Key management method, device, equipment and storage medium

Abstract

The present application discloses a key management method, device, equipment and storage medium, which belongs to the field of information security technology. The method includes: obtaining the plaintext of the object key of the first object, the object key includes at least one of the public key and the private key of the first object; based on the plaintext of the object key, obtaining the ciphertext of the object key; wherein the ciphertext of the object key is the ciphertext obtained by the key management service device after encrypting the plaintext of the object key using the plaintext of the first key, or the ciphertext of the object key is the ciphertext obtained after the plaintext of the object key is encrypted locally using the plaintext of the second key; the ciphertext of the object key is stored in a database corresponding to the identification information of the first object. This method can store the public key and / or private key of the first object in the database in the form of ciphertext, which is not easy to leak and has a high security of key management; there are two cases of the ciphertext of the object key, and the flexibility of obtaining the ciphertext of the object key is high.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of information security technology, and in particular to a key management method, apparatus, device and storage medium. Background Art

[0002] In the field of information security technology, the security of key management will affect the security of information. Therefore, key management is extremely important in the field of information security technology. Among them, key management includes managing the public key and private key of the first object. At present, how to manage the public key and private key of the first object more securely is a problem that needs to be solved urgently. Summary of the invention

[0003] The embodiments of the present application provide a key management method, apparatus, device and storage medium, which can be used to improve the security of key management. The technical solution is as follows:

[0004] On the one hand, an embodiment of the present application provides a key management method, the method comprising:

[0005] Obtaining a plaintext of an object key of a first object, the object key including at least one of a public key and a private key of the first object, the plaintext of the public key of the first object being used to generate blockchain account information corresponding to the first object on a target blockchain, and the plaintext of the private key of the first object being used to sign target information of the first object to be recorded on the target blockchain;

[0006] Based on the plain text of the object key, obtaining the ciphertext of the object key; wherein the ciphertext of the object key is the ciphertext obtained by encrypting the plain text of the object key by the key management service device using the plain text of the first key, or the ciphertext of the object key is the ciphertext obtained by encrypting the plain text of the object key by the local using the plain text of the second key;

[0007] The ciphertext of the object key and the identification information of the first object are stored in a database in correspondence.

[0008] In another aspect, a key management device is provided, the device comprising:

[0009] A first acquisition unit is configured to acquire a plaintext of an object key of a first object, wherein the object key includes at least one of a public key and a private key of the first object, the plaintext of the public key of the first object is used to generate blockchain account information corresponding to the first object on a target blockchain, and the plaintext of the private key of the first object is used to sign target information of the first object to be recorded on the target blockchain;

[0010] A second acquisition unit is configured to acquire a ciphertext of the object key based on the plaintext of the object key; wherein the ciphertext of the object key is a ciphertext obtained by encrypting the plaintext of the object key by the key management service device using the plaintext of the first key, or the ciphertext of the object key is a ciphertext obtained by encrypting the plaintext of the object key locally using the plaintext of the second key;

[0011] A storage unit is used to store the ciphertext of the object key and the identification information of the first object in a database in correspondence with each other.

[0012] In one possible implementation, the second acquisition unit is used to send a first encryption request to the key management service device, where the first encryption request includes the plaintext of the object key and identification information of the plaintext of the first key, and the key management service device is used to respond to the first encryption request, encrypt the plaintext of the object key using the plaintext of the first key, obtain the ciphertext of the object key, and return the ciphertext of the object key; and receive the ciphertext of the object key returned by the key management service device.

[0013] In one possible implementation, the plaintext identification information of the first key is extracted from the database, and the storage unit is also used to send a first key generation request to the key management service device, and the key management service device is used to generate the plaintext of the first key in response to the first key generation request, and return the plaintext identification information of the first key; receive the plaintext identification information of the first key returned by the key management service device, and store the plaintext identification information of the first key in the database.

[0014] In a possible implementation, the second obtaining unit is configured to encrypt the plain text of the object key by using the plain text of the second key to obtain the cipher text of the object key.

[0015] In one possible implementation, the second acquisition unit is also used to extract the ciphertext of the second key from the database; send a first decryption request to the key management service device, the first decryption request includes the ciphertext of the second key, and the key management service device is used to respond to the first decryption request, decrypt the ciphertext of the second key, obtain the plaintext of the second key, and return the plaintext of the second key; receive the plaintext of the second key returned by the key management service device.

[0016] In a possible implementation, the second acquisition unit is further configured to extract the ciphertext of the second key from the database; and decrypt the ciphertext of the second key to obtain the plaintext of the second key.

[0017] In a possible implementation, the second acquisition unit is further configured to extract the plain text of the second key from local storage.

[0018] In one possible implementation, the storage unit is also used to send a first key generation request to the key management service device, and the key management service device is used to generate the plaintext of the first key in response to the first key generation request, and return the identification information of the plaintext of the first key; receive the identification information of the plaintext of the first key returned by the key management service device; send a second key generation request to the key management service device, the second key generation request includes the identification information of the plaintext of the first key, and the key management service device is used to generate the plaintext of the second key based on the plaintext of the first key in response to the second key generation request, encrypt the plaintext of the second key to obtain the ciphertext of the second key, and return the ciphertext of the second key; store the ciphertext of the second key and the identification information of the plaintext of the first key in the database accordingly.

[0019] In one possible implementation, the storage unit is further used to generate a plaintext of the second key based on the identification information of the first object, encrypt the plaintext of the second key to obtain a ciphertext of the second key; and store the ciphertext of the second key and the identification information of the first object in the database in correspondence.

[0020] In one possible implementation, the first acquisition unit is further used to send a public-private key pair generation request to a public-private key pair generation device, the public-private key pair generation request including identification information of the first object, the public-private key pair generation device is used to generate the plaintext of the public key and the plaintext of the private key of the first object in response to the public-private key pair generation request, and return the plaintext of the public key and the plaintext of the private key; and receive the plaintext of the public key and the plaintext of the private key returned by the public-private key pair generation device.

[0021] In a possible implementation, the device further includes:

[0022] A third acquisition unit is used to extract the ciphertext of the object key from the database based on the identification information of the first object; send a second decryption request to the key management service device, the second decryption request includes the plaintext identification information of the first key and the ciphertext of the object key, the key management service device is used to respond to the second decryption request, use the plaintext of the first key to decrypt the ciphertext of the object key, obtain the plaintext of the object key, and return the plaintext of the object key; receive the plaintext of the object key returned by the key management service device.

[0023] In a possible implementation, the third acquisition unit is further used to extract the ciphertext of the object key from the database based on the identification information of the first object; and decrypt the ciphertext of the object key using the plaintext of the second key to obtain the plaintext of the object key.

[0024] In a possible implementation, the object key includes the public key, and the apparatus further includes:

[0025] The fourth acquisition unit is used to send an account generation request to the blockchain node device, wherein the account generation request includes the plain text of the public key, and the blockchain node device is used to respond to the account generation request, generate the blockchain account information corresponding to the first object on the target blockchain based on the plain text of the public key, and return the blockchain account information; receive the blockchain account information returned by the blockchain node device.

[0026] In one possible implementation, the object key includes the private key, and the fourth acquisition unit is further used to sign the target information based on the plain text of the private key to obtain the signature information of the target information; send an information recording request to a blockchain node device, the information recording request includes the target information, the signature information and the blockchain account information of the first object, the blockchain node device is used to respond to the information recording request, verify the target information based on the signature information and the blockchain account information of the first object, record the verified target information on the target blockchain, and return the information recording result; receive the information recording result returned by the blockchain node device.

[0027] On the other hand, a computer device is provided, comprising a processor and a memory, wherein the memory stores at least one computer program, and the at least one computer program is loaded and executed by the processor so that the computer device implements any of the above-mentioned key management methods.

[0028] On the other hand, a computer-readable storage medium is provided, in which at least one computer program is stored. The at least one computer program is loaded and executed by a processor so that a computer implements any of the key management methods described above.

[0029] On the other hand, a computer program product is also provided, the computer program product comprising a computer program or computer instructions, the computer program or the computer instructions being loaded and executed by a processor so that a computer implements any of the above-mentioned key management methods.

[0030] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:

[0031] The technical solution provided in the embodiment of the present application obtains the ciphertext of the public key and / or private key of the first object, so that the public key and / or private key of the first object can be stored in the database in ciphertext. The public key and / or private key stored in ciphertext is not easy to be leaked, and the security of key management is relatively high. In addition, there are two cases of the ciphertext of the object key, and the flexibility of obtaining the ciphertext of the object key is relatively high. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 It is a schematic diagram of an implementation environment of a key management method provided in an embodiment of the present application;

[0034] Figure 2 is a flowchart of a key management method provided by an embodiment of the present application;

[0035] Figure 3 is a flowchart of a key management method provided by an embodiment of the present application;

[0036] Figure 4 is a schematic diagram of a key management solution provided in an embodiment of the present application;

[0037] Figure 5 is a schematic diagram of a key management solution provided in an embodiment of the present application;

[0038] Figure 6 is a schematic diagram of a key management solution provided in an embodiment of the present application;

[0039] Figure 7 is a schematic diagram of a key management solution provided in an embodiment of the present application;

[0040] Figure 8 It is a schematic diagram of the overall encryption and decryption process of a public and private key provided in an embodiment of the present application;

[0041] Fig. 9 It is a schematic diagram of an envelope encryption and decryption process in the related art;

[0042] Fig.10 is a schematic diagram of a comparison result of a key management solution provided in an embodiment of the present application;

[0043] Fig.11It is a score radar chart corresponding to a key management solution provided in an embodiment of the present application;

[0044] Fig.12 is a schematic diagram of a digital resource management system provided by an embodiment of the present application;

[0045] Fig.13 It is a schematic diagram of the relationship between a VUID, a plain text of a public and private key, and a digital resource address provided in an embodiment of the present application;

[0046] Fig.14 is a schematic diagram of a key management device provided in an embodiment of the present application;

[0047] Fig.15 is a schematic diagram of the structure of a terminal provided in an embodiment of the present application;

[0048] Fig.16 It is a structural diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0050] The nouns involved in the embodiments of the present application are introduced as follows:

[0051] KMS (Key Management Service) is a security management service that can create and manage keys, protect the confidentiality, integrity and availability of keys, meet the key management needs of users for multiple applications and businesses, and comply with management regulations.

[0052] RSA: An asymmetric encryption algorithm. Asymmetric encryption algorithms are also called public key cryptographic algorithms. They use the generated public and private keys to encrypt and decrypt plaintext and ciphertext. The name RSA comes from the initials of its three developers, Ron Rivest, Adi Shamir, and Leonard Adleman.

[0053] Digital resources: resources that can be traded on the blockchain. For example, digital resources include but are not limited to digital artworks (or digital collectibles), virtual game items, videos, etc. The representation of digital resources includes but is not limited to video clips, JPEG (Joint Photographic Experts Group), etc.

[0054] Digital resource address: A unique address for managing digital resources generated on the blockchain using the plain text of the public key, used to identify the unique address of the interactive object on the blockchain.

[0055] CMK (Custom Master Key): a key used to encrypt and decrypt a user's public and private key pairs.

[0056] Zhixin Chain: It is a copyright protection platform built on blockchain technology, which can protect the copyright (or property rights) of digital resources throughout their life cycle. Zhixin Chain can quickly register copyrights, trace digital copyright content, and prevent infringement. Based on Zhixin Chain, it is possible to confirm the ownership, store evidence, and protect the rights of original works.

[0057] Exemplarily, the key management method provided in the embodiment of the present application relates to blockchain technology. Blockchain is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods, each of which contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, the platform product service layer, and the application service layer.

[0058] The underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operations. Among them, the user management module is responsible for the identity information management of all blockchain participants, including maintaining the generation of public and private keys (account management), key management, and the maintenance of the correspondence between the user's real identity and blockchain account information (authority management). The basic service module is deployed on all blockchain node devices to verify the validity of business requests and record the valid requests in storage after consensus is reached. For a new business request, the basic service first performs interface adaptation analysis and authentication processing (interface adaptation), and then encrypts the business information through the consensus algorithm (consensus management), and transmits it to the shared ledger in a complete and consistent manner after encryption (network communication), and records and stores it.

[0059] The smart contract module is responsible for contract registration, issuance, contract triggering and contract execution. Developers can define the contract logic in a programming language and publish it to the blockchain (contract registration). According to the logic of the contract terms, the key or other events are called to trigger the execution and complete the contract logic. It also provides the function of contract upgrade and cancellation. The operation module is mainly responsible for the deployment, configuration modification, contract setting, cloud adaptation and real-time status visualization output of the product during the product release process, such as alarm, network status check, node device health status check, etc.

[0060] The platform product service layer provides the basic capabilities and implementation framework of typical applications. Developers can superimpose business features based on these basic capabilities to complete the blockchain implementation of business logic. The application service layer provides application services based on blockchain solutions for business participants to use.

[0061] Figure 1 A schematic diagram of an implementation environment of a key management method provided in an embodiment of the present application is shown. The implementation environment may include: a target device 11 and a database 12.

[0062] The target device 11 can manage the public key and private key of the interactive object according to the key management method provided in the embodiment of the present application, so as to store at least one of the public key and private key of the interactive object in the form of ciphertext in the database 12, thereby improving security. Among them, the public key and private key of the interactive object are a key pair belonging to the interactive object, which is used to identify the identity of the interactive object. Different interactive objects have different public and private key pairs. Exemplarily, the target device 11 can be a terminal of the interactive object, or a server that has established a communication connection with the terminal of the interactive object, which is not limited in the embodiment of the present application.

[0063] Exemplarily, the target application is installed in the terminal of the interactive object, and the server that establishes a communication connection with the terminal of the interactive object can provide background services for the target application. Exemplarily, the types of services that the server can provide can be set based on experience, or flexibly adjusted according to actual application requirements, the type of target application, etc., and the embodiments of the present application do not limit this. Exemplarily, in the case where the target application is a video playback application, the services that the server can provide include but are not limited to video playback services, identity authentication services, services for recording information on the blockchain, etc.

[0064] The database 12 is used to store data related to the key. Exemplarily, the data related to the key includes but is not limited to data related to the key possessed by the interactive object (such as the ciphertext of the public key and the ciphertext of the private key possessed by the interactive object), and data related to the key used to encrypt the plaintext of the public key and the plaintext of the private key of the interactive object (such as the plaintext identification information of the first key and the ciphertext of the second key).

