized identifier corresponds to non-automatic authorization, the first key information is not processed.

[0018] In one of the embodiments, the method further comprises:

[0019] Obtaining a communication request sent by a client; wherein the communication request comprises a channel identifier;

[0020] Querying the key configuration information based on the channel identifier to obtain the first key information corresponding to the channel identifier; wherein the first key information comprises a first key expiration time and a first key identifier;

[0021] Determining the validity state of the first key identifier based on the relationship between the first key expiration time and the current time; wherein the validity state of the first key identifier comprises valid and invalid;

[0022] When the validity state of the first key identifier is valid, sending the first key identifier, the client public key and the client private key in the first key information to the client.

[0023] In one of the embodiments, after the validity state of the first key identifier is determined based on the relationship between the first key expiration time and the current time, the method further comprises:

[0024] When the validity state of the first key identifier is invalid, obtaining an authorized identifier corresponding to the first key identifier;

[0025] When the authorized identifier corresponds to automatic authorization, updating the first key information based on the first key expiration time and the expiration continuation time to obtain the second key information;

[0026] Sending the second key information as the new first key information, and sending the first key identifier, the client public key and the client private key in the new first key information to the client.

[0027] In one of the embodiments, determining the validity state of the first key identifier based on the relationship between the first key expiration time and the current time comprises:

[0028] In the same direction as the time flow, when the current time is before the expiration time of the first key, the validity state of the first key identifier is valid;

[0029] In the same direction as the time flow, when the current time is not before the expiration time of the first key, the validity state of the first key identifier is invalid.

[0030] In a second aspect, the present application further provides a key information processing device. The device comprises:

[0031] A key configuration information obtaining module, configured to obtain key configuration information at a regular time; the key configuration information comprises an authorization identifier, an expiration extension time and first key information; the first key information comprises a first key expiration time and a first key identifier;

[0032] An authorization identifier obtaining module, configured to, for each first key identifier, obtain an authorization identifier when the first key expiration time is reached;

[0033] A key updating module, configured to, when the authorization identifier corresponds to automatic authorization, update the first key information based on the first key expiration time and the expiration extension time, to obtain second key information;

[0034] A storage module, configured to store the second key information as new first key information in the key configuration information.

[0035] In a third aspect, the present application further provides a computer device. The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the steps of the method according to any one of the above embodiments when executing the computer program.

[0036] In a fourth aspect, the present application further provides a computer device readable storage medium. The computer device readable storage medium stores a computer program, and the computer program implements the steps of the method according to any one of the above embodiments when executed by a processor.

[0037] In a fifth aspect, the present application further provides a computer program product. The computer program product comprises a computer program, and the computer program implements the steps of the method according to any one of the above embodiments when executed by a processor.

[0038] The aforementioned key information processing method, apparatus, computer equipment, storage medium, and computer program product first periodically acquire key configuration information. This key configuration information includes an authorization identifier, an expiration and extension time, and first key information. The first key information includes a first key expiration time and a first key identifier. Then, for each first key identifier, when the first key expiration time arrives, an authorization identifier is acquired. Further, when the authorization identifier corresponds to automatic authorization, the first key information is updated based on the first key expiration time and the expiration and extension time to obtain second key information. Finally, the second key information is stored as the new first key information in the key configuration information. Dynamically updating the key configuration information when the authorization identifier corresponds to automatic authorization improves the security of the key data. Attached Figure Description

[0039] Figure 1 This is an application environment diagram of a key information processing method in one embodiment;

[0040] Figure 2 This is a flowchart illustrating a key information processing method in one embodiment;

[0041] Figure 3 This is a schematic diagram illustrating the key information processing flow during client-server communication in one embodiment.

