A method, system and device for offline key distribution

Abstract

The present invention provides a method, system, and device for offline key distribution, relating to the field of key management. The offline key distribution method comprises: receiving a key distribution request sent by a key-using device; obtaining a key to be distributed and a protection key according to the key distribution request; encrypting the key to be distributed according to the protection key to generate a ciphertext file of the key to be distributed; encrypting the protection key to generate a protection key ciphertext; writing the protection key ciphertext to a first storage device, and writing the ciphertext file of the key to be distributed to a second storage device; distributing the protection key ciphertext to the distributed device via the first storage device, and distributing the ciphertext file of the key to be distributed to the distributed device via the second storage device. The solution of the present invention realizes the simultaneous distribution of keys during offline key distribution when the number of keys exceeds the storage space of the smart password key, thereby improving work efficiency.

Description

Technical Field

[0001] The present invention relates to the field of key management, and in particular to a key offline distribution method, system and device. Background Art

[0002] Currently, offline key distribution is an essential feature in key management systems. Offline key distribution involves storing the key management system's keys in a secure medium, offline, and then handing the secure medium over to the administrator of the device or application being distributed, who then imports the key into the device or application. Traditional offline key distribution technologies use a secure medium called a smart key (UKey), whose password protects the distributed keys. However, due to the limited storage space of UKeys (maximum 2MB and minimum 128KB), the number of keys that can be stored during offline distribution is limited, limiting key distribution capacity. For devices requiring keys exceeding this capacity, a single offline distribution cannot distribute a large number of keys. Distributing a large number of keys in multiple batches increases operational complexity. Summary of the Invention

[0003] The present invention provides a key offline distribution method, system and device, which solves the problem in existing key offline distribution process that when the number of keys to be distributed exceeds the storage space of the smart password key, multiple batch distributions are required and the keys cannot be distributed simultaneously.

[0004] In order to solve the above technical problems, the technical solutions of the present invention are as follows:

[0005] An embodiment of the present invention provides a key offline distribution method, which is applied to a key management system. The method includes:

[0006] receiving a key distribution request sent by a key-using device;

[0007] Obtaining, according to the key distribution request, keys to be distributed and protection keys, wherein the number of keys to be distributed is greater than a preset value;

[0008] Encrypting the key to be distributed according to the protection key to generate a ciphertext file of the key to be distributed;

[0009] Encrypting the protection key to generate a protection key ciphertext;

[0010] Writing the protection key ciphertext into a first storage device, and writing the to-be-distributed key ciphertext file into a second storage device; the storage capacity of the first storage device is smaller than the storage capacity of the second storage device;

[0011] The protection key ciphertext is distributed to the distributed device through the first storage device, and the key ciphertext file to be distributed is distributed to the distributed device through the second storage device.

[0012] Optionally, encrypting the key to be distributed according to the protection key to generate a ciphertext file of the key to be distributed includes:

[0013] Based on the protection key, each key to be distributed is encrypted using a preset symmetric algorithm to obtain ciphertext data of each key to be distributed;

[0014] Write all the ciphertext data of the key to be distributed into the preset file to generate the ciphertext file of the key to be distributed.

[0015] Optionally, based on the protection key, each key to be distributed is encrypted using a preset symmetric algorithm to obtain ciphertext data of each key to be distributed, including:

[0016] Splitting the key protection data and the key to be distributed data to obtain a plurality of first data blocks and a plurality of second data blocks respectively;

[0017] Perform bitwise XOR processing on each first data block and a preset fixed parameter to obtain a new protection key;

[0018] Performing an XOR process on the second data block and the new protection key to obtain a third data block;

[0019] Splitting the third data block to obtain a preset number of fourth data blocks;

[0020] performing nonlinear transformation processing on the fourth data block to obtain a fifth data block;

[0021] Based on a preset number of fourth data blocks, performing a ring left shift process on the fifth data block to obtain a sixth data block;

[0022] Performing XOR processing on the sixth data block to obtain a seventh data block;

[0023] Performing an XOR process on the sixth data block, the seventh data block, and the second data block to obtain a loop value;

[0024] Based on the round value and the second data block, ciphertext data of the key to be distributed is determined.

[0025] Optionally, encrypting the protection key to generate a protection key ciphertext includes:

[0026] Obtain the encryption public key certificate of the distributed device;

[0027] Parsing the encrypted public key certificate to obtain the public key of the encrypted public key certificate;

[0028] Based on the public key, the protection key is encrypted using a preset algorithm to generate a protection key ciphertext.