[0065] Exemplarily, the target device 11 may store data in the database 12, or extract data from the database 12. Exemplarily, the database 12 may be maintained by one or more computer devices. The one or more computer devices may include the target device 11, or may not include the target device 11.

[0066] For example, a terminal may be any electronic product that can interact with a user through one or more methods such as a keyboard, a touchpad, a touch screen, a remote control, voice interaction, or a handwriting device, such as a PC (Personal Computer), a mobile phone, a smart phone, a PDA (Personal Digital Assistant), a wearable device, a PPC (Pocket PC), a tablet computer, a smart car machine, a smart TV, a smart speaker, a car terminal, etc. A server may be a single server, a server cluster consisting of multiple servers, or a cloud computing service center.

[0067] Those skilled in the art should understand that the above-mentioned target device 11 and database 12 are only examples, and other existing or future target devices or databases that are applicable to the present application should also be included in the protection scope of the present application and are included here by reference.

[0068] Based on the above Figure 1 In the implementation environment shown, the present application embodiment provides a key management method, taking the method applied to the target device 11 as an example. Figure 2 As shown, the key management method provided in the embodiment of the present application may include the following steps 201 to 203.

[0069] In step 201, the plaintext of the object key of the first object is obtained, the object key includes at least one of the public key and the private key of the first object, the plaintext of the public key of the first object is used to generate the blockchain account information corresponding to the first object on the target blockchain, and the plaintext of the private key of the first object is used to sign the target information of the first object to be recorded on the target blockchain.

[0070] The first object refers to any interactive object that interacts with the target application. The target device can be a terminal of the first object with the target application installed, or a server that has a communication connection with the terminal of the first object and is used to provide background services for the target application. The type of the target application is set based on experience or flexibly adjusted according to the actual application scenario. The embodiment of the present application does not limit this. For example, the type of the target application can be a video playback application, an audio playback application, etc.

[0071] The object key of the first object refers to a key of the first object that needs to be stored in a database in a ciphertext format. The key of the first object includes at least one of a public key and a private key of the first object. That is, the object key of the first object may refer to the public key of the first object, may refer to the private key of the first object, or may include the public key and the private key of the first object. The specific situation of the object key of the first object can be flexibly set, and the embodiments of the present application do not limit this.

[0072] The plaintext of the public key of the first object and the plaintext of the private key of the first object are a key pair that the first object has at the current moment. Exemplarily, the plaintext of the public key and the plaintext of the private key of the first object may not change with the change of the timestamp, or may change with the change of the timestamp. In an exemplary embodiment, in the case where the plaintext of the public key and the plaintext of the private key of the first object change with the change of the timestamp, after obtaining the new plaintext of the public key and the plaintext of the private key, the historical plaintext of the public key and the plaintext of the private key are deleted to avoid conflicts. It should be noted that the public-private key pair is a key pair isolated between objects, that is, the public-private key pair is different for different interactive objects.

[0073] The functions of the plaintext of the public key and the plaintext of the private key of the first object include: the plaintext of the public key of the first object is used to generate the blockchain account information corresponding to the first object on the target blockchain, and the plaintext of the private key of the first object is used to sign the target information of the first object to be recorded on the target blockchain. The embodiment of the present application does not limit the type of the target blockchain, and it can be flexibly selected according to the actual application scenario. Exemplarily, the target blockchain is a blockchain for recording information related to digital resources. Exemplarily, the information related to digital resources includes but is not limited to the purchase information of digital resources, the change information of the holder of digital resources, etc. Of course, the target blockchain can also be a blockchain for recording other information, such as a blockchain for recording game-related information.

[0074] The blockchain account information corresponding to the first object on the target blockchain is used to identify the unique identity of the first object on the target blockchain, and the information of the first object that needs to be recorded on the target blockchain will be stored in correspondence with the blockchain account information corresponding to the first object on the target blockchain. The target information is the information to be recorded on the target blockchain corresponding to the first object. The type of target information is related to the type of the target blockchain, and the embodiments of the present application do not limit this. For example, taking the target blockchain as a blockchain that records information related to digital resources as an example, the target information is the information related to digital resources generated by the first object.

[0075] The plain text of the object key of the first object refers to the original information of the object key of the first object that has not been encrypted. If the plain text of the object key is directly stored in the database, the object key will be easily leaked. Therefore, in the embodiment of the present application, the object key is stored in the database in ciphertext to improve the security of the object key.

[0076] In one possible implementation, before obtaining the plaintext of the object key of the first object, it also includes: sending a public-private key pair generation request to a public-private key pair generation device, the public-private key pair generation request includes identification information of the first object, the public-private key pair generation device is used to respond to the public-private key pair generation request, generate the plaintext of the public key and the plaintext of the private key of the first object, and return the plaintext of the public key and the plaintext of the private key; receive the plaintext of the public key and the plaintext of the private key returned by the public-private key pair generation device.

[0077] In this way, the target device obtains the plaintext of the public key and the plaintext of the private key of the first object by interacting with the public-private key pair generation device, which is conducive to saving the computing resources of the target device. Exemplarily, the public-private key pair generation device refers to a device that has the function of generating the plaintext of the public-private key pair of the interactive object. Exemplarily, the public-private key pair generation device can be a blockchain node device in the blockchain system, or a device that is not in the blockchain system, etc., and the embodiments of the present application are not limited to this.

[0078] Exemplarily, the target device sends a public-private key pair generation request to the public-private key pair generation device in the following manner: the target device calls a public-private key pair generation SDK (Software Development Kit) and sends a public-private key pair generation request to the public-private key pair generation device. The public-private key pair generation SDK integrates a function of generating a plain text of a public-private key pair. Exemplarily, the public-private key pair generation device is a blockchain node device in a blockchain system, and the blockchain node device may be configured with a target blockchain.

[0079] The public-private key pair generation request includes identification information of the first object, so that the public-private key pair generation device knows which interactive object's public-private key pair needs to be generated. After receiving the public-private key pair generation request, the public-private key pair generation device generates the plaintext of the public key and the plaintext of the private key of the first object in response to the public-private key pair generation request. After generating the plaintext of the public key and the plaintext of the private key of the first object, the plaintext of the public key and the plaintext of the private key of the first object are returned to the target device, so that the target device receives the plaintext of the public key and the plaintext of the private key returned by the public-private key pair generation device. The embodiment of the present application does not limit the algorithm used by the public-private key pair generation device to generate the plaintext of the public key and the plaintext of the private key of the first object, which can be pre-written and set by a technician.

[0080] Exemplarily, after receiving the plaintext of the public key and the plaintext of the private key returned by the public-private key pair generating device and determining which one or more of the public key and private key of the first object are the object key, the plaintext of the object key can be extracted from the received plaintext of the public key and the plaintext of the private key, thereby obtaining the plaintext of the object key.

[0081] In an exemplary embodiment, the method for obtaining the plaintext of the object key can also be: sending an object key generation request to an object key generation device, the object key generation request includes identification information of the first object, the object key generation device is used to respond to the object key generation request, generate the plaintext of the object key of the first object, and return the plaintext of the object key; receive the plaintext of the object key returned by the object key generation device.

[0082] In an exemplary embodiment, the method of obtaining the plaintext of the object key may also include: the target device uses a key generation algorithm to obtain the plaintext of the object key of the first object. In this way, the plaintext of the object key is obtained locally without the need to interact with other devices, which is conducive to improving efficiency. The key generation algorithm is used to generate the plaintext of the object key, which is set based on experience or flexibly adjusted according to the application scenario, and the embodiments of the present application do not limit this. In an exemplary embodiment, the input parameters of the key generation algorithm include identification information of the first object. Exemplarily, in addition to the identification information of the first object, the input parameters of the key generation algorithm may also include information such as the current timestamp.

[0083] In step 202, based on the plaintext of the object key, the ciphertext of the object key is obtained; wherein the ciphertext of the object key is the ciphertext obtained by the key management service device after encrypting the plaintext of the object key using the plaintext of the first key, or the ciphertext of the object key is the ciphertext obtained by locally encrypting the plaintext of the object key using the plaintext of the second key.

[0084] After obtaining the plaintext of the object key, the ciphertext of the object key is obtained based on the plaintext of the object key, so as to store the object key in the database in ciphertext. Exemplarily, there are two cases of the ciphertext of the object key, which can improve the flexibility of obtaining the ciphertext of the object key. The two cases are: the ciphertext of the object key is the ciphertext obtained by the key management service device encrypting the plaintext of the object key using the plaintext of the first key; or the ciphertext of the object key is the ciphertext obtained by locally encrypting the plaintext of the object key using the plaintext of the second key. It should be noted that the local mentioned in the embodiment of the present application refers to the local of the target device.

[0085] The key management service device is a device for providing key management services, referred to as KMS for short. Exemplarily, the key management service device is a device deployed in the cloud. The plaintext of the first key is the plaintext of the key generated according to the capabilities of the key management service device and used by the key management service device. Exemplarily, the first key refers to CMK. Exemplarily, the first key is a globally unique key, that is, the first key is the same for different interactive objects. The plaintext of the second key is the plaintext of the key that can be used locally. Exemplarily, the second key is different from the first key. Exemplarily, the second key can be a globally unique key or a key isolated between objects, which is not limited in the embodiments of the present application. Exemplarily, isolation between objects means that the second key is different for different interactive objects.

[0086] In an exemplary embodiment, if Figure 3 As shown, the ciphertext of the object key is the ciphertext obtained by the key management service device encrypting the plaintext of the object key using the plaintext of the first key. Based on the plaintext of the object key, the implementation process of obtaining the ciphertext of the object key includes the following steps 2021 and 2022.

[0087] Step 2021: Send a first encryption request to the key management service device, the first encryption request including the plaintext of the object key and identification information of the plaintext of the first key; the key management service device is used to respond to the first encryption request, use the plaintext of the first key to encrypt the plaintext of the object key, obtain the ciphertext of the object key, and return the ciphertext of the object key.

[0088] After obtaining the plaintext of the object key of the first object, the target device sends a first encryption request including the plaintext of the object key and the identification information of the plaintext of the first key to the key management service device, and the first encryption request is used to request the key management service device to encrypt the plaintext of the object key using the plaintext of the first key. Exemplarily, the identification information of the plaintext of the first key is generated by the key management service device and returned to the target device, and the target device may store the identification information of the plaintext of the first key in a local storage, or may store the identification information of the plaintext of the first key in a database.

[0089] In the case where the target device stores the plaintext identification information of the first key in the local storage, the target device needs to extract the plaintext identification information of the first key from the local storage before sending the first encryption request to the key management service device. In the case where the target device stores the plaintext identification information of the first key in the database, the target device needs to extract the plaintext identification information of the first key from the database before sending the first encryption request to the key management service device.

[0090] In an exemplary embodiment, taking the plaintext identification information of the first key extracted from the database as an example, the plaintext identification information of the first key needs to be stored in the database. Exemplarily, the process of storing the plaintext identification information of the first key in the database includes: the target device sends a first key generation request to the key management service device, the key management service device is used to respond to the first key generation request, generate the plaintext of the first key, and return the plaintext identification information of the first key; receive the plaintext identification information of the first key returned by the key management service device, and store the plaintext identification information of the first key in the database.

[0091] In an exemplary embodiment, the key management service device provides a first key creation interface, and the target device sends a first key generation request to the key management service device by calling the first key creation interface. Exemplarily, the first key creation interface refers to the CreateKey interface. Exemplarily, the form of the first key generation request may refer to a form that matches the first key creation interface, which is set based on experience or flexibly adjusted based on actual application requirements, and the embodiments of the present application do not limit this.

[0092] In an exemplary embodiment, the target device may send the first key generation request to the key management service device when the target device is started or when the timestamp reaches a specified timestamp, etc. This is not limited in the embodiment of the present application.

[0093] After receiving the first key generation request, the key management service device generates the plaintext of the first key in response to the first key generation request, and then returns the identification information of the plaintext of the first key to the target device. The identification information of the plaintext of the first key is used to identify the plaintext of the first key. The embodiment of the present application does not limit the type of the identification information of the plaintext of the first key, which can be set by the key management service device. Exemplarily, the first key is CMK, and the identification information of the plaintext of the first key can be recorded as CMKKeyID.

[0094] After the key management service device returns the plaintext identification information of the first key to the target device, the target device receives the plaintext identification information of the first key returned by the key management service device, and then stores the plaintext identification information of the first key in a database, so that the plaintext identification information of the first key can be directly extracted from the database when needed later.

[0095] In an exemplary embodiment, after receiving the plaintext identification information of the first key returned by the key management service device, the target device can also store the plaintext identification information of the first key in the local storage, and then directly extract the plaintext identification information of the first key from the local storage. Exemplarily, the local storage refers to the external storage space (such as a disk) of the target device, and the data in the local storage will not disappear after the target device loses power.

[0096] In an exemplary embodiment, after receiving the plaintext identification information of the first key returned by the key management service device, the target device can also cache the plaintext identification information of the first key in the memory. If the plaintext identification information of the first key exists in the memory when the first decryption request needs to be sent, the plaintext identification information of the first key in the memory can be directly read. Exemplarily, the memory refers to the internal storage space of the target device, and the data in the memory will disappear after the target device loses power.

[0097] In an exemplary embodiment, the key management service device is provided with an encryption interface, which is used to provide an encryption function. The target device sends a first encryption request to the key management service device by calling the encryption interface. Exemplarily, the encryption interface refers to the Encrypt interface. Exemplarily, the form of the first encryption request may refer to a form that matches the encryption interface, which is set based on experience or flexibly adjusted according to actual application requirements, and the embodiments of the present application do not limit this.

[0098] After receiving the first encryption request, the key management service device responds to the first encryption request by encrypting the plaintext of the object key using the plaintext of the first key to obtain the ciphertext of the object key and returns the ciphertext of the object key. Exemplarily, the relationship between the ciphertext of the object key and the plaintext of the object key can be expressed as: ciphertext of the object key = Encrypt (plaintext of the first key + plaintext of the object key).

