Key management method and key management device, computer device, and storage medium

Abstract

The embodiment of the application provides a key management method and device, computer equipment and a storage medium, and belongs to the technical field of information security management. The method comprises the following steps: receiving a key reading instruction, obtaining a key reading index according to the key reading instruction; obtaining first matching index data from a pre-constructed key index table according to the key reading index, wherein the first matching index data comprises a first matching key index and a first key address offset value corresponding to the first matching key index; determining a target key reading address according to the key index table and the first key address offset value, wherein the target key reading address is used to represent a storage address of key information corresponding to the key reading index in a preset key memory; and reading the key information corresponding to the key reading index from the key memory according to the target key reading address. The embodiment of the application can shorten the key reading and writing operation time and improve the operation efficiency during key management.

Description

Technical Field

[0001] This application relates to the field of information security management technology, and in particular to a key management method, key management device, computer equipment, and storage medium. Background Technology

[0002] Currently, key management methods in related technologies typically allocate a fixed amount of storage space to each key. Once the number of supported keys is determined, the total key storage space is also fixed. Furthermore, as the number of supported keys increases, the required storage space increases linearly. In addition, these key management methods store all key-related information in flash memory, which can lead to long read / write operation times and low operational efficiency. Therefore, proposing a key management method that can shorten key read / write operation time and improve operational efficiency has become an urgent technical problem to be solved. Summary of the Invention

[0003] The main objective of this application is to propose a key management method, a key management device, a computer device, and a storage medium, which can shorten the key read / write operation time and improve the operational efficiency of key management.

[0004] To achieve the above objectives, a first aspect of this application proposes a key management method, the method comprising:

[0005] Receive key operation instructions, the key operation instructions including key read instructions;

[0006] When the key operation instruction is the key read instruction, obtain the key read index according to the key read instruction;

[0007] The first matching index data is obtained by matching the key reading index from the pre-built key index table. The first matching index data includes the first matching key index and the first key address offset value corresponding to the first matching key index. The first matching key index and the key reading index have the same index.

[0008] The target key reading address is determined based on the key index table and the first key address offset value. The target key reading address is used to represent the storage address of the key information corresponding to the key reading index in the preset key memory.

[0009] The key information corresponding to the key read index is read from the key memory according to the target key read address.

[0010] In some embodiments, determining the target key read address based on the key index table and the first key address offset value includes:

[0011] Obtain the preset invalid offset value and the first index starting address corresponding to the key index table;

[0012] The key storage status of the first matching index data is determined based on the preset invalid offset value and the first key address offset value, wherein the key storage status includes a valid status.

[0013] When the key storage status of the first matching index data is the valid status, the target key reading address is determined according to the first index start address and the first key address offset value.

[0014] In some embodiments, the key operation instruction further includes a table construction instruction. Before obtaining the first matching index data from the pre-built key index table based on the key reading index, the method further includes: constructing the key index table, specifically including:

[0015] When the key operation instruction is the table construction instruction, key construction information is obtained according to the table construction instruction;

[0016] Write the key construction information into the key memory to obtain the key construction address where the key construction information is stored in the key memory;

[0017] Obtain the initial index table and the starting address of the second index corresponding to the initial index table;

[0018] The key construction address offset value is determined based on the key construction address and the second index start address;

[0019] The key construction address offset value is filled into the initial index table to obtain the key index table.

[0020] In some embodiments, the key storage state further includes an invalid state, and the step of filling the key construction address offset value into the initial index table to obtain the key index table includes:

[0021] Obtain the initial index data from the initial index table where the key storage state is invalid. The initial index data includes the initial key index and the initial address offset value.

[0022] Replace the initial address offset value with the key construction address offset value, and update the initial index data;

[0023] The key index table is obtained based on the updated initial index data.

[0024] In some embodiments, the key operation instruction further includes a key writing instruction, and after receiving the key operation instruction, the method further includes:

[0025] When the key operation instruction is the key write instruction, the key write index and key write information are obtained according to the key write instruction;

[0026] The second matching index data is obtained by matching the key index table according to the key write index. The second matching index data includes the second matching key index and the second key address offset value corresponding to the second matching key index. The second matching key index and the key write index are the same.

[0027] The key storage status of the second matching index data is determined based on the preset invalid offset value and the second key address offset value.

[0028] When the key storage status of the second matching index data is the valid status, the target key write address is determined according to the first index start address and the second key address offset value;

[0029] The key writing information is written into the key memory according to the target key writing address.

[0030] In some embodiments, after writing the key writing information into the key memory according to the target key writing address, the method further includes:

[0031] Obtain historical index data from the key index table following the second matching key index, the historical index data including historical key address offset values;

[0032] The historical key address offset value is updated based on the key length of the key writing information and the target key writing address, and the key index table is updated based on the updated historical key address offset value.

