A key processing method, system and device

Abstract

The present invention provides a key processing method, system and device, which relate to the field of key security technology. The key processing method includes: obtaining a first key and storing the attribute information of the first key; obtaining security device registration information; establishing a topological structure of the security device according to the security device registration information, and setting an identifier for each link of the topological structure; allocating the first key according to the link; generating binding data according to the attribute information of the first key and the identifier; binding the link with the first key according to the binding data; distributing the first key of the bound link to the security device according to the management type of the security device. The solution of the present invention is implemented in a complex topological structure, configuring corresponding keys for different types of security devices, and centrally configuring and managing keys, so as to improve the coordination of the key management system and improve the security strength of the key management system.

Description

Technical Field

[0001] The present invention relates to the field of key security technology, and in particular to a key processing method, system and device. Background Art

[0002] With the continuous advancement of digital construction, the degree of informatization and networking is getting higher and higher, followed by various network attacks and information theft becoming more and more rampant. Network security is increasingly receiving attention from security management departments and network operation and maintenance personnel.

[0003] In traditional network security implementation scenarios, it is generally necessary to deploy a variety of different types of network security equipment to establish a complete information security system. Different types of network security equipment usually conduct security analysis and design planning independently, and the collaboration of various types of equipment and protocols is extremely complex. This traditional method is barely feasible for networks with a small number of nodes. Once the network topology is complex, the traditional network security management method is obviously incapable of coping, and it cannot guarantee the real-time linkage of security policies. Summary of the invention

[0004] The present invention provides a key processing method, system and device, which solves the technical problem that the traditional network security management method cannot uniformly plan, configure and manage the security of the entire network when security devices of different manufacturers and types are deployed and configured at each node in a complex network topology environment.

[0005] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0006] A key processing method, comprising:

[0007] Obtaining a first key and storing attribute information of the first key;

[0008] Get security device registration information;

[0009] Establishing a topology structure of the security device according to the security device registration information, and setting an identifier for each link of the topology structure;

[0010] allocating the first key according to the link;

[0011] Generate binding data according to the attribute information of the first key and the identifier;

[0012] Binding the link to the first key according to the binding data;

[0013] Distribute a first key of a binding link to the security device according to a management type of the security device.

[0014] Optionally, obtaining a first key and storing attribute information of the first key includes:

[0015] Obtaining a first key generated by a key generation device;

[0016] The first key is encrypted and protected, and the attribute information of the first key is stored in a database; the key generation device is a true random number generator; the attribute information of the first key includes: first key generation time, first key validity period, first key length, first key serial number and first key integrity identifier.

[0017] Optionally, establishing a topology structure of the security device according to the security device registration information, and setting an identifier for each link of the topology structure includes:

[0018] The security device registration information includes: type information and physical location information of the security device;

[0019] A full mesh topology of the security device is constructed.

[0020] Optionally, allocating the first key according to the link includes:

[0021] Obtaining the first key generation time and the first key length;

[0022] Obtaining a key length matching the link;

[0023] Selecting a first key having the same length as the key matching the link;

[0024] According to the generation time of the first key, a first key with the same key length is matched for the link.

[0025] Optionally, generating binding data according to the attribute information of the first key and the identifier includes:

[0026] Concatenate the attribute information of the first key and the identifier to generate binding data of the link;

[0027] The binding data includes: one or more of the first key generation time, the first key validity period, the first key length, the first key serial number and the first key integrity identifier, and an identifier.

[0028] Optionally, distributing the first key of the binding link to the security device according to the management type of the security device includes:

[0029] Get the pre-set security device management type;

[0030] When the management type of the security device is a directly managed security device, encapsulating the binding data through a preset format key distribution protocol, and then distributing the encapsulated first key of the binding link to the directly managed security device in an online manner;

[0031] When the management type of the security device is a security device with full cryptographic computing capabilities, the binding data is encapsulated by using the public key of the security device certificate generated when the security device is registered, and password protection is set, and then the first key of the encapsulated binding link is stored in the first distribution security device, and the first distribution security device and the password are distributed to the security device with full cryptographic computing capabilities through different channels;

[0032] When the management type of the security device is other types of security devices, the first key of the binding link is encrypted by a second distribution security device to generate a ciphertext and a password, and the ciphertext is stored in the second distribution security device. The second distribution security device and the ciphertext are then delivered offline to the other types of security devices through different channels. After confirming the secure delivery, the password is delivered offline to the other types of security devices.