[0099] Exemplarily, the key management service device uses the plaintext of the first key to encrypt the plaintext of the object key, and the method of obtaining the ciphertext of the object key includes: using the plaintext of the first key and the plaintext of the object key as input parameters of the encryption function of the reference encryption algorithm, running the encryption function of the reference encryption algorithm, and using the running result as the plaintext of the object key. The reference encryption algorithm can be a preset algorithm bound to the encryption interface, which is not limited in the embodiments of the present application.

[0100] Step 2022: Receive the ciphertext of the object key returned by the key management service device.

[0101] After the key management service device returns the ciphertext of the object key to the target device, the target device receives the ciphertext of the object key returned by the key management service device.

[0102] In the implementation method described in the above steps 2021 and 2022, the target device obtains the ciphertext of the object key by interacting with the key management service device, and the process of encrypting the plaintext of the object key is performed on the key management service device side, which is beneficial to saving the computing resources of the target device.

[0103] In an exemplary embodiment, the ciphertext of the object key is a ciphertext obtained by encrypting the plaintext of the object key locally using the plaintext of the second key. Based on the plaintext of the object key, the process of obtaining the ciphertext of the object key includes: encrypting the plaintext of the object key using the plaintext of the second key to obtain the ciphertext of the object key. In this way, the process of obtaining the ciphertext of the object key is completed locally without interacting with the key management service device, which is conducive to improving efficiency and reducing single-point dependence on the key management service device.

[0104] In an exemplary embodiment, the target device uses the plaintext of the second key to encrypt the plaintext of the object key, which can be set based on experience or flexibly adjusted according to the application scenario, and the embodiment of the present application does not limit this. Exemplarily, the target device uses the plaintext of the second key to encrypt the plaintext of the object key based on the encryption function of the first encryption algorithm to obtain the ciphertext of the object key. The first encryption algorithm is selected based on experience or flexibly adjusted according to the actual application scenario.

[0105] Exemplarily, the first encryption algorithm may be a public algorithm or an undisclosed algorithm, etc. Exemplarily, the first encryption algorithm may refer to an asymmetric encryption algorithm (such as RSA, ECC (Elliptic Curves Cryptography), etc.), or may refer to a symmetric encryption algorithm (such as AES (Advanced Encryption Standard), DES (Data Encryption Standard), etc.). In the case where the first encryption algorithm refers to a symmetric encryption algorithm, the process of encrypting the plaintext of the object key and decrypting the ciphertext of the object key are both based on the plaintext of the second key.

[0106] Exemplarily, the first encryption algorithm is the AES256 algorithm. The plaintext of the second key and the plaintext of the object key are used as input parameters of the encryption function of the AES256 algorithm, the encryption function of the AES256 algorithm is run, and the result of the run is used as the ciphertext of the object key. Exemplarily, the relationship between the ciphertext of the object key and the plaintext of the object key can be expressed as: the ciphertext of the object key = the encryption function of AES256 (the plaintext of the object key + the plaintext of the second key).

[0107] It should be noted that, since the ciphertext of the object key may be the ciphertext obtained by the key management service device using the plaintext of the first key to encrypt the plaintext of the object key, or may be the ciphertext obtained by locally encrypting the plaintext of the object key using the plaintext of the second key, when it is necessary to obtain the ciphertext of the object key, the implementation method can be flexibly selected. For example, when the current network status is good, the implementation method of obtaining the ciphertext of the object key by interacting with the key management service device can be selected to save the computing resources of the target device; when the current network status is not good, the implementation method of obtaining the ciphertext of the object key locally can be selected to avoid the problem of being unable to successfully interact with the key management service device due to the poor network status.

[0108] Exemplarily, before using the plaintext of the second key to encrypt the plaintext of the object key, it is necessary to first obtain the plaintext of the second key. The method of obtaining the plaintext of the second key is related to the method of generating the plaintext of the second key, and whether the second key is stored in the local storage of the target device in plaintext form or in the database in ciphertext form, etc., which is not limited in the embodiments of the present application.

[0109] In an exemplary embodiment, the second key is stored in the database in the form of ciphertext. In this case, the process of obtaining the plaintext of the second key includes steps 1 and 2.

[0110] Step 1: Extract the ciphertext of the second key from the database.

[0111] The second key is stored in the database in the form of ciphertext, which means that the ciphertext of the second key is stored in the database. This storage method is conducive to improving the security of the second key. Before extracting the ciphertext of the second key from the database, the ciphertext of the second key needs to be stored in the database. Exemplarily, the implementation method of storing the ciphertext of the second key in the database is related to the method of obtaining the ciphertext of the second key.

[0112] In a possible implementation, the ciphertext of the second key is obtained by the key management service device by encrypting the plaintext of the second key and storing it in the database. In this case, the plaintext of the second key is generated by the key management service device. In an exemplary embodiment, the key management service device generates the plaintext of the second key based on the plaintext of the first key. In this case, the process of storing the ciphertext of the second key in the database includes the following steps 1-1 to 1-3.

[0113] Step 1-1: Send a first key generation request to the key management service device, the key management service device is used to respond to the first key generation request, generate a plaintext of the first key, and return identification information of the plaintext of the first key; receive the plaintext identification information of the first key returned by the key management service device.

[0114] The implementation process of step 1-1 refers to the implementation process of the related step of storing the plain text identification information of the first key in the database, which will not be repeated here.

[0115] In an exemplary embodiment, after receiving the plaintext identification information of the first key returned by the key management service device, the target device can store the plaintext identification information of the first key in a database or in a local storage, which is not limited in the embodiment of the present application.

[0116] Step 1-2: Send a second key generation request to the key management service device, the second key generation request includes the plaintext identification information of the first key, the key management service device is used to respond to the second key generation request, generate the plaintext of the second key based on the plaintext of the first key, encrypt the plaintext of the second key to obtain the ciphertext of the second key, and return the ciphertext of the second key.

[0117] Since the plaintext of the second key is generated by the key management service device based on the plaintext of the first key, it is necessary to send a second key generation request including identification information of the plaintext of the first key to the key management service device. The second key generation request is used to request the key management service device to generate the plaintext of the second key based on the plaintext of the first key.

[0118] After receiving the second key generation request, the key management service device generates the plaintext of the second key based on the plaintext of the first key in response to the second key generation request, and then encrypts the plaintext of the second key to obtain the ciphertext of the second key. After obtaining the ciphertext of the second key, the ciphertext of the second key is returned to the target device. It should be noted that the method of generating the plaintext of the second key based on the plaintext of the first key and the method of encrypting the plaintext of the second key are determined by the key management service device, and the embodiments of the present application do not limit this. Exemplarily, the second key may refer to a DEK (Data Encryption Key).

[0119] Exemplarily, the target device sends the second key generation request to the key management service device in an implementation manner including: the target device calls the second key generation interface to send the second key generation request to the key management service device. Exemplarily, the second key generation interface refers to the GenerateDataKey interface. Exemplarily, the form of the second key generation request may refer to a form that matches the second key generation interface, which is set based on experience or flexibly adjusted based on actual application requirements, and the embodiments of the present application do not limit this.

[0120] In an exemplary embodiment, the key management service device can return the plaintext of the second key in addition to the ciphertext of the second key, so that the target device caches the plaintext of the second key in the memory, that is, temporarily stores the plaintext of the second key. It should be noted that if the target device loses power, the plaintext of the second key temporarily stored in the memory of the target device will be deleted.

[0121] Step 1-3: Store the ciphertext of the second key in the database.

[0122] After the key management service device returns the ciphertext of the second key, the target device can receive the ciphertext of the second key. After receiving the ciphertext of the second key, the target device stores the ciphertext of the second key in a database for subsequent retrieval and use.

[0123] In an exemplary embodiment, if the plaintext of the first key is not globally unique, then the ciphertext of the second key is also not globally unique, and the ciphertext of the second key and the identification information of the plaintext of the first key can be stored in a database in correspondence. In this case, the target device extracts the ciphertext of the second key from the database in the following manner: based on the identification information of the plaintext of the first key, the ciphertext of the second key is extracted from the database. Exemplarily, the identification information of the plaintext of the first key can be extracted from the database, or from local storage, etc.

[0124] In an exemplary embodiment, if the plaintext of the first key is globally unique, then the ciphertext of the second key is also globally unique, and the ciphertext of the second key can be directly stored in the database. In this case, the target device can directly extract the ciphertext of the second key from the database. Of course, the ciphertext of the second key can also be stored in the database in correspondence with the identification information of the plaintext of the first key.

[0125] In an exemplary embodiment, in the case where the ciphertext of the second key is globally unique, the above operation of storing the ciphertext of the second key in the database only needs to be performed once. That is, by calling the key generation function of the key management service device, a pair of public second key plaintext and second key ciphertext is generated, the second key ciphertext is stored in the database, and the second key plaintext can be placed in the memory for local encryption and decryption. If the ciphertext of the second key is already stored in the database, it is not necessary to perform the entire implementation process of storing the ciphertext of the second key in the database.

[0126] In an exemplary embodiment, the key management service device can directly generate the plaintext of the second key. In this case, the process of storing the ciphertext of the second key in the database includes: sending a second key generation request to the key management service device, the key management service device is used to respond to the second key generation request, generate the plaintext of the second key, encrypt the plaintext of the second key to obtain the ciphertext of the second key, and return the ciphertext of the second key; the target device stores the ciphertext of the second key in the database.

[0127] In an exemplary embodiment, the key management service device may also generate a plain text of the second key based on the identification information of the first object. In this case, the process of storing the ciphertext of the second key in the database includes: sending a second key generation request including the identification information of the first object to the key management service device, the key management service device is used to respond to the second key generation request, generate the plain text of the second key based on the identification information of the first object, encrypt the plain text of the second key to obtain the ciphertext of the second key, and return the ciphertext of the second key; the target device stores the ciphertext of the second key in the database.

[0128] In a possible implementation, the ciphertext of the second key is obtained by encrypting the plaintext of the second key locally by the target device and stored in the database. In this case, the plaintext of the second key is generated locally by the target service device. In an exemplary embodiment, the target device generates the plaintext of the second key based on the identification information of the first object. In this case, the process of storing the ciphertext of the second key in the database includes: generating the plaintext of the second key based on the identification information of the first object, encrypting the plaintext of the second key to obtain the ciphertext of the second key; and storing the ciphertext of the second key in the database in correspondence with the identification information of the first object.

[0129] The method by which the target device generates the plaintext of the second key based on the identification information of the first object is set according to experience, or is flexibly adjusted according to the actual application scenario. The embodiment of the present application does not limit this. Exemplarily, the target device uses the MD5 (Message Digest 5) algorithm to generate the plaintext of the second key based on the identification information of the first object and the current timestamp, that is, the plaintext of the second key = MD5 (identification information of the first object + current timestamp). The current timestamp refers to the timestamp when the plaintext of the second key is generated. Exemplarily, the plaintext of the second key generated based on the identification information of the first object is the plaintext of the second key corresponding to the first object. This method can generate encryption and decryption keys isolated between objects.

[0130] The method of encrypting the plaintext of the second key to obtain the ciphertext of the second key is set according to experience, or flexibly adjusted according to the application scenario, and the embodiments of the present application do not limit this. Exemplarily, based on the encryption function of the AES256 algorithm, the plaintext of the second key is encrypted using the plaintext of the reference key to obtain the ciphertext of the second key, that is, the ciphertext of the second key = the encryption function of AES256 (the plaintext of the second key + the plaintext of the reference key). The reference key can be flexibly selected according to experience, and can also be flexibly adjusted according to the actual application scenario, and the embodiments of the present application do not limit this.

[0131] Since the ciphertext of the second key corresponds to the identification information of the first object, after obtaining the ciphertext of the second key, the ciphertext of the second key and the identification information of the first object are stored in the database in correspondence. In this storage method, the method of extracting the ciphertext of the second key from the database includes: extracting the ciphertext of the second key from the database based on the identification information of the first object.

[0132] Exemplarily, the process of generating the plaintext of the second key based on the identification information of the first object can be implemented by the local encryption and decryption key generation module of the target device. This method of generating the plaintext of the second key can be independent of the key management service device, and can achieve encryption and decryption key isolation between objects, localize the encryption and decryption key generation function, and has no network requests and interface costs. It also meets compliance requirements and can be applied to scenarios with high security requirements, user authentication, and protection of user core assets, to achieve efficient generation of user encryption and decryption keys, and to store them securely and compliantly.

[0133] In an exemplary embodiment, the target device generates the plaintext of the second key based on a pre-configured key generation script. In this case, the process of storing the ciphertext of the second key in the database includes: the target device generates the plaintext of the second key based on the key generation script, encrypts the plaintext of the second key to obtain the ciphertext of the second key, and stores the ciphertext of the second key in the database. Exemplarily, the key generation script is a pre-configured script for generating the plaintext of the second key. The key generation script is set according to experience, or flexibly adjusted according to actual application scenarios, etc., which is not limited in the embodiments of the present application. In an exemplary embodiment, for the case where the target device generates the plaintext of the second key based on the pre-configured key generation script, the plaintext of the second key and the ciphertext of the second key are fixed for different interactive objects, that is, the plaintext of the second key and the ciphertext of the second key are globally unique, which can achieve the direct local generation of encryption and decryption keys shared by all interactive objects without relying on the key management service device.

[0134] In an exemplary embodiment, after generating the plain text of the second key, the target device may cache the plain text of the second key in a memory.

[0135] Step 2: Based on the ciphertext of the second key, obtain the plaintext of the second key.

[0136] After extracting the ciphertext of the second key from the database, the plaintext of the second key is obtained based on the ciphertext of the second key. The method of obtaining the plaintext of the second key based on the ciphertext of the second key is related to whether the ciphertext of the second key is obtained by encrypting the plaintext of the second key by the key management service device or by encrypting the plaintext of the second key locally.

[0137] In an exemplary embodiment, when the ciphertext of the second key is obtained by encrypting the plaintext of the second key by a key management service device and stored in a database, a process of obtaining the plaintext of the second key based on the ciphertext of the second key includes: sending a first decryption request to the key management service device, the first decryption request including the ciphertext of the second key, the key management service device being used to decrypt the ciphertext of the second key in response to the first decryption request, obtain the plaintext of the second key, and return the plaintext of the second key; and receiving the plaintext of the second key returned by the key management service device.

