Key management method, key management device and storage medium

Abstract

The present invention provides a key management method, a key management device and a storage medium, the method comprising: receiving at least one key request, wherein the at least one key request includes a key application request and / or a key recovery request; for each key request in the at least one key request, respectively determining a user key corresponding to each key request; the user key is an unrecovered key; according to the user key corresponding to each key request, respectively executing a key allocation operation corresponding to the key application request, and / or executing a key recovery operation corresponding to the key recovery request; the present invention can solve the problem that the security key at the software level cannot operate the logical behavior at the digital circuit level and cannot ensure the data security at the digital circuit level; and improve the data security at the digital circuit level.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a key management method, a key management device and a storage medium. Background Art

[0002] The security key module of the computer system is used to lock a thread of a multi-threaded program, thereby protecting the thread from other threads operating the memory area that needs to be protected during execution, so as to ensure the consistency and security of the data.

[0003] The security key modules of existing computer systems all belong to the software level. Therefore, when digital circuits are used to implement the operation of multi-threaded programs, the security keys at the software level cannot operate on the logical behavior of the digital circuit level, and cannot guarantee the data security at the digital circuit level. Summary of the invention

[0004] In view of this, the embodiments of the present invention provide a key management method, a key management device and a storage medium to eliminate or improve one or more defects in the prior art. The method can solve the problem that the security key at the software level cannot operate the logical behavior at the digital circuit level and cannot ensure the data security at the digital circuit level.

[0005] One aspect of the present invention provides a key management method, which is applied to key management transfer, and the method comprises the following steps:

[0006] receiving at least one key request, wherein the at least one key request includes a key application request and / or a key recovery request;

[0007] For each key request in the at least one key request, respectively determine a user key corresponding to each key request; the user key is an unrecovered key;

[0008] According to the user key corresponding to each key request, the key allocation operation corresponding to the key application request and / or the key recovery operation corresponding to the key recovery request are respectively performed.

[0009] Optionally, executing a key distribution operation corresponding to the key application request includes:

[0010] Determine the key quantity of the user key corresponding to the key application request;

[0011] When the number of keys is greater than or equal to the preset number of keys, wait for the current user corresponding to the key application request to send a user key recovery request, and record the waiting time;

[0012] When the waiting time is less than the preset time and a user key recovery request is received, matching the recovery key indicated by the user key recovery request with the user key;

[0013] In the case where there is a reclaimed key in the user key, the reclaimed key in the user key is reclaimed and the number of keys is updated;

[0014] Generates the key corresponding to the key application request and returns it, updating the key quantity.

[0015] Optionally, when the waiting time is greater than or equal to a preset time length, the method further includes: generating a key application error message and returning, thereby ending the key distribution operation.

[0016] Optionally, before waiting for the current user corresponding to the key application request to send a user key recovery request, the method further includes: generating and returning key quantity prompt information, where the key quantity prompt information is used to prompt the user to send the user key recovery request.

[0017] Optionally, when the number of keys is less than the preset number of keys, the method further includes: generating a key corresponding to the key application request and returning it, and updating the number of keys.

[0018] Optionally, generate and return a key corresponding to the key application request, including:

[0019] Generate a key corresponding to the key application request and indication information corresponding to the key; the indication information is used to indicate the life cycle corresponding to the key;

[0020] The key and instruction information are returned to the user terminal corresponding to the current user.

[0021] Optionally, performing a key recovery operation corresponding to the key recovery request includes:

[0022] Matching the reclaimed key indicated by the key reclaim request with the user key;

[0023] In the case where there is a reclaimed key in the user key, the reclaimed key in the user key is reclaimed, and the key quantity of the user key is updated.

[0024] Another aspect of the present invention provides a key management device, which is applied to the above-mentioned key management method, comprising:

[0025] The application channel arbitration module is used to: when receiving a key application request sent by a user terminal, forward the key application request to the main control state machine;

[0026] The master control state machine is used to: determine the key quantity of the user key corresponding to the key application request when receiving the key application request; obtain the key generated by the key generator module and update the key quantity when the key quantity is less than the preset key quantity; and return the key to the application channel arbitration module;

[0027] The channel arbitration module is also used to return the key to the user terminal when the key is received.

[0028] Optionally, the master control state machine is further used to: upon receiving a key recovery request sent by a user terminal, match the recovery key indicated in the key recovery request with the user key; if a recovery key exists in the user key, recover the recovery key in the user key; and update the number of keys.

[0029] Another aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, characterized in that the program implements the steps of the above-mentioned key management method when executed by a processor.