[0033] In some embodiments, writing the key writing information into the key memory according to the target key writing address includes:

[0034] Retrieve historical write information stored at the target key write address from the key memory;

[0035] The historical information is deleted from the key storage.

[0036] The key writing range in the key memory for storing the key writing information is determined based on the target key writing address and the key length of the key writing information.

[0037] Write the key information into the key writing range.

[0038] To achieve the above objectives, a second aspect of this application provides a key management apparatus, the apparatus comprising:

[0039] The instruction receiving module is used to receive key operation instructions, including key reading instructions;

[0040] The index acquisition module is used to acquire the key reading index according to the key reading instruction when the key operation instruction is the key reading instruction;

[0041] An index matching module is used to obtain first matching index data from a pre-built key index table based on the key reading index. The first matching index data includes a first matching key index and a first key address offset value corresponding to the first matching key index. The first matching key index and the key reading index have the same index.

[0042] The address determination module is used to determine the target key reading address based on the key index table and the first key address offset value. The target key reading address is used to represent the storage address of the key information corresponding to the key reading index in a preset key memory.

[0043] The key reading module is used to read the key information corresponding to the key reading index from the key memory according to the target key reading address.

[0044] To achieve the above objectives, a third aspect of this application provides a computer device, comprising:

[0045] At least one memory;

[0046] At least one processor;

[0047] At least one computer program;

[0048] The at least one computer program is stored in the at least one memory, and the at least one processor executes the at least one computer program to implement the key management method described in the first aspect above.

[0049] To achieve the above objectives, a fourth aspect of the present application provides a computer-readable storage medium storing a computer program for causing a computer to execute the key management method described in the first aspect.

[0050] This application proposes a key management method, key management device, computer equipment, and storage medium. First, a key operation instruction is received, including a key reading instruction. When the key operation instruction is a key reading instruction, a key reading index is obtained based on the key reading instruction. Then, a first matching index is obtained by matching the key reading index against a pre-built key index table. This first matching index data includes a first matching key index and a corresponding first key address offset value. The first matching key index and the key reading index have the same index. To accurately read the key information corresponding to the key reading index, a target key reading address is determined based on the key index table and the first key address offset value. The target key reading address represents the storage address of the key information corresponding to the key reading index in a preset key memory. Finally, the key information corresponding to the key reading index is read from the key memory according to the target key reading address. This application embodiment can shorten the key read / write operation time and improve the operational efficiency of key management. Attached Figure Description

[0051] Figure 1 This is a first flowchart of the key management method provided in the embodiments of this application;

[0052] Figure 2 yes Figure 1 A flowchart of step S140 in the process;

[0053] Figure 3 This is a second flowchart of the key management method provided in the embodiments of this application;

[0054] Figure 4 yes Figure 3 Another flowchart of step S350 in the process;

[0055] Figure 5 This is a third flowchart of the key management method provided in the embodiments of this application;

[0056] Figure 6 yes Figure 5 A flowchart of step S550 in the process;

[0057] Figure 7 This is the fourth flowchart of the key management method provided in the embodiments of this application;

[0058] Figure 8 This is a schematic diagram of the key management device provided in the embodiments of this application;

[0059] Figure 9 This is a schematic diagram of the hardware structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0061] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0063] First, let's analyze some of the terms used in this application:

[0064] A key is a parameter that is input into an algorithm that converts plaintext to ciphertext or vice versa. Keys are categorized into symmetric keys and asymmetric keys.

[0065] Symmetric key encryption: This refers to the requirement that both the sender and receiver use the same key to encrypt and decrypt plaintext. Common symmetric key encryption algorithms include DES, 3DES, IDEA, RC5, and RC6.

[0066] Asymmetric keys: A key encryption and decryption method as opposed to symmetric keys. Asymmetric keys use a pair of keys (algorithms), one key for encryption and the other for decryption. The encryption key is called the private key, and the decryption key is called the public key. The private key is kept securely by one party and cannot be disclosed, while the public key can be sent to any party that requests the private key.

[0067] Currently, key management methods in related technologies typically allocate a fixed amount of storage space to each key. Once the number of supported keys is determined, the total key storage space is also fixed. Furthermore, as the number of supported keys increases, the required storage space increases linearly. In addition, these key management methods store all key-related information in flash memory, which can lead to long read / write operation times and low operational efficiency. Therefore, proposing a key management method that can shorten key read / write operation time and improve operational efficiency has become an urgent technical problem to be solved.

[0068] Based on this, embodiments of this application provide a key management method, a key management device, a computer device, and a storage medium, which can shorten the key read / write operation time and improve the operational efficiency of key management.

[0069] The key management method provided in this application can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms; the software can be an application implementing the key management method, but is not limited to the above forms.