[0138] The first decryption request is used to request the key management service device to decrypt the ciphertext of the second key. Exemplarily, the way the key management service device decrypts the ciphertext of the second key is related to the way the key management service device encrypts the plaintext of the second key, which is not limited in this embodiment of the application.

[0139] Exemplarily, the target device sends a first decryption request to the key management service device in an implementation manner including: the target device calls a decryption interface to send the first decryption request to the key management service device. Exemplarily, the decryption interface refers to a Decrypt interface. Exemplarily, the form of the first decryption request may refer to a form that matches the decryption interface, which is set based on experience or flexibly adjusted based on actual application requirements, and the embodiments of the present application do not limit this.

[0140] In an exemplary embodiment, when the ciphertext of the second key is obtained by encrypting the plaintext of the second key locally and storing it in a database, the process of obtaining the plaintext of the second key based on the ciphertext of the second key includes: decrypting the ciphertext of the second key to obtain the plaintext of the second key. The method of decrypting the ciphertext of the second key to obtain the plaintext of the second key is related to the method of encrypting the plaintext of the second key to obtain the ciphertext of the second key, and the embodiment of the present application does not limit this.

[0141] In an exemplary embodiment, the second key is stored in the local storage of the target device in plain text form. In this case, the process of obtaining the plain text of the second key includes: extracting the plain text of the second key from the local storage. This method is more efficient in obtaining the plain text of the second key.

[0142] Before extracting the plaintext of the second key from the local storage, the plaintext of the second key needs to be stored in the local storage. Exemplarily, storing the plaintext of the second key in the local storage may refer to configuring the plaintext of the second key in a configuration file in the local storage.

[0143] In an exemplary embodiment, the target device stores the plain text of the second key in the local storage in an implementation manner including: after the target device generates the plain text of the second key based on the identification information of the first object or based on the key generation script, the target device stores the plain text of the second key in the local storage in correspondence with the identification information of the first object. In an exemplary embodiment, the target device stores the plain text of the second key in the local storage in an implementation manner including: after the target device receives the plain text of the second key returned by the key management service device, the target device stores the plain text of the second key in the local storage.

[0144] It should be noted that the above-mentioned methods of obtaining the plain text of the second key all refer to the method when the plain text of the second key does not exist in the memory of the target device when the plain text of the second key needs to be obtained. In an exemplary embodiment, if the plain text of the second key exists in the memory of the target device when the plain text of the second key needs to be obtained, the plain text of the second key in the memory can be directly read out.

[0145] The embodiment of the present application does not limit the situation where the plain text of the second key exists in the memory. Exemplarily, the situation where the plain text of the second key exists in the memory may refer to that the target device receives the plain text of the second key returned by the key management service device and caches the plain text of the second key in the memory, and the data in the memory is not cleared. Exemplarily, the situation where the plain text of the second key exists in the memory may also refer to that the target device caches the plain text of the second key generated locally in the memory and the data in the memory is not cleared.

[0146] Exemplarily, the situation where the plaintext of the second key exists in the memory may also mean that the target device caches the plaintext of the second key obtained by interacting with the key management service device based on the ciphertext of the second key or the plaintext of the second key obtained by decrypting the ciphertext of the second key locally in the memory, and the data in the memory is not cleared. Exemplarily, the situation where the plaintext of the second key exists in the memory may also mean that the target device caches the plaintext of the second key extracted from the local storage in the memory, and the data in the memory is not cleared.

[0147] In step 203, the ciphertext of the object key and the identification information of the first object are stored in a database in correspondence.

[0148] The identification information of the first object is used to identify the first object. The embodiment of the present application does not limit the type of the identification information of the first object. Exemplarily, the identification information of the first object includes but is not limited to the identity document number, communication number, etc. of the first object. Exemplarily, the identification information of the first object may refer to the account number registered by the first object in the target application.

[0149] After obtaining the ciphertext of the object key, the ciphertext of the object key is stored in the database in correspondence with the identification information of the first object, so that the ciphertext of the object key can be extracted from the database based on the identification information of the first object later. The ciphertext of the object key is stored in the database in correspondence with the identification information of the first object, so that the object key can be stored in the database in the form of ciphertext. The object key stored in the database in the form of ciphertext is not easy to be leaked, which is conducive to improving the security of the object key.

[0150] The database is used to store data related to the key. Exemplarily, the data related to the key includes, but is not limited to, data related to the key possessed by the interactive object (e.g., ciphertext of the public key possessed by the interactive object, ciphertext of the private key, etc.), and data related to the key used to encrypt the plaintext of the public key and the plaintext of the private key of the interactive object (e.g., identification information of the plaintext of the first key, ciphertext of the second key, etc.). The embodiment of the present application does not limit the type of database, and it can be selected based on experience, or it can be flexibly adjusted according to actual application requirements. Exemplarily, the database can be a relational database, or it can be a non-relational database, etc. Exemplarily, the non-relational database can specifically refer to Redis (a memory database) to improve the efficiency of data extraction. Exemplarily, the database can also refer to a distributed database.

[0151] Exemplarily, in the case where the object key is the public key of the first object, the plain text of the private key of the first object and the identification information of the first object can be directly stored in the database in correspondence; in the case where the object key is the private key of the first object, the plain text of the public key of the first object and the identification information of the first object can be directly stored in the database in correspondence.

[0152] In an exemplary embodiment, after the ciphertext of the object key and the identification information of the first object are stored in the database in correspondence, the method further includes: extracting the ciphertext of the object key from the database based on the identification information of the first object; and obtaining the plaintext of the object key based on the ciphertext of the object key.

[0153] Exemplarily, in a case where the ciphertext of the object key is the ciphertext obtained by encrypting the plaintext of the object key by the key management service device using the plaintext of the first key, the process of obtaining the plaintext of the object key based on the ciphertext of the object key includes: sending a second decryption request to the key management service device, the second decryption request including identification information of the plaintext of the first key and the ciphertext of the object key, the key management service device being used to decrypt the ciphertext of the object key using the plaintext of the first key in response to the second decryption request to obtain the plaintext of the object key, and returning the plaintext of the object key; and receiving the plaintext of the object key returned by the key management service device.

[0154] The second decryption request is used to request the key management service device to decrypt the ciphertext of the object key using the plaintext of the first key, so the second decryption request needs to include the identification information of the plaintext of the first key and the ciphertext of the object key. The identification information of the plaintext of the first key is used to identify the plaintext of the first key.

[0155] In an exemplary embodiment, the key management service device is provided with a decryption interface, which is used to provide a decryption function. The target device sends a second decryption request to the key management service device by calling the decryption interface. Exemplarily, the decryption interface refers to a Decrypt interface. Exemplarily, the form of the second decryption request may refer to a form that matches the decryption interface, which is set based on experience or flexibly adjusted according to actual application requirements, and the embodiments of the present application do not limit this.

[0156] After receiving the second decryption request, the key management service device responds to the second decryption request and uses the plaintext of the first key to decrypt the ciphertext of the object key to obtain the plaintext of the object key. After obtaining the plaintext of the object key, the key management service device returns the plaintext of the object key to the target device. Exemplarily, the relationship between the plaintext of the object key and the ciphertext of the object key can be expressed as: plaintext of the object key = Decrypt (plaintext of the first key + ciphertext of the object key).

[0157] Exemplarily, the key management service device uses the plaintext of the first key to decrypt the ciphertext of the object key, and the method of obtaining the plaintext of the object key includes: using the plaintext of the first key and the ciphertext of the object key as input parameters of the decryption function bound to the decryption interface, running the decryption function bound to the decryption interface, and using the running result as the plaintext of the object key. The decryption function bound to the decryption interface can be set based on experience or flexibly adjusted according to actual application requirements, and the embodiments of the present application do not limit this.

[0158] After the key management service device returns the plaintext of the object key to the target device, the target device receives the plaintext of the object key returned by the key management service device. In this implementation, the target device interacts with the key management service device to implement the process of obtaining the plaintext of the object key based on the ciphertext of the object key. This method is conducive to saving the computing resources of the target device.

[0159] In an exemplary embodiment, when the ciphertext of the object key is the ciphertext obtained by locally encrypting the plaintext of the object key using the plaintext of the second key, the process of obtaining the plaintext of the object key based on the ciphertext of the object key includes: decrypting the ciphertext of the object key using the plaintext of the second key to obtain the plaintext of the object key.

[0160] Since the ciphertext of the object key is obtained by encrypting the plaintext of the object key locally using the plaintext of the second key, after obtaining the ciphertext of the object key, the target device can decrypt the ciphertext of the object key locally using the plaintext of the second key to obtain the plaintext of the object key.

[0161] Exemplarily, the method by which the target device uses the plaintext of the second key to decrypt the ciphertext of the object key can be set based on experience, or flexibly adjusted according to the application scenario, and the embodiments of the present application do not limit this. Exemplarily, the target device uses the plaintext of the second key to decrypt the ciphertext of the object key based on the decryption function of the target encryption algorithm to obtain the plaintext of the object key. The target encryption algorithm is selected based on experience, or flexibly adjusted according to the actual application scenario. Exemplarily, the target encryption algorithm refers to a symmetric encryption algorithm, and the process of encrypting the plaintext of the object key and decrypting the ciphertext of the object key are both based on the plaintext of the second key.

[0162] Exemplarily, based on the decryption function of the target encryption algorithm, the ciphertext of the object key is decrypted using the plaintext of the second key to obtain the plaintext of the object key, including: using the plaintext of the second key and the ciphertext of the object key as input parameters of the decryption function of the target encryption algorithm, running the decryption function of the target encryption algorithm, and using the result of the running as the plaintext of the object key. Exemplarily, the target encryption algorithm refers to AES256. The relationship between the plaintext of the object key and the ciphertext of the object key can be expressed as: plaintext of the object key = decryption function of AES256 (ciphertext of the object key + plaintext of the second key).

[0163] Before using the plaintext of the second key to decrypt the ciphertext of the object key, it is necessary to first obtain the plaintext of the second key. The implementation method of obtaining the plaintext of the second key refers to the implementation method of obtaining the plaintext of the second key before using the plaintext of the object key to encrypt the plaintext of the second key introduced in step 202, which will not be repeated here.

[0164] In an exemplary embodiment, after obtaining the plaintext of the object key, it is possible to interact with the blockchain node device based on the plaintext of the object key. Exemplarily, in different cases of the object key, the way of interacting with the blockchain node device based on the plaintext of the object key is different. The blockchain node device refers to a node device configured with a target blockchain.

[0165] In an exemplary embodiment, the object key includes a public key of the first object. In this case, the process of interacting with the blockchain node device based on the plain text of the object key includes: sending an account generation request to the blockchain node device, the account generation request includes the plain text of the public key, the blockchain node device is used to respond to the account generation request, generate the blockchain account information corresponding to the first object on the target blockchain based on the plain text of the public key, and return the blockchain account information; receive the blockchain account information returned by the blockchain node device. The account generation request is used to request the blockchain node device to generate the blockchain account information of the first object.

[0166] The blockchain account information corresponding to the first object on the target blockchain is generated based on the plain text of the public key of the first object. Therefore, if the target device wants to obtain the blockchain account information of the first object, it needs to send an account generation request including the plain text of the public key to the blockchain node device.

[0167] In an exemplary embodiment, a blockchain node device may refer to a node device in a blockchain system that maintains a target blockchain and is used to generate blockchain account information of an interactive object. The target device records the device identification information of the blockchain node device, and then can send an account generation request to the corresponding blockchain node device based on the device identification information.

[0168] The embodiment of the present application does not limit the way in which the blockchain node device generates the blockchain account information of the first object based on the plain text of the public key. In an exemplary embodiment, the blockchain account information of the first object is generated based on the plain text of the public key using a target algorithm. In an exemplary embodiment, the target algorithm is an undisclosed algorithm recorded by the blockchain node device to ensure the security of the blockchain account information.

[0169] After generating the blockchain account information, the blockchain node device returns the blockchain account information to the target device, so that the target device receives the blockchain account information returned by the blockchain node device. In an exemplary embodiment, after receiving the blockchain account information, the target device can bind the blockchain account information with the object identifier of the first object, so that when the information of the first object that needs to be recorded on the target blockchain is sent to the blockchain node device, the blockchain account information is sent together with the information that needs to be recorded, so that the blockchain node device verifies the information that needs to be recorded, and after the verification is passed, the information that needs to be recorded and the blockchain account information are recorded on the target blockchain in correspondence.

[0170] In an exemplary embodiment, taking the target blockchain as a blockchain that records digital resource-related information as an example, the blockchain account information of the first object may also refer to the digital resource address of the first object.

[0171] In an exemplary embodiment, the object key includes a private key of the first object. In this case, the process of interacting with the blockchain node device based on the plain text of the object key includes: signing the target information based on the plain text of the private key to obtain the signature information of the target information; sending an information recording request to the blockchain node device, the information recording request includes the target information, signature information and the blockchain account information of the first object, the blockchain node device is used to respond to the information recording request, verify the target information based on the signature information and the blockchain account information of the first object, record the verified target information on the target blockchain, and return the information recording result; receive the information recording result returned by the blockchain node device.

[0172] In an exemplary embodiment, the target information is signed based on the plain text of the private key to obtain the signature information of the target information by obtaining a summary of the target information, encrypting the summary of the target information using the plain text of the private key, and using the encrypted information as the signature information of the target information. The embodiment of the present application does not limit the method of obtaining the summary of the target information. Exemplarily, the target information is processed using a hash function to obtain the summary of the target information.

[0173] After obtaining the signature information, the target device sends an information recording request to the blockchain node device, and the information recording request is used to request the blockchain node device to record the target information on the target blockchain. The information recording request includes the target information, the signature information, and the blockchain account information of the first object. The blockchain account information of the first object is used to identify the identity of the first object on the target blockchain.

[0174] Exemplarily, the blockchain account information of the first object is generated by the blockchain node device based on the plain text of the public key of the first object. Exemplarily, the blockchain account information of the first object can be recorded in the target device corresponding to the identification information of the first object, and the target device can directly obtain the blockchain account information of the first object based on the identification information of the first object.

[0175] It should be noted that the blockchain node device used to receive information record requests and the blockchain node device used to receive account generation requests can be the same node device in the blockchain system, or they can be different node devices in the blockchain system. This is related to the function of the node device in the blockchain system, and the embodiments of the present application are not limited to this.