[0042] Figure 4 This is a structural block diagram of a key information processing device in one embodiment;

[0043] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0045] The key information processing method provided in this application embodiment can be applied to, for example... Figure 1The application environment shown. Among them, the client 102 communicates with the server 104 through the network. The data storage system can store the data required by the server 104 to process. The data storage system can be integrated on the server, or placed on the cloud or other network servers. The server 104 can provide the client 102 with the environment of key information processing, and the server 104 communicates with the client 102 to enter the environment of key information processing. First, the server 104 can obtain the key configuration information in a timely manner; the key configuration information includes: authorization identifier, expiration extension time and first key information; the first key information includes: first key expiration time and first key identifier. Then, for each first key identifier, when the first key expiration time is reached, the server 104 can obtain the authorization identifier sent by the client 102. Further, when the authorization identifier corresponds to automatic authorization, the server 104 can update the first key information based on the first key expiration time and the expiration extension time to obtain the second key information. Finally, the server 104 can store the second key information as new first key information in the key configuration information. Wherein, the server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0046] The key information processing method provided by the embodiment of the application can be applied to a system including a server and a client, and is realized through the interaction of the server and the client.

[0047] In one embodiment, as Figure 2 shown, a key information processing method is provided. Taking the example of the method applied to a system including a server and a client, the method includes the following steps 202 to 208.

[0048] Step 202, obtaining key configuration information in a timely manner; the key configuration information includes: authorization identifier, expiration extension time and first key information; the first key information includes: first key expiration time and first key identifier.

[0049] In this embodiment, the first key identifier is the unique identifier of the key data (public and private key data), and the client and the server communicate based on the first key identifier.

[0050] In this embodiment, the authorization identifier is determined by the server and the client in advance.

[0051] In this embodiment, the key configuration information can include key configuration information corresponding to multiple different clients.

[0052] Step 204, for each first key identifier, when the first key expiration time is reached, the authorization identifier is obtained.

[0053] In the embodiment, the authorization identifier can correspond to automatic authorization or non-automatic authorization.

[0054] In step 206, when the authorization identifier corresponds to automatic authorization, the first key information is updated based on the first key expiration time and the expiration extension time, to obtain second key information.

[0055] In the embodiment, the second key information can include but is not limited to the second key expiration time and the second key identifier.

[0056] In the embodiment, the expiration extension time is a time period. Specifically, the time period length of the expiration extension time can include but is not limited to seconds, minutes, hours, days, years, etc.

[0057] In the embodiment, the server can determine the second key expiration time based on the first key expiration time and the expiration extension time.

[0058] In step 208, the second key information is stored in the key configuration information as new first key information.

[0059] In the embodiment, after the server updates the first key information, the old first key information can also be stored in the key configuration information as historical key information for query.

[0060] In the above key information processing method, first, the key configuration information is obtained in a timely manner. The key configuration information includes an authorization identifier, an expiration extension time, and first key information. The first key information includes a first key expiration time and a first key identifier. Then, for each first key identifier, when the first key expiration time is reached, the authorization identifier is obtained. Further, when the authorization identifier corresponds to automatic authorization, the first key information is updated based on the first key expiration time and the expiration extension time, to obtain second key information. Finally, the second key information is stored in the key configuration information as new first key information. When the authorization identifier corresponds to automatic authorization, the key configuration information is dynamically updated, which can improve the security of the key data.

[0061] In some embodiments, the second key information includes a second key expiration time and a second key identifier. Updating the first key information based on the first key expiration time and the expiration extension time to obtain the second key information can include updating the first key identifier to obtain the second key identifier, and determining the second key expiration time corresponding to the second key identifier based on the first key expiration time and the expiration extension time.

[0062] In the embodiment, the expiration extension time is a time period, and the time period length of the expiration extension time can include but is not limited to seconds, minutes, hours, days, years, etc.

[0063] In the embodiment, the server can extend the first key expiration time by a time period consistent with the expiration extension time in the same direction of the time flow to obtain the second key expiration time. For example, when the first key expiration time is January 28, 2023, 13:23:07, and the expiration extension time is 24 hours, the server can determine the second key expiration time as January 29, 2023, 13:23:07.

[0064] In the embodiment, the second key identifier is different from the first key identifier.