[0029] Optionally, encrypting the protection key using a preset algorithm based on the public key to generate a protection key ciphertext includes:

[0030] Get the length value of the protection key and a random number;

[0031] Determine a reference point on the preset elliptic curve using a preset elliptic curve and a random number;

[0032] Determining, based on a preset elliptic curve, public key point parameters of a point of the public key on the preset elliptic curve;

[0033] Determine the target point according to the public key point parameters and the preset elliptic curve;

[0034] Determine a derived key value by using a preset function, the target point, and the length value of the protection key;

[0035] XORing the derived key value with the protection key to obtain a first ciphertext;

[0036] The protection key and the target point are combined to obtain a second ciphertext;

[0037] The reference point, the first ciphertext, and the second ciphertext are combined to generate a protection key ciphertext.

[0038] An embodiment of the present invention further provides a key offline distribution method, which is applied to a distributed device, and the method includes:

[0039] Obtaining a protection key ciphertext from the first storage device; wherein the protection key ciphertext is obtained by encrypting the protection key by the key management system;

[0040] Obtaining the encrypted key file to be distributed from the second storage device;

[0041] Decrypting the protection key ciphertext to obtain the protection key;

[0042] The key to be distributed ciphertext in the key to be distributed ciphertext file is decrypted using the protection key to obtain the key to be distributed.

[0043] Optionally, decrypting the protection key ciphertext to obtain the distribution protection key includes:

[0044] Obtaining a private key corresponding to the encrypted public key certificate; wherein the private key corresponding to the encrypted public key certificate is stored in a storage device of the distributed device;

[0045] The protection key ciphertext is decrypted using a preset algorithm using the private key corresponding to the encrypted public key certificate to obtain the protection key.

[0046] An embodiment of the present invention further provides a key offline distribution system, comprising:

[0047] A key management system, used to receive a key distribution request sent by a key-using device; obtain a key to be distributed and a protection key according to the key distribution request, wherein the number of the key to be distributed is greater than a preset value; encrypt the key to be distributed according to the protection key to generate a ciphertext file of the key to be distributed; encrypt the protection key to generate a ciphertext of the protection key; write the ciphertext of the protection key into a first storage device, and write the ciphertext file of the key to be distributed into a second storage device; the storage capacity of the first storage device is smaller than the storage capacity of the second storage device; distribute the protection key ciphertext to the distributed device through the first storage device, and distribute the ciphertext file of the key to be distributed to the distributed device through the second storage device, so that the distributed device decrypts the protection key ciphertext to obtain a distribution protection key; decrypts the distribution key ciphertext file through the distribution protection key to obtain the key to be distributed.

[0048] An embodiment of the present invention further provides a computing device, comprising: a processor and a memory storing a computer program, wherein when the computer program is executed by the processor, the computer program executes the above-mentioned offline key distribution method.

[0049] An embodiment of the present invention further provides a computer-readable storage medium, comprising: storing instructions, which, when executed on a computer, enable the computer to execute the above-mentioned offline key distribution method.

[0050] The above solution of the present invention includes at least the following beneficial effects:

[0051] The offline key distribution method of the present invention receives a key distribution request from a key-using device; obtains a key to be distributed and a protection key based on the key distribution request, wherein the number of keys to be distributed is greater than a preset value; encrypts the key to be distributed based on the protection key to generate a ciphertext file of the key to be distributed; encrypts the protection key to generate a protection key ciphertext; writes the protection key ciphertext to a first storage device, and writes the ciphertext file of the key to be distributed to a second storage device; the storage capacity of the first storage device is smaller than that of the second storage device; distributes the protection key ciphertext to the distributed device via the first storage device, and distributes the ciphertext file of the key to be distributed to the distributed device via the second storage device. This method achieves simultaneous distribution of keys during offline key distribution when the number of keys exceeds the storage space of the smart password key, reduces the number and complexity of system interactions, and improves work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 Schematic diagram of the process of the offline key distribution method of the present invention;

[0053] Figure 2 It is a structural diagram of the key offline distribution system of the present invention. DETAILED DESCRIPTION

[0054] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0055] like Figure 1 As shown, an embodiment of the present invention provides a key offline distribution method, which is applied to a key management system. The method includes:

[0056] Step 11: receiving a key distribution request sent by a key-using device;

[0057] Step 12: Obtaining keys to be distributed and protection keys according to the key distribution request, where the number of keys to be distributed is greater than a preset value;

[0058] Step 13: encrypt the key to be distributed according to the protection key to generate a ciphertext file of the key to be distributed;

[0059] Step 14: encrypt the protection key to generate a protection key ciphertext;

[0060] Step 15: writing the protection key ciphertext into a first storage device, and writing the to-be-distributed key ciphertext file into a second storage device; the storage capacity of the first storage device is smaller than the storage capacity of the second storage device;

[0061] Step 16: distribute the protection key ciphertext to the distributed device through the first storage device, and distribute the to-be-distributed key ciphertext file to the distributed device through the second storage device.

[0062] In this embodiment, the first storage device is a smart password key; step 11 can specifically be, setting a key distribution request automatic trigger device in the key management system, and the trigger condition is that the first storage device is connected to the key management system, that is, when the first storage device is connected to the key management system, the key distribution request automatic trigger device automatically sends a key distribution request to the key management system; according to the key distribution request, obtaining the key to be distributed can specifically be, pre-storing the required key to be distributed in the storage device in the key management system in advance, when the system receives the key distribution request, obtaining the key to be distributed through the storage device; according to the key distribution request, obtaining the protection key can specifically be, generating a 16-byte random number as the protection key through the random number generator device of the key management system.

[0063] In this example, the number of keys to be distributed being greater than the preset value means that the number of keys to be distributed is greater than the normal storage number of the smart password key. For example, the normal storage number of the smart password key is 10 keys to be distributed, which means that a maximum of 10 keys can be distributed at a time. The solution of the present invention allows more than 10 keys to be distributed at a time, thereby solving the problem that the original smart password key is affected by the storage space and cannot distribute keys exceeding the preset value. The offline key distribution method of the present invention encrypts the keys to be distributed according to the protection key to generate a ciphertext file of the keys to be distributed; encrypts the protection key to generate a protection key ciphertext; writes the protection key ciphertext to a first storage device, and writes the ciphertext file of the keys to be distributed to a second storage device; the storage capacity of the first storage device is smaller than the storage capacity of the second storage device; the design of distributing the protection key ciphertext to the distributed device through the first storage device and distributing the ciphertext file of the keys to be distributed to the distributed device through the second storage device solves the problem that in the existing offline key distribution process, when the number of distributed keys exceeds the storage space of the smart password key, multiple batch distributions are required, and the keys cannot be distributed simultaneously. The system realizes the simultaneous distribution of keys during offline key distribution when the number of keys exceeds the storage space of the smart password key, which reduces the number and complexity of system interactions and improves work efficiency.

[0064] In an optional embodiment of the present invention, step 13 may include:

[0065] Step 131: encrypt each key to be distributed using a preset symmetric algorithm based on the protection key to obtain ciphertext data of each key to be distributed;

[0066] Step 132: Write all the ciphertext data of the key to be distributed into a preset file to generate a ciphertext file of the key to be distributed.

[0067] In this embodiment, during use, the preset symmetric algorithm encapsulated by the key management system can be called, and each key to be distributed can be encrypted in a cyclic manner to obtain ciphertext data, and recorded in the memory of the key management system. At the end of the cycle, all ciphertext data will be written to the preset file, and finally the ciphertext file of the key to be distributed will be obtained; if the amount of data is too large, the keys to be distributed can be calculated in batches according to the above to obtain different ciphertext files.

[0068] In an optional embodiment of the present invention, step 131 may include:

[0069] Step 131: split the key protection data and the key to be distributed data to obtain a plurality of first data blocks and a plurality of second data blocks respectively;

[0070] Step 132, performing bitwise XOR processing on each first data block and a preset fixed parameter to obtain a new protection key;

[0071] Step 133: XOR the second data block and the new protection key to obtain a third data block;

[0072] Step 134: split the third data block to obtain a preset number of fourth data blocks;

[0073] Step 135: performing nonlinear transformation processing on the fourth data block to obtain a fifth data block;

[0074] Step 136: Based on the preset number of fourth data blocks, perform a ring left shift on the fifth data block to obtain a sixth data block.