[0030] The key management method, key management device and storage medium of the present invention can be applied to programs or logical behaviors at the digital circuit level at the digital circuit level to provide keys for them, and encrypt the threads of the digital circuit level programs through the keys to prevent other threads from operating the memory area so that they can perform encryption operations, thereby ensuring the data security and consistency at the digital circuit level; at the same time, the present application at the digital circuit level, based on the user's configuration, including the channel number of the key application channel, the accumulated value of the key application and the system time provided by the outside world, obtains a unique key within the program running life cycle, which is used to encrypt the access to the memory or the operation of a thread, thereby ensuring the optional component of the data integrity and atomicity of the computing unit within the computing system.

[0031] Furthermore, the generation and recovery of the key only takes one clock cycle, which can increase the speed of generating the key and the speed of recovering the key, thereby improving the running efficiency of the program at the data circuit level.

[0032] Furthermore, the key management device supports multiple key application channels and multiple key recovery channels, and can simultaneously support multiple users to generate multiple non-conflicting keys. In this way, it can ensure that data between users do not interfere with each other, thereby enhancing data isolation and security.

[0033] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically indicated in the specification and the accompanying drawings.

[0034] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention.

[0036] Figure 1 A result schematic diagram of a key management device provided by an embodiment of the present invention;

[0037] Figure 2 A flowchart of a key management method provided by another embodiment of the present invention;

[0038] Figure 3 A flowchart of a key management method provided by another embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0040] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0041] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0042] It should also be noted that, unless otherwise specified, the term “connection” herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0043] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0044] Figure 1 Schematic diagram of the structure of a key management device provided by an embodiment of the present application. Figure 1 As shown, the device at least includes an application channel arbitration module 110 , a master control state machine 120 and a key generator module 130 .

[0045] Figure 1 In the description, the number of each of the application channel arbitration module 110, the master state machine 120 and the key generator module 130 is taken as an example. In actual implementation, the number of each of the application channel arbitration module 110, the master state machine 120 and the key generator module 130 is at least one. This implementation does not limit the number of the application channel arbitration module 110, the master state machine 120 and the key generator module 130.

[0046] The application channel arbitration module 110 refers to an internal arbitrator of the key application channel.

[0047] In this embodiment, a key application channel is established between the key management device and the user terminal. Optionally, the key application channel between the key management device and the user terminal is a communication channel established based on a handshake protocol.

[0048] Optionally, the key management device supports 16 key application channels.

[0049] In actual implementation, the number of key application channels can be adjusted according to actual needs. This embodiment does not limit the number of key application channels.

[0050] The key management device receives the key application request sent by the user terminal through the key application channel. Specifically, the key application request is received by the application channel arbitration module 110, and the key application request is sent to the main control state machine 120 for processing in a polling arbitration manner.

[0051] Specifically, the application channel arbitration module 110 is used to: when receiving a key application request sent by a user terminal, forward the key application request to the main control state machine 120 .

[0052] In this embodiment, the main control state machine 120 refers to a device that controls the operation of the entire key management device according to input from the outside of the key management device and can issue corresponding outputs.

[0053] In this embodiment, the external input of the key management device is a key request, which includes a key application request and a key recovery request. Accordingly, after receiving the key request, the master state machine 120 also needs to determine the type of the received key request.

[0054] When the input from the outside of the key management device is a key application request, the main control state machine 120 is used to determine the key quantity of the user key used by the user who sends the key application request, and compare the key quantity of the user key with the preset key quantity. When the key quantity is less than the preset key quantity, the key allocation operation corresponding to the key application request is executed to avoid the number of keys held by the user exceeding the preset key quantity.

[0055] The preset number of keys is a pre-set number of keys, and its value includes but is not limited to 5, 10 or 15. This embodiment does not limit the value of the preset number of keys.

[0056] Specifically, the main control state machine 120 is used to: determine the key quantity of the user key corresponding to the key application request when a key application request is received; when the key quantity is less than the preset key quantity, obtain the key generated by the key generation module 130 and update the key quantity; and return the key to the application channel arbitration module 110.

[0057] The key generation module 130 is a hardware random number generator or a pseudo-random number generator, which is used to generate a key.

[0058] Specifically, in this embodiment, the key generation module 130 is used to: concatenate the channel number of the key application channel, the key application count and the system time hash value in order from high to low to obtain the key.

[0059] Among them, the channel number of the key application channel is a 4-bit number pre-set by the user, and different key application channels have different channel numbers; the key application count is a cumulative value of the applied key, which is a 4-bit number; the system time hash value is the value obtained by converting the 64-bit current system time into 8 bits through the hash algorithm.

