A key management method, key calling method and cryptographic machine

Abstract

The present invention discloses a key management method, a key calling method and a cipher machine, and relates to the technical field of cipher machines. The key management method comprises: when a key update cycle is reached, the storage address of the key is encrypted using a randomly selected first key to obtain an address ciphertext; the address ciphertext is split to generate address ciphertext fragments, and the address ciphertext fragments are stored in different storage areas according to the fragment lengths of the address ciphertext fragments to generate a storage area sequence; a storage area sequence key is obtained, and the storage area sequence is encrypted using the storage area sequence key to obtain an encrypted sequence; and a key table is updated according to the encrypted sequence. The present invention can dynamically update the key, greatly enhance the security of key storage, and effectively prevent potential attackers from locating and attacking fixed storage locations, thereby reducing the risk of key theft or abuse.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic machines, and in particular to a key management method, a key calling method and a cryptographic machine. Background Art

[0002] With the rapid development of information technology and the widespread popularity of network applications, data security has become increasingly important. As the core of data encryption, the management and protection of keys are particularly important. Traditional key management methods often use static storage, that is, keys or related information are stored in a fixed location. However, this method has obvious security risks, because the fixed storage location is easy to be located and attacked by potential attackers, thereby increasing the risk of key theft or abuse. Summary of the invention

[0003] In view of the defects in the prior art, the present invention provides a key management method, a key calling method and a cryptographic machine, which can dynamically update the storage address of the key ciphertext when the key update cycle arrives, greatly enhancing the security of key storage.

[0004] In a first aspect, the present invention provides a key management method, the method comprising:

[0005] When the key update cycle is reached, the storage address of the key is encrypted using the randomly selected first key to obtain the address ciphertext;

[0006] Splitting the address ciphertext to generate address ciphertext fragments, storing the address ciphertext fragments in different storage areas according to the fragment lengths of the address ciphertext fragments, and generating a storage area sequence;

[0007] Obtaining a storage area sequence key, and encrypting the storage area sequence using the storage area sequence key to obtain an encrypted sequence;

[0008] The key table is updated according to the encryption sequence.

[0009] Preferably, the address ciphertext is split to generate address ciphertext fragments, which includes:

[0010] Get the key level before the key reaches the usage limit and the usage in the previous cycle;

[0011] The storage level is determined according to the key level and the ratio of the usage in the previous cycle to the rated usage.

[0012] Preferably, splitting the address ciphertext to generate address ciphertext fragments includes:

[0013] Determine splitting parameters based on storage level;

[0014] The address ciphertext fragments are split into a preset number according to the splitting parameters.

[0015] Preferably, the storage level formula is determined according to the key level and the ratio of the usage in the previous cycle to the rated usage:

[0016]

[0017] Among them, E is the storage level, E0 is the key level, P t is the tth usage index, and P0 is the rated value of the tth usage index.

[0018] Preferably, storing the address ciphertext fragments in different storage areas according to the fragment lengths of the address ciphertext fragments to generate a storage area sequence includes:

[0019] The address ciphertext fragment is recorded as A(w,d i ), the storage area is recorded as

[0020] Among them, w is the storage level of the address ciphertext fragment, d i is the length of the i-th address ciphertext fragment, n is the number of address ciphertext fragments stored in the randomly selected storage area, and w j is the storage level of the jth stored ciphertext fragment, d j is the fragment length of the jth stored ciphertext fragment;

[0021] The Euclidean distance between the address ciphertext fragment and each storage area is calculated, and the storage area with the largest Euclidean distance is used as the storage area of ​​the address ciphertext fragment.

[0022] Preferably, updating the key table according to the encryption sequence includes:

[0023] Replace the original encryption sequence in the key table with the encryption sequence of the current update cycle;

[0024] Without changing other data, only the encryption sequence in the key table is shuffled to obtain a new key table.