[0033] Optionally, the key processing method further includes: managing the security device online through a key management system;

[0034] The online management includes:

[0035] Distributing a first key of a binding link to the security device;

[0036] Updating a first key of the binding link;

[0037] Stop using the original first key of the binding link;

[0038] The updated first key of the binding link is enabled.

[0039] An embodiment of the present invention further provides a key processing system, comprising:

[0040] An acquisition module, used to acquire a first key and store attribute information of the first key; acquire security device registration information;

[0041] A processing module is provided to establish a topological structure of the security device and set an identifier for each link of the topological structure; allocate the first key according to the link; generate binding data according to the attribute information of the first key and the identifier, and bind the link to the first key according to the binding data; and distribute the first key of the binding link to the security device according to the management type of the security device.

[0042] The present invention also provides a computing device, comprising: a processor and a memory storing a computer program, wherein when the computer program is executed by the processor, the method described above is executed.

[0043] The present invention also provides a computer-readable storage medium storing instructions, which, when executed on a computer, enable the computer to execute the method described above.

[0044] The above solution of the present invention includes at least the following beneficial effects:

[0045] The above solution of the present invention includes: the embodiment of the present invention obtains the registration information of the security device, establishes the topology structure of the security device, and then sets an identifier for each link in the topology structure, so as to realize

[0046] Now, a unique identifier is set for the link between all security devices. By obtaining the first key and the attribute information of the first key, and matching the corresponding first key according to the application requirements of the link, and then generating binding data by combining the attribute information of each first key with the identifier on the corresponding link, and binding the link with the first key according to the binding data, a first key of the bound link is generated, which plays a role in allocating a unique first key to the link. Finally, according to the management type of the security device, the first key of the bound link is distributed to the security device. In a complex topology, corresponding keys are configured for different types of security devices, and centralized configuration management of keys is implemented, which plays a role in improving the coordination of the key management system and improving the security strength of the key management system. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 is a schematic diagram of a key processing method according to an embodiment of the present invention;

[0048] Figure 2 It is a structural diagram of a key processing system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0050] like Figure 1 As shown, an embodiment of the present invention provides a key processing method, comprising:

[0051] Step 11, obtaining a first key and storing attribute information of the first key;

[0052] Step 12, obtaining security device registration information;

[0053] Step 13, establishing a topology structure of the security device according to the security device registration information, and setting an identifier for each link of the topology structure;

[0054] Step 14, allocating the first key according to the link;

[0055] Step 15, generating binding data according to the attribute information of the first key and the identifier;

[0056] Step 16, binding the link to the first key according to the binding data;

[0057] Step 17: Distribute the first key of the binding link to the security device according to the management type of the security device.

[0058] The embodiment of the present invention obtains the registration information of the security device, establishes the topology structure of the security device, and then sets an identifier for each link in the topology structure, so as to set a unique identifier for the links between all security devices. By obtaining the first key and the attribute information of the first key, and matching the corresponding first key according to the application requirements of the link, and then generating binding data by combining the attribute information of each first key with the identifier on the corresponding link, and binding the link with the first key according to the binding data, the first key of the bound link is generated, which plays the role of allocating a unique first key to the link. Finally, according to the management type of the security device, the first key of the bound link is distributed to the security device. In a complex topology structure, corresponding keys are configured for different types of security devices, and centralized configuration management of keys is implemented, which plays the role of improving the coordination of the key management system and improving the security strength of the key management system.

[0059] In an optional embodiment of the present invention, the step 11 comprises:

[0060] Step 111, obtaining a first key generated by a key generation device;

[0061] Step 112, encrypt and protect the first key, and store the attribute information of the first key in a database; the key generation device is a true random number generator; the attribute information of the first key includes: first key generation time, first key validity period, first key length, first key serial number and first key integrity identifier.

[0062] In the above embodiment, the key generation device is a true random number generator, and further, the true random number generator can be a cryptographic machine, a cryptographic card, an encryption chip, etc. The attribute information of the first key includes: first key serial number, first key generation time, first key validity period, first key length, first key integrity identifier and other information.

[0063] The first key serial number is a 32-bit integer that uniquely represents the first key in the key management system.