[0070] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers (PCs), minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0071] Please see Figure 1 , Figure 1 This is an optional flowchart of the key management method provided in the embodiments of this application. In some embodiments of this application, Figure 1 The method described below may include, but is not limited to, steps S110 to S150. Figure 1 These five steps will be explained in detail.

[0072] Step S110: Receive key operation instructions, including key reading instructions;

[0073] Step S120: When the key operation instruction is a key read instruction, obtain the key read index according to the key read instruction;

[0074] Step S130: Obtain the first matching index data from the pre-built key index table according to the key reading index. The first matching index data includes the first matching key index and the first key address offset value corresponding to the first matching key index. The first matching key index and the key reading index have the same index.

[0075] Step S140: Determine the target key reading address based on the key index table and the first key address offset value. The target key reading address is used to represent the storage address of the key information corresponding to the key reading index in the preset key memory.

[0076] Step S150: Read the key information corresponding to the key reading index from the key storage according to the target key reading address.

[0077] In step S110 of some embodiments, key security management is a crucial step to ensure encrypted communication and data security. Key management includes key generation, key writing and storage, key transmission, and key updating. Key generation requires a random number generator to ensure the randomness and unpredictability of the key. Key writing and storage requires a secure storage medium, such as a Hardware Security Module (HSM), smart card, secure memory, Flash memory, or Non-Volatile Random Access Memory (NVRAM). Key transmission includes accurately reading key information from the key storage area. Key updating refers to updating the key information already stored in the key storage area. In practical applications, the key management device includes a storage section and an algorithm section. The storage section provides a read / write interface connected to the key storage area, and the algorithm section performs read / write operations on the key information or performs corresponding operations based on the read key information.

[0078] Understandably, when a client needs to read or write keys, it sends a key operation command to the interface used for key management on the server equipped with the key management device of this application. A key read command refers to an instruction to read key information from the key storage area.

[0079] In step S120 of some embodiments, in order to dynamically adjust the storage space of each key in the key memory, this application embodiment assigns a corresponding key index to each key information written to the key memory, avoiding the need to pair each key in the key memory one by one. Furthermore, adjusting the key storage space does not affect the corresponding key index, effectively improving the operational efficiency and flexibility of key management. Specifically, when a client (i.e., a key user) needs to use a key, the key user calls the read interface provided by the key management device and sends a key read command through the read interface. This key read command includes a parameter that passes in the corresponding key read index.

[0080] In step S130 of some embodiments, in order to dynamically adjust the number of supported keys and the dynamic changes in key storage space, this application embodiment uses a pre-built key index table to achieve dynamic changes in the number of supported keys and key storage space. Specifically, the key reading index is matched with the index stored in the pre-built key index table to determine the first matching index data corresponding to the matching index. The first matching index data includes a first matching key index and a first key address offset value corresponding to the first matching key index. The first matching key index is the same as the key reading index. The first key address offset value is the storage start value in the key memory that stores the key information corresponding to the key reading index, determined according to the index start address of the key index table storing the first matching key index. Furthermore, the key address offset value is related to the key length of the previous key of the corresponding key. When the key length of the previous key changes, the key address offset value of that key will also change, and the address offset values ​​of all keys stored after that key will change accordingly. The key information includes the key length of the corresponding key and the specific key content.

[0081] It should be noted that the key index represents the sequential identifier of the corresponding key in the key index table, that is, which key it is. The key index can be represented as 1, 2, 3, etc. For example, when the key index table stores 10 keys, the corresponding key indices are numbers 1 to 10, or numbers 0 to 9. Assuming that one key index occupies 1 bit of space, one byte can represent 8 key indices, that is, 8 keys. This description of the key index can be applied to the different types of index forms in this application. The key index can also occupy 2 bits of space, which is not specifically limited here.

[0082] It should be noted that the embodiments of this application may include multiple key index tables, and the starting address of the index for the next expanded key index table is determined based on the storage space occupied by the current key index table in the key storage and the starting address of the index of the current key index table. The starting address of the index is used to represent the starting address for storing the first key information corresponding to the key index table in the key storage.

[0083] It should be noted that the key usage space represents the storage space occupied by all keys in the current key index table in the key storage, and this key usage space is used to determine the starting address of the key index stored in the next expanded key index table. When the number of indexes in the key index table reaches a preset threshold, a new key index table needs to be added to allow for flexible increases in key indexes.

[0084] It should be noted that the address offset value represents the offset of the key corresponding to each index in the key index table relative to the starting address of the corresponding index. The storage size of the address offset value can be either 2 bytes or 4 bytes; no specific limitation is made here.

[0085] For example, Table 1 below shows the space occupied by a key index table. Assume the extended key index table address occupies 4 bytes, the key usage space of the key index table is 4 bytes, the total number of keys n supported by the key index table is 256, one key index occupies 1 bit, and the storage size of the address offset value can be 2 bytes. Therefore, the total space occupied by the key index is n / 8 = 256 / 8 = 32 bytes, and the total space occupied by the address offset value of the corresponding key in the key index table is 256 * 2 = 512 bytes.