[0065] In some embodiments, the key configuration information further includes a key buffer period. After the first key information is updated based on the first key expiration time and the expiration extension time to obtain the second key information, the method can further include: after the first key information is updated, extending the valid time of the first key identifier based on the key buffer period.

[0066] In the embodiment, after the server updates the first key information, the server can also store the old first key information as historical key information in the key configuration information for query.

[0067] In the embodiment, the key buffer period is a time period, and the time period length of the expiration extension time can include but is not limited to seconds, minutes, hours, days, etc.

[0068] In the embodiment, based on the key buffer period, the valid time of the old first key identifier is extended. For example, when the key buffer period is 1 hour and 30 minutes, and the first key expiration time corresponding to the old first key identifier is February 13, 2023, 13:23:11, the first key identifier is updated after February 13, 2023, 13:23:11, but within the time interval from February 13, 2023, 13:23:11 to February 13, 2023, 14:53:11 (key buffer period 1 hour and 30 minutes), the client can still use the old first key identifier to send a communication request to the server, and the server can still respond to the communication request carrying the old first key identifier within the time interval.

[0069] In some embodiments, when the first key expiration time is reached, after the authorized identifier is obtained, the method can further include: when the authorized identifier corresponds to non-automatic authorization, the first key information is not processed.

[0070] In the embodiment, the authorized identifier can correspond to automatic authorization or non-automatic authorization.

[0071] In the embodiment, when the authorized identifier corresponds to non-automatic authorization, when the first key expiration time is reached, the first key identifier in the first key information is invalidated.

[0072] In this embodiment, when the client sends a communication request to the server using the invalid first key identifier, the server can not respond or the response result corresponds to a request failure.

[0073] In some embodiments, as shown in Figure 3 The above method can further include: obtaining a communication request sent by the client; wherein the communication request includes a channel identifier; querying the key configuration information based on the channel identifier to obtain first key information corresponding to the channel identifier; wherein the first key information includes: a first key expiration time and a first key identifier; determining the validity status of the first key identifier based on the relationship between the first key expiration time and the current time; wherein the validity status of the first key identifier includes: valid and invalid; when the validity status of the first key identifier is valid, sending the first key identifier in the first key information, the client public key and the client private key to the client.

[0074] In this embodiment, the communication request sent by the client can include but is not limited to: a channel identifier, a first key identifier, etc.

[0075] In this embodiment, since the communication interaction between the client and the server is not continuous, the first key identifier of the client can have been invalid. Based on this, when receiving the communication request sent by the client, the server can also query the key configuration information based on the channel identifier to obtain the latest first key identifier corresponding to the channel identifier.

[0076] In this embodiment, when the first key identifier of the client is consistent with the latest first key identifier corresponding to the channel identifier, the validity status of the first key identifier is determined based on the relationship between the first key expiration time and the current time. When the validity status of the first key identifier is valid, the server can directly respond to the communication request of the client.

[0077] In this embodiment, when the first key identifier of the client is not consistent with the latest first key identifier corresponding to the channel identifier, the server can also query the key configuration information based on the first key identifier of the client to obtain the first key expiration time corresponding to the first key identifier of the client, and then determine the validity status of the first key identifier of the client based on the relationship between the first key expiration time, the key buffer period and the current time.

[0078] In some embodiments, after determining the validity state of the first key identifier based on the relationship between the first key expiration time and the current time, the method can further include: when the validity state of the first key identifier is invalid, obtaining an authorization identifier corresponding to the first key identifier; when the authorization identifier corresponds to automatic authorization, updating the first key information based on the first key expiration time and the expiration extension time to obtain second key information; and sending the second key information as new first key information, and the first key identifier, the client public key and the client private key in the new first key information to the client.

[0079] In the present embodiment, when the validity state of the first key identifier is invalid, that is, when the first key expiration time of the first key is before the current time in the same direction as the time flow, the server can obtain an authorization identifier corresponding to the first key identifier; when the authorization identifier corresponds to automatic authorization, updating the first key information based on the first key expiration time and the expiration extension time to obtain second key information.