[0064] The key management system includes a main server, a key generation device, a database and a cryptographic key. The main server plays the role of operating the management system, the key generation device plays the role of providing cryptographic capability support, the database plays the role of providing data storage support, and the cryptographic key plays the role of providing management personnel identity authentication.

[0065] The attribute information of the first key needs to pass through the cryptographic card or server cryptographic machine that provides cryptographic capability support in the key management system, and be stored in the database after encryption protection. Specifically, the confidentiality protection can use the SM4-ECB encryption algorithm to protect the confidentiality and integrity of the attribute information of the first key. Among them, SM4 is a block cipher algorithm, and ECB is the working mode of the SM4 block cipher algorithm, which can divide the attribute information of the first key into blocks of fixed size and encrypt each block independently. In this application, the attribute information of the first key is divided into two parts, and independent confidentiality protection keys and integrity protection keys are generated respectively, and stored in the database.

[0066] The key generation device stores the generated first key in a spare key data table in a database.

[0067] In an optional embodiment of the present invention, the step 13 comprises:

[0068] Step 131, the security device registration information includes: type information and physical location information of the security device;

[0069] Step 132: construct a full mesh topology of the security device.

[0070] In the above embodiment, the security device registration information includes type information and physical location information. The type information of the security device includes: device type information, organizational unit information and registered security device information.

[0071] The device type information includes: the manufacturer of the device, the model of the device, the type of the device, the unique identifier of the device, the manufacturer of the device, the version of the device, the organization to which the device belongs, the physical location of the device and the cryptographic computing capability information of the device.

[0072] The organizational unit information includes: organizational unit name, organizational unit unique identifier, organizational unit management information, etc.

[0073] The registered security device information includes the unique serial number of the security device, the organizational unit information of the security device, the topological node information of the security device, etc.

[0074] The security device can adopt a star topology, a ring topology, a bus topology, a tree topology, a full mesh topology and a hybrid topology. Preferably, the construction steps of the topology structure in the present application when the full mesh topology structure is adopted are as follows:

[0075] First, obtain the number of security devices in the full mesh topology and the connection relationship between security devices, and then assign an IP address to each security device to ensure the uniqueness and rationality of the address. According to the network scale and requirements, select the appropriate routing protocol for the link between nodes to ensure the effective transmission of data in the network. Use the transmission medium to connect the nodes, and establish the identification on the link between the new node and the existing node in turn to form a full mesh topology. The full mesh topology is monitored in real time by the main server in the key management system.

[0076] Specifically, the nodes are provided with security devices, and the security devices located on any node in the topology can establish links with the security devices located on other nodes.

[0077] Preferably, the identifier set on each link of the topological structure adopts a randomly generated universally unique identifier (random UUID). The randomly generated universally unique identifier can be generated based on a random number or a pseudo-random number. The universally unique identifier can enable all nodes in the topological structure to have unique identification information without the need to specify the identification information through a central control endpoint, thereby avoiding duplication between the identifiers.

[0078] The identifier described in this application includes: the organizational unit information of the security device, the model of the security device and the unique serial number of the security device. The key management system can retrieve the ID information of the security device bidirectionally connected to the link through the identifier, and store all link and identifier information in the database. In a specific embodiment of the identifier, the identifier adopts a random universal unique identifier (random UUID), that is, a version 4 universal unique identifier, where the identifier = {972241b5-26a0-4573-992d-a76d9922db8f}.

[0079] In an optional embodiment of the present invention, the step 14 comprises:

[0080] Step 141, obtaining the first key generation time and the first key length;

[0081] Step 142, obtaining a key length matching the link;

[0082] Step 143, selecting a first key having the same length as the key matching the link;

[0083] Step 144: Match a first key with the same key length for the link according to the generation time of the first key.

[0084] In the above embodiment, since the lengths of the communication paths between different security devices are different, the lengths of the links connecting the security devices are also different. When the first key matches the link, the length of the first key is the same as the length of the link. The key generation device randomly generates a plurality of first keys of different lengths according to the communication path of the security device, and then stores the first keys of the same length in the standby key data table in the order of generation time from first to last. When matching the first key for the link, the main server first retrieves the first key in the standby key data table in the database, selects the first key that is the same as the length of the corresponding link and is generated first, transfers the selected first key from the standby key data table to the key data table, marks the link corresponding to the first key, and completes the matching of the link with the first key.