[0086]

[0087]

[0088] Table 1

[0089] It should be noted that, in order to improve the efficiency of key operations, the key storage device and the key index table storing key information can be used or stored in different storage media. For example, the key storage device can be Flash, and the key index table can be stored in NVRAM; or, both the key information and the key index table can be stored in NVRAM, without specific limitations. Therefore, storing the key index table in NVRAM, compared to storing it in Flash, can effectively improve the key read / write speed, thereby resulting in smoother product operation.

[0090] In step S140 of some embodiments, after obtaining the first key address offset value, the accurate storage address of the key corresponding to the key reading index in the key memory is determined according to the key index table and the first key address offset value.

[0091] Please see Figure 2 , Figure 2 This is an optional flowchart of step S140 provided in the embodiments of this application. In some embodiments of this application, step S140 may specifically include, but is not limited to, steps S210 to S230. The following is in conjunction with... Figure 2 These three steps will be explained in detail.

[0092] Step S210: Obtain the preset invalid offset value and the starting address of the first index corresponding to the key index table;

[0093] Step S220: Determine the key storage status of the first matching index data based on the preset invalid offset value and the first key address offset value. The key storage status includes the valid status.

[0094] Step S230: When the key storage status of the first matching index data is valid, the target key reading address is determined based on the first index start address and the first key address offset value.

[0095] In step S210 of some embodiments, the first index starting address refers to the starting storage address of the key index table in the key memory that stores the currently matched first matching index data. Furthermore, the specific storage location of the key index table in the key memory can be determined based on this starting storage address and the overall key usage space of the key index table.

[0096] In step S220 of some embodiments, since the key index table may contain key indexes and store corresponding keys, the address offset value corresponding to the key index in the key index table is a preset invalid offset value. Therefore, after obtaining the first key address offset value, it is necessary to verify whether the key index corresponding to the first key address offset value has stored key information, that is, to verify whether the first key address offset value is a valid address. If the first key address offset value is verified to be a valid address, the corresponding key information can be accurately read from the key storage according to the key reading index, and subsequent algorithm operations can be performed. If the first key address offset value is not a valid address, it indicates that the key reading index does not contain corresponding stored key information. Specifically, a numerical comparison is performed between the preset invalid offset value and the first key address offset value, and the key storage state of the first matching index data is determined based on the result of the numerical comparison. The key storage state includes a valid state and an invalid state. A valid state indicates that the preset invalid offset value and the first key address offset value are the same; an invalid state indicates that the preset invalid offset value and the first key address offset value are not the same.

[0097] For example, a key index table includes two columns: a key index field and an address offset value field for the key corresponding to that key index in the key storage. Table 2 below illustrates a specific key index table. Assume a key index occupies 1 bit, and the storage size of an address offset value can be 2 bytes. The address offset value is represented in hexadecimal; when the address offset value is 0x0004, 00 represents 1 byte, and 04 represents 1 byte. When the total number of keys n supported by the key index table is 256, the key indexes start from 0 and range from 0 to 255. Furthermore, assume the default invalid offset value is 0xFFFF.

[0098]

[0099] Table 2

[0100] According to Table 2, the key information corresponding to key index 0 is already stored, with an address offset of 0x0000. Assuming the key length corresponding to key index 0 is 0x0020 bytes, the key information corresponding to key index 0 occupies 0x0000-0x0020 bytes in the key memory. The key information corresponding to key index 1 is already stored, with an address offset of 0x0020 bytes. Assuming the key length corresponding to key index 1 is 0x0060 bytes, the key information corresponding to key index 1 occupies 0x0020-0x0080 bytes in the key memory. The key information corresponding to key index 2 is already stored, with an address offset of 0x0020 bytes. Assuming the key length corresponding to key index 1 is 0x0060 bytes, the key information corresponding to key index 1 occupies 0x0020-0x0080 bytes in the key memory. Table 2 also indicates that the address offsets for key indices 3 to 255 are 0xFFFF bytes, meaning that no key information is stored under key indices 3 to 255. Therefore, the key storage status for key indices 0 to 2 is valid, while the key storage status for key indices 3 to 255 is invalid.

[0101] In step S230 of some embodiments, when the key storage state of the first matching index data is valid, that is, the first matching key index stores the corresponding key information in the key memory, the target key reading address is determined by adding the first index starting address to the first key address offset value. The target key reading address represents the starting address for storing the key information corresponding to the target key reading index in the key memory. That is, the length and content of the corresponding key are stored starting from this target key reading address. Therefore, the storage space occupied by the corresponding key can be determined through this target key reading address.