[0075] Step 137, performing XOR processing on the sixth data block to obtain a seventh data block;

[0076] Step 138, performing an XOR operation on the sixth data block, the seventh data block, and the second data block to obtain a loop value;

[0077] Step 139: Determine the ciphertext data of the key to be distributed based on the cycle value and the second data block.

[0078] In this embodiment, the key protection data p is split into data blocks of the same length (first data blocks), and then the first data blocks are bitwise XORed with a preset fixed parameter f to form a new key k (new protection key). The key distribution data d is then split into data blocks of the same length (second data blocks) d1, d2...dn. The second data blocks other than the first data block d1 in the second data blocks are XORed with the new key k to obtain data M (third data block), so that the length of M is consistent with the length of d. M is then split into data blocks Mi (fourth data blocks) of the same length, and the number N of the blocks is recorded. A nonlinear transformation is performed on each fourth data block. The nonlinear transformation base is 16 * 16, each row and column corresponds to a fixed value (i.e., a preset value). The new value M+ (fifth data block) is formed after the nonlinear transformation of each fourth data block. Then, the left shift operation is cyclically performed on M+ to obtain the new value Mbi (sixth data block). This is performed N times in total. Then, the new values ​​Mbi are XORed one by one to obtain the result Ly (seventh data block). M+ is XORed with Ly and the first block of data d1 split above to obtain a temporary value Ei (cyclic value), so that the length of Ei value is consistent with the length of d1;

[0079] The loop is repeated (i.e., steps 131 to 138 are repeated in sequence), with the Ei value placed after dn, and the new value Pi is formed from d2 to Ei. The above operation is repeated (i.e., steps 131 to 138 are repeated). After 64 rounds of calculation, the new value Ein is obtained. The reverse transformation operation is performed on Ein and the previous values ​​Ein-1, Ein-2, etc. with the same length as d to obtain the final value E, which is the ciphertext data of the key to be distributed.

[0080] In this embodiment, the preset symmetric algorithm may be a preset group algorithm, the group length of the preset symmetric algorithm is 128 bits, the key length is 128 bits, and the algorithm adopts a 64-round nonlinear iterative structure; wherein, the algorithm pattern example is: input hexadecimal plaintext "0123456789ABCDEFFEDCBA9876543210"; input hexadecimal key "0123456789ABCDEFFEDCBA9876543210"; after calculation, the hexadecimal ciphertext output is: "681EDF34D206965E86B3E94F536E4246".

[0081] In an optional embodiment of the present invention, step 14 may include:

[0082] Step 141, obtaining the encryption public key certificate of the distributed device;

[0083] Step 142: parsing the encrypted public key certificate to obtain the public key of the encrypted public key certificate;

[0084] Step 143: Based on the public key, the protection key is encrypted using a preset algorithm to generate a protection key ciphertext.

[0085] In an optional embodiment of the present invention, step 143 may include:

[0086] Step 1431, obtaining the length value of the protection key and a random number;

[0087] Step 1432: Determine a reference point on the preset elliptic curve using the preset elliptic curve and the random number.

[0088] Step 1433: Determine, based on a preset elliptic curve, the public key point parameters of the public key on the preset elliptic curve;

[0089] Step 1434: Determine the target point based on the public key point parameters and the preset elliptic curve;

[0090] Step 1435: Determine a derived key value by using a preset function, the target point, and the length of the protection key;

[0091] Step 1436: XOR the derived key value with the protection key to obtain a first ciphertext.

[0092] Step 1437: Combine the protection key and the target point to obtain a second ciphertext.

[0093] Step 1438: Combine the reference point, the first ciphertext, and the second ciphertext to generate a protection key ciphertext.

[0094] In this embodiment, a random number r is first generated, and the data for protecting the key is P1, then L is recorded as the length of P1; a point Z1=[r]O=(xa, ya) (reference point) on the preset elliptic curve is calculated, where O is the base point of the elliptic curve, [ r ] OIt means multiplying the base point O by the random number r to obtain a point Z1 on the elliptic curve, namely the reference point (xa, ya), and converting the calculated Z1 value into a data value; calculating the specific position of the public key value S=[h]Pb on the preset elliptic curve (public key point parameter), doubling the position of the point by [r]Pb, and calculating the specific value of the doubled data (xb, yb); where Pb is the elliptic curve point corresponding to the private key, and h is a preset integer; by calculating [r]Pb, the doubled point (xb, yb) is obtained, namely the target point; initializing a fixed-length counter, and calculating a new derived key value t by the preset function F1(xa || yb, L) function (F1 is a key derivation function); performing XOR processing on the original data protecting the key and the above-calculated t value, recorded as Z2 (first ciphertext); then calculating the data summary based on the above data by combining xb || P1 || yb, recorded as Z3 (second ciphertext); finally, using Z1 || Z3 The final ciphertext data obtained by the Z2 merging method is the protection key ciphertext.