[0176] After receiving the information recording request, the blockchain node device responds to the information recording request and verifies the target information based on the signature information and the blockchain account information of the first object. Exemplarily, the blockchain account information of the first object is generated based on the plaintext of the public key of the first object, and the process of the blockchain node device verifying the target information based on the signature information and the blockchain account information of the first object includes: the blockchain node device obtains the plaintext of the public key of the first object based on the blockchain account information of the first object; uses the plaintext of the public key of the first object to decrypt the signature information to obtain the first summary; uses the same summary acquisition method as the target device to obtain the summary to be verified of the target information; verifies whether the first summary is the same as the summary to be verified of the target information. If the first summary is the same as the summary to be verified of the target information, the verification of the target information passes; if the first summary is different from the summary to be verified of the target information, the verification of the target information fails. Exemplarily, the above-mentioned verification process based on signature information can be called a signature verification process.

[0177] Exemplarily, the blockchain node device records the correspondence between the blockchain account information of the first object and the plaintext of the public key of the first object, and can directly extract the plaintext of the public key of the first object based on the blockchain account information of the first object. Exemplarily, the process of generating the blockchain account information of the first object based on the plaintext of the public key of the first object is a reversible process, and the blockchain node device can obtain the plaintext of the public key of the first object by parsing the blockchain account information of the first object.

[0178] After the blockchain node device determines that the target information has been verified, it records the verified target information on the target blockchain and returns the information recording result. After the blockchain node device returns the information recording result, the target device receives the information recording result returned by the blockchain node device, and the process of recording the target information on the target blockchain is completed.

[0179] In an exemplary embodiment, the process in which a blockchain node device records target information on a target blockchain includes: the blockchain node device generates a target block based on the target information; and adds the target block to the target blockchain based on a consensus mechanism.

[0180] In blockchain technology, data can be stored in blocks in the form of electronic records. When the packaging conditions are met, the blockchain node device can package the target information and generate a target block. Among them, satisfying the packaging conditions may refer to the time interval required for packaging data, or the amount of data required for packaging data, which is not limited in the embodiments of the present application. In one possible implementation, the process of the blockchain node device generating the target block can be as follows:

[0181] The blockchain node device verifies the target information. After verification, it takes the target information as input information, stores the input information in the memory pool, and updates the hash tree used to record the input information. After that, it updates the update timestamp to the time when the new input information is received, tries different random numbers, and calculates the eigenvalues ​​multiple times so that the calculated eigenvalues ​​can satisfy the following formula:

[0182] SHA256(SHA256(version+prev_hash+merkle_root+ntime+nbits+x)) <TARGET

[0183] Among them, SHA256 is the eigenvalue algorithm used to calculate the eigenvalue; version (version number) is the version information of the relevant block protocol in the blockchain; prev_hash is the block header eigenvalue of the parent block of the target block, and the parent block of the target block is the block with the largest block height on the current target blockchain; merkle_root is the eigenvalue of the input information; ntime is the update time of the update timestamp; nbits is the current difficulty, which is a fixed value within a period of time and is determined again after exceeding the fixed time period; x is a random number; TARGET is the eigenvalue threshold, which can be determined based on nbits.

[0184] In this way, when a random number that satisfies the above formula is calculated, the information can be stored accordingly, the block header and block body can be generated, and the target block can be obtained.

[0185] It should be noted that the above description of the target block generation process is only an exemplary description of a block generation method, and the embodiment of the present application does not limit which specific block generation method is adopted.

[0186] The blockchain system can reach a consensus on the target block to determine whether the data in the target block is accurate, that is, to verify the data in the target block. In one possible implementation, after the blockchain node device generates the target block, it can send the target block to other node devices according to the node device identifiers of other node devices in the blockchain system. Other node devices can verify the target block and broadcast the verification results in the blockchain system. When the number of node devices that pass the verification result in the blockchain system is greater than the reference ratio or greater than the reference number, the blockchain node device can determine that the consensus of the target block is passed, and then add the target block to the target blockchain.

[0187] Exemplarily, the reference ratio refers to the ratio of the number of node devices with a passed verification result to the number of all node devices in the blockchain system. The reference ratio can be set based on experience or freely adjusted according to the application scenario, and the embodiments of the present application do not limit this. For example, the reference ratio can be set to 1 / 3, etc. Similarly, the reference number can be set based on experience or freely adjusted according to the total number of all node devices in the blockchain system, for example, the reference number can be set to 100, etc. The above consensus process can be implemented based on a consensus mechanism, for example, the consensus mechanism can be a proof-of-work mechanism, a proof-of-stake mechanism, etc. It should be noted that the above consensus process is only an exemplary description, and the embodiments of the present application do not limit this.

[0188] In an exemplary embodiment, the target device can also interact with a device to be interacted that is not in the blockchain system based on the ciphertext of the object key. The purpose of the target device interacting with the device to be interacted based on the plaintext of the object key can be flexibly set according to the actual interaction needs, and the embodiment of the present application does not limit this. Under different purposes, the interaction process may be different.

[0189] Exemplarily, the object key is the public key of the first object, and the purpose of interacting with the device to be interacted based on the plain text of the object key may be to enable the device to be interacted to save the public key of the first object, so that the device to be interacted can subsequently use the public key of the first object to encrypt the information to be sent to the first object, thereby improving security and avoiding information leakage. In this case, the process of the target device interacting with the device to be interacted based on the plain text of the object key may be: the target device sends the plain text of the public key to the device to be interacted, the object to be interacted is used to save the plain text of the public key, and returns the saved result; the target device receives the saved result.

[0190] Exemplarily, the object key is the private key of the first object, and the purpose of interacting with the device to be interacted based on the plain text of the object key may be to use the plain text of the private key to sign the information to be sent to the object to be interacted, so that the reliability of the information to be interacted can be verified by signature verification. In this case, the process of the target device interacting with the device to be interacted based on the plain text of the object key may be: the target device uses the plain text of the private key to sign the first information to be sent to the device to be interacted, obtains the first signature, sends the first information and the first signature to the device to be interacted, the object to be interacted is used to verify the first information using the first signature and the plain text of the public key of the first object stored in advance, and returns the response information after the verification is passed; the target device receives the response information.

[0191] Exemplarily, the key management method provided in the embodiment of the present application can assist in realizing the interface authentication and user authentication of the blockchain, which are the core of the blockchain smart contract and are mainly realized by the signature and verification technology of public and private keys. The key management method provided in the embodiment of the present application involves the generation, storage, reading and use of public and private keys.

[0192] In the embodiment of the present application, in the public-private key generation phase, a public-private key pair generation SDK is used to generate a public-private key pair, and the public-private key pair of each interactive object is different. In the key storage phase, compliant and secure storage is required, such as encryption and storage using the AES256 algorithm. Compliance and secure storage and use of the public-private keys of interactive objects can be achieved through remote encryption or local encryption using encryption and decryption keys isolated between objects.

[0193] Exemplarily, the public and private key pairs of each interactive object are different. The public and private keys of the interactive objects cannot be stored in plain text, and the public and private keys need to be encrypted and stored. The encryption and decryption keys used by the AES256 algorithm for public and private key encryption can be shared by all interactive objects or isolated between objects. The generation and management of encryption and decryption keys can be managed remotely based on KMS, or they can be generated locally, encrypted and stored locally, and decrypted when used. KMS remote management has the risk of single-point dependence and the problem of time-consuming interfaces, but it can save local computing resources. If generated locally, encryption and decryption are more efficient, but the encryption and decryption keys require more compliant storage.

[0194] The key management method provided in the embodiment of the present application obtains the ciphertext of the public key and / or private key of the first object, so that the public key and / or private key of the first object can be stored in the database in ciphertext. The public key and / or private key stored in ciphertext is not easy to be leaked, and the security of key management is relatively high. In addition, there are two cases of the ciphertext of the object key, and the flexibility of obtaining the ciphertext of the object key is relatively high.

[0195] The above-mentioned embodiment explains the key management method from the perspective of method steps. The following describes four key management schemes implemented based on the key management method provided in the embodiment of the present application from the perspective of four detailed embodiments. Exemplarily, each key management scheme is an implementation method when the object key includes a public key and a private key. Exemplarily, each key management scheme may include an encryption and decryption key generation phase, a public-private key encryption phase, and a public-private key decryption phase. Exemplarily, the public-private key encryption phase is initiated under the operation of generating a public-private key pair carrying the identification information (VUID) of the first object, and the public-private key decryption phase is initiated under the operation of obtaining the public and private keys carrying the VUID.

[0196] The first key management scheme is Figure 4 As shown, in the first key management scheme, in the encryption and decryption key generation stage, the target device sends a first key generation request to the key management service device (KMS) by calling the CreateKey interface. The key management service device responds to the first key generation request, generates the plaintext of the first key (CMK), and returns the identification information (CMKKeyID) of the plaintext of the first key to the target device. CMK is globally unique, and CMKKeyID is also globally unique. After receiving the CMKKeyID, the target device stores the globally unique CMKKeyID in the Redis database.

[0197] In the public-private key encryption phase, the target device sends a public-private key pair generation request to the public-private key pair generation device by calling the public-private key pair generation SDK. The public-private key pair generation device responds to the public-private key generation request, generates the plaintext of the public key and the plaintext of the private key, and returns the plaintext of the public key and the plaintext of the private key to the target device. After receiving the plaintext of the public key and the plaintext of the private key, the target device sends an encryption request including the CMKKeyID and the plaintext of the public key to KMS by calling the Encrypt interface; KMS responds to the encryption request, encrypts the plaintext of the public key with the plaintext of the CMK, obtains the ciphertext of the public key (the ciphertext of the public key = Encrypt (the plaintext of the public key + the plaintext of the CMK)), and returns the ciphertext of the public key to the target device. The target device sends an encryption request including CMKKeyID and the plaintext of the private key to KMS by calling the Encrypt interface; KMS responds to the encryption request and encrypts the plaintext of the private key with the plaintext of CMK to obtain the ciphertext of the private key (ciphertext of private key = Encrypt (plaintext of private key + plaintext of CMK)), and returns the ciphertext of the private key to the target device. The target device stores the ciphertext of the public key and the vuid in the Redis database, and stores the ciphertext of the private key and the vuid in the Redis database.

[0198] In the public and private key decryption phase, the target device extracts CMKKeyID from the Redis database based on vuid, and extracts the ciphertext of the public key and the ciphertext of the private key from the Redis database based on vuid. The target device sends the ciphertext of the public key and the ciphertext of the private key, as well as CMKKeyID, to KMS by calling the Decrypt interface. KMS uses the plaintext of CMK to decrypt the ciphertext of the public key and the ciphertext of the private key, and obtains the plaintext of the public key (the plaintext of the public key = Decrypt (the ciphertext of the public key + the plaintext of CMK)) and the plaintext of the private key (the plaintext of the private key = Decrypt (the ciphertext of the private key + the plaintext of CMK)), and returns the plaintext of the public key and the plaintext of the private key to the target device, so that the target device obtains the plaintext of the public key and the plaintext of the private key that it needs to use.

[0199] For example, Figure 4 The key management scheme shown can be called the KMS remote encryption and decryption scheme. This scheme relies on KMS. When the target device starts, a globally unique CMK is generated from KMS, and CMKKeyID is returned at the same time. The CMKKeyID is stored in the Redis database. After this step, all operations of the interactive object rely on this globally unique CMKKeyID. Each encryption and decryption on the interactive object side relies on KMS, and encryption and decryption are performed on the KMS side through the stored CMKKeyID.

[0200] The second key management scheme is Figure 5 As shown, in the second key management scheme, in the encryption and decryption key generation stage, the target device sends a first key generation request to the KMS by calling the CreatKey interface. The key management service device responds to the first key generation request, generates the plaintext of the CMK, and returns the CMKKeyID to the target device. This process only needs to be executed once. If there is a ciphertext of the DEK in the database, this process does not need to be executed. CMK is globally unique, so CMKKeyID is also globally unique. After receiving the CMKKeyID, the target device sends a second key generation request including the CMKKeyID to the KMS by calling GenerateDataKey. The KMS responds to the second key generation request, generates the plaintext of the DEK, encrypts the plaintext of the DEK, obtains the ciphertext of the DEK, and returns the plaintext and ciphertext of the DEK to the target device. The target device stores the CMKKeyID and the ciphertext of the DEK in the Redis database. This process only needs to be executed once. If there is a ciphertext of the DEK in the database, this process does not need to be executed. Exemplarily, the plaintext of DEK and the ciphertext of DEK are also globally unique, that is, all interacting objects share the plaintext of DEK and the ciphertext of DEK generated by KMS.

[0201] In this encryption and decryption key generation phase, before executing the public and private key encryption phase, the following process can also be performed: When the target device is started, the ciphertext of the DEK is extracted from the Redis database based on the CMKKeyID. By calling the Decrypt interface, a decryption request including the ciphertext of the DEK is sent to the KMS. In response to the decryption request, the KMS decrypts the ciphertext of the DEK, obtains the plaintext of the DEK, and returns the plaintext of the DEK to the target device. After receiving the plaintext of the DEK, the target device caches the plaintext of the DEK into the memory for direct use.

[0202] In the public-private key encryption stage, the target device sends a public-private key pair generation request to the public-private key pair generation device by calling the public-private key pair generation SDK. The public-private key pair generation device responds to the public-private key pair generation request, generates the plaintext of the public key and the plaintext of the private key, and returns the plaintext of the public key and the plaintext of the private key to the target device. After receiving the plaintext of the public key and the plaintext of the private key, the target device encrypts the plaintext of the public key using the plaintext of the DEK based on the encryption function of the AES256 algorithm to obtain the ciphertext of the public key (the ciphertext of the public key = the encryption function of AES256 (the plaintext of the public key + the plaintext of the DEK)), and encrypts the plaintext of the private key using the plaintext of the DEK to obtain the ciphertext of the private key (the ciphertext of the private key = the encryption function of AES256 (the plaintext of the private key + the plaintext of the DEK)). The target device stores the plaintext of the public key and the vuid in the Redis database in correspondence, and stores the plaintext of the private key and the vuid in the Redis database in correspondence.