[0102] In step S150 of some embodiments, the key length of the key corresponding to the key read index can be determined according to the next address offset value of the first matching key index in the key index table, that is, the target key length is obtained by subtracting the first key address offset value from the next address offset value. Then, all key information corresponding to the key read index is read from the key storage according to the target key read address and the target key length.

[0103] This application embodiment can utilize the number of keys in the key index table as needed, and can improve the utilization of storage space by expanding the number of keys in the key index table or the number of keys the key index table can support. Furthermore, this application embodiment can effectively shorten the key read / write operation time and improve operational efficiency by matching key indexes.

[0104] Please see Figure 3 , Figure 3 This is another optional flowchart of the key management method provided in the embodiments of this application. In some embodiments of this application, before step S130, the key management method of this application may further include the step of constructing a key index table. This step may specifically include, but is not limited to, steps S310 to S350. The following is in conjunction with... Figure 3 These five steps will be explained in detail.

[0105] Step S310: When the key operation instruction is a table construction instruction, obtain the key construction information according to the table construction instruction;

[0106] Step S320: Write the key construction information into the key storage to obtain the key construction address where the key construction information is stored in the key storage.

[0107] Step S330: Obtain the initial index table and the starting address of the second index corresponding to the initial index table;

[0108] Step S340: Determine the key construction address offset value based on the key construction address and the second index start address;

[0109] Step S350: Fill the key construction address offset value into the initial index table to obtain the key index table.

[0110] In step S310 of some embodiments, since the client knows the key index corresponding to the key to be read when using a key, the corresponding index needs to be stored in the key index table before reading the key. Therefore, the key operation instruction also includes a table construction instruction. The table construction instruction is used to construct the key index table, and the table construction instruction includes at least one key construction information. The key construction information is used to represent key information that does not yet correspond to a key index in the key index table. The key construction information includes the key length and the specific key content.

[0111] In step S320 of some embodiments, key construction information is written into a key memory, and the key construction address stored in the key memory is obtained according to the key length in the key construction information. The key construction address is used to represent the starting address of the key in the key memory where the key construction information is stored.

[0112] In steps S330 and S340 of some embodiments, the initial index table and the corresponding second index start address are obtained. Then, the key construction address is subtracted from the second index start address to obtain the key construction address offset value corresponding to the key construction information. The key construction address offset value refers to the address offset value relative to the second index start address.

[0113] It should be noted that, in order to facilitate address lookup or comparison, the address offset value in this application embodiment can be an absolute value.

[0114] It should be noted that this initial index table can be a new key index table expanded from the previous key index table, and the starting address of the second index is the address determined by the key usage space based on the previous key index table. This initial index table can also be the very first key index table; no specific limitation is made here.

[0115] In step S350 of some embodiments, the initial index table includes two column fields: a key index field and a key offset value field corresponding to the key index. Therefore, the key construction address offset value is filled into the key offset value field of the corresponding key index in the initial index table to obtain index data of the key construction information in the initial index table. This index data includes the key index corresponding to the key construction address offset value and the key construction address offset value itself. The construction of this initial index table is the same as the structure of the key index table in Table 2 above, and will not be described again here.

[0116] Please see Figure 4 , Figure 4 This is an optional flowchart of step S350 provided in the embodiments of this application. In some embodiments of this application, step S350 may specifically include, but is not limited to, steps S410 to S430. The following is in conjunction with... Figure 4These three steps will be explained in detail.

[0117] Step S410: Obtain the initial index data from the initial index table where the key storage status is invalid. The initial index data includes the initial key index and the initial address offset value.

[0118] Step S420: Replace the initial address offset value with the key construction address offset value and update the initial index data;

[0119] Step S430: Obtain the key index table based on the updated initial index data.

[0120] In steps S410 to S430 of some embodiments, when filling the key construction address offset value into the initial index table, it needs to be filled into the key index where no corresponding key is stored. Therefore, the initial index data with an invalid key storage state is first obtained from the initial index table. Thus, the initial address offset value is a preset invalid offset value. The initial address offset value is replaced by the key construction address offset value to update the initial index data, and the key storage state of the initial index data is changed to a valid state. The key index table is then obtained based on the updated initial index data.

[0121] It should be noted that when deleting a key from a key index in the key index table, the key is deleted using the address offset value corresponding to the key index to be deleted and the starting address of the key in the key index table. Then, the address offset value corresponding to the key index to be deleted is modified to a preset invalid offset value, at which point the storage state of the key corresponding to the key index to be deleted changes to an invalid state.

[0122] This application embodiment can determine the key storage status based on the address offset value corresponding to the supported key index in the key index table, thereby enabling the addition and deletion of keys. Furthermore, changes in key length do not affect the length of the address offset value in the key index table; only the offset value changes. Therefore, compared to related technologies that allocate the same storage space to each key, this solution does not limit the key length; that is, the position of each key is not fixed. Storage space can be dynamically allocated according to the actual size of each stored key, thus allowing for flexible storage of various keys.