[0095] In an optional embodiment of the present invention, the protection key ciphertext is written into the first storage device, specifically:

[0096] Read the encrypted public key certificate in the smart password key through the driver control of the smart password key or the corresponding management tool;

[0097] Parsing the encrypted public key certificate to obtain the public key of the encrypted public key certificate;

[0098] The protection key ciphertext is encrypted by using the public key of the encryption public key certificate and stored in the smart password key.

[0099] An embodiment of the present invention provides a method for offline key distribution, which is applied to a distributed device. The method includes:

[0100] Step 21: Obtain a protection key ciphertext from the first storage device; wherein the protection key ciphertext is obtained by encrypting the protection key by the key management system;

[0101] Step 22: Obtain the encrypted key file to be distributed from the second storage device;

[0102] Step 23: decrypt the protection key ciphertext to obtain the protection key;

[0103] Step 24: decrypt the ciphertext of the key to be distributed in the ciphertext file of the key to be distributed using the protection key to obtain the key to be distributed.

[0104] In this embodiment, step 21 may specifically include: invoking the private key corresponding to the smart key stored in the distributed device through an application; and decrypting the smart key using the private key corresponding to the smart key to obtain the protected key ciphertext. In this example, after obtaining the plaintext of the protected key, the distributed device decrypts each key ciphertext to be distributed using a pre-set symmetric algorithm decryption program in a cyclic manner based on the protected key to obtain the original text of the key to be distributed. During decryption, the round keys are used in the reverse order of the round keys used for encryption, and the same algorithm structure used for decryption is used.

[0105] In an optional embodiment of the present invention, step 23 may include:

[0106] Step 231: Obtain the private key corresponding to the encrypted public key certificate; wherein the private key corresponding to the encrypted public key certificate is stored in the storage device of the distributed device;

[0107] Step 232: Decrypt the protection key ciphertext using a preset algorithm using the private key corresponding to the encrypted public key certificate to obtain the protection key.

[0108] In an optional embodiment of the present invention, step 232 may include:

[0109] Step 2321: Obtain the reference point, the first ciphertext, and the second ciphertext in the protection key ciphertext;

[0110] Step 2322: Determine the target point using the private key and the reference point according to the preset elliptic curve.

[0111] Step 2323: Determine a derived key value based on the target point using a preset function;

[0112] Step 2324: XOR the derived key value with the first ciphertext to obtain comparison data;

[0113] Step 2325: merge the comparison data and the target point, and compare the merged data with the second ciphertext. When the comparison data is identical to the second ciphertext, the comparison data is output as the protection key.

[0114] In this embodiment, the distributed device obtains the private key Pr corresponding to its own device encryption public key certificate. Since the ciphertext is combined in the form of Z1 || Z3 || Z2, Z1 is first taken out, and Z1 is calculated according to the established preset elliptic curve to obtain a point on the elliptic curve. It is determined whether the value satisfies the elliptic curve equation. If not, the program is exited. If it does, the point on the elliptic curve is calculated according to the [h]Z1 function, and the private key Pr is used to calculate Z1 using [Pr]Z1 to obtain another coordinate (xb, yb), namely the target point. A new derived key value t is calculated using the preset function F1(xb || yb, L). If the t value is all 0, the program is exited. Otherwise, Z2 and t are XORed to obtain comparison data P'; the digest value of the comparison data is calculated in the form of xb || P' || yb, and it is determined whether it is consistent with Z3. If not, the program is exited. If they are consistent, P' is the decrypted data, that is, the comparison data is output as the plaintext of the protection key.