[0203] In the public and private key decryption phase, the target device extracts the ciphertext of the public key and the ciphertext of the private key from the Redis database based on the vuid. Based on the decryption function of the AES256 algorithm, the target device uses the plaintext of the DEK to decrypt the ciphertext of the public key and obtain the plaintext of the public key (the plaintext of the public key = the decryption function of AES256 (the ciphertext of the public key + the plaintext of DEK)); the plaintext of the DEK is used to decrypt the ciphertext of the private key and obtain the plaintext of the private key (the plaintext of the private key = the decryption function of AES256 (the ciphertext of the private key + the plaintext of DEK)).

[0204] Exemplarily, the first key may refer to a master key (CMK). Figure 5 The key management scheme shown can be called a KMS-generated master key and local encryption and decryption scheme. In this scheme, the CMK generation function of KMS is used to generate a pair of public DEK plaintext and DEK ciphertext, the DEK ciphertext is stored in the database, and the DEK plaintext is cached in the memory for local encryption and decryption. The process of generating CMK and the process of generating DEK plaintext and DEK ciphertext only requires one network call.

[0205] The third key management scheme is Figure 6As shown, in the third key management scheme, in the encryption and decryption key generation phase, the target device generates the plaintext of the AES256 encryption and decryption key (Key) based on the script, and all interactive objects share a Key.

[0206] In the public-private key encryption phase, the target device sends a public-private key pair generation request to the public-private key pair generation device by calling the public-private key pair generation SDK. The public-private key pair generation device responds to the public-private key pair generation request, generates the plaintext of the public key and the plaintext of the private key, and returns the plaintext of the public key and the plaintext of the private key to the target device. After receiving the plaintext of the public key and the plaintext of the private key, the target device reads the plaintext of the configured encryption and decryption key (Key); based on the encryption function of the AES256 algorithm, the plaintext of the public key is encrypted using the plaintext of the Key to obtain the ciphertext of the public key (the ciphertext of the public key = the encryption function of AES256 (the plaintext of the public key + the plaintext of the Key)); based on the encryption function of the AES256 algorithm, the plaintext of the private key is encrypted using the plaintext of the Key to obtain the ciphertext of the private key (the ciphertext of the private key = the encryption function of AES256 (the plaintext of the private key + the plaintext of the Key)). The target device stores the plain text of the public key and the vuid in the Redis database in correspondence, and stores the plain text of the private key and the vuid in the Redis database in correspondence, so that other services can obtain the ciphertext of the public and private keys of the first object.

[0207] In the public and private key decryption phase, the target device extracts the ciphertext of the public key and the ciphertext of the private key from the Redis database based on the vuid. The target device reads the plaintext of the configured Key, and based on the decryption function of the AES256 algorithm, uses the plaintext of the Key to decrypt the ciphertext of the public key to obtain the plaintext of the public key (the plaintext of the public key = the decryption function of AES256 (the ciphertext of the public key + the plaintext of the Key)); based on the decryption function of the AES256 algorithm, uses the plaintext of the Key to decrypt the ciphertext of the private key to obtain the plaintext of the private key (the plaintext of the private key = the decryption function of AES256 (the ciphertext of the private key + the Key)).

[0208] For example, Figure 6 The key management scheme shown can be called a local AES256 encryption and decryption scheme that does not rely on KMS. This scheme does not rely on KMS. The public and private keys of all interactive objects share a global key for encryption and decryption. The key is generated in advance using a script and configured in the configuration file. By pulling the key into the memory through the configuration file, the public and private keys of the interactive objects can be efficiently encrypted and decrypted. There is no network request in this scheme, and all operations are completed using local computing.

[0209] The fourth key management scheme is Figure 7As shown, in the fourth key management scheme, in the encryption and decryption key generation stage, the target device generates the plaintext of DEK (e.g., plaintext of DEK = MD5(vuid ​​+ timestamp)) and the ciphertext of DEK (e.g., ciphertext of DEK = encryption function of AES256 (plaintext of DEK + plaintext of Key')) based on vuid through the local encryption and decryption key generation module, where Key' is a key set based on experience.

[0210] In the public-private key encryption stage, the target device sends a public-private key pair generation request to the public-private key pair generation device by calling the public-private key pair generation SDK. The public-private key pair generation device responds to the public-private key pair generation request, generates the plaintext of the public key and the plaintext of the private key, and returns the plaintext of the public key and the plaintext of the private key to the target device. After receiving the plaintext of the public key and the plaintext of the private key, the target device encrypts the plaintext of the public key using the plaintext of the DEK based on the encryption function of the AES256 algorithm to obtain the ciphertext of the public key (the ciphertext of the public key = the encryption function of AES256 (the plaintext of the public key + the plaintext of the DEK)); based on the encryption function of the AES256 algorithm, the plaintext of the private key is encrypted using the plaintext of the DEK to obtain the ciphertext of the private key (the ciphertext of the private key = the encryption function of AES256 (the plaintext of the private key + the plaintext of the DEK)). The target device stores the plain text of the public key and the vuid in the Redis database in correspondence, and stores the plain text of the private key and the vuid in the Redis database in correspondence.

[0211] In the public and private key decryption phase, the target device extracts the ciphertext of the DEK from the Redis database based on the vuid, and extracts the ciphertext of the public key and the ciphertext of the private key from the Redis database based on the vuid. The target device decrypts the ciphertext of the DEK through the local encryption and decryption key generation module to obtain the plaintext of the DEK. Based on the decryption function of the AES256 algorithm, the plaintext of the DEK is used to decrypt the ciphertext of the public key to obtain the plaintext of the public key (the plaintext of the public key = the decryption function of AES256 (the ciphertext of the public key + the plaintext of DEK)); the plaintext of the DEK is used to decrypt the ciphertext of the private key to obtain the plaintext of the private key (the plaintext of the private key = the decryption function of AES256 (the ciphertext of the private key + the plaintext of DEK)).

[0212] For example, Figure 7 The key management scheme shown can be called a scheme that does not rely on KMS, performs local AES256 encryption and decryption, and isolates the encryption and decryption keys of each interactive object.

[0213] For example, Figure 7The key management scheme shown in the figure localizes the ability to generate encryption and decryption keys, maintains an encryption and decryption key generation module locally, and generates DEK plaintext and DEK ciphertext based on the identification information of the interactive object, realizing object-level encryption and decryption key isolation. This method can realize local encryption and decryption, and can isolate encryption and decryption keys at the object level, avoiding single-point dependence on KMS, no network request, no interface cost, and also meets compliance requirements. Based on Figure 7 The key management solution shown is aimed at scenarios with high security requirements, such as interaction object authentication and protection of interaction object core assets. It requires efficient generation of public and private keys of interaction objects and safe and compliant storage.

[0214] For example, in Figure 7 Under the key management scheme shown, the overall encryption and decryption process of public and private keys can be as follows: Figure 8 As shown. Generate the plaintext of the public and private keys, encrypt the plaintext of the public and private keys using the plaintext of the DEK based on the encryption function of the AES256 algorithm, obtain the ciphertext of the public and private keys, and store the ciphertext of the public and private keys and the ciphertext of the DEK. The plaintext of the DEK and the ciphertext of the DEK are obtained by the local encryption and decryption key generation module based on the identification information vuid of the interactive object. They are keys isolated at the object level and are different for each interactive object. When the interactive object needs to be authenticated, the ciphertext of the public and private keys and the ciphertext of the DEK are extracted from the Redis database, and the ciphertext of the DEK is decrypted by the local encryption and decryption key generation module to obtain the plaintext of the DEK. Based on the decryption function of the AES256 algorithm, the ciphertext of the public and private keys is decrypted using the plaintext of the DEK to obtain the plaintext of the public and private keys. The encryption and decryption keys of each interactive object are calculated and generated by the local encryption and decryption key generation module based on the identification information (vuid) of the interactive object, and the encryption and decryption keys between objects are isolated. Exemplarily, the plain text of the DEK can be generated based on the AES256 algorithm to implement configurable management of encryption and decryption keys, and be disclosed within a limited scope of authority.

[0215] For example, Figure 7 A related technology corresponding to the key management scheme shown is a remote envelope encryption and decryption scheme that relies on KMS implementation. For example, the process of envelope encryption and decryption in the related technology is as follows: Fig. 9As shown. The entire encryption process is divided into the following four steps: 1. The master key CMK module in KMS generates the plaintext of DEK and the ciphertext of DEK; 2. Use the plaintext of DEK to encrypt the plaintext of business data to obtain the ciphertext of business data; 3. Package the ciphertext of DEK generated in step 1 and the ciphertext of business data generated in step 2 together; 4. Store the packaged ciphertext of DEK and the ciphertext of business data in a storage container (such as a database). The entire decryption process is divided into the following four steps: (1) Take out the ciphertext of business data and the ciphertext of DEK from the storage container; (2) Pass the ciphertext of DEK to the master key CMK module for decryption; (3) The master key CMK module returns the decrypted plaintext of DEK; (4) Use the plaintext of DEK returned in step (3) to decrypt the ciphertext of business data to obtain the plaintext of business data.

[0216] according to Fig. 9 It can be seen that the envelope encryption and decryption process in the related technology relies on KMS implementation, and there is a single-point dependence problem on KMS. If KMS fails, the encryption and decryption process cannot be successfully implemented. In addition, the envelope encryption and decryption process in the related technology is a process for managing business data, and does not involve the management process of the public key and private key of the interactive object, and the application scenario of management is relatively limited. Moreover, the DEK plaintext and DEK ciphertext used in the envelope encryption and decryption process in the related technology are applicable to all business data, with a low isolation level and low security.

[0217] Based on Figure 7 The key management solution shown can localize the functions of the master key CMK module of KMS, maintain a cryptographic key generation module locally, and manage public and private keys locally through the locally maintained cryptographic key generation module, thus expanding the application scenarios of management. In addition, this management process does not require network requests with KMS, thus avoiding the single-point dependency problem on KMS. In addition, Figure 7 The DEK plaintext and DEK ciphertext used in the key management scheme shown are generated by a locally maintained encryption and decryption key generation module based on the identification information of the interactive objects, which can achieve isolation between objects, with a high isolation level and high security.

[0218] For example, compared with the key management scheme in the related art that is managed by the key management service device, the above four key management schemes have their own advantages in terms of applicable scenarios, dependent interfaces, access complexity, billing interfaces, interface QPS (Queries Per Second), whether to store keys in the database, whether to isolate keys between objects, cost, security, etc. The comparison results of the above four key management schemes and the key management scheme in the related art are as follows: Fig.10 shown.

[0219] In order to more intuitively compare the advantages and disadvantages of each solution, Fig.10 The table shown is simplified into five dimensions: security, access complexity, interface performance, degree of key isolation between objects, and cost. Under the information and score description of each dimension shown in Table 1, the score radar chart corresponding to the above four key management schemes and the key management schemes in related technologies is as follows Fig.11 shown.

[0220] Table 1

[0221]

[0222] according to Fig.11 It can be seen that the scores of the key management schemes in the related technologies in the five dimensions of security, access complexity, interface performance, degree of key isolation between objects and cost are 3 points, 2 points, 2 points, 1 point and 2 points respectively; the scores of the first key management scheme in the five dimensions of security, access complexity, interface performance, degree of key isolation between objects and cost are 4 points, 3 points, 2 points, 2 points and 2 points respectively; the scores of the second key management scheme in the five dimensions of security, access complexity, interface performance, degree of key isolation between objects and cost are 4 points, 2 points, 3 points, 2 points and 3 points respectively; the scores of the third key management scheme in the five dimensions of security, access complexity, interface performance, degree of key isolation between objects and cost are 4 points, 3 points, 5 points, 2 points and 5 points respectively; the scores of the fourth key management scheme in the five dimensions of security, access complexity, interface performance, degree of key isolation between objects and cost are 5 points, 5 points, 4 points, 5 points and 5 points respectively.

[0223] For example, the above four key management solutions have different focuses in terms of security, access complexity, interface performance, degree of key isolation between objects, and cost, covering different usage scenarios and having a certain degree of universality. For the fourth key management solution, through the local encryption and decryption solution, the isolated storage and encryption and decryption of keys between objects are realized, which does not rely on KMS, removes the single point service that the system relies on for network requests, saves the payment cost of KMS calls, is safe, efficient, and does not require additional services.

[0224] In an exemplary embodiment, the target device execution operation involved in the embodiment of the present application may specifically refer to the account registration service module in the target device executing the operation, and the target blockchain may refer to the Zhixin Chain, which can be maintained by the Zhixin Chain system. The target device can be connected to the Zhixin Chain system. Exemplarily, the target device and the Zhixin Chain system can constitute a digital resource management system. Exemplarily, as Fig.12As shown, the digital resource management system is divided into five layers, namely the front-end display layer, access layer, business background logic layer, basic service layer and data storage layer.

[0225] The front-end display layer is mainly used to provide pages that can be viewed by interactive objects. The pages provided include but are not limited to the homepage of digital resource products, digital resource products H5 (a marketing page), digital resource purchase H5, digital resource assistance appointment H5, digital resource face verification page, digital resource personal center page, configuration page, etc. The access layer is mainly used to access related applications and interfaces, etc. The access layer includes but is not limited to the APP (Application) access layer, the CGI (Common Gateway Interface) access layer, and the configuration background access layer, etc. The business background logic layer is mainly used to implement the logical operation of the business. The business background logic layer includes but is not limited to the APP product service module, the H5 product management service module, the purchase service module, the assistance service module, the account registration service module, the personal asset service module, and the management desk service module. The main functions implemented by different modules are different. For example, the main functions implemented by the account registration service module include: face verification to obtain face identification, bind digital resource address, obtain personal digital resource address, and obtain the digital resource address of the bound account, etc. It should be noted that the key management method provided in the embodiment of the present application is mainly implemented by the account registration service module.

[0226] The basic service layer is used to provide services required to run business logic. The services that the basic service layer can provide include but are not limited to mobile phone number binding, account conversion, login status verification, graphic verification code, and security components. Exemplarily, the basic service layer can also implement face recognition by calling the face recognition SDK, and access the letter chain by calling the letter chain SDK. The data storage layer is used to provide a database. The type of database provided by the data storage layer can be flexibly set. For example, the database provided by the data storage layer includes a Redis database and multiple other databases.