[0025] In a second aspect, the present invention provides a key calling method, the method comprising:

[0026] Obtaining a data encryption request, wherein the data encryption request includes a user identity;

[0027] The user identity is verified, and if the verification is successful, the corresponding key is obtained according to the key table, and the key table is updated by the method described in the first aspect.

[0028] In a third aspect, a cryptographic machine comprises:

[0029] A first encryption module, used to encrypt the storage address of the key using a randomly selected first key to obtain an address ciphertext when a key update cycle is reached;

[0030] A storage module, used for splitting the address ciphertext to generate address ciphertext fragments, storing the address ciphertext fragments into different storage areas according to the fragment lengths of the address ciphertext fragments, and generating a storage area sequence;

[0031] A second encryption module is used to obtain a storage area sequence key, and encrypt the storage area sequence using the storage area sequence key to obtain an encrypted sequence;

[0032] The third encryption module is used to update the key table according to the encryption sequence.

[0033] The beneficial effects of the present invention are embodied in: a key management method, a key calling method and a cryptographic machine, which greatly enhance the security of key storage by encrypting and splitting address ciphertexts when a key update cycle is reached, and dynamically updating the storage address of key ciphertexts. This method effectively prevents potential attackers from locating and attacking fixed storage locations, thereby reducing the risk of key theft or abuse. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for the specific embodiments or the description of the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

[0035] Figure 1 A flowchart of a key management method provided by an embodiment of the present invention;

[0036] Figure 2 A schematic diagram of the structure of a cryptographic machine provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The following embodiments of the technical solution of the present invention are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and are therefore only used as examples, and cannot be used to limit the protection scope of the present invention.

[0038] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by those skilled in the art to which the present invention belongs.

[0039] like Figure 1As shown, the present invention provides a key management method, the method comprising:

[0040] Step 1: When the key update cycle is reached, the storage address of the key is encrypted using a randomly selected first key to obtain an address ciphertext.

[0041] In some embodiments, the key update cycle is set according to security requirements and network conditions. Specifically, for systems with higher security requirements, a shorter key update cycle should be set to reduce the risk of key cracking. For example, for highly sensitive application scenarios such as banking and military, keys may need to be updated more frequently. When the network environment is unstable, frequent key updates may cause communication interruptions or increased delays. Therefore, when setting the key update cycle, it is necessary to weigh the requirements of network stability and security. Frequent key updates may have a certain impact on system performance. Therefore, in performance-sensitive applications, the key update cycle needs to be carefully selected.

[0042] More specifically, some usage restrictions may be set to determine the update cycle, such as usage time restrictions, usage times restrictions, usage frequency restrictions, etc.

[0043] Step 2: split the address ciphertext to generate address ciphertext fragments, store the address ciphertext fragments into different storage areas according to the fragment lengths of the address ciphertext fragments, and generate a storage area sequence.

[0044] In the embodiment of the present invention, the formula for determining the storage level according to the key level and the ratio of the usage in the previous cycle to the rated usage is:

[0045]

[0046] Among them, E is the storage level, E0 is the key level, P t is the tth usage index, and P0 is the rated value of the tth usage index.

[0047] In an embodiment of the present invention, the address ciphertext is split to generate address ciphertext fragments, which includes: obtaining the key level before the key reaches the usage limit and the usage in the previous cycle; determining the storage level according to the ratio of the key level and the usage in the previous cycle to the rated usage; determining the splitting parameters according to the storage level; and splitting the address ciphertext fragments into a preset number according to the splitting parameters.

[0048] Before splitting the address ciphertext to generate address ciphertext fragments, the key level and usage of the key in the previous cycle are obtained. This is not only for simple data collection, but also for building a dynamic and flexible key management system. By deeply analyzing this data, the importance and frequency of use of the key can be accurately evaluated, and then the appropriate storage level can be determined for it. This elevates key management to a more sophisticated and personalized level.