[0115] The offline key distribution method of the present invention encrypts the key to be distributed according to the protection key to generate a ciphertext file of the key to be distributed; encrypts the protection key to generate a protection key ciphertext; writes the protection key ciphertext to a first storage device, and writes the ciphertext file of the key to be distributed to a second storage device; the storage capacity of the first storage device is smaller than the storage capacity of the second storage device; the protection key ciphertext is distributed to the distributed device via the first storage device, and the ciphertext file of the key to be distributed is distributed to the distributed device via the second storage device. This design solves the problem in the existing offline key distribution process that when the number of keys to be distributed exceeds the storage space of the smart password key, multiple batch distributions are required, and the simultaneous distribution of keys is impossible. This method realizes the simultaneous distribution of keys when the number of keys exceeds the storage space of the smart password key during the offline key distribution process, reduces the number and complexity of system interactions, and improves work efficiency.

[0116] like Figure 2 As shown, an embodiment of the present invention provides a key offline distribution system 20, comprising:

[0117] A key management system 21 is used to receive a key distribution request sent by a key-using device; obtain a key to be distributed and a protection key according to the key distribution request, wherein the number of the key to be distributed is greater than a preset value; encrypt the key to be distributed according to the protection key to generate a ciphertext file of the key to be distributed; encrypt the protection key to generate a ciphertext of the protection key; write the ciphertext of the protection key into a first storage device, and write the ciphertext file of the key to be distributed into a second storage device; the storage capacity of the first storage device is smaller than the storage capacity of the second storage device; distribute the protection key ciphertext to the distributed device through the first storage device, and distribute the ciphertext file of the key to be distributed to the distributed device through the second storage device, so that the distributed device decrypts the protection key ciphertext to obtain a distribution protection key; decrypts the distribution key ciphertext file through the distribution protection key to obtain the key to be distributed.

[0118] It should be noted that the system is a device corresponding to the above method, and all implementation methods in the above method are applicable to the embodiments of the device and can achieve the same technical effects.

[0119] An embodiment of the present invention further provides a computing device comprising: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, executes the above method. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0120] The embodiment of the present invention further provides a computer-readable storage medium storing instructions, which, when executed on a computer, causes the computer to execute the above method. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0121] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0122] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0123] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0124] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0125] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0126] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard drive, ROM, RAM, a magnetic disk, or an optical disk.

[0127] In addition, it should be pointed out that in the apparatus and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent solutions of the present invention. Moreover, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but they do not necessarily need to be performed in chronological order, and some steps can be performed in parallel or independently of each other. For those of ordinary skill in the art, it can be understood that all or any steps or components of the method and apparatus of the present invention can be implemented in hardware, firmware, software or a combination thereof in any computing device (including a processor, storage medium, etc.) or a network of computing devices. This can be achieved by those of ordinary skill in the art using their basic programming skills after reading the description of the present invention.

[0128] Therefore, the purpose of the present invention can also be achieved by running a program or a group of programs on any computing device. The computing device can be a well-known general-purpose device. Therefore, the purpose of the present invention can also be achieved simply by providing a program product containing program code that implements the method or device. That is to say, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any well-known storage medium or any storage medium developed in the future. It should also be pointed out that in the device and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. In addition, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but do not necessarily need to be performed in chronological order. Certain steps can be performed in parallel or independently of each other.