[0227] In the Zhixin Chain system, smart contracts are an important part of managing digital resources and digital resource addresses on the chain, and the public and private keys of the interactive objects are the basis and core of the implementation of smart contracts. The public and private keys of the interactive objects need to be generated, stored, and read in compliance with regulations, and cannot be obtained by third parties. Only the Zhixin Chain system and the target device are allowed to perceive, and the objects are isolated.

[0228] Exemplarily, the interactive object generates a digital resource address in the Zhixin Chain system through the target device, where the digital resource address = f (the plain text of the public key). The target device generates a pair of public and private keys for each interactive object. The public and private keys between objects are isolated. The plain text of the public key is used to generate the digital resource address on the Zhixin Chain system side. The plain text of the private key is used by the target device side for object-level authentication, signature calculation and signature verification, etc. Exemplarily, the relationship between the identification information (vuid) of the interactive object, the plain text of the public and private keys, and the digital resource address is as follows: Fig.13 As shown. Fig.13 It can be seen that the plaintext of the public key and the plaintext of the private key can be generated according to the vuid maintained on the target device side, wherein the plaintext of the public key can be used to generate the digital resource address maintained on the Zhixin Chain system side. Fig.13 The one-to-one mapping relationship shown in FIG. 1 shows the entire process of generating a digital resource address through a vuid, and also describes the process of deriving and generating a digital resource address.

[0229] See also Fig.14 , an embodiment of the present application provides a key management device, the device comprising:

[0230] A first acquisition unit 1401 is used to acquire a plain text of an object key of a first object, where the object key includes at least one of a public key and a private key of the first object, the plain text of the public key of the first object is used to generate blockchain account information corresponding to the first object on a target blockchain, and the plain text of the private key of the first object is used to sign target information of the first object to be recorded on the target blockchain;

[0231] The second acquisition unit 1402 is used to acquire the ciphertext of the object key based on the plaintext of the object key; wherein the ciphertext of the object key is the ciphertext obtained by the key management service device encrypting the plaintext of the object key using the plaintext of the first key, or the ciphertext of the object key is the ciphertext obtained by the local device encrypting the plaintext of the object key using the plaintext of the second key;

[0232] The storage unit 1403 is used to store the ciphertext of the object key and the identification information of the first object in a database in correspondence.

[0233] In one possible implementation, the second acquisition unit 1402 is used to send a first encryption request to the key management service device, where the first encryption request includes the plaintext of the object key and identification information of the plaintext of the first key. The key management service device is used to respond to the first encryption request, encrypt the plaintext of the object key using the plaintext of the first key, obtain the ciphertext of the object key, and return the ciphertext of the object key; and receive the ciphertext of the object key returned by the key management service device.

[0234] In one possible implementation, the plaintext identification information of the first key is extracted from a database, and the storage unit 1403 is also used to send a first key generation request to the key management service device, and the key management service device is used to generate the plaintext of the first key in response to the first key generation request, and return the plaintext identification information of the first key; receive the plaintext identification information of the first key returned by the key management service device, and store the plaintext identification information of the first key in the database.

[0235] In a possible implementation, the second obtaining unit 1402 is configured to encrypt the plain text of the object key by using the plain text of the second key to obtain the cipher text of the object key.

[0236] In one possible implementation, the second acquisition unit 1402 is also used to extract the ciphertext of the second key from the database; send a first decryption request to the key management service device, the first decryption request includes the ciphertext of the second key, the key management service device is used to respond to the first decryption request, decrypt the ciphertext of the second key, obtain the plaintext of the second key, and return the plaintext of the second key; receive the plaintext of the second key returned by the key management service device.

[0237] In a possible implementation, the second acquisition unit 1402 is further configured to extract the ciphertext of the second key from the database; and decrypt the ciphertext of the second key to obtain the plaintext of the second key.

[0238] In a possible implementation, the second obtaining unit 1402 is further configured to extract the plain text of the second key from the local storage.

[0239] In one possible implementation, the storage unit 1403 is also used to send a first key generation request to the key management service device, and the key management service device is used to generate a plaintext of the first key in response to the first key generation request, and return identification information of the plaintext of the first key; receive the identification information of the plaintext of the first key returned by the key management service device; send a second key generation request to the key management service device, the second key generation request includes the identification information of the plaintext of the first key, and the key management service device is used to respond to the second key generation request, generate a plaintext of the second key based on the plaintext of the first key, encrypt the plaintext of the second key to obtain a ciphertext of the second key, and return the ciphertext of the second key; store the ciphertext of the second key and the identification information of the plaintext of the first key in a database in correspondence.

[0240] In one possible implementation, the storage unit 1403 is further used to generate a plaintext of the second key based on the identification information of the first object, encrypt the plaintext of the second key to obtain a ciphertext of the second key; and store the ciphertext of the second key and the identification information of the first object in a database in correspondence.

[0241] In one possible implementation, the first acquisition unit 1401 is also used to send a public-private key pair generation request to a public-private key pair generation device, where the public-private key pair generation request includes identification information of the first object, and the public-private key pair generation device is used to respond to the public-private key pair generation request, generate the plaintext of the public key and the plaintext of the private key of the first object, and return the plaintext of the public key and the plaintext of the private key; and receive the plaintext of the public key and the plaintext of the private key returned by the public-private key pair generation device.

[0242] In a possible implementation, the device further includes:

[0243] The third acquisition unit is used to extract the ciphertext of the object key from the database based on the identification information of the first object; send a second decryption request to the key management service device, the second decryption request includes the plaintext identification information of the first key and the ciphertext of the object key, the key management service device is used to respond to the second decryption request, use the plaintext of the first key to decrypt the ciphertext of the object key, obtain the plaintext of the object key, and return the plaintext of the object key; receive the plaintext of the object key returned by the key management service device.

[0244] In a possible implementation, the third acquisition unit is further used to extract the ciphertext of the object key from the database based on the identification information of the first object; and decrypt the ciphertext of the object key using the plaintext of the second key to obtain the plaintext of the object key.

[0245] In a possible implementation, the object key includes a public key, and the apparatus further includes:

[0246] The fourth acquisition unit is used to send an account generation request to the blockchain node device, the account generation request includes the plain text of the public key, the blockchain node device is used to respond to the account generation request, generate the blockchain account information corresponding to the first object on the target blockchain based on the plain text of the public key, and return the blockchain account information; receive the blockchain account information returned by the blockchain node device.

[0247] In one possible implementation, the object key includes a private key, and the fourth acquisition unit is further used to sign the target information based on the plain text of the private key to obtain the signature information of the target information; send an information recording request to the blockchain node device, the information recording request includes the target information, signature information and the blockchain account information of the first object, the blockchain node device is used to respond to the information recording request, verify the target information based on the signature information and the blockchain account information of the first object, record the verified target information on the target blockchain, and return the information recording result; receive the information recording result returned by the blockchain node device.

[0248] The key management device provided in the embodiment of the present application obtains the ciphertext of the public key and / or private key of the first object, so that the public key and / or private key of the first object can be stored in the database in ciphertext. The public key and / or private key stored in ciphertext is not easy to be leaked, and the security of key management is relatively high. In addition, there are two cases of the ciphertext of the object key, and the flexibility of obtaining the ciphertext of the object key is relatively high.

[0249] It should be noted that the device provided in the above embodiment only uses the division of the above functional units as an example to implement its functions. In actual applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device is divided into different functional units to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0250] In an exemplary embodiment, a computer device is also provided, which includes a processor and a memory, in which at least one computer program is stored. The at least one computer program is loaded and executed by one or more processors so that the computer device implements any of the above-mentioned key management methods. Exemplarily, the computer device may refer to the target device, blockchain node device, key management service device, etc. involved in the above-mentioned embodiments. The computer device may refer to a terminal or a server, which is not limited in the embodiments of the present application. Next, the structures of the terminal and the server are introduced respectively.

[0251] Fig.15 1501 and 1502. The terminal 1502 includes a processor 1501 and a memory 1502.

[0252] The processor 1501 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 1501 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 1501 may also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 1501 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1501 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0253] The memory 1502 may include one or more computer-readable storage media, which may be non-transitory. The memory 1502 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 1502 is used to store at least one instruction, which is used to be executed by the processor 1501 so that the terminal implements the key management method provided in the method embodiment of the present application.

[0254] In some embodiments, the terminal may further optionally include: a peripheral device interface 1503 and at least one peripheral device. The processor 1501, the memory 1502 and the peripheral device interface 1503 may be connected via a bus or a signal line. Each peripheral device may be connected to the peripheral device interface 1503 via a bus, a signal line or a circuit board. Specifically, the peripheral device includes: at least one of a radio frequency circuit 1504, a display screen 1505, a camera assembly 1506, an audio circuit 1507 and a power supply 1508.

[0255] The peripheral device interface 1503 may be used to connect at least one peripheral device related to I / O (Input / Output) to the processor 1501 and the memory 1502. In some embodiments, the processor 1501, the memory 1502, and the peripheral device interface 1503 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 1501, the memory 1502, and the peripheral device interface 1503 may be implemented on a separate chip or circuit board, which is not limited in this embodiment.

[0256] The radio frequency circuit 1504 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 1504 communicates with the communication network and other communication devices through electromagnetic signals. The radio frequency circuit 1504 converts the electrical signal into an electromagnetic signal for transmission, or converts the received electromagnetic signal into an electrical signal. Optionally, the radio frequency circuit 1504 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, and the like. The radio frequency circuit 1504 can communicate with other terminals through at least one wireless communication protocol. The wireless communication protocol includes, but is not limited to: a metropolitan area network, various generations of mobile communication networks (2G, 3G, 4G and 5G), a wireless local area network and / or a WiFi (Wireless Fidelity) network. In some embodiments, the radio frequency circuit 1504 may also include circuits related to NFC (Near Field Communication), which is not limited in this application.

[0257] The display screen 1505 is used to display a UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof. When the display screen 1505 is a touch display screen, the display screen 1505 also has the ability to collect touch signals on the surface or above the surface of the display screen 1505. The touch signal can be input to the processor 1501 as a control signal for processing. At this time, the display screen 1505 can also be used to provide virtual buttons and / or virtual keyboards, also known as soft buttons and / or soft keyboards. In some embodiments, the display screen 1505 can be one, which is set on the front panel of the terminal; in other embodiments, the display screen 1505 can be at least two, which are respectively set on different surfaces of the terminal or are folded; in other embodiments, the display screen 1505 can be a flexible display screen, which is set on the curved surface or folded surface of the terminal. Even, the display screen 1505 can also be set to a non-rectangular irregular shape, that is, a special-shaped screen. The display screen 1505 can be made of materials such as LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode, organic light-emitting diode).

[0258] The camera assembly 1506 is used to capture images or videos. Optionally, the camera assembly 1506 includes a front camera and a rear camera. Typically, the front camera is arranged on the front panel of the terminal, and the rear camera is arranged on the back of the terminal. In some embodiments, there are at least two rear cameras, which are any one of a main camera, a depth of field camera, a wide-angle camera, and a telephoto camera, so as to realize the fusion of the main camera and the depth of field camera to realize the background blur function, the fusion of the main camera and the wide-angle camera to realize the panoramic shooting and VR (Virtual Reality) shooting function or other fusion shooting functions. In some embodiments, the camera assembly 1506 may also include a flash. The flash can be a monochrome temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cold light flash, which can be used for light compensation at different color temperatures.

[0259] The audio circuit 1507 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals and input them into the processor 1501 for processing, or input them into the RF circuit 1504 to achieve voice communication. For the purpose of stereo acquisition or noise reduction, there may be multiple microphones, which are respectively arranged at different parts of the terminal. The microphone may also be an array microphone or an omnidirectional acquisition microphone. The speaker is used to convert the electrical signal from the processor 1501 or the RF circuit 1504 into sound waves. The speaker may be a traditional film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert the electrical signal into sound waves audible to humans, but also convert the electrical signal into sound waves inaudible to humans for purposes such as ranging. In some embodiments, the audio circuit 1507 may also include a headphone jack.

[0260] The power supply 1508 is used to power various components in the terminal. The power supply 1508 can be an alternating current, a direct current, a disposable battery, or a rechargeable battery. When the power supply 1508 includes a rechargeable battery, the rechargeable battery can support wired charging or wireless charging. The rechargeable battery can also be used to support fast charging technology.

[0261] In some embodiments, the terminal further includes one or more sensors 1509 , including but not limited to: an acceleration sensor 1510 , a gyroscope sensor 1511 , a pressure sensor 1512 , an optical sensor 1513 , and a proximity sensor 1514 .

[0262] The acceleration sensor 1510 can detect the magnitude of acceleration on the three coordinate axes of the coordinate system established by the terminal. For example, the acceleration sensor 1510 can be used to detect the components of gravity acceleration on the three coordinate axes. The processor 1501 can control the display screen 1505 to display the user interface in a horizontal view or a vertical view according to the gravity acceleration signal collected by the acceleration sensor 1510. The acceleration sensor 1510 can also be used for collecting game or user motion data.

[0263] The gyro sensor 1511 can detect the body direction and rotation angle of the terminal, and the gyro sensor 1511 can cooperate with the acceleration sensor 1510 to collect the user's 3D actions on the terminal. The processor 1501 can implement the following functions based on the data collected by the gyro sensor 1511: motion sensing (such as changing the UI according to the user's tilt operation), image stabilization during shooting, game control, and inertial navigation.

[0264] The pressure sensor 1512 can be set in the side frame of the terminal and / or the lower layer of the display screen 1505. When the pressure sensor 1512 is set in the side frame of the terminal, it can detect the user's holding signal of the terminal, and the processor 1501 performs left and right hand recognition or shortcut operation according to the holding signal collected by the pressure sensor 1512. When the pressure sensor 1512 is set in the lower layer of the display screen 1505, the processor 1501 controls the operability controls on the UI interface according to the user's pressure operation on the display screen 1505. The operability controls include at least one of a button control, a scroll bar control, an icon control, and a menu control.

[0265] The optical sensor 1513 is used to collect the ambient light intensity. In one embodiment, the processor 1501 can control the display brightness of the display screen 1505 according to the ambient light intensity collected by the optical sensor 1513. Specifically, when the ambient light intensity is high, the display brightness of the display screen 1505 is increased; when the ambient light intensity is low, the display brightness of the display screen 1505 is reduced. In another embodiment, the processor 1501 can also dynamically adjust the shooting parameters of the camera component 1506 according to the ambient light intensity collected by the optical sensor 1513.