[0123] Please see Figure 5 , Figure 5 This is another optional flowchart of the key management method provided in the embodiments of this application. In some embodiments of this application, after step S110, the key management method of this application may further include, but is not limited to, steps S510 to S550, as described below. Figure 5 These five steps will be explained in detail.

[0124] Step S510: When the key operation instruction is a key write instruction, obtain the key write index and key write information according to the key write instruction;

[0125] Step S520: Obtain the second matching index data from the key index table according to the key writing index. The second matching index data includes the second matching key index and the second key address offset value corresponding to the second matching key index. The second matching key index and the key writing index have the same index.

[0126] Step S530: Determine the key storage status of the second matching index data based on the preset invalid offset value and the second key address offset value;

[0127] Step S540: When the key storage status of the second matching index data is valid, determine the target key write address based on the first index start address and the second key address offset value.

[0128] Step S550: Write the key writing information into the key storage according to the target key writing address.

[0129] In steps S510 and S520 of some embodiments, the key operation instruction of this application embodiment further includes a key writing instruction. The key writing instruction refers to writing key information into the key storage. The key writing instruction sent by the client from the interface includes a key writing index and key writing information. The key writing information includes the key length and key content. A second matching index data is obtained by matching the key index from the key index table according to the key writing index. The second matching index data includes a second matching key index and a second key address offset value corresponding to the second matching key index. The second matching key index and the key writing index have the same index. At this time, the second matching index data is the same as the first matching index data, which will not be described again here.

[0130] In steps S530 to S550 of some embodiments, a preset invalid offset value and a second key address offset value are compared. If the preset invalid offset value and the second key address offset value are the same, the key storage state of the second matching index data is determined to be valid; if the preset invalid offset value and the second key address offset value are different, the key storage state of the second matching index data is determined to be invalid. Therefore, when the key storage state of the second matching index data is valid, the first index start address and the second key address offset value are added together to obtain the target key write address. The target key write address represents the starting address for storing the key information corresponding to the key write index in the key memory. That is, the length and content of the corresponding key write information are written starting from this target key write address. Therefore, the storage space occupied by the corresponding key write information in the key memory can be determined through the target key write address. Then, the key write information is written into the key memory according to the target key write address.

[0131] It should be noted that the key write instruction is used to update the key information corresponding to a key that is already included in the key index table. When the key index table does not contain a key corresponding to a key, the process of adding a key to the key index table as described in the table construction instruction above can be referred to. This involves retrieving the initial index data where the key storage state is invalid from the key index table, replacing the address offset value with the required key information, and updating the key index table. This will not be elaborated further here.

[0132] Please see Figure 6 , Figure 6 This is an optional flowchart of step S550 provided in the embodiments of this application. In some embodiments of this application, step S550 may specifically include, but is not limited to, steps S610 to S640, as described below. Figure 6 These four steps will be explained in detail.

[0133] Step S610: Obtain the historical write information stored at the target key write address from the key memory;

[0134] Step S620: Delete the historical write information from the key storage;

[0135] Step S630: Determine the key writing range in the key memory that stores the key writing information based on the target key writing address and the key length of the key writing information;

[0136] Step S640: Write the key writing information into the key writing range.

[0137] In steps S610 to S640 of some embodiments, since the key write instruction is used to indicate a case where the key index table already contains the key corresponding to the key, historical write information stored at the target key write address is retrieved from the key memory. Historical write information refers to historical key information stored at the same second matching key index as the key write index. The target key write address is also the starting address for storing the historical write information in the key memory, and the historical write information is deleted from the key memory based on this target key write address. Then, the key write interval for storing the key write information in the key memory is determined based on the target key write address and the key length of the key write information. Finally, the key write information is written into the key write interval of the key memory.

[0138] Please see Figure 7 , Figure 7 This is another optional flowchart of the key management method provided in the embodiments of this application. In some embodiments of this application, after step S550, the key management method of this application may further include, but is not limited to, steps S710 to S720, as described below. Figure 7 These two steps will be explained in detail.

[0139] Step S710: Obtain historical index data after the second matching key index in the key index table. The historical index data includes historical key address offset values.

[0140] Step S720: Update the historical key address offset value according to the key length and target key writing address of the key writing information, and update the key index table according to the updated historical key address offset value.

[0141] In steps S710 to S720 of some embodiments, when the key length of the key written information is different from the key length of the historical written information, the address offset value corresponding to each key index after the second matching key index in the key index table is updated simultaneously to obtain a new key index table. When the key length of the key written information is the same as the key length of the historical written information, the address offset value corresponding to each key index after the second matching key index in the key index table is not updated, and a new key index table is obtained.