[0080] In the present embodiment, the expiration extension time is a time period, and the length of the time period of the expiration extension time can include but is not limited to seconds, minutes, hours, days, etc.

[0081] In the present embodiment, the expiration extension time can be determined by the server and the client in advance, or can be determined by the server alone in advance.

[0082] In the present embodiment, the first key information can include but is not limited to the server private key, the server public key, the client public key, the client private key and the first key identifier.

[0083] In the present embodiment, the second key information can include but is not limited to the server private key, the server public key, the client public key, the client private key and the second key identifier.

[0084] In the present embodiment, when the validity state of the first key identifier is valid, the server can respond to the communication request sent by the client, and send the first key identifier, the client public key and the client private key in the first key information to the client.

[0085] In the present embodiment, when the first key identifier of the client expires but is still within the time interval corresponding to the key buffer period, the server can respond to the communication request of the client, and send the first key identifier, the client public key and the client private key in the latest first key information corresponding to the channel identifier of the server to the client.

[0086] In some embodiments, determining the validity state of the first key identifier based on the relationship between the first key expiration time and the current time can include: when the current time is before the first key expiration time in the same direction of time flow, the validity state of the first key identifier is valid; and when the current time is not before the first key expiration time in the same direction of time flow, the validity state of the first key identifier is invalid.

[0087] In the present embodiment, when the first key identifier of the client is inconsistent with the latest first key identifier corresponding to the channel identifier, the server can also query the key configuration information based on the first key identifier of the client, query the first key expiration time corresponding to the first key identifier of the client, and determine the validity state of the first key identifier of the client based on the relationship between the first key expiration time, the key buffer period and the current time. For example, when the key buffer period is 30 minutes and the first key expiration time corresponding to the first key identifier of the client is 13:23:11 on February 13, 2023, based on the key buffer period, the validity state of the first key identifier in the time interval from 13:23:11 on February 13, 2023 to 13:53:11 on February 13, 2023 (30 minutes of key buffer period) is invalid, but the client can still use the first key identifier to send a communication request to the server, and the server can still respond to the communication request carrying the first key identifier within the time interval; if the current time is after 13:53:11 on February 13, 2023, the first key identifier of the client is invalid, and the server does not respond to the communication request carrying the first key identifier or the response result corresponds to a request failure.

[0088] In the present embodiment, when the first key identifier of the client expires but is still within the time interval corresponding to the key buffer period, the server can respond to the communication request of the client and send the first key identifier, the client public key and the client private key in the latest first key information corresponding to the channel identifier of the server to the client.

[0089] It should be understood that, although each step in the flowchart involved in each of the above embodiments is displayed in sequence according to the direction of the arrow, these steps are not necessarily executed in sequence according to the direction of the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in each of the above embodiments can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0090] Based on the same inventive concept, the embodiments of the present application also provide a key information processing device for implementing the key information processing method described above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more key information processing device embodiments provided below can refer to the limitations of the key information processing method in the foregoing, which will not be described here again.

[0091] In one embodiment, as shown in Figure 4 A key information processing device is provided, comprising: a key configuration information obtaining module 402, an authorization identifier obtaining module 404, a key updating module 406, and a storage module 408, wherein:

[0092] The key configuration information obtaining module 402 is configured to obtain key configuration information at a regular time; the key configuration information comprises: an authorization identifier, an expiration extension time, and first key information; the first key information comprises: a first key expiration time and a first key identifier.

[0093] The authorization identifier obtaining module 404 is configured to, for each first key identifier, obtain an authorization identifier when the first key expiration time is reached.

[0094] The key updating module 406 is configured to, when the authorization identifier corresponds to automatic authorization, update the first key information based on the first key expiration time and the expiration extension time to obtain second key information.

[0095] The storage module 408 is configured to store the second key information as new first key information in the key configuration information.