[0060] In this embodiment, the life cycle of the key generated by the key generation module 130 is one clock cycle, and the length of the key is two bytes.

[0061] In this embodiment, the application channel arbitration module 110 is further configured to return the key to the user terminal when the key is received.

[0062] In one example, the key application channel is a communication channel constructed based on a handshake protocol. Therefore, when the handshake protocol is satisfied, the key management device determines that the generated key has been successfully sent to the user terminal.

[0063] In this embodiment, the key is used to encrypt the thread. When a thread operates a memory area, in order to prevent other threads from operating the memory area, causing data errors in the memory area, the key generated by the key generation module 130 is used to encrypt the thread to prevent other threads from operating the memory area.

[0064] In addition, when the number of keys is less than the preset number of keys, the main control state machine 120 is also used to: wait for the current user corresponding to the key application request to send a user key recovery request, and record the waiting time; when the waiting time is less than the preset time and the user key recovery request is received, match the recovery key indicated by the user key recovery request with the user key; when there is a recovery key in the user key, recover the recovery key in the user key and update the number of keys.

[0065] When the input from the outside of the key management device is a key revocation request, the key revocation request is received by the master state machine 120 .

[0066] In this embodiment, a key recovery channel is established between the key management device and the user terminal. Optionally, the key recovery channel between the key management device and the user terminal is a communication channel established based on a handshake protocol.

[0067] Optionally, the key management device supports 16 key recovery channels.

[0068] In actual implementation, the number of key recovery channels can be adjusted according to actual needs. This embodiment does not limit the number of key recovery channels.

[0069] After the master state machine 120 receives the key recovery request, the master state machine 120 will match the user key used by the user. If the match is successful, the master state machine 120 will reduce the number of keys currently held by the user.

[0070] Specifically, the master control state machine is also used to: upon receiving a key recovery request sent by a user terminal, match the recovery key indicated by the key recovery request with the user key; if a recovery key exists in the user key, recover the recovery key in the user key; and update the number of keys.

[0071] In addition, after the key recovery is completed, the main control state machine 120 is further used to: generate recovery prompt information and return it to the user terminal. The recovery prompt information is used to prompt the current user that the key recovery is completed.

[0072] In addition, in this embodiment, since there is a limit on the number of user keys held by each user, in order to manage the number of user keys, the register configuration of the key management device can be changed through the register configuration interface to modify the number of keys that each user can hold simultaneously.

[0073] The key management method provided by this application is introduced below.

[0074] like Figure 2 As shown, the embodiment of the present application provides a key management method, and this embodiment uses the method for Figure 1 Taking the key management device shown in FIG. 1 as an example, the method at least includes steps S201 to S203:

[0075] Step S201: receiving at least one key request.

[0076] The at least one key request includes a key application request and / or a key recovery request.

[0077] In this embodiment, the key management device receives the key application request through the key application channel, which is a communication channel established between the key management device and the user terminal based on the handshake protocol; the key management device receives the key application request through the key recovery channel, which is a communication channel established between the key management device and the user terminal based on the handshake protocol.

[0078] Optionally, the key management device supports 16 key application channels or 16 key recovery channels.

[0079] In actual implementation, the number of key application channels or the number of key recovery channels supported by the key management device can be adjusted according to actual conditions. This embodiment does not limit the number of key application channels or the number of key recovery channels supported by the key management device.

[0080] Step S202: for each key request in the at least one key request, determine the user key corresponding to each key request, wherein the user key is an unreclaimed key.

[0081] In this embodiment, the number of user keys that each user can hold does not exceed the preset number of keys.

[0082] Step S203: According to the user key corresponding to each key request, a key allocation operation corresponding to the key application request and / or a key recovery operation corresponding to the key recovery request are respectively performed.

[0083] In this embodiment, when at least one key request is a key application request, the key allocation operation corresponding to each key application request is executed respectively; when at least one key request is a key recovery request, the key recovery operation corresponding to each key recovery request is executed respectively; when at least one key request includes a key application request and a key recovery request, the key allocation operation corresponding to each key application request and the key recovery operation corresponding to each key recovery request are executed respectively.

[0084] Among them, executing the key allocation operation corresponding to the key application request includes: determining the key quantity of the user key corresponding to the key application request; when the key quantity is greater than or equal to the preset key quantity, waiting for the current user corresponding to the key application request to send a user key recovery request, and recording the waiting time; when the waiting time is less than the preset time length and the user key recovery request is received, matching the recovery key indicated by the user key recovery request with the user key; when there is a recovery key in the user key, recovering the recovery key in the user key and updating the key quantity; generating the key corresponding to the key application request and returning it, and updating the key quantity.