[0142] Specifically, when the key length of the key written information differs from the key length of the historical written information, the historical index data following the second matching key index in the key index table is retrieved. This historical index data includes historical key address offset values. For example, according to Table 2, assuming the key write index corresponds to key index 1 in Table 2 (i.e., the second matching key index), the target key write address is determined to be 0x0020 bytes based on the first index start address of 0x0000 bytes and the second key address offset value of 0x0020 bytes. The key length corresponding to key index 1 is 0x0060 bytes, while the key length of the key written information is 0x0080 bytes, meaning the key length of the key written information differs from the key length of the historical written information. The historical index data following the second matching key index in the key index table (i.e., the index data corresponding to key index 2) is retrieved, and the historical key address offset value corresponding to this historical index data is 0x0080 bytes. Since the second key address offset values ​​of 0x0020 bytes and 0xFFFF bytes are different, the key storage state of key index 1 is determined to be valid. The key length of the key writing information (0x0080 bytes) and the target key writing address (0x0020 bytes) are summed, and the sum (0x00A0 byte) is used to update the historical key address offset value, which is the address offset value corresponding to the updated key index 2. Based on the target key writing address (0x0020 bytes) and the key length of the key writing information (0x0080 bytes), the key writing range storing the key writing information in the key memory is determined to be [0x0020, 0x00A0]. Therefore, the key index table is updated according to the updated historical key address offset value (0x00A0 byte), and the updated key index table is shown in Table 3 below.

[0143]

[0144] Table 3

[0145] This invention provides a key management method that matches key indexes for reading and writing using a key index table, effectively shortening key read / write operation time and improving operational efficiency. This embodiment can utilize the number of keys in the key index table as needed, and can improve storage space utilization by expanding the number of keys in the key index table or the number of key indexes it supports. This embodiment can determine the key storage status based on the address offset value corresponding to the key indexes supported in the key index table, thereby enabling the addition and deletion of keys. Changes in key length do not affect the length of the address offset value in the key index table; only the offset value changes. Therefore, compared to related technologies that allocate the same storage space to each key, this solution does not limit the key length, meaning the position of each key is not fixed. Since symmetric and asymmetric keys differ significantly in size, related key management methods generally process different types of keys separately, reducing key management efficiency. This solution, however, dynamically allocates storage space based on the actual size of each stored key, allowing for flexible storage of various key types. Furthermore, this embodiment stores the key index table in NVRAM, which effectively improves key read / write speed compared to storing it in Flash, resulting in smoother product operation.

[0146] Please see Figure 8 , Figure 8 This is a schematic diagram of the key management device provided in an embodiment of this application. The device includes an instruction receiving module 810, an index acquisition module 820, an index matching module 830, an address determination module 840, and a key reading module 850.

[0147] The instruction receiving module 810 is used to receive key operation instructions, including key reading instructions.

[0148] The index acquisition module 820 is used to acquire the key reading index according to the key reading instruction when the key operation instruction is a key reading instruction;

[0149] The index matching module 830 is used to match the first matching index data from the pre-built key index table according to the key reading index. The first matching index data includes the first matching key index and the first key address offset value corresponding to the first matching key index. The first matching key index and the key reading index have the same index.

[0150] The address determination module 840 is used to determine the target key reading address based on the key index table and the first key address offset value. The target key reading address is used to represent the storage address of the key information corresponding to the key reading index in the preset key memory.

[0151] The key reading module 850 is used to read the key information corresponding to the key reading index from the key storage according to the target key reading address.

[0152] It should be noted that the key management device in this application embodiment is used to implement the key management method in the above embodiment. The key management device in this application embodiment corresponds to the aforementioned key management method. For the specific processing procedure, please refer to the aforementioned key management method, which will not be repeated here.

[0153] This application also provides a computer device, which includes: at least one memory, at least one processor, and at least one computer program. The at least one computer program is stored in the at least one memory, and the at least one processor executes the at least one computer program to implement any of the key management methods described in the above embodiments. This computer device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0154] Please see Figure 9 , Figure 9 The illustration shows the hardware structure of a computer device according to another embodiment, the computer device comprising:

[0155] The processor 910 can be implemented using a general-purpose central processing unit (CPU), microprocessor, application specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0156] The memory 920 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 920 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 920 and is called and executed by the processor 910 using the key management method of the embodiments of this application.

[0157] The input / output interface 930 is used to implement information input and output;

[0158] The communication interface 940 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0159] Bus 950 transmits information between various components of the device (e.g., processor 910, memory 920, input / output interface 930, and communication interface 940);

[0160] The processor 910, memory 920, input / output interface 930 and communication interface 940 are connected to each other within the device via bus 950.

[0161] This application also provides a computer-readable storage medium storing a computer program for causing a computer to execute the key management method described in the above embodiments.