[0096] In one of the embodiments, the second key information comprises: a second key expiration time and a second key identifier; the key updating module 406 can comprise:

[0097] A key identifier updating submodule is configured to update the first key identifier to obtain the second key identifier.

[0098] A key expiration time updating submodule is configured to determine the second key expiration time corresponding to the second key identifier based on the first key expiration time and the expiration extension time.

[0099] In one of the embodiments, the key configuration information further comprises: a key buffer period; after the key updating module 406, the above device can further comprise:

[0100] An expiration extension module is configured to, after updating the first key information, extend the valid time of the first key identifier based on the key buffer period.

[0101] In one of the embodiments, after the authorization identifier obtaining module 404, the apparatus can further include:

[0102] The key information non-processing module is configured to, when the authorization identifier corresponds to non-automatic authorization, not process the first key information.

[0103] In one of the embodiments, the apparatus can further include:

[0104] The communication request obtaining module is configured to obtain a communication request sent by the client; wherein the communication request includes a channel identifier.

[0105] The first key information querying module is configured to query the key configuration information based on the channel identifier, and obtain the first key information corresponding to the channel identifier; wherein the first key information includes a first key expiration time and a first key identifier.

[0106] The effective state determining module is configured to determine the effective state of the first key identifier based on the relationship between the first key expiration time and the current time; wherein the effective state of the first key identifier includes valid and invalid.

[0107] The first state processing module is configured to, when the effective state of the first key identifier is valid, send the first key identifier, the client public key and the client private key in the first key information to the client.

[0108] In one of the embodiments, after the effective state determining module, the apparatus can further include:

[0109] The second state processing module is configured to, when the effective state of the first key identifier is invalid, obtain the authorization identifier corresponding to the first key identifier.

[0110] The automatic updating module is configured to, when the authorization identifier corresponds to automatic authorization, update the first key information based on the first key expiration time and the expiration extension time, and obtain second key information.

[0111] The key information sending module is configured to send the second key information as new first key information, and send the first key identifier, the client public key and the client private key in the new first key information to the client.

[0112] In one of the embodiments, the effective state determining module can include:

[0113] The first state determining submodule is configured to, in the same direction as the time flow direction, when the current time is before the first key expiration time, determine that the effective state of the first key identifier is valid.

[0114] The second state determining submodule is configured to, in the same direction as the time flow direction, determine the valid state of the first key as invalid when the current time is not before the first key expiration time.

[0115] The modules in the key information processing apparatus can be implemented by software, hardware or a combination thereof. The modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in a computer device in software form, so as to be invoked and executed by a processor to perform operations corresponding to the modules.

[0116] In an embodiment, a computer device, which can be a server, has an internal structure as shown in Figure 5 The computer device includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store key configuration information, channel identifiers and the like. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with external terminals through a network connection. The computer program is executed by the processor to implement a key information processing method.

[0117] Those skilled in the art can understand that Figure 5 The structure shown in the above embodiment is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. Specifically, the computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0118] In one embodiment, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, the processor implementing the following steps when executing the computer program: obtaining key configuration information in a timing manner; the key configuration information comprising: an authorization identifier, an expiration extension time, and first key information; the first key information comprising: a first key expiration time and a first key identifier; for each first key identifier, when the first key expiration time is reached, obtaining the authorization identifier; when the authorization identifier corresponds to automatic authorization, updating the first key information based on the first key expiration time and the expiration extension time to obtain second key information; and storing the second key information as new first key information in the key configuration information.

[0119] In one embodiment, the second key information comprises: a second key expiration time and a second key identifier; and the processor, when executing the computer program, implements updating the first key information based on the first key expiration time and the expiration extension time to obtain the second key information, which can comprise: updating the first key identifier to obtain the second key identifier; and determining the second key expiration time corresponding to the second key identifier based on the first key expiration time and the expiration extension time.

[0120] In one embodiment, the key configuration information further comprises: a key buffer period; and after the processor, when executing the computer program, implements updating the first key information based on the first key expiration time and the expiration extension time to obtain the second key information, the processor can further implement the following steps: after updating the first key information, extending the validity time of the first key identifier based on the key buffer period.