[0085] In an optional embodiment of the present invention, the step 15 comprises:

[0086] Step 151, concatenating the attribute information of the first key and the identifier to generate binding data of the link;

[0087] Step 152: The binding data includes: one or more of the first key generation time, the first key validity period, the first key length, the first key serial number, and the first key integrity identifier, and an identifier.

[0088] In the above embodiment, the attribute information of the selected first key and the link are spliced ​​in the key data table in a manner that the link identifier is in front and the first key attribute information is in the back to generate the binding data of the link. In a specific embodiment of the binding data, the binding data = {identifier + first key serial number}, that is, the binding data = {972241b5-26a0-4573-992d-a76d9922db8f|0247d9ac}.

[0089] In an optional embodiment of the present invention, the step 16 includes:

[0090] Binding the link to the first key according to the binding data

[0091] In the above embodiment, since the identifier of each link and the first key matching each link and its attribute information are different, the binding data of each link is also different, and each binding data corresponds to a unique set of links and first key, so the link can be bound to the first key according to the binding data.

[0092] In an optional embodiment of the present invention, the step 17 comprises:

[0093] Step 171, obtaining a preset security device management type;

[0094] Step 172, when the management type of the security device is a directly managed security device, encapsulate the binding data through a preset format key distribution protocol, and then distribute the encapsulated first key of the binding link to the directly managed security device in an online manner;

[0095] Step 173, when the management type of the security device is a security device with full cryptographic computing capabilities, the binding data is encapsulated by using the public key of the security device certificate generated when the security device is registered, and password protection is set, and then the first key of the encapsulated binding link is stored in the first distribution security device, and the first distribution security device and the password are distributed to the security device with full cryptographic computing capabilities through different channels;

[0096] Step 174, when the management type of the security device is other types of security devices, the first key of the binding link is encrypted by the second distribution security device to generate a ciphertext and a password, and the ciphertext is stored in the second distribution security device, and then the second distribution security device and the ciphertext are delivered to the other types of security devices offline through different channels. After confirming the secure delivery, the password is delivered to the other types of security devices offline.

[0097] In the above embodiment, the first key of the binding link is the first key bound to the binding data. In step 172, the directly managed security device is a security device that can be directly managed by the main server in the key management system. If the security device can actively initiate a connection to the key management system, the management type of the security device is a directly managed security device. The preset format distribution protocol is a key distribution protocol specified in the GM / T0050 standard. The binding data is encapsulated in accordance with the provisions of the GM / T0050 standard, and then the encapsulated first key of the binding link is distributed to the directly managed security device through the key management system.

[0098] Preferably, the directly managed security device has complete cryptographic computing capabilities, and the directly managed security device has been configured with an asymmetric public key of the security device during registration, and a secure channel is established between the key management system and the security device. The first key of the binding link is issued online in real time through a cryptographic key in the secure channel using the GM / T0050 standard key management protocol, and the confidentiality and integrity of the key are guaranteed by the secure channel during the issuance process.

[0099] In step 173, the complete cryptographic operation capability includes: security equipment with functions such as random number generation, asymmetric cryptographic operation, symmetric cryptographic operation, hash cryptographic operation, asymmetric key management, symmetric key management, and certificate management.

[0100] The first key of the binding link is encapsulated by using the public key of the security device certificate generated when the security device is registered, and the steps include: step 1, randomly generating a temporary key, using the temporary key to symmetric encrypt and protect the data to be distributed, and generating a temporary key ciphertext;

[0101] Step 2: Use the device certificate stored in the database of the key management system to verify the validity of the certificate and extract the public key in the certificate;

[0102] Step 3: Use the public key in the device certificate to asymmetrically encrypt the temporary key to generate the distribution key ciphertext, and then destroy the random temporary key;

[0103] Step 4, after concatenating the temporary key ciphertext with the distribution key ciphertext, use the key management system to sign the private key, that is, complete the encapsulation of the binding data through the public key of the security device certificate generated when the security device is registered.

[0104] The first key of the binding link is stored in the first distribution security device in the form of a file, and a password is set for protection. The first distribution security device is a security device such as a password key in the key management system. The first distribution security device and the password are distributed to the security device with complete cryptographic computing capabilities through different channels, which prevents the first key of the binding link from being stolen during the transmission process.