[0129] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A key offline distribution method, characterized in that: Applied to a key management system, the method includes: receiving a key distribution request sent by a key-using device; specifically, providing a key distribution request automatic triggering device in the key management system, and automatically sending a key distribution request to the key management system when the first storage device is connected to the key management system; Obtaining, according to the key distribution request, a key to be distributed and a protection key, where the number of the keys to be distributed is greater than a preset value; specifically, pre-storing the required keys to be distributed in a storage device in the key management system; when the key management system receives the key distribution request, obtaining the keys to be distributed through the storage device, generating a 16-byte random number as a protection key through a random number generator of the key management system; encrypting the keys to be distributed according to the protection key to generate a ciphertext file of the keys to be distributed; Encrypting the protection key to generate a protection key ciphertext; Writing the protection key ciphertext into a first storage device, and writing the to-be-distributed key ciphertext file into a second storage device; the storage capacity of the first storage device is smaller than the storage capacity of the second storage device; Distributing the protection key ciphertext to the distributed device through the first storage device, and distributing the to-be-distributed key ciphertext file to the distributed device through the second storage device; Wherein, the first storage device is a smart password key, and the preset value is equal to the normal storage number of the smart password key; The process of encrypting the key to be distributed according to the protection key to generate a ciphertext file of the key to be distributed includes: Based on the protection key, each key to be distributed is encrypted by a preset symmetric algorithm to obtain ciphertext data of each key to be distributed; Write all the ciphertext data of the key to be distributed into the preset file to generate the ciphertext file of the key to be distributed; Wherein, based on the protection key, each key to be distributed is encrypted by a preset symmetric algorithm to obtain ciphertext data of each key to be distributed, including: The data for protecting the key and the data for the key to be distributed are split respectively to obtain a plurality of first data blocks and a plurality of second data blocks; specifically, the data for protecting the key is split into first data blocks of the same length, and the data d for the key to be distributed is split into second data blocks of the same length; Perform bitwise XOR processing on each first data block and a preset fixed parameter to obtain a new protection key; specifically, perform bitwise XOR processing on the first data block and the preset fixed parameter f to form a new protection key k; Performing an XOR operation on the second data block and the new protection key to obtain a third data block; specifically, performing an XOR operation on the second data blocks other than the first data block d1 and the new protection key k to obtain a third data block M; performing splitting processing on the third data block to obtain a preset number of fourth data blocks; specifically, ensuring that the length of the third data block M is consistent with the length of the data d to be distributed as the key, splitting the third data block M into fourth data blocks Mi of the same length, and recording the number N of blocks of the fourth data block Mi; Performing a nonlinear transformation on the fourth data block to obtain a fifth data block; specifically, performing a nonlinear transformation on each fourth data block, and each fourth data block after the nonlinear transformation forms a fifth data block M+; Based on the preset number of the fourth data blocks, the fifth data block is subjected to a left shift operation to obtain a sixth data block; specifically, based on the number N of blocks of the fourth data block Mi, the fifth data block M+ is subjected to a cyclic left shift operation to obtain a sixth data block Mbi; Performing an XOR operation on the sixth data block to obtain a seventh data block; specifically, performing an XOR operation on the sixth data blocks Mbi one by one in sequence to obtain the seventh data block Ly; Performing an XOR operation on the sixth data block, the seventh data block, and the second data block to obtain a cycle value. Specifically, performing an XOR operation on the fifth data block M+, the seventh data block Ly, and the first data block d1 in the second data block to obtain a cycle value Ei. The length of the cycle value Ei is the same as the length of the second data block d1. Determining ciphertext data of a key to be distributed based on the cycle value and the second data block; The step of encrypting the protection key to generate a ciphertext of the protection key includes: Obtain the encryption public key certificate of the distributed device; Parsing the encrypted public key certificate to obtain the public key of the encrypted public key certificate; Based on the public key, the protection key is encrypted using a preset algorithm to generate a protection key ciphertext.

2. The offline key distribution method according to claim 1, characterized in that: Based on the public key, the protection key is encrypted using a preset algorithm to generate a protection key ciphertext, including: Get the length value of the protection key and a random number; Determine a reference point on the preset elliptic curve using a preset elliptic curve and a random number; Determining, based on a preset elliptic curve, public key point parameters of a point of the public key on the preset elliptic curve; Determine the target point according to the public key point parameters and the preset elliptic curve; Determine a derived key value by using a preset function, the target point, and the length value of the protection key; XORing the derived key value with the protection key to obtain a first ciphertext; The protection key and the target point are combined to obtain a second ciphertext; The reference point, the first ciphertext, and the second ciphertext are combined to generate a protection key ciphertext.

3. A key offline distribution method, characterized in that: Applied to a distributed device, the method includes: Obtaining a protection key ciphertext from the first storage device; wherein the protection key ciphertext is obtained by encrypting the protection key through a key management system, wherein the key management system distributes the key by executing the offline key distribution method according to claim 1; Obtaining the encrypted key file to be distributed from the second storage device; Decrypting the protection key ciphertext to obtain the protection key; The key to be distributed ciphertext in the key to be distributed ciphertext file is decrypted using the protection key to obtain the key to be distributed.

4. The offline key distribution method according to claim 3, characterized in that: Decrypting the protection key ciphertext to obtain the distribution protection key includes: Obtaining a private key corresponding to the encrypted public key certificate; wherein the private key corresponding to the encrypted public key certificate is stored in a storage device of the distributed device; The protection key ciphertext is decrypted using a preset algorithm using the private key corresponding to the encrypted public key certificate to obtain the protection key.