[0121] In one embodiment, after the processor, when executing the computer program, implements obtaining the authorization identifier when the first key expiration time is reached, the processor can further implement the following steps: when the authorization identifier corresponds to non-automatic authorization, not processing the first key information.

[0122] In one embodiment, the processor, when executing the computer program, can implement the following steps: obtaining a communication request sent by a client; wherein the communication request comprises a channel identifier; querying the key configuration information based on the channel identifier to obtain first key information corresponding to the channel identifier; wherein the first key information comprises: a first key expiration time and a first key identifier; determining a validity state of the first key identifier based on a relationship between the first key expiration time and a current time; wherein the validity state of the first key identifier comprises: valid and invalid; and when the validity state of the first key identifier is valid, sending the first key identifier, a client public key, and a client private key in the first key information to the client.

[0123] In one of the embodiments, when the processor executes the computer program, the determination of the validity state of the first key identifier based on the relationship between the expiration time of the first key and the current time can further include: when the current time is before the expiration time of the first key in the same direction of the time flow, the validity state of the first key identifier is valid; and when the current time is not before the expiration time of the first key in the same direction of the time flow, the validity state of the first key identifier is invalid.

[0124] In one of the embodiments, when the processor executes the computer program, the determination of the validity state of the first key identifier based on the relationship between the expiration time of the first key and the current time can further include: when the current time is before the expiration time of the first key in the same direction of the time flow, the validity state of the first key identifier is valid; and when the current time is not before the expiration time of the first key in the same direction of the time flow, the validity state of the first key identifier is invalid.

[0125] In one of the embodiments, the computer readable storage medium has the computer program stored thereon, and when the computer program is executed by the processor, the following steps are implemented: obtaining the key configuration information in a timely manner; the key configuration information includes the authorization identifier, the expiration extension time and the first key information; the first key information includes the expiration time of the first key and the first key identifier; for each first key identifier, when the expiration time of the first key is reached, the authorization identifier is obtained; when the authorization identifier corresponds to the automatic authorization, the first key information is updated based on the expiration time of the first key and the expiration extension time to obtain the second key information; and the second key information is stored in the key configuration information as the new first key information.

[0126] In one of the embodiments, the second key information includes the expiration time of the second key and the second key identifier; and when the computer program is executed by the processor, the updating of the first key information based on the expiration time of the first key and the expiration extension time to obtain the second key information can include: updating the first key identifier to obtain the second key identifier; and determining the expiration time of the second key corresponding to the second key identifier based on the expiration time of the first key and the expiration extension time.

[0127] In one of the embodiments, the key configuration information further includes the key buffer period; and when the computer program is executed by the processor, after the updating of the first key information based on the expiration time of the first key and the expiration extension time to obtain the second key information, the following steps can be further implemented: after the updating of the first key information, the validity time of the first key identifier is extended based on the key buffer period.

[0128] In one of the embodiments, the computer program, when executed by the processor, can implement the following steps: obtaining a communication request sent by the client; wherein the communication request comprises a channel identifier; querying the key configuration information based on the channel identifier to obtain first key information corresponding to the channel identifier; wherein the first key information comprises a first key expiration time and a first key identifier; determining the validity state of the first key identifier based on the relationship between the first key expiration time and the current time; wherein the validity state of the first key identifier comprises valid and invalid; when the validity state of the first key identifier is valid, sending the first key identifier, the client public key and the client private key in the first key information to the client.

[0129] In one of the embodiments, the computer program, when executed by the processor, can implement the following steps: obtaining a communication request sent by the client; wherein the communication request comprises a channel identifier; querying the key configuration information based on the channel identifier to obtain first key information corresponding to the channel identifier; wherein the first key information comprises a first key expiration time and a first key identifier; determining the validity state of the first key identifier based on the relationship between the first key expiration time and the current time; wherein the validity state of the first key identifier comprises valid and invalid; when the validity state of the first key identifier is valid, sending the first key identifier, the client public key and the client private key in the first key information to the client.