[0085] Since the number of user keys that each user in this embodiment can hold does not exceed the preset number of keys, before allocating new keys, it is necessary to first confirm the number of user keys held by the current user. When the number of keys is greater than or equal to the preset number of keys, it is necessary to first recycle the user keys, that is, wait for the current user to send a user key recycle instruction to recycle the user keys specified by the current user to be reclaimed, so that the number of user keys of the current user is less than the preset number of keys; thereafter, generate the corresponding key according to the key application request and return it to complete the key allocation of the current user.

[0086] In this embodiment, the key generation is completed by the key generation module, and the key generation module is used to concatenate the channel number of the key application channel, the key application count and the system time hash value in order from high to low to obtain the key.

[0087] Among them, the channel number of the key application channel is the channel number of the key application channel through which the key management device receives the key application request. The channel number of each key application channel is pre-set by the user and is a 4-bit number. Different key application channels have different channel numbers. The key application count refers to the cumulative value of the currently generated keys, which is a 4-bit number. The system time hash value refers to the value obtained by converting the 64-bit current system time into 8-bit through the hash algorithm.

[0088] After the time length for waiting for the current user to send a user key recovery instruction is greater than or equal to the preset time length, the current user can be regarded as giving up the application for the key. At this time, the key management device needs to generate a key application error message and return it to the user terminal, so that the user terminal displays the key application error message after receiving it, prompting the current user's key application failed.

[0089] Specifically, when the waiting time is greater than or equal to the preset time length, the method further includes: generating key application error information and returning, and ending the key distribution operation.

[0090] When the number of keys is less than the preset number of keys, the method further includes: generating a key corresponding to the key application request and returning it, and updating the number of keys.

[0091] Among them, generating and returning a key corresponding to the key application request includes: generating a key corresponding to the key application request and indication information corresponding to the key; the indication information is used to indicate the life cycle corresponding to the key; and returning the key and the indication information to the user terminal corresponding to the current user.

[0092] In this embodiment, executing the key recovery operation corresponding to the key recovery request includes: matching the recovered key indicated by the key recovery request with the user key; if a recovered key exists in the user key, recovering the recovered key in the user key and updating the key quantity of the user key.

[0093] In addition, in order to ensure that the current user sends the user key recovery request in a timely manner, before waiting for the current user corresponding to the key application request to send the user key recovery request, the key management device also needs to generate key quantity prompt information and send it to the user terminal, so that the user terminal displays the key quantity prompt information after receiving the key quantity prompt information to prompt the current user to send the user key recovery request.

[0094] Specifically, before waiting for the current user corresponding to the key application request to send a user key recovery request, the method further includes: generating and returning key quantity prompt information, where the key quantity prompt information is used to prompt the user to send the user key recovery request.

[0095] In order to more clearly understand the key management method provided by the present application, an example is given below to illustrate the method. Figure 3 , the method includes the following steps:

[0096] Step S301, receiving a key request sent by a user terminal;

[0097] Step S302, determining whether the key request is a key application request; if the key request is a key application request, executing step S303; otherwise, executing step S309;

[0098] Step S303, determining the number of keys of the current user;

[0099] Step S304, determining whether the number of keys is greater than or equal to the preset number of keys; if the number of keys is greater than or equal to the preset number of keys, executing step S305; otherwise, executing step S307;

[0100] Step S305, waiting for the current user to send a user key recovery request;

[0101] Step S306, upon receiving a user key recovery request, recover the user key and update the key quantity;

[0102] Step S307, generating a key corresponding to the key generation request;

[0103] Step S308, sending the key to the user terminal and updating the number of keys of the current user; end.

[0104] Step S309, determining the user key of the current user;

[0105] Step S310, matching in the user key;

[0106] Step S311, if the match is successful, reclaim the user key indicated by the key reclaim request;

[0107] Step S312, update the key quantity of the user key of the current user; end.

[0108] To summarize, the key management method provided by the present application is applied to a key management device, and can be applied to programs or logical behaviors at the digital circuit level at the digital circuit level to provide keys for them, and encrypt the threads of the digital circuit level programs through the keys to prevent other threads from operating the memory area so that they can perform encryption operations, thereby ensuring data security and consistency at the digital circuit level; at the same time, the present application at the digital circuit level, based on the user's configuration, including the channel number of the key application channel, the accumulated value of the key application, and the system time provided by the outside world, obtains a unique key within the life cycle of the program, which is used to encrypt memory access or the operation of a thread, thereby ensuring the data integrity and atomicity of the computing units within the computing system.