[0105] Preferably, the security device with complete cryptographic computing capabilities refers to a security device with complete cryptographic computing capabilities, but cannot be directly managed by the main server in the key management system. The key management system uses a temporary key to encrypt and protect the data to be distributed to generate a temporary key ciphertext, and then uses the public key in the device certificate to encrypt and protect the temporary key to generate a distribution key ciphertext. After splicing the temporary key ciphertext with the distribution key ciphertext, the key management system is used to sign the private key. The entire process is protected by an asymmetric cryptographic algorithm to ensure the confidentiality and integrity of the key.

[0106] In step 174, the other types of security devices include: security devices with limited physical size and strict power consumption requirements. For example, remote industrial control instruments, satellite-borne components and other devices. The other types of security devices have limited cryptographic computing capabilities. The second distribution security device is a security device such as a cryptographic key in the key management system.

[0107] Preferably, the first key of the binding link is encrypted by the cryptographic key using the elliptic curve public key cryptographic algorithm (SM2) to generate a ciphertext and create a password, and then the ciphertext is stored in the cryptographic key. When distributed to other types of security devices, the ciphertext and the cryptographic key are first transmitted to other types of security devices offline through different channels, and then after the other types of security devices confirm the secure transmission, the password is directly input into the other types of security devices offline, and the other types of security devices use the password to receive the ciphertext.

[0108] Preferably, the other types of security devices have limited cryptographic computing capabilities. The key management system uses the second distribution security device to encrypt and protect the first key of the binding link to be distributed to generate ciphertext and password, and sends the protected ciphertext and the second distribution security device to the other types of security devices to complete key distribution. After the other types of security devices confirm the secure transmission, the password is notified to the other types of security devices offline. The second distribution security device ensures the confidentiality and integrity of the first key of the binding link throughout the process.

[0109] In an optional embodiment of the present invention, it also includes:

[0110] The online management includes:

[0111] Distributing a first key of a binding link to the security device;

[0112] Updating a first key of the binding link;

[0113] Stop using the original first key of the binding link;

[0114] The updated first key of the binding link is enabled.

[0115] In the above embodiment, the key management system distributes the first key of the binding link to the security device in an online or offline manner according to the management type, working status and network operation and maintenance management of the security device. A new first key is generated by the key generation device in the key management system and stored in the database, and then a new first key of the binding link is generated by the main server to update the first key of the binding link. According to the working status and network operation and maintenance management of the security device, the key management system sends instructions to the security device through the main server to stop using the original first key of the binding link, and finally activates the updated first key of the binding link through the main server.

[0116] A specific embodiment of the key processing method of the present invention includes:

[0117] The key management system uses a key generation device to generate a first key and stores it securely in a database; the key management system registers security devices and establishes a topological structure of the security devices; the key management system allocates the first key according to the topological structure of the security devices, binds the link between the first key and the security device, and generates a first key for the bound link; the key management system distributes the first key of the bound link offline or online according to the management type of the security device; the key management system manages the security devices and the first keys of the bound links according to the security policy.

[0118] Specifically, the key management system uses a key generation device to generate a first key and stores it in a database, including: using a key generation device to generate a first key, the device for generating the first key is a true random number generator, such as a cipher machine, a cipher card, an encryption chip, etc., which is not specifically limited in this application.

[0119] The key management system encrypts and protects the generated first key, obtains attribute information of the first key, including the first key generation time, the first key validity period, the first key length, and the first key integrity identifier, and then stores the attribute information of the first key. When storing, the first key and the attribute information of the first key should be encrypted and protected by the key management system and stored using technology that can persist data.

[0120] Specifically, the key management system registers security devices and establishes a topological structure of security devices, including: the key management system obtains device type information, including device type, device model unique identifier, device manufacturer, device version, etc.; the key management system obtains organizational unit information, including organizational unit name, organizational unit unique identifier, organizational unit management information, etc.; the key management system obtains registered security device information, including device unique serial number, device type information, device organizational unit information, device topological node information, etc.; the key management system builds a topological structure of the security device network based on the device type information, organizational unit information and registered security device information; and generates identifiers for links between security devices in the topological structure.