[0049] This embodiment adopts a method of dynamically adjusting storage levels to flexibly allocate resources according to actual needs, avoiding waste and excessive use of resources. Through reasonable resource allocation and efficient key processing mechanism, the overall performance of the system is improved, ensuring the timeliness and effectiveness of key management.

[0050] In the embodiment of the present invention, the address ciphertext fragments are stored in different storage areas according to the fragment lengths of the address ciphertext fragments to generate a storage area sequence, including: recording the address ciphertext fragments as A(w,d i ), the storage area is recorded as Among them, w is the storage level of the address ciphertext fragment, d i is the length of the i-th address ciphertext fragment, n is the number of address ciphertext fragments stored in the randomly selected storage area, and w j is the storage level of the jth stored ciphertext fragment, d j is the fragment length of the jth stored ciphertext fragment; calculate the Euclidean distance between the address ciphertext fragment and each storage area, and use the storage area with the largest Euclidean distance as the storage area of ​​the address ciphertext fragment.

[0051] This embodiment distributes similar key fragments to different storage areas as much as possible, which increases the security of data and the robustness of recovery. If a storage area fails, there are still key fragments in other areas that can be used for recovery.

[0052] Step 3: Obtain a storage area sequence key, and use the storage area sequence key to encrypt the storage area sequence to obtain an encrypted sequence.

[0053] Specifically, the storage area sequence key can be randomly selected from the sequence key table, or can be selected according to the authorized user. Specifically, each storage area has multiple key fragments, each key fragment has one key, each key corresponds to one or more encryption algorithms, and each key and encryption algorithm can be called by multiple users. Therefore, this embodiment selects the user keys of multiple authorized users randomly selected as the storage area key based on the hysteresis principle, that is, the storage area key of the current update cycle is a combination of multiple authorized user keys of another storage area in the previous cycle.

[0054] Step 4: Update the key table according to the encryption sequence.

[0055] In an embodiment of the present invention, updating the key table according to the encryption sequence includes: replacing the original encryption sequence in the key table with the encryption sequence of the current update cycle; and shuffling the arrangement of the encryption sequence in the key table without changing other data to obtain a new key table.

[0056] Keep all data in the key table unchanged except the encryption sequence, and only shuffle the arrangement of the encryption sequence, that is, the relevant information of the same encryption algorithm and / or the same authorized user remains unchanged, and only the corresponding encryption sequence is changed, that is, only the corresponding encryption algorithm is changed. Specifically, the shuffling can be achieved through various algorithms, such as the Fisher-Yates shuffle algorithm, to ensure that the order of the encryption sequence is fully disrupted, thereby improving security. After replacement and shuffling, verify whether the new key table is valid to ensure that the encryption and decryption processes can be carried out correctly. Once verified, the new key table is applied to the encryption or decryption process.

[0057] In summary, the key management method provided by the present invention greatly enhances the security of key storage by encrypting and splitting the address ciphertext and dynamically updating the storage address of the key ciphertext when the key update cycle is reached. This method effectively prevents potential attackers from locating and attacking fixed storage locations, thereby reducing the risk of key theft or abuse.

[0058] The present invention also provides a key calling method, which includes: obtaining a data encryption request, the data encryption request includes a user identity; verifying the user identity, and if the verification passes, obtaining the corresponding key according to the key table, and the key table is updated by any of the methods described above.

[0059] Specifically, identity authentication is used to ensure that only authorized users can access sensitive data and keys. Depending on the specific application scenario and security requirements, a suitable identity authentication method can be selected. The identity authentication method includes but is not limited to password authentication, two-factor authentication, biometrics, smart card authentication, public key infrastructure authentication, single sign-on, social media or third-party authentication, and knowledge-based authentication.

[0060] like Figure 2As shown, a cryptographic machine includes: a first encryption module, used to encrypt the storage address of the key using a randomly selected first key when a key update cycle is reached to obtain an address ciphertext; a storage module, used to split the address ciphertext to generate address ciphertext fragments, store the address ciphertext fragments in different storage areas according to the fragment lengths of the address ciphertext fragments, and generate a storage area sequence; a second encryption module, used to obtain a storage area sequence key, encrypt the storage area sequence using the storage area sequence key, and obtain an encrypted sequence; a third encryption module, used to update the key table according to the encrypted sequence.