[0266] The proximity sensor 1514, also known as a distance sensor, is usually arranged on the front panel of the terminal. The proximity sensor 1514 is used to collect the distance between the user and the front of the terminal. In one embodiment, when the proximity sensor 1514 detects that the distance between the user and the front of the terminal is gradually decreasing, the processor 1501 controls the display screen 1505 to switch from the screen-on state to the screen-off state; when the proximity sensor 1514 detects that the distance between the user and the front of the terminal is gradually increasing, the processor 1501 controls the display screen 1505 to switch from the screen-off state to the screen-on state.

[0267] Those skilled in the art will understand that Fig.15 The structure shown in the figure does not constitute a limitation on the terminal, and may include more or less components than those shown in the figure, or combine certain components, or adopt a different component arrangement.

[0268] Fig.16It is a structural diagram of a server provided in an embodiment of the present application. The server may have relatively large differences due to different configurations or performances, and may include one or more processors (Central Processing Units, CPU) 1601 and one or more memories 1602, wherein the one or more memories 1602 store at least one computer program, and the at least one computer program is loaded and executed by the one or more processors 1601, so that the server implements the key management method provided in the above-mentioned various method embodiments. Of course, the server may also have components such as a wired or wireless network interface, a keyboard, and an input and output interface for input and output, and the server may also include other components for implementing device functions, which will not be repeated here.

[0269] In an exemplary embodiment, a computer-readable storage medium is further provided, in which at least one computer program is stored. The at least one computer program is loaded and executed by a processor of a computer device to enable the computer to implement any of the above-mentioned key management methods.

[0270] In one possible implementation, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0271] In an exemplary embodiment, a computer program product is further provided. The computer program product includes a computer program or computer instructions. The computer program or computer instructions are loaded and executed by a processor to enable a computer to implement any one of the above-mentioned key management methods.

[0272] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions. For example, the target information and identification information of the first object involved in this application are all obtained with full authorization.

[0273] It should be noted that the terms "first", "second", etc. in this application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the above exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0274] It should be understood that the "plurality" mentioned in this article refers to two or more. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0275] The above description is only an exemplary embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A key management method, It is characterized in that The method is performed by a target device, and includes: Sending a public-private key pair generation request to a public-private key pair generation device, the public-private key pair generation request including identification information of a first object, the public-private key pair generation device being used to generate a plaintext of a public key and a plaintext of a private key of the first object in response to the public-private key pair generation request, and returning the plaintext of the public key and the plaintext of the private key; Receive the plaintext of the public key and the plaintext of the private key returned by the public-private key pair generating device, extract the plaintext of the object key of the first object from the plaintext of the public key and the plaintext of the private key, the object key includes at least one of the public key and the private key of the first object, the plaintext of the public key of the first object is used to generate the blockchain account information corresponding to the first object on the target blockchain, and the plaintext of the private key of the first object is used to sign the target information of the first object to be recorded on the target blockchain; Based on the plaintext of the object key, the ciphertext of the object key is obtained; wherein the ciphertext of the object key is the ciphertext obtained by encrypting the plaintext of the object key by the key management service device using the plaintext of the first key, or the ciphertext of the object key is the ciphertext obtained by encrypting the plaintext of the object key by the target device using the plaintext of the second key; wherein the plaintext of the first key is generated by the key management service device; and the plaintext of the second key is generated by the key management service device or the target device; The ciphertext of the object key and the identification information of the first object are stored in a database in correspondence.

2. The method according to claim 1, It is characterized in that The obtaining, based on the plain text of the object key, the cipher text of the object key includes: Sending a first encryption request to the key management service device, the first encryption request including the plain text of the object key and identification information of the plain text of the first key, the key management service device being configured to respond to the first encryption request, encrypt the plain text of the object key using the plain text of the first key to obtain the ciphertext of the object key, and return the ciphertext of the object key; Receive the ciphertext of the object key returned by the key management service device.

3. The method according to claim 2, It is characterized in that The plain text identification information of the first key is extracted from the database, and the method further includes: Sending a first key generation request to the key management service device, wherein the key management service device is used to generate a plain text of the first key in response to the first key generation request and return identification information of the plain text of the first key; Receive the plaintext identification information of the first key returned by the key management service device, and store the plaintext identification information of the first key in the database.

4. The method according to claim 1, It is characterized in that The obtaining, based on the plain text of the object key, the cipher text of the object key includes: The plain text of the object key is encrypted using the plain text of the second key to obtain the cipher text of the object key.

5. The method according to claim 4, It is characterized in that The method further comprises: extracting the ciphertext of the second key from the database; Sending a first decryption request to the key management service device, where the first decryption request includes the ciphertext of the second key, and the key management service device is configured to decrypt the ciphertext of the second key in response to the first decryption request, obtain the plaintext of the second key, and return the plaintext of the second key; Receive the plain text of the second key returned by the key management service device.

6. The method according to claim 4, It is characterized in that The method further comprises: extracting the ciphertext of the second key from the database; The ciphertext of the second key is decrypted to obtain the plaintext of the second key.

7. The method according to claim 4, It is characterized in that The method further comprises: The plain text of the second key is extracted from the local storage of the target device.

8. The method according to claim 5, It is characterized in that Before extracting the ciphertext of the second key from the database, the method further includes: Sending a first key generation request to the key management service device, wherein the key management service device is used to generate a plain text of the first key in response to the first key generation request and return identification information of the plain text of the first key; Receiving plaintext identification information of the first key returned by the key management service device; sending a second key generation request to the key management service device, the second key generation request including identification information of the plain text of the first key, the key management service device being configured to respond to the second key generation request, generate the plain text of the second key based on the plain text of the first key, encrypt the plain text of the second key to obtain the ciphertext of the second key, and return the ciphertext of the second key; The ciphertext of the second key and the identification information of the plaintext of the first key are stored in the database in correspondence.

9. The method according to claim 6, It is characterized in that Before extracting the ciphertext of the second key from the database, the method further includes: Based on the identification information of the first object, generate a plaintext of the second key, and encrypt the plaintext of the second key to obtain a ciphertext of the second key; The ciphertext of the second key and the identification information of the first object are stored in the database in correspondence.

10. The method according to claim 2 or 3, It is characterized in that After storing the ciphertext of the object key and the identification information of the first object in a database in correspondence with each other, the method further includes: Based on the identification information of the first object, extracting the ciphertext of the object key from the database; sending a second decryption request to the key management service device, the second decryption request including the plaintext identification information of the first key and the ciphertext of the object key, the key management service device being configured to, in response to the second decryption request, decrypt the ciphertext of the object key using the plaintext of the first key to obtain the plaintext of the object key, and return the plaintext of the object key; Receive the plain text of the object key returned by the key management service device.

11. The method according to any one of claims 4 to 9, It is characterized in that After storing the ciphertext of the object key and the identification information of the first object in a database in correspondence with each other, the method further includes: Based on the identification information of the first object, extracting the ciphertext of the object key from the database; The ciphertext of the object key is decrypted using the plaintext of the second key to obtain the plaintext of the object key.

12. The method according to any one of claims 1 to 9, It is characterized in that The object key includes the public key, and the method further includes: Sending an account generation request to a blockchain node device, wherein the account generation request includes the plain text of the public key, and the blockchain node device is used to respond to the account generation request, generate blockchain account information corresponding to the first object on the target blockchain based on the plain text of the public key, and return the blockchain account information; Receive the blockchain account information returned by the blockchain node device.

13. The method according to any one of claims 1 to 9, It is characterized in that The object key includes the private key, and the method further includes: Signing the target information based on the plain text of the private key to obtain signature information of the target information; Sending an information recording request to a blockchain node device, the information recording request including the target information, the signature information, and the blockchain account information of the first object, the blockchain node device being used to respond to the information recording request, verify the target information based on the signature information and the blockchain account information of the first object, record the verified target information on the target blockchain, and return the information recording result; Receive the information recording result returned by the blockchain node device.

14. A key management device, It is characterized in that The device comprises: A first acquisition unit is configured to send a public-private key pair generation request to a public-private key pair generation device, wherein the public-private key pair generation request includes identification information of a first object, and the public-private key pair generation device is configured to generate a plaintext of a public key and a plaintext of a private key of the first object in response to the public-private key pair generation request, and return the plaintext of the public key and the plaintext of the private key; receive the plaintext of the public key and the plaintext of the private key returned by the public-private key pair generation device, and extract the plaintext of an object key of the first object from the plaintext of the public key and the plaintext of the private key, wherein the object key includes at least one of a public key and a private key of the first object, the plaintext of the public key of the first object is used to generate blockchain account information corresponding to the first object on a target blockchain, and the plaintext of the private key of the first object is used to sign target information of the first object to be recorded on the target blockchain; a second acquisition unit, configured to acquire a ciphertext of the object key based on the plaintext of the object key; wherein the ciphertext of the object key is the ciphertext obtained by encrypting the plaintext of the object key by the key management service device using the plaintext of the first key, or the ciphertext of the object key is the ciphertext obtained by encrypting the plaintext of the object key by the target device using the plaintext of the second key; wherein the plaintext of the first key is generated by the key management service device; and the plaintext of the second key is generated by the key management service device or the target device; A storage unit is used to store the ciphertext of the object key and the identification information of the first object in a database in correspondence with each other.

15. The device according to claim 14, It is characterized in that The second acquisition unit is configured to send a first encryption request to the key management service device, wherein the first encryption request includes the plain text of the object key and identification information of the plain text of the first key, and the key management service device is configured to respond to the first encryption request, encrypt the plain text of the object key by using the plain text of the first key to obtain the ciphertext of the object key, and return the ciphertext of the object key; Receive the ciphertext of the object key returned by the key management service device.

16. The device according to claim 15, It is characterized in that The plaintext identification information of the first key is extracted from the database, and the storage unit is further used to send a first key generation request to the key management service device, and the key management service device is used to generate the plaintext of the first key in response to the first key generation request, and return the plaintext identification information of the first key; Receive the plaintext identification information of the first key returned by the key management service device, and store the plaintext identification information of the first key in the database.

17. The device according to claim 14, It is characterized in that The second acquisition unit is used to encrypt the plain text of the object key by using the plain text of the second key to obtain the cipher text of the object key.

18. The device according to claim 17, It is characterized in that The second acquisition unit is further configured to extract the ciphertext of the second key from the database; send a first decryption request to the key management service device, wherein the first decryption request includes the ciphertext of the second key, and the key management service device is configured to decrypt the ciphertext of the second key in response to the first decryption request, obtain the plaintext of the second key, and return the plaintext of the second key; Receive the plain text of the second key returned by the key management service device.

19. The device according to claim 17, It is characterized in that The second acquisition unit is further used to extract the ciphertext of the second key from the database; and decrypt the ciphertext of the second key to obtain the plaintext of the second key.

20. The device according to claim 17, It is characterized in that The second acquisition unit is further configured to extract the plain text of the second key from the local storage of the target device.

21. The device according to claim 18, It is characterized in that The storage unit is further used to send a first key generation request to the key management service device, and the key management service device is used to generate a plain text of the first key in response to the first key generation request and return identification information of the plain text of the first key; Receiving plaintext identification information of the first key returned by the key management service device; sending a second key generation request to the key management service device, the second key generation request including identification information of the plain text of the first key, the key management service device being configured to respond to the second key generation request, generate the plain text of the second key based on the plain text of the first key, encrypt the plain text of the second key to obtain the ciphertext of the second key, and return the ciphertext of the second key; The ciphertext of the second key and the identification information of the plaintext of the first key are stored in the database in correspondence.

22. The device according to claim 19, It is characterized in that The storage unit is further used to generate a plain text of the second key based on the identification information of the first object, and encrypt the plain text of the second key to obtain a cipher text of the second key; The ciphertext of the second key and the identification information of the first object are stored in the database in correspondence.

23. The device according to claim 15 or 16, It is characterized in that The device also includes: A third acquisition unit is used to extract the ciphertext of the object key from the database based on the identification information of the first object; send a second decryption request to the key management service device, the second decryption request includes the plaintext identification information of the first key and the ciphertext of the object key, the key management service device is used to respond to the second decryption request, use the plaintext of the first key to decrypt the ciphertext of the object key, obtain the plaintext of the object key, and return the plaintext of the object key; receive the plaintext of the object key returned by the key management service device.

24. The device according to any one of claims 17 to 22, It is characterized in that The device also includes: The third acquisition unit is used to extract the ciphertext of the object key from the database based on the identification information of the first object; and decrypt the ciphertext of the object key using the plaintext of the second key to obtain the plaintext of the object key.

25. The device according to any one of claims 14 to 22, It is characterized in that The object key includes the public key, and the apparatus further includes: The fourth acquisition unit is used to send an account generation request to the blockchain node device, wherein the account generation request includes the plain text of the public key, and the blockchain node device is used to respond to the account generation request, generate the blockchain account information corresponding to the first object on the target blockchain based on the plain text of the public key, and return the blockchain account information; receive the blockchain account information returned by the blockchain node device.

26. The device according to any one of claims 14 to 22, It is characterized in that The object key includes the private key, and the apparatus further includes: The fourth acquisition unit is used to sign the target information based on the plain text of the private key to obtain the signature information of the target information; send an information recording request to the blockchain node device, the information recording request includes the target information, the signature information and the blockchain account information of the first object, the blockchain node device is used to respond to the information recording request, verify the target information based on the signature information and the blockchain account information of the first object, record the verified target information on the target blockchain, and return the information recording result; receive the information recording result returned by the blockchain node device.

27. A computer device, It is characterized in that The computer device includes a processor and a memory, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor so that the computer device implements the key management method according to any one of claims 1 to 13.

28. A computer readable storage medium, It is characterized in that The computer-readable storage medium stores at least one computer program, and the at least one computer program is loaded and executed by a processor so that a computer implements the key management method according to any one of claims 1 to 13.

29. A computer program product, It is characterized in that The computer program product comprises a computer program or a computer instruction, and the computer program or the computer instruction is loaded and executed by a processor so as to enable a computer to implement the key management method according to any one of claims 1 to 13.

Images