[0121] Specifically, the key management system allocates the first key according to the topological structure of the security device and binds the first key to the security device, including: the key management system selects the first key that matches the link according to the application requirements of the link; wherein the binding data is the application information of the first key, and the key application information includes the first key binding time, the first key expiration time, the first key application algorithm, the identifier matched by the first key, the first key issuance identifier, etc.

[0122] Configure binding data between the attribute information of the first key and the identifier; the binding data is generated by combining and splicing the attribute information of the first key and the identifier according to a specific data structure, and the binding configuration between the first key and the link can be obtained through the binding data.

[0123] Specifically, the key management system uses offline or online methods to securely distribute keys according to the management type of the security device, including: obtaining the management type of the security device, where the management type of the security device includes directly managed security devices, security devices with complete cryptographic computing capabilities, and other types of security devices.

[0124] Furthermore, the directly managed security device has complete cryptographic computing capabilities, and the directly managed security device has been configured with an asymmetric public key of the security device during registration, and a secure channel is established between the key management system and the security device. The first key of the binding link is issued online in real time through a cryptographic key in the secure channel using the GM / T0050 standard key management protocol, and the confidentiality and integrity of the key are guaranteed by the secure channel during the issuance process.

[0125] Furthermore, the security device with complete cryptographic operation capabilities has complete cryptographic operation capabilities. The key management system uses a temporary key to encrypt and protect the data to be distributed to generate a temporary key ciphertext, and then uses the public key in the device certificate to encrypt and protect the temporary key to generate a distribution key ciphertext. After the temporary key ciphertext is concatenated with the distribution key ciphertext, the key management system is used to sign the private key. The entire process is protected by an asymmetric cryptographic algorithm to ensure the confidentiality and integrity of the key.

[0126] Furthermore, the other types of security devices have limited cryptographic computing capabilities. The key management system uses the second distribution security device to encrypt and protect the first key of the binding link to be distributed to generate ciphertext and password, and sends the protected ciphertext and security medium to the security device to complete key distribution. After the other types of security devices confirm the secure transmission, the password is notified to the other types of security devices offline. The second distribution security device ensures the confidentiality and integrity of the first key of the binding link throughout the process.

[0127] Specifically, the key management system manages the first key of the security device and the binding link according to the security policy, including: the key management system initiates online management instructions such as key issuance, key update, key deactivation, and key activation to the security device according to the working status of the security device, network operation and maintenance management status and management type.

[0128] like Figure 2 As shown, an embodiment of the present invention further provides a key processing system 20, comprising:

[0129] The acquisition module 21 is used to acquire the first key and store the attribute information of the first key; acquire the security device registration information;

[0130] Processing module 22 establishes the topological structure of the security device and sets an identifier for each link of the topological structure; allocates the first key according to the link; generates binding data according to the attribute information of the first key and the identifier, and binds the link to the first key according to the binding data; and distributes the first key of the binding link to the security device according to the management type of the security device.

[0131] Optionally, obtaining a first key and storing attribute information of the first key includes:

[0132] Obtaining a first key generated by a key generation device;

[0133] The first key is encrypted and protected, and the attribute information of the first key is stored in a database; the key generation device is a true random number generator; the attribute information of the first key includes: first key generation time, first key validity period, first key length, first key serial number and first key integrity identifier.

[0134] Optionally, establishing a topology structure of the security device according to the security device registration information, and setting an identifier for each link of the topology structure includes:

[0135] The security device registration information includes: type information and physical location information of the security device;

[0136] A full mesh topology of the security device is constructed.

[0137] Optionally, allocating the first key according to the link includes:

[0138] Obtaining the first key generation time and the first key length;

[0139] Obtaining a key length matching the link;

[0140] Selecting a first key having the same length as the key matching the link;

[0141] According to the generation time of the first key, a first key with the same key length is matched for the link.

[0142] Optionally, generating binding data according to the attribute information of the first key and the identifier includes:

[0143] Concatenate the attribute information of the first key and the identifier to generate binding data of the link;

[0144] The binding data includes: one or more of the first key generation time, the first key validity period, the first key length, the first key serial number and the first key integrity identifier, and an identifier.