5. A key offline distribution system, characterized in that: include: A key management system, configured to receive key distribution requests sent by key-using devices; Specifically, a key distribution request automatic triggering device is provided in the key management system. When the first storage device is connected to the key management system, the key distribution request automatic triggering device automatically sends a key distribution request to the key management system. According to the key distribution request, a key to be distributed and a protection key are obtained, and the number of the keys to be distributed is greater than a preset value. Specifically, the required keys to be distributed are pre-stored in a storage device in the key management system. When the key management system receives the key distribution request, the key to be distributed is obtained through the storage device, and a 16-byte random number is generated as the protection key by a random number generator device of the key management system. Encrypting the key to be distributed according to the protection key to generate a ciphertext file of the key to be distributed; Encrypting the protection key to generate a protection key ciphertext; Writing the protection key ciphertext into the first storage device, and writing the to-be-distributed key ciphertext file into the second storage device; The storage capacity of the first storage device is smaller than the storage capacity of the second storage device; Distributing the protection key ciphertext to the distributed device via the first storage device, and distributing the to-be-distributed key ciphertext file to the distributed device via the second storage device, so that the distributed device decrypts the protection key ciphertext to obtain the distribution protection key; decrypting the distribution key ciphertext file using the distribution protection key to obtain the to-be-distributed key; Wherein, the first storage device is a smart password key, and the preset value is equal to the normal storage number of the smart password key; The process of encrypting the key to be distributed according to the protection key to generate a ciphertext file of the key to be distributed includes: Based on the protection key, each key to be distributed is encrypted by a preset symmetric algorithm to obtain ciphertext data of each key to be distributed; Write all the ciphertext data of the key to be distributed into the preset file to generate the ciphertext file of the key to be distributed; Wherein, based on the protection key, each key to be distributed is encrypted by a preset symmetric algorithm to obtain ciphertext data of each key to be distributed, including: The data for protecting the key and the data for the key to be distributed are split respectively to obtain a plurality of first data blocks and a plurality of second data blocks; specifically, the data for protecting the key is split into first data blocks of the same length, and the data d for the key to be distributed is split into second data blocks of the same length; Perform bitwise XOR processing on each first data block and a preset fixed parameter to obtain a new protection key; specifically, perform bitwise XOR processing on the first data block and the preset fixed parameter f to form a new protection key k; Performing an XOR operation on the second data block and the new protection key to obtain a third data block; specifically, performing an XOR operation on the second data blocks other than the first data block d1 and the new protection key k to obtain a third data block M; performing splitting processing on the third data block to obtain a preset number of fourth data blocks; specifically, ensuring that the length of the third data block M is consistent with the length of the data d to be distributed as the key, splitting the third data block M into fourth data blocks Mi of the same length, and recording the number N of blocks of the fourth data block Mi; Performing a nonlinear transformation on the fourth data block to obtain a fifth data block; specifically, performing a nonlinear transformation on each fourth data block, and each fourth data block after the nonlinear transformation forms a fifth data block M+; Based on the preset number of the fourth data blocks, the fifth data block is subjected to a left shift operation to obtain a sixth data block; specifically, based on the number N of blocks of the fourth data block Mi, the fifth data block M+ is subjected to a cyclic left shift operation to obtain a sixth data block Mbi; Performing an XOR operation on the sixth data block to obtain a seventh data block; specifically, performing an XOR operation on the sixth data blocks Mbi one by one in sequence to obtain the seventh data block Ly; Performing an XOR operation on the sixth data block, the seventh data block, and the second data block to obtain a cycle value. Specifically, performing an XOR operation on the fifth data block M+, the seventh data block Ly, and the first data block d1 in the second data block to obtain a cycle value Ei. The length of the cycle value Ei is the same as the length of the second data block d1. Determining ciphertext data of a key to be distributed based on the cycle value and the second data block; The step of encrypting the protection key to generate a ciphertext of the protection key includes: Obtain the encryption public key certificate of the distributed device; Parsing the encrypted public key certificate to obtain the public key of the encrypted public key certificate; Based on the public key, the protection key is encrypted using a preset algorithm to generate a protection key ciphertext.

6. A computing device, characterized in that include: A processor and a memory storing a computer program, wherein when the computer program is executed by the processor, the method according to any one of claims 1 to 4 is performed.

7. A computer-readable storage medium, characterized in that The device stores instructions, which, when executed on a computer, cause the computer to perform the method according to any one of claims 1 to 4.

Images