[0130] In one of the embodiments, the computer program, when executed by the processor, can implement the following steps: obtaining a communication request sent by the client; wherein the communication request comprises a channel identifier; querying the key configuration information based on the channel identifier to obtain first key information corresponding to the channel identifier; wherein the first key information comprises a first key expiration time and a first key identifier; determining the validity state of the first key identifier based on the relationship between the first key expiration time and the current time; wherein the validity state of the first key identifier comprises valid and invalid; when the validity state of the first key identifier is valid, sending the first key identifier, the client public key and the client private key in the first key information to the client.

[0131] In one of the embodiments, the computer program, when executed by the processor, can implement the following steps: obtaining a communication request sent by the client; wherein the communication request comprises a channel identifier; querying the key configuration information based on the channel identifier to obtain first key information corresponding to the channel identifier; wherein the first key information comprises a first key expiration time and a first key identifier; determining the validity state of the first key identifier based on the relationship between the first key expiration time and the current time; wherein the validity state of the first key identifier comprises valid and invalid; when the validity state of the first key identifier is valid, sending the first key identifier, the client public key and the client private key in the first key information to the client.

[0132] In one of the embodiments, a computer program product is provided, comprising a computer program, which, when executed by the processor, implements the following steps: obtaining the key configuration information in a timely manner; the key configuration information comprises an authorization identifier, an expiration extension time and first key information; the first key information comprises a first key expiration time and a first key identifier; for each first key identifier, when the first key expiration time is reached, the authorization identifier is obtained; when the authorization identifier corresponds to automatic authorization, the first key information is updated based on the first key expiration time and the expiration extension time to obtain second key information; the second key information is stored as new first key information in the key configuration information.

[0133] In one embodiment, the second key information comprises: a second key expiration time and a second key identifier; and the computer program, when executed by the processor, further implements updating the first key information based on the first key expiration time and the expiration time extension to obtain the second key information, which can comprise: updating the first key identifier to obtain the second key identifier; and determining the second key expiration time corresponding to the second key identifier based on the first key expiration time and the expiration time extension.

[0134] In one embodiment, the key configuration information further comprises: a key buffer period; and the computer program, when executed by the processor, further implements, after updating the first key information based on the first key expiration time and the expiration time extension to obtain the second key information, the following step: based on the key buffer period, extending the valid time of the first key identifier after updating the first key information.

[0135] In one embodiment, the computer program, when executed by the processor, further implements, after obtaining the authorization identifier when the first key expiration time is reached, the following step: when the authorization identifier corresponds to non-automatic authorization, not processing the first key information.

[0136] In one embodiment, the computer program, when executed by the processor, further implements the following steps: obtaining a communication request sent by a client; wherein the communication request comprises a channel identifier; querying the key configuration information based on the channel identifier to obtain the first key information corresponding to the channel identifier; wherein the first key information comprises: a first key expiration time and a first key identifier; determining the valid state of the first key identifier based on the relationship between the first key expiration time and the current time; wherein the valid state of the first key identifier comprises: valid and invalid; and when the valid state of the first key identifier is valid, sending the first key identifier, the client public key and the client private key in the first key information to the client.

[0137] In one embodiment, after determining the valid state of the first key identifier based on the relationship between the first key expiration time and the current time, the computer program, when executed by the processor, further implements the following steps: when the valid state of the first key identifier is invalid, obtaining the authorization identifier corresponding to the first key identifier; when the authorization identifier corresponds to automatic authorization, updating the first key information based on the first key expiration time and the expiration time extension to obtain the second key information; and sending the second key information as the new first key information, and the first key identifier, the client public key and the client private key in the new first key information to the client.

[0138] In one of the embodiments, the computer program, when executed by the processor, further implements determining the valid state of the first key identifier based on a relationship between an expiration time of the first key and a current time, which can include: when the current time is before the expiration time of the first key, the valid state of the first key identifier is valid in the same direction as the time flow; and when the current time is not before the expiration time of the first key, the valid state of the first key identifier is invalid in the same direction as the time flow.