[0145] Optionally, distributing the first key of the binding link to the security device according to the management type of the security device includes:

[0146] Get the pre-set security device management type;

[0147] When the management type of the security device is a directly managed security device, encapsulating the binding data through a preset format key distribution protocol, and then distributing the encapsulated first key of the binding link to the directly managed security device in an online manner;

[0148] When the management type of the security device is a security device with full cryptographic computing capabilities, the binding data is encapsulated by using the public key of the security device certificate generated when the security device is registered, and password protection is set, and then the first key of the encapsulated binding link is stored in the first distribution security device, and the first distribution security device and the password are distributed to the security device with full cryptographic computing capabilities through different channels;

[0149] When the management type of the security device is other types of security devices, the first key of the binding link is encrypted by a second distribution security device to generate a ciphertext and a password, and the ciphertext is stored in the second distribution security device. The second distribution security device and the ciphertext are then delivered offline to the other types of security devices through different channels. After confirming the secure delivery, the password is delivered offline to the other types of security devices.

[0150] Optionally, the key processing method further includes: managing the security device online through a key management system;

[0151] The online management includes:

[0152] Distributing a first key of a binding link to the security device;

[0153] Updating a first key of the binding link;

[0154] Stop using the original first key of the binding link;

[0155] The updated first key of the binding link is enabled.

[0156] It should be noted that the device is a device corresponding to the above method, and all implementation methods in the above method embodiments are applicable to the embodiments of the device and can achieve the same technical effects.

[0157] The embodiment of the present invention further provides a computing device, including: a processor, a memory storing a computer program, and when the computer program is executed by the processor, the method described in the above embodiment is executed. All implementations in the above method embodiment are applicable to this embodiment and can achieve the same technical effect.

[0158] In an embodiment of the present invention, a computer-readable storage medium is further provided, which stores instructions, and when the instructions are executed on a computer, the computer executes the method described in the above embodiment. All implementations in the above method embodiment are applicable to this embodiment, and can also achieve the same technical effect.

[0159] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0160] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0161] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0162] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0163] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0164] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0165] In addition, it should be pointed out that in the apparatus and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. Moreover, the steps of performing the above series of processing can naturally be performed in chronological order according to the order of description, but it is not necessary to perform them in chronological order, and some steps can be performed in parallel or independently of each other. For those of ordinary skill in the art, it is understandable that all or any steps or components of the method and apparatus of the present invention can be implemented in hardware, firmware, software or a combination thereof in any computing device (including processors, storage media, etc.) or a network of computing devices, which can be achieved by those of ordinary skill in the art using their basic programming skills after reading the description of the present invention.

[0166] Therefore, the purpose of the present invention can also be achieved by running a program or a group of programs on any computing device. The computing device can be a well-known general device. Therefore, the purpose of the present invention can also be achieved by simply providing a program product containing a program code that implements the method or device. That is to say, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any well-known storage medium or any storage medium developed in the future. It should also be pointed out that in the device and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. In addition, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but it is not necessary to perform them in chronological order. Some steps can be performed in parallel or independently of each other.

[0167] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A key processing method, characterized in that: include: Obtaining a first key and storing attribute information of the first key; Get security device registration information; Establishing a topology structure of the security device according to the security device registration information, and setting an identifier for each link of the topology structure; allocating the first key according to the link; Generate binding data according to the attribute information of the first key and the identifier; Binding the link to the first key according to the binding data; Distributing a first key of a binding link to the security device according to a management type of the security device; The step of obtaining a first key and storing attribute information of the first key includes: Obtaining a first key generated by a key generation device; The first key is encrypted and protected, and the attribute information of the first key is stored in a database; the key generation device is a true random number generator; the attribute information of the first key includes: first key generation time, first key validity period, first key length, first key serial number and first key integrity identifier; wherein the key generation device is a true random number generator; the first key serial number is a 32-bit integer that uniquely represents the first key in the key management system; the key management system includes a main server, a key generation device, a database and a cryptographic key; the attribute information of the first key is encrypted and protected and stored in the database through a cryptographic card or a server cryptographic machine that provides cryptographic capability support in the key management system; specifically, the encryption protection uses the SM4-ECB encryption algorithm to protect the confidentiality and integrity of the attribute information of the first key; wherein SM4 is a block cipher algorithm, and ECB is the working mode of the SM4 block cipher algorithm, which can divide the attribute information of the first key into blocks of fixed size and encrypt each block independently; the attribute information of the first key is divided into two parts, and a confidentiality protection key and an integrity protection key that are independent of each other are generated respectively, and stored in the database; The step of allocating the first key according to the link includes: Obtaining the first key generation time and the first key length; Obtaining a key length matching the link; Selecting a first key having the same length as the key matching the link; According to the generation time of the first key, matching the first key with the same key length for the link; The step of generating binding data according to the attribute information of the first key and the identifier includes: Concatenate the attribute information of the first key and the identifier to generate binding data of the link; The binding data includes: one or more of the first key generation time, the first key validity period, the first key length, the first key serial number and the first key integrity identifier, and an identifier.