[0061] It should be understood that the cryptographic machine provided in the embodiment of the present invention and the key management method provided in the above embodiment are based on the same inventive concept. For more specific working principles of each module in the embodiment of the present invention, please refer to the above embodiment and will not be repeated in the embodiment of the present invention.

[0062] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. A key management method, characterized in that: include: When the key update cycle is reached, the storage address of the key is encrypted using the randomly selected first key to obtain the address ciphertext; Splitting the address ciphertext to generate address ciphertext fragments, storing the address ciphertext fragments in different storage areas according to the fragment lengths of the address ciphertext fragments, and generating a storage area sequence; Obtaining a storage area sequence key, and encrypting the storage area sequence using the storage area sequence key to obtain an encrypted sequence; updating the key table according to the encryption sequence; The address ciphertext is split to generate address ciphertext fragments, which includes: Get the key level before the key reaches the usage limit and the usage in the previous cycle; Determining a storage level according to the key level and a ratio of usage in a previous cycle to rated usage; The address ciphertext is split to generate address ciphertext fragments, including: Determine splitting parameters based on storage level; The address ciphertext is split into a preset number of address ciphertext fragments according to the splitting parameter.

2. The method according to claim 1, characterized in that The storage level formula is determined based on the key level and the ratio of the usage in the previous cycle to the rated usage: Among them, E is the storage level, E0 is the key level, P t is the tth usage index, and P0 is the rated value of the tth usage index.

3. The method according to claim 1, characterized in that Storing the address ciphertext fragments in different storage areas according to the fragment lengths of the address ciphertext fragments, and generating a storage area sequence, including: The address ciphertext fragment is recorded as A(w,d i ), the storage area is recorded as Among them, w is the storage level of the address ciphertext fragment, d i is the length of the i-th address ciphertext fragment, n is the number of address ciphertext fragments stored in the randomly selected storage area, and w j is the storage level of the jth stored ciphertext fragment, d j is the fragment length of the jth stored ciphertext fragment; The Euclidean distance between the address ciphertext fragment and each storage area is calculated, and the storage area with the largest Euclidean distance is used as the storage area of ​​the address ciphertext fragment.

4. The method according to claim 1, characterized in that Updating the key table according to the encryption sequence includes: Replace the original encryption sequence in the key table with the encryption sequence of the current update cycle; Without changing other data, only the encryption sequence in the key table is shuffled to obtain a new key table.

5. A key calling method, characterized in that: include: Obtaining a data encryption request, wherein the data encryption request includes a user identity; The user identity is verified, and if the verification is successful, the corresponding key is obtained according to the key table, and the key table is updated by the method described in any one of claims 1-4.

6. A cryptographic machine, characterized in that: include: A first encryption module, used to encrypt the storage address of the key using a randomly selected first key to obtain an address ciphertext when a key update cycle is reached; A storage module, used for splitting the address ciphertext to generate address ciphertext fragments, storing the address ciphertext fragments into different storage areas according to the fragment lengths of the address ciphertext fragments, and generating a storage area sequence; A second encryption module is used to obtain a storage area sequence key, and encrypt the storage area sequence using the storage area sequence key to obtain an encrypted sequence; A third encryption module, used for updating the key table according to the encryption sequence; The address ciphertext is split to generate address ciphertext fragments, which includes: Get the key level before the key reaches the usage limit and the usage in the previous cycle; Determining a storage level according to the key level and a ratio of usage in a previous cycle to rated usage; The address ciphertext is split to generate address ciphertext fragments, including: Determine splitting parameters based on storage level; The address ciphertext is split into a preset number of address ciphertext fragments according to the splitting parameter.

Images