[0139] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0140] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0141] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0142] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A key information processing method, characterized in that, The method includes: The key configuration information is periodically retrieved; the key configuration information includes: authorization identifier, expiration and renewal time, and first key information; the first key information includes: first key expiration time and first key identifier. For each first key identifier, when the first key expires, the authorization identifier is obtained; When the authorization identifier corresponds to automatic authorization, the first key information is updated based on the first key expiration time and the expiration extension time to obtain the second key information; the second key information includes: the second key expiration time and the second key identifier; the second key identifier is different from the first key identifier; The second key information is stored as the new first key information in the key configuration information; The method further includes: Obtain the communication request sent by the client; wherein the communication request includes a channel identifier; Based on the channel identifier, the key configuration information is queried to obtain the first key information corresponding to the channel identifier; wherein, the first key information includes: the first key expiration time and the first key identifier; Based on the relationship between the expiration time of the first key and the current time, the validity status of the first key identifier is determined; When the validity status of the first key identifier is valid, the first key identifier, the client public key, and the client private key in the first key information are sent to the client.

2. The method according to claim 1, characterized in that, The step of updating the first key information based on the first key expiration time and the expiration extension time to obtain the second key information includes: The first key identifier is updated to obtain the second key identifier; Based on the expiration time of the first key and the expiration extension time, the expiration time of the second key corresponding to the second key identifier is determined.

3. The method according to claim 1, characterized in that, The key configuration information further includes: a key buffer period; after updating the first key information based on the first key expiration time and the expiration extension time to obtain the second key information, the method further includes: After updating the first key information, the validity period of the first key identifier is extended based on the key buffer period.

4. The method according to claim 1, characterized in that, After obtaining the authorization identifier when the first key expires, the method further includes: When the authorization identifier corresponds to non-automatic authorization, the first key information is not processed.

5. The method according to claim 1, characterized in that, The validity status of the first key identifier includes: valid and invalid; after determining the validity status of the first key identifier based on the relationship between the expiration time of the first key and the current time, the method further includes: When the validity status of the first key identifier is invalid, the authorization identifier corresponding to the first key identifier is obtained; When the authorization identifier corresponds to automatic authorization, the first key information is updated based on the first key expiration time and the expiration extension time to obtain the second key information; The second key information is used as the new first key information, and the first key identifier, client public key, and client private key in the new first key information are sent to the client.

6. The method according to claim 1, characterized in that, Determining the validity status of the first key identifier based on the relationship between the expiration time of the first key and the current time includes: Following the same direction as the flow of time, when the current moment is before the expiration time of the first key, the validity status of the first key identifier is valid; Following the same direction as the flow of time, if the current time is not before the expiration time of the first key, the validity status of the first key identifier is invalid.

7. A key information processing device, characterized in that, The device includes: A key configuration information acquisition module is used to acquire key configuration information periodically; the key configuration information includes: an authorization identifier, an expiration extension time, and first key information; the first key information includes: a first key expiration time and a first key identifier. The authorization identifier acquisition module is used to acquire the authorization identifier for each first key identifier when the first key expires. The key update module is used to update the first key information based on the first key expiration time and the expiration extension time when the authorization identifier corresponds to automatic authorization, to obtain second key information; the second key information includes: the second key expiration time and the second key identifier; the second key identifier is different from the first key identifier; The storage module is used to store the second key information as new first key information into the key configuration information; The device is further configured to acquire a communication request sent by a client; wherein the communication request includes a channel identifier; query key configuration information based on the channel identifier to obtain first key information corresponding to the channel identifier; wherein the first key information includes: a first key expiration time and a first key identifier; determine the validity status of the first key identifier based on the relationship between the first key expiration time and the current time; when the validity status of the first key identifier is valid, send the first key identifier, the client public key, and the client private key from the first key information to the client.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images