2. The key processing method according to claim 1, characterized in that: According to the security device registration information, a topology structure of the security device is established, and an identifier is set for each link of the topology structure, including: The security device registration information includes: type information and physical location information of the security device; A full mesh topology of the security device is constructed.

3. The key processing method according to claim 1, characterized in that: Distributing a first key of a binding link to the security device according to a management type of the security device includes: Get the pre-set security device management type; When the management type of the security device is a directly managed security device, encapsulating the binding data through a preset format key distribution protocol, and then distributing the encapsulated first key of the binding link to the directly managed security device in an online manner; When the management type of the security device is a security device with full cryptographic computing capabilities, the binding data is encapsulated by using the public key of the security device certificate generated when the security device is registered, and password protection is set, and then the first key of the encapsulated binding link is stored in the first distribution security device, and the first distribution security device and the password are distributed to the security device with full cryptographic computing capabilities through different channels; When the management type of the security device is other types of security devices, the first key of the binding link is encrypted by a second distribution security device to generate a ciphertext and a password, and the ciphertext is stored in the second distribution security device. The second distribution security device and the ciphertext are then delivered offline to the other types of security devices through different channels. After confirming the secure delivery, the password is delivered offline to the other types of security devices.

4. The key processing method according to claim 1, characterized in that: Also includes: Managing the security device online through a key management system; The online management includes: Distributing a first key of a binding link to the security device; Updating a first key of the binding link; Stop using the original first key of the binding link; The updated first key of the binding link is enabled.

5. A key processing system, characterized in that: include: An acquisition module, used for acquiring a first key and storing attribute information of the first key; Get security device registration information; A processing module, establishing a topology structure of the security device, and setting an identifier for each link of the topology structure; and allocating the first key according to the link; generating binding data according to the attribute information of the first key and the identifier, and binding the link to the first key according to the binding data; Distributing a first key of a binding link to the security device according to a management type of the security device; The step of obtaining a first key and storing attribute information of the first key includes: Obtaining a first key generated by a key generation device; The first key is encrypted and protected, and the attribute information of the first key is stored in a database; the key generation device is a true random number generator; the attribute information of the first key includes: first key generation time, first key validity period, first key length, first key serial number and first key integrity identifier; wherein the key generation device is a true random number generator; the first key serial number is a 32-bit integer that uniquely represents the first key in the key management system; the key management system includes a main server, a key generation device, a database and a cryptographic key; the attribute information of the first key is encrypted and protected and stored in the database through a cryptographic card or a server cryptographic machine that provides cryptographic capability support in the key management system; specifically, the encryption protection uses the SM4-ECB encryption algorithm to protect the confidentiality and integrity of the attribute information of the first key; wherein SM4 is a block cipher algorithm, and ECB is the working mode of the SM4 block cipher algorithm, which can divide the attribute information of the first key into blocks of fixed size and encrypt each block independently; the attribute information of the first key is divided into two parts, and a confidentiality protection key and an integrity protection key that are independent of each other are generated respectively, and stored in the database; The step of allocating the first key according to the link includes: Obtaining the first key generation time and the first key length; Obtaining a key length matching the link; Selecting a first key having the same length as the key matching the link; According to the generation time of the first key, matching the first key with the same key length for the link; The step of generating binding data according to the attribute information of the first key and the identifier includes: Concatenate the attribute information of the first key and the identifier to generate binding data of the link; The binding data includes: one or more of the first key generation time, the first key validity period, the first key length, the first key serial number and the first key integrity identifier, and an identifier.

6. A computing device, characterized in that include: A processor and a memory storing a computer program, wherein when the computer program is executed by the processor, the method according to any one of claims 1 to 4 is performed.

7. A computer-readable storage medium, characterized in that: Instructions are stored, and when the instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 4.

Images