[0162] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0163] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0164] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0165] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0166] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0167] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0168] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0169] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0170] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0171] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0172] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0173] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A key management method, characterized in that, The method includes: Receive key operation instructions, which include key read instructions and key write instructions; When the key operation instruction is the key read instruction, obtain the key read index according to the key read instruction; The first matching index data is obtained by matching the key reading index from the pre-built key index table. The first matching index data includes the first matching key index and the first key address offset value corresponding to the first matching key index. The first matching key index and the key reading index have the same index. Obtain a preset invalid offset value and a first index starting address corresponding to the key index table; determine the key storage state of the first matching index data based on the preset invalid offset value and the first key address offset value, the key storage state including a valid state; when the key storage state of the first matching index data is the valid state, determine the target key reading address based on the first index starting address and the first key address offset value, the target key reading address being used to represent the storage address of the key information corresponding to the key reading index in a preset key memory; The key information corresponding to the key read index is read from the key memory according to the target key read address; When the key operation instruction is the key write instruction, the key write index and key write information are obtained according to the key write instruction; The second matching index data is obtained by matching the key index table according to the key write index. The second matching index data includes the second matching key index and the second key address offset value corresponding to the second matching key index. The second matching key index and the key write index are the same. The key storage status of the second matching index data is determined based on the preset invalid offset value and the second key address offset value. When the key storage status of the second matching index data is the valid status, the target key write address is determined according to the first index start address and the second key address offset value; Write the key writing information into the key storage according to the target key writing address, obtain the historical index data after the second matching key index in the key index table, the historical index data includes the historical key address offset value; update the historical key address offset value according to the key length of the key writing information and the target key writing address, and update the key index table according to the updated historical key address offset value.

2. The method according to claim 1, characterized in that, The key operation instructions further include table construction instructions. Before obtaining the first matching index data from the pre-built key index table based on the key index reading, the method further includes: constructing the key index table, specifically including: When the key operation instruction is the table construction instruction, key construction information is obtained according to the table construction instruction; Write the key construction information into the key memory to obtain the key construction address where the key construction information is stored in the key memory; Obtain the initial index table and the starting address of the second index corresponding to the initial index table; The key construction address offset value is determined based on the key construction address and the second index start address; The key construction address offset value is filled into the initial index table to obtain the key index table.

3. The method according to claim 2, characterized in that, The key storage state also includes an invalid state. The step of filling the key construction address offset value into the initial index table to obtain the key index table includes: Obtain the initial index data from the initial index table where the key storage state is invalid. The initial index data includes the initial key index and the initial address offset value. Replace the initial address offset value with the key construction address offset value, and update the initial index data; The key index table is obtained based on the updated initial index data.

4. The method according to claim 1, characterized in that, The step of writing the key writing information into the key memory according to the target key writing address includes: Retrieve historical write information stored at the target key write address from the key memory; The historical information is deleted from the key storage. The key writing range in the key memory for storing the key writing information is determined based on the target key writing address and the key length of the key writing information. Write the key information into the key writing range.

5. A key management device, characterized in that, The device includes: The instruction receiving module is used to receive key operation instructions, which include key reading instructions and key writing instructions; The index acquisition module is used to acquire the key reading index according to the key reading instruction when the key operation instruction is the key reading instruction; An index matching module is used to obtain first matching index data from a pre-built key index table based on the key reading index. The first matching index data includes a first matching key index and a first key address offset value corresponding to the first matching key index. The first matching key index and the key reading index have the same index. The address determination module is used to obtain a preset invalid offset value and a first index starting address corresponding to the key index table; determine the key storage state of the first matching index data according to the preset invalid offset value and the first key address offset value, the key storage state including a valid state; when the key storage state of the first matching index data is the valid state, determine the target key reading address according to the first index starting address and the first key address offset value, the target key reading address is used to represent the storage address of the key information corresponding to the key reading index in a preset key memory; A key reading module is configured to: read key information corresponding to the key reading index from the key storage according to the target key reading address; when the key operation instruction is the key writing instruction, obtain the key writing index and key writing information according to the key writing instruction; match the key writing index from the key index table to obtain second matching index data, the second matching index data including the second matching key index and the second key address offset value corresponding to the second matching key index, the second matching key index and the key writing index having the same index; determine the key storage state of the second matching index data according to the preset invalid offset value and the second key address offset value; when the key storage state of the second matching index data is the valid state, determine the target key writing address according to the first index start address and the second key address offset value; write the key writing information into the key storage according to the target key writing address; obtain historical index data after the second matching key index in the key index table, the historical index data including historical key address offset values; update the historical key address offset value according to the key length of the key writing information and the target key writing address, and update the key index table according to the updated historical key address offset value.

6. A computer device, characterized in that, include: At least one memory; At least one processor; At least one computer program; The at least one computer program is stored in the at least one memory, and the at least one processor executes the at least one computer program to perform: The method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that is used to cause the computer to execute: The method as described in any one of claims 1 to 4.

Images