[0109] Furthermore, the generation and recovery of the key only takes one clock cycle, which can increase the speed of generating the key and the speed of recovering the key, thereby improving the running efficiency of the program at the data circuit level.

[0110] Furthermore, the key management device supports multiple key application channels and multiple key recovery channels, and can simultaneously support multiple users to generate multiple non-conflicting keys. In this way, it can ensure that data between users do not interfere with each other, thereby enhancing data isolation and security.

[0111] Corresponding to the above method, the present invention also provides a key management method device, which includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, the processor is used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the electronic device implements the steps of the key management method in the above method embodiment.

[0112] The processor may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0113] The memory may include one or more computer-readable storage media, which may be non-transitory. The memory may also include high-speed random access memory, and non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory is used to store at least one instruction, which is used to be executed by the processor to implement the key management method provided by the method embodiment of the present invention.

[0114] In some embodiments, the electronic device may further optionally include: a peripheral device interface and at least one peripheral device. The processor, the memory and the peripheral device interface may be connected via a bus or a signal line. Each peripheral device may be connected to the peripheral device interface via a bus, a signal line or a circuit board. Schematically, the peripheral devices include but are not limited to: a radio frequency circuit, a touch display screen, an audio circuit, and a power supply.

[0115] Of course, the electronic device may also include fewer or more components, which is not limited in this embodiment.

[0116] The embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned key management method are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0117] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0118] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0119] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0120] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A key management method, characterized in that: Applied to a key management device, the method comprises the following steps: Receiving at least one key request, wherein the at least one key request includes a key application request and / or a key recovery request; For each key request in the at least one key request, respectively determine a user key corresponding to each key request; the user key is an unrecycled key; According to the user key corresponding to each key request, respectively perform the key allocation operation corresponding to the key application request, and / or perform the key recovery operation corresponding to the key recovery request; The executing the key distribution operation corresponding to the key application request includes: Determine the key quantity of the user key corresponding to the key application request; When the number of keys is greater than or equal to the preset number of keys, waiting for the current user corresponding to the key application request to send a user key recovery request, and recording the waiting time; When the waiting time is less than the preset time length and the user key recovery request is received, matching the recovery key indicated by the user key recovery request with the user key; In the case where the recycled key exists in the user key, recycling the recycled key in the user key and updating the key quantity; Generate a key corresponding to the key application request and return it, and update the key quantity.

2. The key management method according to claim 1, characterized in that: In the case where the waiting time is greater than or equal to the preset time length, the method further includes: generating the key application error information and returning, and ending the key distribution operation.

3. The key management method according to claim 1, characterized in that: Before the waiting for the current user corresponding to the key application request to send the user key recovery request, the method further includes: generating and returning key quantity prompt information, wherein the key quantity prompt information is used to prompt the user to send the user key recovery request.

4. The key management method according to claim 1, characterized in that: In the case that the number of keys is less than the preset number of keys, the method further includes: generating a key corresponding to the key application request and returning it, and updating the number of keys.

5. The key management method according to any one of claims 2 to 4, characterized in that: The generating and returning a key corresponding to the key application request includes: Generate a key corresponding to the key application request and indication information corresponding to the key; the indication information is used to indicate the life cycle corresponding to the key; The key and the indication information are returned to the user terminal corresponding to the current user.

6. The key management method according to claim 1, characterized in that: The performing of the key recovery operation corresponding to the key recovery request includes: Matching the reclaimed key indicated by the key reclaim request with the user key; In a case where the revoked key exists in the user key, the revoked key in the user key is revoked, and the key quantity of the user key is updated.

7. A key management device, characterized in that: Applied to the key management method according to any one of claims 1 to 6, the device comprises: The application channel arbitration module is used to: when receiving a key application request sent by a user terminal, forward the key application request to the main control state machine; The master control state machine is used to: determine the key quantity of the user key corresponding to the key application request when the key application request is received; obtain the key generated by the key generator module and update the key quantity when the key quantity is less than the preset key quantity; and return the key to the application channel arbitration module; The application channel arbitration module is further used to: return the key to the user terminal when the key is received; the master control state machine is further used to: match the recovered key indicated by the key recovery request with the user key when the key recovery request is received from the user terminal; if the recovered key exists in the user key, recover the recovered key in the user key; and update the number of keys.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images